source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39
  40 extern bool global_machine_password_needs_changing;
  41
  42 /* Internal message queue for deferred opens. */
  43 struct pending_message_list {
  44         struct pending_message_list *next, *prev;
  45         struct timeval request_time; /* When was this first issued? */
  46         struct smbd_server_connection *sconn;
  47         struct timed_event *te;
  48         struct smb_perfcount_data pcd;
  49         uint32_t seqnum;
  50         bool encrypted;
  51         bool processed;
  52         DATA_BLOB buf;
  53         DATA_BLOB private_data;
  54 };
  55
  56 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  57                                    char *outbuf);
  58 static struct pending_message_list *get_deferred_open_message_smb(
  59         struct smbd_server_connection *sconn, uint64_t mid);
  60
  61 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  62 {
  63         bool ok;
  64
  65         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  66                 return true;
  67         }
  68
  69         sconn->smb1.echo_handler.ref_count++;
  70
  71         if (sconn->smb1.echo_handler.ref_count > 1) {
  72                 return true;
  73         }
  74
  75         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  76
  77         do {
  78                 ok = fcntl_lock(
  79                         sconn->smb1.echo_handler.socket_lock_fd,
  80                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  81         } while (!ok && (errno == EINTR));
  82
  83         if (!ok) {
  84                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  85                 return false;
  86         }
  87
  88         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  89
  90         return true;
  91 }
  92
  93 void smbd_lock_socket(struct smbd_server_connection *sconn)
  94 {
  95         if (!smbd_lock_socket_internal(sconn)) {
  96                 exit_server_cleanly("failed to lock socket");
  97         }
  98 }
  99
 100 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 101 {
 102         bool ok;
 103
 104         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
 105                 return true;
 106         }
 107
 108         sconn->smb1.echo_handler.ref_count--;
 109
 110         if (sconn->smb1.echo_handler.ref_count > 0) {
 111                 return true;
 112         }
 113
 114         do {
 115                 ok = fcntl_lock(
 116                         sconn->smb1.echo_handler.socket_lock_fd,
 117                         SMB_F_SETLKW, 0, 0, F_UNLCK);
 118         } while (!ok && (errno == EINTR));
 119
 120         if (!ok) {
 121                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 122                 return false;
 123         }
 124
 125         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 126
 127         return true;
 128 }
 129
 130 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 131 {
 132         if (!smbd_unlock_socket_internal(sconn)) {
 133                 exit_server_cleanly("failed to unlock socket");
 134         }
 135 }
 136
 137 /* Accessor function for smb_read_error for smbd functions. */
 138
 139 /****************************************************************************
 140  Send an smb to a fd.
 141 ****************************************************************************/
 142
 143 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 144                   bool do_signing, uint32_t seqnum,
 145                   bool do_encrypt,
 146                   struct smb_perfcount_data *pcd)
 147 {
 148         size_t len = 0;
 149         size_t nwritten=0;
 150         ssize_t ret;
 151         char *buf_out = buffer;
 152
 153         smbd_lock_socket(sconn);
 154
 155         if (do_signing) {
 156                 /* Sign the outgoing packet if required. */
 157                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 158         }
 159
 160         if (do_encrypt) {
 161                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 162                 if (!NT_STATUS_IS_OK(status)) {
 163                         DEBUG(0, ("send_smb: SMB encryption failed "
 164                                 "on outgoing packet! Error %s\n",
 165                                 nt_errstr(status) ));
 166                         goto out;
 167                 }
 168         }
 169
 170         len = smb_len(buf_out) + 4;
 171
 172         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 173         if (ret <= 0) {
 174
 175                 char addr[INET6_ADDRSTRLEN];
 176                 /*
 177                  * Try and give an error message saying what
 178                  * client failed.
 179                  */
 180                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 181                          (int)sys_getpid(), (int)len,
 182                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 183                          (int)ret, strerror(errno) ));
 184
 185                 srv_free_enc_buffer(sconn, buf_out);
 186                 goto out;
 187         }
 188
 189         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 190         srv_free_enc_buffer(sconn, buf_out);
 191 out:
 192         SMB_PERFCOUNT_END(pcd);
 193
 194         smbd_unlock_socket(sconn);
 195         return true;
 196 }
 197
 198 /*******************************************************************
 199  Setup the word count and byte count for a smb message.
 200 ********************************************************************/
 201
 202 int srv_set_message(char *buf,
 203                         int num_words,
 204                         int num_bytes,
 205                         bool zero)
 206 {
 207         if (zero && (num_words || num_bytes)) {
 208                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 209         }
 210         SCVAL(buf,smb_wct,num_words);
 211         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 212         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 213         return (smb_size + num_words*2 + num_bytes);
 214 }
 215
 216 static bool valid_smb_header(struct smbd_server_connection *sconn,
 217                              const uint8_t *inbuf)
 218 {
 219         if (is_encrypted_packet(sconn, inbuf)) {
 220                 return true;
 221         }
 222         /*
 223          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 224          * but it just looks weird to call strncmp for this one.
 225          */
 226         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 227 }
 228
 229 /* Socket functions for smbd packet processing. */
 230
 231 static bool valid_packet_size(size_t len)
 232 {
 233         /*
 234          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 235          * of header. Don't print the error if this fits.... JRA.
 236          */
 237
 238         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 239                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 240                                         (unsigned long)len));
 241                 return false;
 242         }
 243         return true;
 244 }
 245
 246 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 247                                       unsigned int timeout, ssize_t len)
 248 {
 249         NTSTATUS status;
 250
 251         if (len <= 0) {
 252                 return NT_STATUS_OK;
 253         }
 254
 255         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 256         if (!NT_STATUS_IS_OK(status)) {
 257                 char addr[INET6_ADDRSTRLEN];
 258                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 259                           "error = %s.\n",
 260                           get_peer_addr(fd, addr, sizeof(addr)),
 261                           nt_errstr(status)));
 262         }
 263         return status;
 264 }
 265
 266 /****************************************************************************
 267  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 268 ****************************************************************************/
 269
 270 /*
 271  * Unfortunately, earlier versions of smbclient/libsmbclient
 272  * don't send this "standard" writeX header. I've fixed this
 273  * for 3.2 but we'll use the old method with earlier versions.
 274  * Windows and CIFSFS at least use this standard size. Not
 275  * sure about MacOSX.
 276  */
 277
 278 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 279                                 (2*14) + /* word count (including bcc) */ \
 280                                 1 /* pad byte */)
 281
 282 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 283                                                     const char lenbuf[4],
 284                                                     struct smbd_server_connection *sconn,
 285                                                     int sock,
 286                                                     char **buffer,
 287                                                     unsigned int timeout,
 288                                                     size_t *p_unread,
 289                                                     size_t *len_ret)
 290 {
 291         /* Size of a WRITEX call (+4 byte len). */
 292         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 293         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 294         ssize_t toread;
 295         NTSTATUS status;
 296
 297         memcpy(writeX_header, lenbuf, 4);
 298
 299         status = read_fd_with_timeout(
 300                 sock, writeX_header + 4,
 301                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 302                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 303                 timeout, NULL);
 304
 305         if (!NT_STATUS_IS_OK(status)) {
 306                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 307                           "error = %s.\n",
 308                           tsocket_address_string(sconn->remote_address,
 309                                                  talloc_tos()),
 310                           nt_errstr(status)));
 311                 return status;
 312         }
 313
 314         /*
 315          * Ok - now try and see if this is a possible
 316          * valid writeX call.
 317          */
 318
 319         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 320                 /*
 321                  * If the data offset is beyond what
 322                  * we've read, drain the extra bytes.
 323                  */
 324                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 325                 ssize_t newlen;
 326
 327                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 328                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 329                         if (drain_socket(sock, drain) != drain) {
 330                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 331                                         " failed to drain pending bytes");
 332                         }
 333                 } else {
 334                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 335                 }
 336
 337                 /* Spoof down the length and null out the bcc. */
 338                 set_message_bcc(writeX_header, 0);
 339                 newlen = smb_len(writeX_header);
 340
 341                 /* Copy the header we've written. */
 342
 343                 *buffer = (char *)talloc_memdup(mem_ctx,
 344                                 writeX_header,
 345                                 sizeof(writeX_header));
 346
 347                 if (*buffer == NULL) {
 348                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 349                                   (int)sizeof(writeX_header)));
 350                         return NT_STATUS_NO_MEMORY;
 351                 }
 352
 353                 /* Work out the remaining bytes. */
 354                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 355                 *len_ret = newlen + 4;
 356                 return NT_STATUS_OK;
 357         }
 358
 359         if (!valid_packet_size(len)) {
 360                 return NT_STATUS_INVALID_PARAMETER;
 361         }
 362
 363         /*
 364          * Not a valid writeX call. Just do the standard
 365          * talloc and return.
 366          */
 367
 368         *buffer = talloc_array(mem_ctx, char, len+4);
 369
 370         if (*buffer == NULL) {
 371                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 372                           (int)len+4));
 373                 return NT_STATUS_NO_MEMORY;
 374         }
 375
 376         /* Copy in what we already read. */
 377         memcpy(*buffer,
 378                 writeX_header,
 379                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 380         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 381
 382         if(toread > 0) {
 383                 status = read_packet_remainder(
 384                         sock,
 385                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 386                         timeout, toread);
 387
 388                 if (!NT_STATUS_IS_OK(status)) {
 389                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 390                                    nt_errstr(status)));
 391                         return status;
 392                 }
 393         }
 394
 395         *len_ret = len + 4;
 396         return NT_STATUS_OK;
 397 }
 398
 399 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 400                                        struct smbd_server_connection *sconn,
 401                                        int sock,
 402                                        char **buffer, unsigned int timeout,
 403                                        size_t *p_unread, size_t *plen)
 404 {
 405         char lenbuf[4];
 406         size_t len;
 407         int min_recv_size = lp_min_receive_file_size();
 408         NTSTATUS status;
 409
 410         *p_unread = 0;
 411
 412         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 413                                                   &len);
 414         if (!NT_STATUS_IS_OK(status)) {
 415                 return status;
 416         }
 417
 418         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 419             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 420                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 421             !srv_is_signing_active(sconn) &&
 422             sconn->smb1.echo_handler.trusted_fde == NULL) {
 423
 424                 return receive_smb_raw_talloc_partial_read(
 425                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 426                         p_unread, plen);
 427         }
 428
 429         if (!valid_packet_size(len)) {
 430                 return NT_STATUS_INVALID_PARAMETER;
 431         }
 432
 433         /*
 434          * The +4 here can't wrap, we've checked the length above already.
 435          */
 436
 437         *buffer = talloc_array(mem_ctx, char, len+4);
 438
 439         if (*buffer == NULL) {
 440                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 441                           (int)len+4));
 442                 return NT_STATUS_NO_MEMORY;
 443         }
 444
 445         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 446
 447         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 return status;
 450         }
 451
 452         *plen = len + 4;
 453         return NT_STATUS_OK;
 454 }
 455
 456 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 457                                    struct smbd_server_connection *sconn,
 458                                    int sock,
 459                                    char **buffer, unsigned int timeout,
 460                                    size_t *p_unread, bool *p_encrypted,
 461                                    size_t *p_len,
 462                                    uint32_t *seqnum,
 463                                    bool trusted_channel)
 464 {
 465         size_t len = 0;
 466         NTSTATUS status;
 467
 468         *p_encrypted = false;
 469
 470         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 471                                         p_unread, &len);
 472         if (!NT_STATUS_IS_OK(status)) {
 473                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 474                       ("receive_smb_raw_talloc failed for client %s "
 475                        "read error = %s.\n",
 476                        tsocket_address_string(sconn->remote_address,
 477                                               talloc_tos()),
 478                        nt_errstr(status)) );
 479                 return status;
 480         }
 481
 482         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 483                 status = srv_decrypt_buffer(sconn, *buffer);
 484                 if (!NT_STATUS_IS_OK(status)) {
 485                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 486                                 "incoming packet! Error %s\n",
 487                                 nt_errstr(status) ));
 488                         return status;
 489                 }
 490                 *p_encrypted = true;
 491         }
 492
 493         /* Check the incoming SMB signature. */
 494         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 495                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 496                           "incoming packet!\n"));
 497                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 498         }
 499
 500         *p_len = len;
 501         return NT_STATUS_OK;
 502 }
 503
 504 /*
 505  * Initialize a struct smb_request from an inbuf
 506  */
 507
 508 static bool init_smb_request(struct smb_request *req,
 509                              struct smbd_server_connection *sconn,
 510                              const uint8 *inbuf,
 511                              size_t unread_bytes, bool encrypted,
 512                              uint32_t seqnum)
 513 {
 514         size_t req_size = smb_len(inbuf) + 4;
 515         /* Ensure we have at least smb_size bytes. */
 516         if (req_size < smb_size) {
 517                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 518                         (unsigned int)req_size ));
 519                 return false;
 520         }
 521         req->cmd    = CVAL(inbuf, smb_com);
 522         req->flags2 = SVAL(inbuf, smb_flg2);
 523         req->smbpid = SVAL(inbuf, smb_pid);
 524         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 525         req->seqnum = seqnum;
 526         req->vuid   = SVAL(inbuf, smb_uid);
 527         req->tid    = SVAL(inbuf, smb_tid);
 528         req->wct    = CVAL(inbuf, smb_wct);
 529         req->vwv    = discard_const_p(uint16_t, (inbuf+smb_vwv));
 530         req->buflen = smb_buflen(inbuf);
 531         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 532         req->unread_bytes = unread_bytes;
 533         req->encrypted = encrypted;
 534         req->sconn = sconn;
 535         req->conn = conn_find(sconn,req->tid);
 536         req->chain_fsp = NULL;
 537         req->chain_outbuf = NULL;
 538         req->done = false;
 539         req->smb2req = NULL;
 540         smb_init_perfcount_data(&req->pcd);
 541
 542         /* Ensure we have at least wct words and 2 bytes of bcc. */
 543         if (smb_size + req->wct*2 > req_size) {
 544                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 545                         (unsigned int)req->wct,
 546                         (unsigned int)req_size));
 547                 return false;
 548         }
 549         /* Ensure bcc is correct. */
 550         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 551                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 552                         "(wct = %u, size %u)\n",
 553                         (unsigned int)req->buflen,
 554                         (unsigned int)req->wct,
 555                         (unsigned int)req_size));
 556                 return false;
 557         }
 558
 559         req->outbuf = NULL;
 560         return true;
 561 }
 562
 563 static void process_smb(struct smbd_server_connection *conn,
 564                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 565                         uint32_t seqnum, bool encrypted,
 566                         struct smb_perfcount_data *deferred_pcd);
 567
 568 static void smbd_deferred_open_timer(struct event_context *ev,
 569                                      struct timed_event *te,
 570                                      struct timeval _tval,
 571                                      void *private_data)
 572 {
 573         struct pending_message_list *msg = talloc_get_type(private_data,
 574                                            struct pending_message_list);
 575         struct smbd_server_connection *sconn = msg->sconn;
 576         TALLOC_CTX *mem_ctx = talloc_tos();
 577         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 578         uint8_t *inbuf;
 579
 580         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 581                                          msg->buf.length);
 582         if (inbuf == NULL) {
 583                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 584                 return;
 585         }
 586
 587         /* We leave this message on the queue so the open code can
 588            know this is a retry. */
 589         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 590                 (unsigned long long)mid ));
 591
 592         /* Mark the message as processed so this is not
 593          * re-processed in error. */
 594         msg->processed = true;
 595
 596         process_smb(sconn, inbuf,
 597                     msg->buf.length, 0,
 598                     msg->seqnum, msg->encrypted, &msg->pcd);
 599
 600         /* If it's still there and was processed, remove it. */
 601         msg = get_deferred_open_message_smb(sconn, mid);
 602         if (msg && msg->processed) {
 603                 remove_deferred_open_message_smb(sconn, mid);
 604         }
 605 }
 606
 607 /****************************************************************************
 608  Function to push a message onto the tail of a linked list of smb messages ready
 609  for processing.
 610 ****************************************************************************/
 611
 612 static bool push_queued_message(struct smb_request *req,
 613                                 struct timeval request_time,
 614                                 struct timeval end_time,
 615                                 char *private_data, size_t private_len)
 616 {
 617         int msg_len = smb_len(req->inbuf) + 4;
 618         struct pending_message_list *msg;
 619
 620         msg = talloc_zero(NULL, struct pending_message_list);
 621
 622         if(msg == NULL) {
 623                 DEBUG(0,("push_message: malloc fail (1)\n"));
 624                 return False;
 625         }
 626         msg->sconn = req->sconn;
 627
 628         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 629         if(msg->buf.data == NULL) {
 630                 DEBUG(0,("push_message: malloc fail (2)\n"));
 631                 TALLOC_FREE(msg);
 632                 return False;
 633         }
 634
 635         msg->request_time = request_time;
 636         msg->seqnum = req->seqnum;
 637         msg->encrypted = req->encrypted;
 638         msg->processed = false;
 639         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 640
 641         if (private_data) {
 642                 msg->private_data = data_blob_talloc(msg, private_data,
 643                                                      private_len);
 644                 if (msg->private_data.data == NULL) {
 645                         DEBUG(0,("push_message: malloc fail (3)\n"));
 646                         TALLOC_FREE(msg);
 647                         return False;
 648                 }
 649         }
 650
 651         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 652                                    msg,
 653                                    end_time,
 654                                    smbd_deferred_open_timer,
 655                                    msg);
 656         if (!msg->te) {
 657                 DEBUG(0,("push_message: event_add_timed failed\n"));
 658                 TALLOC_FREE(msg);
 659                 return false;
 660         }
 661
 662         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 663                       struct pending_message_list *);
 664
 665         DEBUG(10,("push_message: pushed message length %u on "
 666                   "deferred_open_queue\n", (unsigned int)msg_len));
 667
 668         return True;
 669 }
 670
 671 /****************************************************************************
 672  Function to delete a sharing violation open message by mid.
 673 ****************************************************************************/
 674
 675 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 676                                       uint64_t mid)
 677 {
 678         struct pending_message_list *pml;
 679
 680         if (sconn->using_smb2) {
 681                 remove_deferred_open_message_smb2(sconn, mid);
 682                 return;
 683         }
 684
 685         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 686                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 687                         DEBUG(10,("remove_deferred_open_message_smb: "
 688                                   "deleting mid %llu len %u\n",
 689                                   (unsigned long long)mid,
 690                                   (unsigned int)pml->buf.length ));
 691                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 692                         TALLOC_FREE(pml);
 693                         return;
 694                 }
 695         }
 696 }
 697
 698 /****************************************************************************
 699  Move a sharing violation open retry message to the front of the list and
 700  schedule it for immediate processing.
 701 ****************************************************************************/
 702
 703 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 704                                         uint64_t mid)
 705 {
 706         struct pending_message_list *pml;
 707         int i = 0;
 708
 709         if (sconn->using_smb2) {
 710                 schedule_deferred_open_message_smb2(sconn, mid);
 711                 return;
 712         }
 713
 714         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 715                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 716
 717                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 718                         "msg_mid = %llu\n",
 719                         i++,
 720                         (unsigned long long)msg_mid ));
 721
 722                 if (mid == msg_mid) {
 723                         struct timed_event *te;
 724
 725                         if (pml->processed) {
 726                                 /* A processed message should not be
 727                                  * rescheduled. */
 728                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 729                                         "message mid %llu was already processed\n",
 730                                         (unsigned long long)msg_mid ));
 731                                 continue;
 732                         }
 733
 734                         DEBUG(10,("schedule_deferred_open_message_smb: "
 735                                 "scheduling mid %llu\n",
 736                                 (unsigned long long)mid ));
 737
 738                         te = tevent_add_timer(pml->sconn->ev_ctx,
 739                                               pml,
 740                                               timeval_zero(),
 741                                               smbd_deferred_open_timer,
 742                                               pml);
 743                         if (!te) {
 744                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 745                                         "event_add_timed() failed, "
 746                                         "skipping mid %llu\n",
 747                                         (unsigned long long)msg_mid ));
 748                         }
 749
 750                         TALLOC_FREE(pml->te);
 751                         pml->te = te;
 752                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 753                         return;
 754                 }
 755         }
 756
 757         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 758                 "find message mid %llu\n",
 759                 (unsigned long long)mid ));
 760 }
 761
 762 /****************************************************************************
 763  Return true if this mid is on the deferred queue and was not yet processed.
 764 ****************************************************************************/
 765
 766 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 767 {
 768         struct pending_message_list *pml;
 769
 770         if (sconn->using_smb2) {
 771                 return open_was_deferred_smb2(sconn, mid);
 772         }
 773
 774         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 775                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 776                         return True;
 777                 }
 778         }
 779         return False;
 780 }
 781
 782 /****************************************************************************
 783  Return the message queued by this mid.
 784 ****************************************************************************/
 785
 786 static struct pending_message_list *get_deferred_open_message_smb(
 787         struct smbd_server_connection *sconn, uint64_t mid)
 788 {
 789         struct pending_message_list *pml;
 790
 791         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 792                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 793                         return pml;
 794                 }
 795         }
 796         return NULL;
 797 }
 798
 799 /****************************************************************************
 800  Get the state data queued by this mid.
 801 ****************************************************************************/
 802
 803 bool get_deferred_open_message_state(struct smb_request *smbreq,
 804                                 struct timeval *p_request_time,
 805                                 void **pp_state)
 806 {
 807         struct pending_message_list *pml;
 808
 809         if (smbreq->sconn->using_smb2) {
 810                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 811                                         p_request_time,
 812                                         pp_state);
 813         }
 814
 815         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 816         if (!pml) {
 817                 return false;
 818         }
 819         if (p_request_time) {
 820                 *p_request_time = pml->request_time;
 821         }
 822         if (pp_state) {
 823                 *pp_state = (void *)pml->private_data.data;
 824         }
 825         return true;
 826 }
 827
 828 /****************************************************************************
 829  Function to push a deferred open smb message onto a linked list of local smb
 830  messages ready for processing.
 831 ****************************************************************************/
 832
 833 bool push_deferred_open_message_smb(struct smb_request *req,
 834                                struct timeval request_time,
 835                                struct timeval timeout,
 836                                struct file_id id,
 837                                char *private_data, size_t priv_len)
 838 {
 839         struct timeval end_time;
 840
 841         if (req->smb2req) {
 842                 return push_deferred_open_message_smb2(req->smb2req,
 843                                                 request_time,
 844                                                 timeout,
 845                                                 id,
 846                                                 private_data,
 847                                                 priv_len);
 848         }
 849
 850         if (req->unread_bytes) {
 851                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 852                         "unread_bytes = %u\n",
 853                         (unsigned int)req->unread_bytes ));
 854                 smb_panic("push_deferred_open_message_smb: "
 855                         "logic error unread_bytes != 0" );
 856         }
 857
 858         end_time = timeval_sum(&request_time, &timeout);
 859
 860         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 861                 "len %u mid %llu timeout time [%u.%06u]\n",
 862                 (unsigned int) smb_len(req->inbuf)+4,
 863                 (unsigned long long)req->mid,
 864                 (unsigned int)end_time.tv_sec,
 865                 (unsigned int)end_time.tv_usec));
 866
 867         return push_queued_message(req, request_time, end_time,
 868                                    private_data, priv_len);
 869 }
 870
 871 static void smbd_sig_term_handler(struct tevent_context *ev,
 872                                   struct tevent_signal *se,
 873                                   int signum,
 874                                   int count,
 875                                   void *siginfo,
 876                                   void *private_data)
 877 {
 878         exit_server_cleanly("termination signal");
 879 }
 880
 881 void smbd_setup_sig_term_handler(void)
 882 {
 883         struct tevent_signal *se;
 884
 885         se = tevent_add_signal(server_event_context(),
 886                                server_event_context(),
 887                                SIGTERM, 0,
 888                                smbd_sig_term_handler,
 889                                NULL);
 890         if (!se) {
 891                 exit_server("failed to setup SIGTERM handler");
 892         }
 893 }
 894
 895 static void smbd_sig_hup_handler(struct tevent_context *ev,
 896                                   struct tevent_signal *se,
 897                                   int signum,
 898                                   int count,
 899                                   void *siginfo,
 900                                   void *private_data)
 901 {
 902         struct messaging_context *msg_ctx = talloc_get_type_abort(
 903                 private_data, struct messaging_context);
 904         change_to_root_user();
 905         DEBUG(1,("Reloading services after SIGHUP\n"));
 906         reload_services(msg_ctx, smbd_server_conn->sock, False);
 907         if (am_parent) {
 908                 printing_subsystem_update(ev, msg_ctx, true);
 909         }
 910 }
 911
 912 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
 913                                 struct messaging_context *msg_ctx)
 914 {
 915         struct tevent_signal *se;
 916
 917         se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
 918                                msg_ctx);
 919         if (!se) {
 920                 exit_server("failed to setup SIGHUP handler");
 921         }
 922 }
 923
 924 static NTSTATUS smbd_server_connection_loop_once(struct tevent_context *ev_ctx,
 925                                                  struct smbd_server_connection *conn)
 926 {
 927         int timeout;
 928         int num_pfds = 0;
 929         int ret;
 930         bool retry;
 931
 932         timeout = SMBD_SELECT_TIMEOUT * 1000;
 933
 934         /*
 935          * Are there any timed events waiting ? If so, ensure we don't
 936          * select for longer than it would take to wait for them.
 937          */
 938
 939         event_add_to_poll_args(ev_ctx, conn, &conn->pfds, &num_pfds, &timeout);
 940
 941         /* Process a signal and timed events now... */
 942         if (run_events_poll(ev_ctx, 0, NULL, 0)) {
 943                 return NT_STATUS_RETRY;
 944         }
 945
 946         {
 947                 int sav;
 948                 START_PROFILE(smbd_idle);
 949
 950                 ret = sys_poll(conn->pfds, num_pfds, timeout);
 951                 sav = errno;
 952
 953                 END_PROFILE(smbd_idle);
 954                 errno = sav;
 955         }
 956
 957         if (ret == -1) {
 958                 if (errno == EINTR) {
 959                         return NT_STATUS_RETRY;
 960                 }
 961                 return map_nt_error_from_unix(errno);
 962         }
 963
 964         retry = run_events_poll(ev_ctx, ret, conn->pfds, num_pfds);
 965         if (retry) {
 966                 return NT_STATUS_RETRY;
 967         }
 968
 969         /* Did we timeout ? */
 970         if (ret == 0) {
 971                 return NT_STATUS_RETRY;
 972         }
 973
 974         /* should not be reached */
 975         return NT_STATUS_INTERNAL_ERROR;
 976 }
 977
 978 /*
 979  * Only allow 5 outstanding trans requests. We're allocating memory, so
 980  * prevent a DoS.
 981  */
 982
 983 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 984 {
 985         int count = 0;
 986         for (; list != NULL; list = list->next) {
 987
 988                 if (list->mid == mid) {
 989                         return NT_STATUS_INVALID_PARAMETER;
 990                 }
 991
 992                 count += 1;
 993         }
 994         if (count > 5) {
 995                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 996         }
 997
 998         return NT_STATUS_OK;
 999 }
1000
1001 /*
1002 These flags determine some of the permissions required to do an operation
1003
1004 Note that I don't set NEED_WRITE on some write operations because they
1005 are used by some brain-dead clients when printing, and I don't want to
1006 force write permissions on print services.
1007 */
1008 #define AS_USER (1<<0)
1009 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1010 #define TIME_INIT (1<<2)
1011 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1012 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1013 #define DO_CHDIR (1<<6)
1014
1015 /*
1016    define a list of possible SMB messages and their corresponding
1017    functions. Any message that has a NULL function is unimplemented -
1018    please feel free to contribute implementations!
1019 */
1020 static const struct smb_message_struct {
1021         const char *name;
1022         void (*fn)(struct smb_request *req);
1023         int flags;
1024 } smb_messages[256] = {
1025
1026 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1027 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1028 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1029 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1030 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1031 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1032 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1033 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1034 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1035 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1036 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1037 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1038 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1039 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1040 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1041 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1042 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1043 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1044 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1045 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1046 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1047 /* 0x15 */ { NULL, NULL, 0 },
1048 /* 0x16 */ { NULL, NULL, 0 },
1049 /* 0x17 */ { NULL, NULL, 0 },
1050 /* 0x18 */ { NULL, NULL, 0 },
1051 /* 0x19 */ { NULL, NULL, 0 },
1052 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1053 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1054 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1055 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1056 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1057 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1058 /* 0x20 */ { "SMBwritec", NULL,0},
1059 /* 0x21 */ { NULL, NULL, 0 },
1060 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1061 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1062 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1063 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1064 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1065 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1066 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1067 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1068 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1069 /* 0x2b */ { "SMBecho",reply_echo,0},
1070 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1071 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1072 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1073 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1074 /* 0x30 */ { NULL, NULL, 0 },
1075 /* 0x31 */ { NULL, NULL, 0 },
1076 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1077 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1078 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1079 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1080 /* 0x36 */ { NULL, NULL, 0 },
1081 /* 0x37 */ { NULL, NULL, 0 },
1082 /* 0x38 */ { NULL, NULL, 0 },
1083 /* 0x39 */ { NULL, NULL, 0 },
1084 /* 0x3a */ { NULL, NULL, 0 },
1085 /* 0x3b */ { NULL, NULL, 0 },
1086 /* 0x3c */ { NULL, NULL, 0 },
1087 /* 0x3d */ { NULL, NULL, 0 },
1088 /* 0x3e */ { NULL, NULL, 0 },
1089 /* 0x3f */ { NULL, NULL, 0 },
1090 /* 0x40 */ { NULL, NULL, 0 },
1091 /* 0x41 */ { NULL, NULL, 0 },
1092 /* 0x42 */ { NULL, NULL, 0 },
1093 /* 0x43 */ { NULL, NULL, 0 },
1094 /* 0x44 */ { NULL, NULL, 0 },
1095 /* 0x45 */ { NULL, NULL, 0 },
1096 /* 0x46 */ { NULL, NULL, 0 },
1097 /* 0x47 */ { NULL, NULL, 0 },
1098 /* 0x48 */ { NULL, NULL, 0 },
1099 /* 0x49 */ { NULL, NULL, 0 },
1100 /* 0x4a */ { NULL, NULL, 0 },
1101 /* 0x4b */ { NULL, NULL, 0 },
1102 /* 0x4c */ { NULL, NULL, 0 },
1103 /* 0x4d */ { NULL, NULL, 0 },
1104 /* 0x4e */ { NULL, NULL, 0 },
1105 /* 0x4f */ { NULL, NULL, 0 },
1106 /* 0x50 */ { NULL, NULL, 0 },
1107 /* 0x51 */ { NULL, NULL, 0 },
1108 /* 0x52 */ { NULL, NULL, 0 },
1109 /* 0x53 */ { NULL, NULL, 0 },
1110 /* 0x54 */ { NULL, NULL, 0 },
1111 /* 0x55 */ { NULL, NULL, 0 },
1112 /* 0x56 */ { NULL, NULL, 0 },
1113 /* 0x57 */ { NULL, NULL, 0 },
1114 /* 0x58 */ { NULL, NULL, 0 },
1115 /* 0x59 */ { NULL, NULL, 0 },
1116 /* 0x5a */ { NULL, NULL, 0 },
1117 /* 0x5b */ { NULL, NULL, 0 },
1118 /* 0x5c */ { NULL, NULL, 0 },
1119 /* 0x5d */ { NULL, NULL, 0 },
1120 /* 0x5e */ { NULL, NULL, 0 },
1121 /* 0x5f */ { NULL, NULL, 0 },
1122 /* 0x60 */ { NULL, NULL, 0 },
1123 /* 0x61 */ { NULL, NULL, 0 },
1124 /* 0x62 */ { NULL, NULL, 0 },
1125 /* 0x63 */ { NULL, NULL, 0 },
1126 /* 0x64 */ { NULL, NULL, 0 },
1127 /* 0x65 */ { NULL, NULL, 0 },
1128 /* 0x66 */ { NULL, NULL, 0 },
1129 /* 0x67 */ { NULL, NULL, 0 },
1130 /* 0x68 */ { NULL, NULL, 0 },
1131 /* 0x69 */ { NULL, NULL, 0 },
1132 /* 0x6a */ { NULL, NULL, 0 },
1133 /* 0x6b */ { NULL, NULL, 0 },
1134 /* 0x6c */ { NULL, NULL, 0 },
1135 /* 0x6d */ { NULL, NULL, 0 },
1136 /* 0x6e */ { NULL, NULL, 0 },
1137 /* 0x6f */ { NULL, NULL, 0 },
1138 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1139 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1140 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1141 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1142 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1143 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1144 /* 0x76 */ { NULL, NULL, 0 },
1145 /* 0x77 */ { NULL, NULL, 0 },
1146 /* 0x78 */ { NULL, NULL, 0 },
1147 /* 0x79 */ { NULL, NULL, 0 },
1148 /* 0x7a */ { NULL, NULL, 0 },
1149 /* 0x7b */ { NULL, NULL, 0 },
1150 /* 0x7c */ { NULL, NULL, 0 },
1151 /* 0x7d */ { NULL, NULL, 0 },
1152 /* 0x7e */ { NULL, NULL, 0 },
1153 /* 0x7f */ { NULL, NULL, 0 },
1154 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1155 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1156 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1157 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1158 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1159 /* 0x85 */ { NULL, NULL, 0 },
1160 /* 0x86 */ { NULL, NULL, 0 },
1161 /* 0x87 */ { NULL, NULL, 0 },
1162 /* 0x88 */ { NULL, NULL, 0 },
1163 /* 0x89 */ { NULL, NULL, 0 },
1164 /* 0x8a */ { NULL, NULL, 0 },
1165 /* 0x8b */ { NULL, NULL, 0 },
1166 /* 0x8c */ { NULL, NULL, 0 },
1167 /* 0x8d */ { NULL, NULL, 0 },
1168 /* 0x8e */ { NULL, NULL, 0 },
1169 /* 0x8f */ { NULL, NULL, 0 },
1170 /* 0x90 */ { NULL, NULL, 0 },
1171 /* 0x91 */ { NULL, NULL, 0 },
1172 /* 0x92 */ { NULL, NULL, 0 },
1173 /* 0x93 */ { NULL, NULL, 0 },
1174 /* 0x94 */ { NULL, NULL, 0 },
1175 /* 0x95 */ { NULL, NULL, 0 },
1176 /* 0x96 */ { NULL, NULL, 0 },
1177 /* 0x97 */ { NULL, NULL, 0 },
1178 /* 0x98 */ { NULL, NULL, 0 },
1179 /* 0x99 */ { NULL, NULL, 0 },
1180 /* 0x9a */ { NULL, NULL, 0 },
1181 /* 0x9b */ { NULL, NULL, 0 },
1182 /* 0x9c */ { NULL, NULL, 0 },
1183 /* 0x9d */ { NULL, NULL, 0 },
1184 /* 0x9e */ { NULL, NULL, 0 },
1185 /* 0x9f */ { NULL, NULL, 0 },
1186 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1187 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1188 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1189 /* 0xa3 */ { NULL, NULL, 0 },
1190 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1191 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1192 /* 0xa6 */ { NULL, NULL, 0 },
1193 /* 0xa7 */ { NULL, NULL, 0 },
1194 /* 0xa8 */ { NULL, NULL, 0 },
1195 /* 0xa9 */ { NULL, NULL, 0 },
1196 /* 0xaa */ { NULL, NULL, 0 },
1197 /* 0xab */ { NULL, NULL, 0 },
1198 /* 0xac */ { NULL, NULL, 0 },
1199 /* 0xad */ { NULL, NULL, 0 },
1200 /* 0xae */ { NULL, NULL, 0 },
1201 /* 0xaf */ { NULL, NULL, 0 },
1202 /* 0xb0 */ { NULL, NULL, 0 },
1203 /* 0xb1 */ { NULL, NULL, 0 },
1204 /* 0xb2 */ { NULL, NULL, 0 },
1205 /* 0xb3 */ { NULL, NULL, 0 },
1206 /* 0xb4 */ { NULL, NULL, 0 },
1207 /* 0xb5 */ { NULL, NULL, 0 },
1208 /* 0xb6 */ { NULL, NULL, 0 },
1209 /* 0xb7 */ { NULL, NULL, 0 },
1210 /* 0xb8 */ { NULL, NULL, 0 },
1211 /* 0xb9 */ { NULL, NULL, 0 },
1212 /* 0xba */ { NULL, NULL, 0 },
1213 /* 0xbb */ { NULL, NULL, 0 },
1214 /* 0xbc */ { NULL, NULL, 0 },
1215 /* 0xbd */ { NULL, NULL, 0 },
1216 /* 0xbe */ { NULL, NULL, 0 },
1217 /* 0xbf */ { NULL, NULL, 0 },
1218 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1219 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1220 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1221 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1222 /* 0xc4 */ { NULL, NULL, 0 },
1223 /* 0xc5 */ { NULL, NULL, 0 },
1224 /* 0xc6 */ { NULL, NULL, 0 },
1225 /* 0xc7 */ { NULL, NULL, 0 },
1226 /* 0xc8 */ { NULL, NULL, 0 },
1227 /* 0xc9 */ { NULL, NULL, 0 },
1228 /* 0xca */ { NULL, NULL, 0 },
1229 /* 0xcb */ { NULL, NULL, 0 },
1230 /* 0xcc */ { NULL, NULL, 0 },
1231 /* 0xcd */ { NULL, NULL, 0 },
1232 /* 0xce */ { NULL, NULL, 0 },
1233 /* 0xcf */ { NULL, NULL, 0 },
1234 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1235 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1236 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1237 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1238 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1239 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1240 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1241 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1242 /* 0xd8 */ { NULL, NULL, 0 },
1243 /* 0xd9 */ { NULL, NULL, 0 },
1244 /* 0xda */ { NULL, NULL, 0 },
1245 /* 0xdb */ { NULL, NULL, 0 },
1246 /* 0xdc */ { NULL, NULL, 0 },
1247 /* 0xdd */ { NULL, NULL, 0 },
1248 /* 0xde */ { NULL, NULL, 0 },
1249 /* 0xdf */ { NULL, NULL, 0 },
1250 /* 0xe0 */ { NULL, NULL, 0 },
1251 /* 0xe1 */ { NULL, NULL, 0 },
1252 /* 0xe2 */ { NULL, NULL, 0 },
1253 /* 0xe3 */ { NULL, NULL, 0 },
1254 /* 0xe4 */ { NULL, NULL, 0 },
1255 /* 0xe5 */ { NULL, NULL, 0 },
1256 /* 0xe6 */ { NULL, NULL, 0 },
1257 /* 0xe7 */ { NULL, NULL, 0 },
1258 /* 0xe8 */ { NULL, NULL, 0 },
1259 /* 0xe9 */ { NULL, NULL, 0 },
1260 /* 0xea */ { NULL, NULL, 0 },
1261 /* 0xeb */ { NULL, NULL, 0 },
1262 /* 0xec */ { NULL, NULL, 0 },
1263 /* 0xed */ { NULL, NULL, 0 },
1264 /* 0xee */ { NULL, NULL, 0 },
1265 /* 0xef */ { NULL, NULL, 0 },
1266 /* 0xf0 */ { NULL, NULL, 0 },
1267 /* 0xf1 */ { NULL, NULL, 0 },
1268 /* 0xf2 */ { NULL, NULL, 0 },
1269 /* 0xf3 */ { NULL, NULL, 0 },
1270 /* 0xf4 */ { NULL, NULL, 0 },
1271 /* 0xf5 */ { NULL, NULL, 0 },
1272 /* 0xf6 */ { NULL, NULL, 0 },
1273 /* 0xf7 */ { NULL, NULL, 0 },
1274 /* 0xf8 */ { NULL, NULL, 0 },
1275 /* 0xf9 */ { NULL, NULL, 0 },
1276 /* 0xfa */ { NULL, NULL, 0 },
1277 /* 0xfb */ { NULL, NULL, 0 },
1278 /* 0xfc */ { NULL, NULL, 0 },
1279 /* 0xfd */ { NULL, NULL, 0 },
1280 /* 0xfe */ { NULL, NULL, 0 },
1281 /* 0xff */ { NULL, NULL, 0 }
1282
1283 };
1284
1285 /*******************************************************************
1286  allocate and initialize a reply packet
1287 ********************************************************************/
1288
1289 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1290                           const char *inbuf, char **outbuf, uint8_t num_words,
1291                           uint32_t num_bytes)
1292 {
1293         /*
1294          * Protect against integer wrap
1295          */
1296         if ((num_bytes > 0xffffff)
1297             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1298                 char *msg;
1299                 if (asprintf(&msg, "num_bytes too large: %u",
1300                              (unsigned)num_bytes) == -1) {
1301                         msg = discard_const_p(char, "num_bytes too large");
1302                 }
1303                 smb_panic(msg);
1304         }
1305
1306         *outbuf = talloc_array(mem_ctx, char,
1307                                smb_size + num_words*2 + num_bytes);
1308         if (*outbuf == NULL) {
1309                 return false;
1310         }
1311
1312         construct_reply_common(req, inbuf, *outbuf);
1313         srv_set_message(*outbuf, num_words, num_bytes, false);
1314         /*
1315          * Zero out the word area, the caller has to take care of the bcc area
1316          * himself
1317          */
1318         if (num_words != 0) {
1319                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1320         }
1321
1322         return true;
1323 }
1324
1325 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1326 {
1327         char *outbuf;
1328         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1329                            num_bytes)) {
1330                 smb_panic("could not allocate output buffer\n");
1331         }
1332         req->outbuf = (uint8_t *)outbuf;
1333 }
1334
1335
1336 /*******************************************************************
1337  Dump a packet to a file.
1338 ********************************************************************/
1339
1340 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1341 {
1342         int fd, i;
1343         char *fname = NULL;
1344         if (DEBUGLEVEL < 50) {
1345                 return;
1346         }
1347
1348         if (len < 4) len = smb_len(data)+4;
1349         for (i=1;i<100;i++) {
1350                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1351                              type ? "req" : "resp") == -1) {
1352                         return;
1353                 }
1354                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1355                 if (fd != -1 || errno != EEXIST) break;
1356         }
1357         if (fd != -1) {
1358                 ssize_t ret = write(fd, data, len);
1359                 if (ret != len)
1360                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1361                 close(fd);
1362                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1363         }
1364         SAFE_FREE(fname);
1365 }
1366
1367 /****************************************************************************
1368  Prepare everything for calling the actual request function, and potentially
1369  call the request function via the "new" interface.
1370
1371  Return False if the "legacy" function needs to be called, everything is
1372  prepared.
1373
1374  Return True if we're done.
1375
1376  I know this API sucks, but it is the one with the least code change I could
1377  find.
1378 ****************************************************************************/
1379
1380 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1381 {
1382         int flags;
1383         uint16 session_tag;
1384         connection_struct *conn = NULL;
1385         struct smbd_server_connection *sconn = req->sconn;
1386         char *raddr;
1387
1388         errno = 0;
1389
1390         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1391          * so subtract 4 from it. */
1392         if (!valid_smb_header(sconn, req->inbuf)
1393             || (size < (smb_size - 4))) {
1394                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1395                          smb_len(req->inbuf)));
1396                 exit_server_cleanly("Non-SMB packet");
1397         }
1398
1399         if (smb_messages[type].fn == NULL) {
1400                 DEBUG(0,("Unknown message type %d!\n",type));
1401                 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1402                 reply_unknown_new(req, type);
1403                 return NULL;
1404         }
1405
1406         flags = smb_messages[type].flags;
1407
1408         /* In share mode security we must ignore the vuid. */
1409         session_tag = (lp_security() == SEC_SHARE)
1410                 ? UID_FIELD_INVALID : req->vuid;
1411         conn = req->conn;
1412
1413         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1414                  (int)sys_getpid(), (unsigned long)conn));
1415
1416         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1417
1418         /* Ensure this value is replaced in the incoming packet. */
1419         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1420
1421         /*
1422          * Ensure the correct username is in current_user_info.  This is a
1423          * really ugly bugfix for problems with multiple session_setup_and_X's
1424          * being done and allowing %U and %G substitutions to work correctly.
1425          * There is a reason this code is done here, don't move it unless you
1426          * know what you're doing... :-).
1427          * JRA.
1428          */
1429
1430         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1431                 user_struct *vuser = NULL;
1432
1433                 sconn->smb1.sessions.last_session_tag = session_tag;
1434                 if(session_tag != UID_FIELD_INVALID) {
1435                         vuser = get_valid_user_struct(sconn, session_tag);
1436                         if (vuser) {
1437                                 set_current_user_info(
1438                                         vuser->session_info->unix_info->sanitized_username,
1439                                         vuser->session_info->unix_info->unix_name,
1440                                         vuser->session_info->info->domain_name);
1441                         }
1442                 }
1443         }
1444
1445         /* Does this call need to be run as the connected user? */
1446         if (flags & AS_USER) {
1447
1448                 /* Does this call need a valid tree connection? */
1449                 if (!conn) {
1450                         /*
1451                          * Amazingly, the error code depends on the command
1452                          * (from Samba4).
1453                          */
1454                         if (type == SMBntcreateX) {
1455                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1456                         } else {
1457                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1458                         }
1459                         return NULL;
1460                 }
1461
1462                 if (!change_to_user(conn,session_tag)) {
1463                         DEBUG(0, ("Error: Could not change to user. Removing "
1464                                 "deferred open, mid=%llu.\n",
1465                                 (unsigned long long)req->mid));
1466                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1467                         return conn;
1468                 }
1469
1470                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1471
1472                 /* Does it need write permission? */
1473                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1474                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1475                         return conn;
1476                 }
1477
1478                 /* IPC services are limited */
1479                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1480                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1481                         return conn;
1482                 }
1483         } else {
1484                 /* This call needs to be run as root */
1485                 change_to_root_user();
1486         }
1487
1488         /* load service specific parameters */
1489         if (conn) {
1490                 if (req->encrypted) {
1491                         conn->encrypted_tid = true;
1492                         /* encrypted required from now on. */
1493                         conn->encrypt_level = Required;
1494                 } else if (ENCRYPTION_REQUIRED(conn)) {
1495                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1496                                 exit_server_cleanly("encryption required "
1497                                         "on connection");
1498                                 return conn;
1499                         }
1500                 }
1501
1502                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1503                                          (flags & (AS_USER|DO_CHDIR)
1504                                           ?True:False))) {
1505                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1506                         return conn;
1507                 }
1508                 conn->num_smb_operations++;
1509         }
1510
1511         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1512                                                  talloc_tos());
1513         if (raddr == NULL) {
1514                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1515                 return conn;
1516         }
1517
1518         /* does this protocol need to be run as guest? */
1519         if ((flags & AS_GUEST)
1520             && (!change_to_guest() ||
1521                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1522                               sconn->remote_hostname,
1523                               raddr))) {
1524                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1525                 return conn;
1526         }
1527
1528         smb_messages[type].fn(req);
1529         return req->conn;
1530 }
1531
1532 /****************************************************************************
1533  Construct a reply to the incoming packet.
1534 ****************************************************************************/
1535
1536 static void construct_reply(struct smbd_server_connection *sconn,
1537                             char *inbuf, int size, size_t unread_bytes,
1538                             uint32_t seqnum, bool encrypted,
1539                             struct smb_perfcount_data *deferred_pcd)
1540 {
1541         connection_struct *conn;
1542         struct smb_request *req;
1543
1544         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1545                 smb_panic("could not allocate smb_request");
1546         }
1547
1548         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1549                               encrypted, seqnum)) {
1550                 exit_server_cleanly("Invalid SMB request");
1551         }
1552
1553         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1554
1555         /* we popped this message off the queue - keep original perf data */
1556         if (deferred_pcd)
1557                 req->pcd = *deferred_pcd;
1558         else {
1559                 SMB_PERFCOUNT_START(&req->pcd);
1560                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1561                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1562         }
1563
1564         conn = switch_message(req->cmd, req, size);
1565
1566         if (req->unread_bytes) {
1567                 /* writeX failed. drain socket. */
1568                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1569                                 req->unread_bytes) {
1570                         smb_panic("failed to drain pending bytes");
1571                 }
1572                 req->unread_bytes = 0;
1573         }
1574
1575         if (req->done) {
1576                 TALLOC_FREE(req);
1577                 return;
1578         }
1579
1580         if (req->outbuf == NULL) {
1581                 return;
1582         }
1583
1584         if (CVAL(req->outbuf,0) == 0) {
1585                 show_msg((char *)req->outbuf);
1586         }
1587
1588         if (!srv_send_smb(req->sconn,
1589                         (char *)req->outbuf,
1590                         true, req->seqnum+1,
1591                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1592                         &req->pcd)) {
1593                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1594         }
1595
1596         TALLOC_FREE(req);
1597
1598         return;
1599 }
1600
1601 /****************************************************************************
1602  Process an smb from the client
1603 ****************************************************************************/
1604 static void process_smb(struct smbd_server_connection *sconn,
1605                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1606                         uint32_t seqnum, bool encrypted,
1607                         struct smb_perfcount_data *deferred_pcd)
1608 {
1609         int msg_type = CVAL(inbuf,0);
1610
1611         DO_PROFILE_INC(smb_count);
1612
1613         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1614                     smb_len(inbuf) ) );
1615         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1616                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1617
1618         if (msg_type != NBSSmessage) {
1619                 /*
1620                  * NetBIOS session request, keepalive, etc.
1621                  */
1622                 reply_special(sconn, (char *)inbuf, nread);
1623                 goto done;
1624         }
1625
1626         if (sconn->using_smb2) {
1627                 /* At this point we're not really using smb2,
1628                  * we make the decision here.. */
1629                 if (smbd_is_smb2_header(inbuf, nread)) {
1630                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1631                         return;
1632                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1633                                 && CVAL(inbuf, smb_com) != 0x72) {
1634                         /* This is a non-negprot SMB1 packet.
1635                            Disable SMB2 from now on. */
1636                         sconn->using_smb2 = false;
1637                 }
1638         }
1639
1640         show_msg((char *)inbuf);
1641
1642         construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1643                         encrypted, deferred_pcd);
1644         sconn->trans_num++;
1645
1646 done:
1647         sconn->num_requests++;
1648
1649         /* The timeout_processing function isn't run nearly
1650            often enough to implement 'max log size' without
1651            overrunning the size of the file by many megabytes.
1652            This is especially true if we are running at debug
1653            level 10.  Checking every 50 SMBs is a nice
1654            tradeoff of performance vs log file size overrun. */
1655
1656         if ((sconn->num_requests % 50) == 0 &&
1657             need_to_check_log_size()) {
1658                 change_to_root_user();
1659                 check_log_size();
1660         }
1661 }
1662
1663 /****************************************************************************
1664  Return a string containing the function name of a SMB command.
1665 ****************************************************************************/
1666
1667 const char *smb_fn_name(int type)
1668 {
1669         const char *unknown_name = "SMBunknown";
1670
1671         if (smb_messages[type].name == NULL)
1672                 return(unknown_name);
1673
1674         return(smb_messages[type].name);
1675 }
1676
1677 /****************************************************************************
1678  Helper functions for contruct_reply.
1679 ****************************************************************************/
1680
1681 void add_to_common_flags2(uint32 v)
1682 {
1683         common_flags2 |= v;
1684 }
1685
1686 void remove_from_common_flags2(uint32 v)
1687 {
1688         common_flags2 &= ~v;
1689 }
1690
1691 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1692                                    char *outbuf)
1693 {
1694         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1695         uint16_t out_flags2 = common_flags2;
1696
1697         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1698         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1699         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1700
1701         srv_set_message(outbuf,0,0,false);
1702
1703         SCVAL(outbuf, smb_com, req->cmd);
1704         SIVAL(outbuf,smb_rcls,0);
1705         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1706         SSVAL(outbuf,smb_flg2, out_flags2);
1707         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1708         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1709
1710         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1711         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1712         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1713         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1714 }
1715
1716 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1717 {
1718         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1719 }
1720
1721 /*
1722  * How many bytes have we already accumulated up to the current wct field
1723  * offset?
1724  */
1725
1726 size_t req_wct_ofs(struct smb_request *req)
1727 {
1728         size_t buf_size;
1729
1730         if (req->chain_outbuf == NULL) {
1731                 return smb_wct - 4;
1732         }
1733         buf_size = talloc_get_size(req->chain_outbuf);
1734         if ((buf_size % 4) != 0) {
1735                 buf_size += (4 - (buf_size % 4));
1736         }
1737         return buf_size - 4;
1738 }
1739
1740 /*
1741  * Hack around reply_nterror & friends not being aware of chained requests,
1742  * generating illegal (i.e. wct==0) chain replies.
1743  */
1744
1745 static void fixup_chain_error_packet(struct smb_request *req)
1746 {
1747         uint8_t *outbuf = req->outbuf;
1748         req->outbuf = NULL;
1749         reply_outbuf(req, 2, 0);
1750         memcpy(req->outbuf, outbuf, smb_wct);
1751         TALLOC_FREE(outbuf);
1752         SCVAL(req->outbuf, smb_vwv0, 0xff);
1753 }
1754
1755 /**
1756  * @brief Find the smb_cmd offset of the last command pushed
1757  * @param[in] buf       The buffer we're building up
1758  * @retval              Where can we put our next andx cmd?
1759  *
1760  * While chaining requests, the "next" request we're looking at needs to put
1761  * its SMB_Command before the data the previous request already built up added
1762  * to the chain. Find the offset to the place where we have to put our cmd.
1763  */
1764
1765 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1766 {
1767         uint8_t cmd;
1768         size_t ofs;
1769
1770         cmd = CVAL(buf, smb_com);
1771
1772         SMB_ASSERT(is_andx_req(cmd));
1773
1774         ofs = smb_vwv0;
1775
1776         while (CVAL(buf, ofs) != 0xff) {
1777
1778                 if (!is_andx_req(CVAL(buf, ofs))) {
1779                         return false;
1780                 }
1781
1782                 /*
1783                  * ofs is from start of smb header, so add the 4 length
1784                  * bytes. The next cmd is right after the wct field.
1785                  */
1786                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1787
1788                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1789         }
1790
1791         *pofs = ofs;
1792         return true;
1793 }
1794
1795 /**
1796  * @brief Do the smb chaining at a buffer level
1797  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1798  * @param[in] smb_command       The command that we want to issue
1799  * @param[in] wct               How many words?
1800  * @param[in] vwv               The words, already in network order
1801  * @param[in] bytes_alignment   How shall we align "bytes"?
1802  * @param[in] num_bytes         How many bytes?
1803  * @param[in] bytes             The data the request ships
1804  *
1805  * smb_splice_chain() adds the vwv and bytes to the request already present in
1806  * *poutbuf.
1807  */
1808
1809 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1810                              uint8_t wct, const uint16_t *vwv,
1811                              size_t bytes_alignment,
1812                              uint32_t num_bytes, const uint8_t *bytes)
1813 {
1814         uint8_t *outbuf;
1815         size_t old_size, new_size;
1816         size_t ofs;
1817         size_t chain_padding = 0;
1818         size_t bytes_padding = 0;
1819         bool first_request;
1820
1821         old_size = talloc_get_size(*poutbuf);
1822
1823         /*
1824          * old_size == smb_wct means we're pushing the first request in for
1825          * libsmb/
1826          */
1827
1828         first_request = (old_size == smb_wct);
1829
1830         if (!first_request && ((old_size % 4) != 0)) {
1831                 /*
1832                  * Align the wct field of subsequent requests to a 4-byte
1833                  * boundary
1834                  */
1835                 chain_padding = 4 - (old_size % 4);
1836         }
1837
1838         /*
1839          * After the old request comes the new wct field (1 byte), the vwv's
1840          * and the num_bytes field. After at we might need to align the bytes
1841          * given to us to "bytes_alignment", increasing the num_bytes value.
1842          */
1843
1844         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1845
1846         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1847                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1848         }
1849
1850         new_size += bytes_padding + num_bytes;
1851
1852         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1853                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1854                           (unsigned)new_size));
1855                 return false;
1856         }
1857
1858         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1859         if (outbuf == NULL) {
1860                 DEBUG(0, ("talloc failed\n"));
1861                 return false;
1862         }
1863         *poutbuf = outbuf;
1864
1865         if (first_request) {
1866                 SCVAL(outbuf, smb_com, smb_command);
1867         } else {
1868                 size_t andx_cmd_ofs;
1869
1870                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1871                         DEBUG(1, ("invalid command chain\n"));
1872                         *poutbuf = talloc_realloc(
1873                                 NULL, *poutbuf, uint8_t, old_size);
1874                         return false;
1875                 }
1876
1877                 if (chain_padding != 0) {
1878                         memset(outbuf + old_size, 0, chain_padding);
1879                         old_size += chain_padding;
1880                 }
1881
1882                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1883                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1884         }
1885
1886         ofs = old_size;
1887
1888         /*
1889          * Push the chained request:
1890          *
1891          * wct field
1892          */
1893
1894         SCVAL(outbuf, ofs, wct);
1895         ofs += 1;
1896
1897         /*
1898          * vwv array
1899          */
1900
1901         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1902         ofs += sizeof(uint16_t) * wct;
1903
1904         /*
1905          * bcc (byte count)
1906          */
1907
1908         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1909         ofs += sizeof(uint16_t);
1910
1911         /*
1912          * padding
1913          */
1914
1915         if (bytes_padding != 0) {
1916                 memset(outbuf + ofs, 0, bytes_padding);
1917                 ofs += bytes_padding;
1918         }
1919
1920         /*
1921          * The bytes field
1922          */
1923
1924         memcpy(outbuf + ofs, bytes, num_bytes);
1925
1926         return true;
1927 }
1928
1929 /****************************************************************************
1930  Construct a chained reply and add it to the already made reply
1931 ****************************************************************************/
1932
1933 void chain_reply(struct smb_request *req)
1934 {
1935         size_t smblen = smb_len(req->inbuf);
1936         size_t already_used, length_needed;
1937         uint8_t chain_cmd;
1938         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1939
1940         uint8_t wct;
1941         const uint16_t *vwv;
1942         uint16_t buflen;
1943         const uint8_t *buf;
1944
1945         if (IVAL(req->outbuf, smb_rcls) != 0) {
1946                 fixup_chain_error_packet(req);
1947         }
1948
1949         /*
1950          * Any of the AndX requests and replies have at least a wct of
1951          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1952          * beginning of the SMB header to the next wct field.
1953          *
1954          * None of the AndX requests put anything valuable in vwv[0] and [1],
1955          * so we can overwrite it here to form the chain.
1956          */
1957
1958         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1959                 if (req->chain_outbuf == NULL) {
1960                         req->chain_outbuf = talloc_realloc(
1961                                 req, req->outbuf, uint8_t,
1962                                 smb_len(req->outbuf) + 4);
1963                         if (req->chain_outbuf == NULL) {
1964                                 smb_panic("talloc failed");
1965                         }
1966                 }
1967                 req->outbuf = NULL;
1968                 goto error;
1969         }
1970
1971         /*
1972          * Here we assume that this is the end of the chain. For that we need
1973          * to set "next command" to 0xff and the offset to 0. If we later find
1974          * more commands in the chain, this will be overwritten again.
1975          */
1976
1977         SCVAL(req->outbuf, smb_vwv0, 0xff);
1978         SCVAL(req->outbuf, smb_vwv0+1, 0);
1979         SSVAL(req->outbuf, smb_vwv1, 0);
1980
1981         if (req->chain_outbuf == NULL) {
1982                 /*
1983                  * In req->chain_outbuf we collect all the replies. Start the
1984                  * chain by copying in the first reply.
1985                  *
1986                  * We do the realloc because later on we depend on
1987                  * talloc_get_size to determine the length of
1988                  * chain_outbuf. The reply_xxx routines might have
1989                  * over-allocated (reply_pipe_read_and_X used to be such an
1990                  * example).
1991                  */
1992                 req->chain_outbuf = talloc_realloc(
1993                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1994                 if (req->chain_outbuf == NULL) {
1995                         smb_panic("talloc failed");
1996                 }
1997                 req->outbuf = NULL;
1998         } else {
1999                 /*
2000                  * Update smb headers where subsequent chained commands
2001                  * may have updated them.
2002                  */
2003                 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
2004                 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
2005
2006                 if (!smb_splice_chain(&req->chain_outbuf,
2007                                       CVAL(req->outbuf, smb_com),
2008                                       CVAL(req->outbuf, smb_wct),
2009                                       (uint16_t *)(req->outbuf + smb_vwv),
2010                                       0, smb_buflen(req->outbuf),
2011                                       (uint8_t *)smb_buf(req->outbuf))) {
2012                         goto error;
2013                 }
2014                 TALLOC_FREE(req->outbuf);
2015         }
2016
2017         /*
2018          * We use the old request's vwv field to grab the next chained command
2019          * and offset into the chained fields.
2020          */
2021
2022         chain_cmd = CVAL(req->vwv+0, 0);
2023         chain_offset = SVAL(req->vwv+1, 0);
2024
2025         if (chain_cmd == 0xff) {
2026                 /*
2027                  * End of chain, no more requests from the client. So ship the
2028                  * replies.
2029                  */
2030                 smb_setlen((char *)(req->chain_outbuf),
2031                            talloc_get_size(req->chain_outbuf) - 4);
2032
2033                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2034                                   true, req->seqnum+1,
2035                                   IS_CONN_ENCRYPTED(req->conn)
2036                                   ||req->encrypted,
2037                                   &req->pcd)) {
2038                         exit_server_cleanly("chain_reply: srv_send_smb "
2039                                             "failed.");
2040                 }
2041                 TALLOC_FREE(req->chain_outbuf);
2042                 req->done = true;
2043                 return;
2044         }
2045
2046         /* add a new perfcounter for this element of chain */
2047         SMB_PERFCOUNT_ADD(&req->pcd);
2048         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2049         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2050
2051         /*
2052          * Check if the client tries to fool us. The chain offset
2053          * needs to point beyond the current request in the chain, it
2054          * needs to strictly grow. Otherwise we might be tricked into
2055          * an endless loop always processing the same request over and
2056          * over again. We used to assume that vwv and the byte buffer
2057          * array in a chain are always attached, but OS/2 the
2058          * Write&X/Read&X chain puts the Read&X vwv array right behind
2059          * the Write&X vwv chain. The Write&X bcc array is put behind
2060          * the Read&X vwv array. So now we check whether the chain
2061          * offset points strictly behind the previous vwv
2062          * array. req->buf points right after the vwv array of the
2063          * previous request. See
2064          * https://bugzilla.samba.org/show_bug.cgi?id=8360 for more
2065          * information.
2066          */
2067
2068         already_used = PTR_DIFF(req->buf, smb_base(req->inbuf));
2069         if (chain_offset <= already_used) {
2070                 goto error;
2071         }
2072
2073         /*
2074          * Next check: Make sure the chain offset does not point beyond the
2075          * overall smb request length.
2076          */
2077
2078         length_needed = chain_offset+1; /* wct */
2079         if (length_needed > smblen) {
2080                 goto error;
2081         }
2082
2083         /*
2084          * Now comes the pointer magic. Goal here is to set up req->vwv and
2085          * req->buf correctly again to be able to call the subsequent
2086          * switch_message(). The chain offset (the former vwv[1]) points at
2087          * the new wct field.
2088          */
2089
2090         wct = CVAL(smb_base(req->inbuf), chain_offset);
2091
2092         /*
2093          * Next consistency check: Make the new vwv array fits in the overall
2094          * smb request.
2095          */
2096
2097         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2098         if (length_needed > smblen) {
2099                 goto error;
2100         }
2101         vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2102
2103         /*
2104          * Now grab the new byte buffer....
2105          */
2106
2107         buflen = SVAL(vwv+wct, 0);
2108
2109         /*
2110          * .. and check that it fits.
2111          */
2112
2113         length_needed += buflen;
2114         if (length_needed > smblen) {
2115                 goto error;
2116         }
2117         buf = (const uint8_t *)(vwv+wct+1);
2118
2119         req->cmd = chain_cmd;
2120         req->wct = wct;
2121         req->vwv = discard_const_p(uint16_t, vwv);
2122         req->buflen = buflen;
2123         req->buf = buf;
2124
2125         switch_message(chain_cmd, req, smblen);
2126
2127         if (req->outbuf == NULL) {
2128                 /*
2129                  * This happens if the chained command has suspended itself or
2130                  * if it has called srv_send_smb() itself.
2131                  */
2132                 return;
2133         }
2134
2135         /*
2136          * We end up here if the chained command was not itself chained or
2137          * suspended, but for example a close() command. We now need to splice
2138          * the chained commands' outbuf into the already built up chain_outbuf
2139          * and ship the result.
2140          */
2141         goto done;
2142
2143  error:
2144         /*
2145          * We end up here if there's any error in the chain syntax. Report a
2146          * DOS error, just like Windows does.
2147          */
2148         reply_force_doserror(req, ERRSRV, ERRerror);
2149         fixup_chain_error_packet(req);
2150
2151  done:
2152         /*
2153          * This scary statement intends to set the
2154          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2155          * to the value req->outbuf carries
2156          */
2157         SSVAL(req->chain_outbuf, smb_flg2,
2158               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2159               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2160
2161         /*
2162          * Transfer the error codes from the subrequest to the main one
2163          */
2164         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2165         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2166
2167         if (!smb_splice_chain(&req->chain_outbuf,
2168                               CVAL(req->outbuf, smb_com),
2169                               CVAL(req->outbuf, smb_wct),
2170                               (uint16_t *)(req->outbuf + smb_vwv),
2171                               0, smb_buflen(req->outbuf),
2172                               (uint8_t *)smb_buf(req->outbuf))) {
2173                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2174         }
2175         TALLOC_FREE(req->outbuf);
2176
2177         smb_setlen((char *)(req->chain_outbuf),
2178                    talloc_get_size(req->chain_outbuf) - 4);
2179
2180         show_msg((char *)(req->chain_outbuf));
2181
2182         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2183                           true, req->seqnum+1,
2184                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2185                           &req->pcd)) {
2186                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2187         }
2188         TALLOC_FREE(req->chain_outbuf);
2189         req->done = true;
2190 }
2191
2192 /****************************************************************************
2193  Check if services need reloading.
2194 ****************************************************************************/
2195
2196 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2197 {
2198
2199         if (last_smb_conf_reload_time == 0) {
2200                 last_smb_conf_reload_time = t;
2201         }
2202
2203         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2204                 reload_services(sconn->msg_ctx, sconn->sock, True);
2205                 last_smb_conf_reload_time = t;
2206         }
2207 }
2208
2209 static bool fd_is_readable(int fd)
2210 {
2211         int ret, revents;
2212
2213         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2214
2215         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2216
2217 }
2218
2219 static void smbd_server_connection_write_handler(
2220         struct smbd_server_connection *sconn)
2221 {
2222         /* TODO: make write nonblocking */
2223 }
2224
2225 static void smbd_server_connection_read_handler(
2226         struct smbd_server_connection *sconn, int fd)
2227 {
2228         uint8_t *inbuf = NULL;
2229         size_t inbuf_len = 0;
2230         size_t unread_bytes = 0;
2231         bool encrypted = false;
2232         TALLOC_CTX *mem_ctx = talloc_tos();
2233         NTSTATUS status;
2234         uint32_t seqnum;
2235
2236         bool from_client;
2237
2238         if (lp_async_smb_echo_handler()
2239             && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2240                 /*
2241                  * This is the super-ugly hack to prefer the packets
2242                  * forwarded by the echo handler over the ones by the
2243                  * client directly
2244                  */
2245                 fd = sconn->smb1.echo_handler.trusted_fd;
2246         }
2247
2248         from_client = (sconn->sock == fd);
2249
2250         if (from_client) {
2251                 smbd_lock_socket(sconn);
2252
2253                 if (!fd_is_readable(fd)) {
2254                         DEBUG(10,("the echo listener was faster\n"));
2255                         smbd_unlock_socket(sconn);
2256                         return;
2257                 }
2258         }
2259
2260         /* TODO: make this completely nonblocking */
2261         status = receive_smb_talloc(mem_ctx, sconn, fd,
2262                                     (char **)(void *)&inbuf,
2263                                     0, /* timeout */
2264                                     &unread_bytes,
2265                                     &encrypted,
2266                                     &inbuf_len, &seqnum,
2267                                     false /* trusted channel */);
2268
2269         if (from_client) {
2270                 smbd_unlock_socket(sconn);
2271         }
2272
2273         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2274                 goto process;
2275         }
2276         if (NT_STATUS_IS_ERR(status)) {
2277                 exit_server_cleanly("failed to receive smb request");
2278         }
2279         if (!NT_STATUS_IS_OK(status)) {
2280                 return;
2281         }
2282
2283 process:
2284         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2285                     seqnum, encrypted, NULL);
2286 }
2287
2288 static void smbd_server_connection_handler(struct event_context *ev,
2289                                            struct fd_event *fde,
2290                                            uint16_t flags,
2291                                            void *private_data)
2292 {
2293         struct smbd_server_connection *conn = talloc_get_type(private_data,
2294                                               struct smbd_server_connection);
2295
2296         if (flags & EVENT_FD_WRITE) {
2297                 smbd_server_connection_write_handler(conn);
2298                 return;
2299         }
2300         if (flags & EVENT_FD_READ) {
2301                 smbd_server_connection_read_handler(conn, conn->sock);
2302                 return;
2303         }
2304 }
2305
2306 static void smbd_server_echo_handler(struct event_context *ev,
2307                                      struct fd_event *fde,
2308                                      uint16_t flags,
2309                                      void *private_data)
2310 {
2311         struct smbd_server_connection *conn = talloc_get_type(private_data,
2312                                               struct smbd_server_connection);
2313
2314         if (flags & EVENT_FD_WRITE) {
2315                 smbd_server_connection_write_handler(conn);
2316                 return;
2317         }
2318         if (flags & EVENT_FD_READ) {
2319                 smbd_server_connection_read_handler(
2320                         conn, conn->smb1.echo_handler.trusted_fd);
2321                 return;
2322         }
2323 }
2324
2325 #ifdef CLUSTER_SUPPORT
2326 /****************************************************************************
2327 received when we should release a specific IP
2328 ****************************************************************************/
2329 static void release_ip(const char *ip, void *priv)
2330 {
2331         const char *addr = (const char *)priv;
2332         const char *p = addr;
2333
2334         if (strncmp("::ffff:", addr, 7) == 0) {
2335                 p = addr + 7;
2336         }
2337
2338         DEBUG(10, ("Got release IP message for %s, "
2339                    "our address is %s\n", ip, p));
2340
2341         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2342                 /* we can't afford to do a clean exit - that involves
2343                    database writes, which would potentially mean we
2344                    are still running after the failover has finished -
2345                    we have to get rid of this process ID straight
2346                    away */
2347                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2348                         ip));
2349                 /* note we must exit with non-zero status so the unclean handler gets
2350                    called in the parent, so that the brl database is tickled */
2351                 _exit(1);
2352         }
2353 }
2354
2355 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2356                                struct sockaddr_storage *client)
2357 {
2358         socklen_t length;
2359         length = sizeof(*server);
2360         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2361                 return -1;
2362         }
2363         length = sizeof(*client);
2364         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2365                 return -1;
2366         }
2367         return 0;
2368 }
2369 #endif
2370
2371 /*
2372  * Send keepalive packets to our client
2373  */
2374 static bool keepalive_fn(const struct timeval *now, void *private_data)
2375 {
2376         struct smbd_server_connection *sconn = talloc_get_type_abort(
2377                 private_data, struct smbd_server_connection);
2378         bool ret;
2379
2380         if (sconn->using_smb2) {
2381                 /* Don't do keepalives on an SMB2 connection. */
2382                 return false;
2383         }
2384
2385         smbd_lock_socket(sconn);
2386         ret = send_keepalive(sconn->sock);
2387         smbd_unlock_socket(sconn);
2388
2389         if (!ret) {
2390                 char addr[INET6_ADDRSTRLEN];
2391                 /*
2392                  * Try and give an error message saying what
2393                  * client failed.
2394                  */
2395                 DEBUG(0, ("send_keepalive failed for client %s. "
2396                           "Error %s - exiting\n",
2397                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2398                           strerror(errno)));
2399                 return False;
2400         }
2401         return True;
2402 }
2403
2404 /*
2405  * Do the recurring check if we're idle
2406  */
2407 static bool deadtime_fn(const struct timeval *now, void *private_data)
2408 {
2409         struct smbd_server_connection *sconn =
2410                 (struct smbd_server_connection *)private_data;
2411
2412         if ((conn_num_open(sconn) == 0)
2413             || (conn_idle_all(sconn, now->tv_sec))) {
2414                 DEBUG( 2, ( "Closing idle connection\n" ) );
2415                 messaging_send(sconn->msg_ctx,
2416                                messaging_server_id(sconn->msg_ctx),
2417                                MSG_SHUTDOWN, &data_blob_null);
2418                 return False;
2419         }
2420
2421         return True;
2422 }
2423
2424 /*
2425  * Do the recurring log file and smb.conf reload checks.
2426  */
2427
2428 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2429 {
2430         struct smbd_server_connection *sconn = talloc_get_type_abort(
2431                 private_data, struct smbd_server_connection);
2432
2433         DEBUG(5, ("housekeeping\n"));
2434
2435         change_to_root_user();
2436
2437         /* update printer queue caches if necessary */
2438         update_monitored_printq_cache(sconn->msg_ctx);
2439
2440         /* check if we need to reload services */
2441         check_reload(sconn, time_mono(NULL));
2442
2443         /* Change machine password if neccessary. */
2444         attempt_machine_password_change();
2445
2446         /*
2447          * Force a log file check.
2448          */
2449         force_check_log_size();
2450         check_log_size();
2451         return true;
2452 }
2453
2454 /*
2455  * Read an smb packet in the echo handler child, giving the parent
2456  * smbd one second to react once the socket becomes readable.
2457  */
2458
2459 struct smbd_echo_read_state {
2460         struct tevent_context *ev;
2461         struct smbd_server_connection *sconn;
2462
2463         char *buf;
2464         size_t buflen;
2465         uint32_t seqnum;
2466 };
2467
2468 static void smbd_echo_read_readable(struct tevent_req *subreq);
2469 static void smbd_echo_read_waited(struct tevent_req *subreq);
2470
2471 static struct tevent_req *smbd_echo_read_send(
2472         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2473         struct smbd_server_connection *sconn)
2474 {
2475         struct tevent_req *req, *subreq;
2476         struct smbd_echo_read_state *state;
2477
2478         req = tevent_req_create(mem_ctx, &state,
2479                                 struct smbd_echo_read_state);
2480         if (req == NULL) {
2481                 return NULL;
2482         }
2483         state->ev = ev;
2484         state->sconn = sconn;
2485
2486         subreq = wait_for_read_send(state, ev, sconn->sock);
2487         if (tevent_req_nomem(subreq, req)) {
2488                 return tevent_req_post(req, ev);
2489         }
2490         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2491         return req;
2492 }
2493
2494 static void smbd_echo_read_readable(struct tevent_req *subreq)
2495 {
2496         struct tevent_req *req = tevent_req_callback_data(
2497                 subreq, struct tevent_req);
2498         struct smbd_echo_read_state *state = tevent_req_data(
2499                 req, struct smbd_echo_read_state);
2500         bool ok;
2501         int err;
2502
2503         ok = wait_for_read_recv(subreq, &err);
2504         TALLOC_FREE(subreq);
2505         if (!ok) {
2506                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2507                 return;
2508         }
2509
2510         /*
2511          * Give the parent smbd one second to step in
2512          */
2513
2514         subreq = tevent_wakeup_send(
2515                 state, state->ev, timeval_current_ofs(1, 0));
2516         if (tevent_req_nomem(subreq, req)) {
2517                 return;
2518         }
2519         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2520 }
2521
2522 static void smbd_echo_read_waited(struct tevent_req *subreq)
2523 {
2524         struct tevent_req *req = tevent_req_callback_data(
2525                 subreq, struct tevent_req);
2526         struct smbd_echo_read_state *state = tevent_req_data(
2527                 req, struct smbd_echo_read_state);
2528         struct smbd_server_connection *sconn = state->sconn;
2529         bool ok;
2530         NTSTATUS status;
2531         size_t unread = 0;
2532         bool encrypted;
2533
2534         ok = tevent_wakeup_recv(subreq);
2535         TALLOC_FREE(subreq);
2536         if (!ok) {
2537                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2538                 return;
2539         }
2540
2541         ok = smbd_lock_socket_internal(sconn);
2542         if (!ok) {
2543                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2544                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2545                 return;
2546         }
2547
2548         if (!fd_is_readable(sconn->sock)) {
2549                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2550                           (int)sys_getpid()));
2551
2552                 ok = smbd_unlock_socket_internal(sconn);
2553                 if (!ok) {
2554                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2555                         DEBUG(1, ("%s: failed to unlock socket\n",
2556                                 __location__));
2557                         return;
2558                 }
2559
2560                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2561                 if (tevent_req_nomem(subreq, req)) {
2562                         return;
2563                 }
2564                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2565                 return;
2566         }
2567
2568         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2569                                     0 /* timeout */,
2570                                     &unread,
2571                                     &encrypted,
2572                                     &state->buflen,
2573                                     &state->seqnum,
2574                                     false /* trusted_channel*/);
2575
2576         if (tevent_req_nterror(req, status)) {
2577                 tevent_req_nterror(req, status);
2578                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2579                           (int)sys_getpid(), nt_errstr(status)));
2580                 return;
2581         }
2582
2583         ok = smbd_unlock_socket_internal(sconn);
2584         if (!ok) {
2585                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2586                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2587                 return;
2588         }
2589         tevent_req_done(req);
2590 }
2591
2592 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2593                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2594 {
2595         struct smbd_echo_read_state *state = tevent_req_data(
2596                 req, struct smbd_echo_read_state);
2597         NTSTATUS status;
2598
2599         if (tevent_req_is_nterror(req, &status)) {
2600                 return status;
2601         }
2602         *pbuf = talloc_move(mem_ctx, &state->buf);
2603         *pbuflen = state->buflen;
2604         *pseqnum = state->seqnum;
2605         return NT_STATUS_OK;
2606 }
2607
2608 struct smbd_echo_state {
2609         struct tevent_context *ev;
2610         struct iovec *pending;
2611         struct smbd_server_connection *sconn;
2612         int parent_pipe;
2613
2614         struct tevent_fd *parent_fde;
2615
2616         struct tevent_req *write_req;
2617 };
2618
2619 static void smbd_echo_writer_done(struct tevent_req *req);
2620
2621 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2622 {
2623         int num_pending;
2624
2625         if (state->write_req != NULL) {
2626                 return;
2627         }
2628
2629         num_pending = talloc_array_length(state->pending);
2630         if (num_pending == 0) {
2631                 return;
2632         }
2633
2634         state->write_req = writev_send(state, state->ev, NULL,
2635                                        state->parent_pipe, false,
2636                                        state->pending, num_pending);
2637         if (state->write_req == NULL) {
2638                 DEBUG(1, ("writev_send failed\n"));
2639                 exit(1);
2640         }
2641
2642         talloc_steal(state->write_req, state->pending);
2643         state->pending = NULL;
2644
2645         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2646                                 state);
2647 }
2648
2649 static void smbd_echo_writer_done(struct tevent_req *req)
2650 {
2651         struct smbd_echo_state *state = tevent_req_callback_data(
2652                 req, struct smbd_echo_state);
2653         ssize_t written;
2654         int err;
2655
2656         written = writev_recv(req, &err);
2657         TALLOC_FREE(req);
2658         state->write_req = NULL;
2659         if (written == -1) {
2660                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2661                 exit(1);
2662         }
2663         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2664         smbd_echo_activate_writer(state);
2665 }
2666
2667 static bool smbd_echo_reply(struct smbd_echo_state *state,
2668                             uint8_t *inbuf, size_t inbuf_len,
2669                             uint32_t seqnum)
2670 {
2671         struct smb_request req;
2672         uint16_t num_replies;
2673         size_t out_len;
2674         char *outbuf;
2675         bool ok;
2676
2677         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2678                 DEBUG(10, ("Got netbios keepalive\n"));
2679                 /*
2680                  * Just swallow it
2681                  */
2682                 return true;
2683         }
2684
2685         if (inbuf_len < smb_size) {
2686                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2687                 return false;
2688         }
2689         if (!valid_smb_header(state->sconn, inbuf)) {
2690                 DEBUG(10, ("Got invalid SMB header\n"));
2691                 return false;
2692         }
2693
2694         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2695                               seqnum)) {
2696                 return false;
2697         }
2698         req.inbuf = inbuf;
2699
2700         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2701                    smb_messages[req.cmd].name
2702                    ? smb_messages[req.cmd].name : "unknown"));
2703
2704         if (req.cmd != SMBecho) {
2705                 return false;
2706         }
2707         if (req.wct < 1) {
2708                 return false;
2709         }
2710
2711         num_replies = SVAL(req.vwv+0, 0);
2712         if (num_replies != 1) {
2713                 /* Not a Windows "Hey, you're still there?" request */
2714                 return false;
2715         }
2716
2717         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2718                            1, req.buflen)) {
2719                 DEBUG(10, ("create_outbuf failed\n"));
2720                 return false;
2721         }
2722         req.outbuf = (uint8_t *)outbuf;
2723
2724         SSVAL(req.outbuf, smb_vwv0, num_replies);
2725
2726         if (req.buflen > 0) {
2727                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2728         }
2729
2730         out_len = smb_len(req.outbuf) + 4;
2731
2732         ok = srv_send_smb(req.sconn,
2733                           (char *)outbuf,
2734                           true, seqnum+1,
2735                           false, &req.pcd);
2736         TALLOC_FREE(outbuf);
2737         if (!ok) {
2738                 exit(1);
2739         }
2740
2741         return true;
2742 }
2743
2744 static void smbd_echo_exit(struct tevent_context *ev,
2745                            struct tevent_fd *fde, uint16_t flags,
2746                            void *private_data)
2747 {
2748         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2749         exit(0);
2750 }
2751
2752 static void smbd_echo_got_packet(struct tevent_req *req);
2753
2754 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2755                            int parent_pipe)
2756 {
2757         struct smbd_echo_state *state;
2758         struct tevent_req *read_req;
2759
2760         state = talloc_zero(sconn, struct smbd_echo_state);
2761         if (state == NULL) {
2762                 DEBUG(1, ("talloc failed\n"));
2763                 return;
2764         }
2765         state->sconn = sconn;
2766         state->parent_pipe = parent_pipe;
2767         state->ev = s3_tevent_context_init(state);
2768         if (state->ev == NULL) {
2769                 DEBUG(1, ("tevent_context_init failed\n"));
2770                 TALLOC_FREE(state);
2771                 return;
2772         }
2773         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2774                                         TEVENT_FD_READ, smbd_echo_exit,
2775                                         state);
2776         if (state->parent_fde == NULL) {
2777                 DEBUG(1, ("tevent_add_fd failed\n"));
2778                 TALLOC_FREE(state);
2779                 return;
2780         }
2781
2782         read_req = smbd_echo_read_send(state, state->ev, sconn);
2783         if (read_req == NULL) {
2784                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2785                 TALLOC_FREE(state);
2786                 return;
2787         }
2788         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2789
2790         while (true) {
2791                 if (tevent_loop_once(state->ev) == -1) {
2792                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2793                                   strerror(errno)));
2794                         break;
2795                 }
2796         }
2797         TALLOC_FREE(state);
2798 }
2799
2800 static void smbd_echo_got_packet(struct tevent_req *req)
2801 {
2802         struct smbd_echo_state *state = tevent_req_callback_data(
2803                 req, struct smbd_echo_state);
2804         NTSTATUS status;
2805         char *buf = NULL;
2806         size_t buflen = 0;
2807         uint32_t seqnum = 0;
2808         bool reply;
2809
2810         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2811         TALLOC_FREE(req);
2812         if (!NT_STATUS_IS_OK(status)) {
2813                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2814                           nt_errstr(status)));
2815                 exit(1);
2816         }
2817
2818         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2819         if (!reply) {
2820                 size_t num_pending;
2821                 struct iovec *tmp;
2822                 struct iovec *iov;
2823
2824                 num_pending = talloc_array_length(state->pending);
2825                 tmp = talloc_realloc(state, state->pending, struct iovec,
2826                                      num_pending+1);
2827                 if (tmp == NULL) {
2828                         DEBUG(1, ("talloc_realloc failed\n"));
2829                         exit(1);
2830                 }
2831                 state->pending = tmp;
2832
2833                 if (buflen >= smb_size) {
2834                         /*
2835                          * place the seqnum in the packet so that the main process
2836                          * can reply with signing
2837                          */
2838                         SIVAL(buf, smb_ss_field, seqnum);
2839                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2840                 }
2841
2842                 iov = &state->pending[num_pending];
2843                 iov->iov_base = buf;
2844                 iov->iov_len = buflen;
2845
2846                 DEBUG(10,("echo_handler[%d]: forward to main\n",
2847                           (int)sys_getpid()));
2848                 smbd_echo_activate_writer(state);
2849         }
2850
2851         req = smbd_echo_read_send(state, state->ev, state->sconn);
2852         if (req == NULL) {
2853                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2854                 exit(1);
2855         }
2856         tevent_req_set_callback(req, smbd_echo_got_packet, state);
2857 }
2858
2859
2860 /*
2861  * Handle SMBecho requests in a forked child process
2862  */
2863 bool fork_echo_handler(struct smbd_server_connection *sconn)
2864 {
2865         int listener_pipe[2];
2866         int res;
2867         pid_t child;
2868
2869         res = pipe(listener_pipe);
2870         if (res == -1) {
2871                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2872                 return false;
2873         }
2874         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2875         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2876                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2877                 goto fail;
2878         }
2879
2880         child = sys_fork();
2881         if (child == 0) {
2882                 NTSTATUS status;
2883
2884                 close(listener_pipe[0]);
2885                 set_blocking(listener_pipe[1], false);
2886
2887                 status = reinit_after_fork(sconn->msg_ctx,
2888                                            sconn->ev_ctx,
2889                                            false);
2890                 if (!NT_STATUS_IS_OK(status)) {
2891                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2892                                   nt_errstr(status)));
2893                         exit(1);
2894                 }
2895                 smbd_echo_loop(sconn, listener_pipe[1]);
2896                 exit(0);
2897         }
2898         close(listener_pipe[1]);
2899         listener_pipe[1] = -1;
2900         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2901
2902         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2903
2904         /*
2905          * Without smb signing this is the same as the normal smbd
2906          * listener. This needs to change once signing comes in.
2907          */
2908         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
2909                                         sconn,
2910                                         sconn->smb1.echo_handler.trusted_fd,
2911                                         TEVENT_FD_READ,
2912                                         smbd_server_echo_handler,
2913                                         sconn);
2914         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2915                 DEBUG(1, ("event_add_fd failed\n"));
2916                 goto fail;
2917         }
2918
2919         return true;
2920
2921 fail:
2922         if (listener_pipe[0] != -1) {
2923                 close(listener_pipe[0]);
2924         }
2925         if (listener_pipe[1] != -1) {
2926                 close(listener_pipe[1]);
2927         }
2928         sconn->smb1.echo_handler.trusted_fd = -1;
2929         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2930                 close(sconn->smb1.echo_handler.socket_lock_fd);
2931         }
2932         sconn->smb1.echo_handler.trusted_fd = -1;
2933         sconn->smb1.echo_handler.socket_lock_fd = -1;
2934         return false;
2935 }
2936
2937 #if CLUSTER_SUPPORT
2938
2939 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2940                                   struct sockaddr_storage *srv,
2941                                   struct sockaddr_storage *clnt)
2942 {
2943         struct ctdbd_connection *cconn;
2944         char tmp_addr[INET6_ADDRSTRLEN];
2945         char *addr;
2946
2947         cconn = messaging_ctdbd_connection();
2948         if (cconn == NULL) {
2949                 return NT_STATUS_NO_MEMORY;
2950         }
2951
2952         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2953         addr = talloc_strdup(cconn, tmp_addr);
2954         if (addr == NULL) {
2955                 return NT_STATUS_NO_MEMORY;
2956         }
2957         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2958 }
2959
2960 #endif
2961
2962 /****************************************************************************
2963  Process commands from the client
2964 ****************************************************************************/
2965
2966 void smbd_process(struct tevent_context *ev_ctx,
2967                   struct smbd_server_connection *sconn)
2968 {
2969         TALLOC_CTX *frame = talloc_stackframe();
2970         struct sockaddr_storage ss;
2971         struct sockaddr *sa = NULL;
2972         socklen_t sa_socklen;
2973         struct tsocket_address *local_address = NULL;
2974         struct tsocket_address *remote_address = NULL;
2975         const char *locaddr = NULL;
2976         const char *remaddr = NULL;
2977         char *rhost;
2978         int ret;
2979
2980         if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
2981                 /*
2982                  * We're not making the decision here,
2983                  * we're just allowing the client
2984                  * to decide between SMB1 and SMB2
2985                  * with the first negprot
2986                  * packet.
2987                  */
2988                 sconn->using_smb2 = true;
2989         }
2990
2991         /* Ensure child is set to blocking mode */
2992         set_blocking(sconn->sock,True);
2993
2994         set_socket_options(sconn->sock, "SO_KEEPALIVE");
2995         set_socket_options(sconn->sock, lp_socket_options());
2996
2997         sa = (struct sockaddr *)(void *)&ss;
2998         sa_socklen = sizeof(ss);
2999         ret = getpeername(sconn->sock, sa, &sa_socklen);
3000         if (ret != 0) {
3001                 int level = (errno == ENOTCONN)?2:0;
3002                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3003                 exit_server_cleanly("getpeername() failed.\n");
3004         }
3005         ret = tsocket_address_bsd_from_sockaddr(sconn,
3006                                                 sa, sa_socklen,
3007                                                 &remote_address);
3008         if (ret != 0) {
3009                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3010                         __location__, strerror(errno)));
3011                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3012         }
3013
3014         sa = (struct sockaddr *)(void *)&ss;
3015         sa_socklen = sizeof(ss);
3016         ret = getsockname(sconn->sock, sa, &sa_socklen);
3017         if (ret != 0) {
3018                 int level = (errno == ENOTCONN)?2:0;
3019                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3020                 exit_server_cleanly("getsockname() failed.\n");
3021         }
3022         ret = tsocket_address_bsd_from_sockaddr(sconn,
3023                                                 sa, sa_socklen,
3024                                                 &local_address);
3025         if (ret != 0) {
3026                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3027                         __location__, strerror(errno)));
3028                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3029         }
3030
3031         sconn->local_address = local_address;
3032         sconn->remote_address = remote_address;
3033
3034         if (tsocket_address_is_inet(local_address, "ip")) {
3035                 locaddr = tsocket_address_inet_addr_string(
3036                                 sconn->local_address,
3037                                 talloc_tos());
3038                 if (locaddr == NULL) {
3039                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3040                                  __location__, strerror(errno)));
3041                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3042                 }
3043         } else {
3044                 locaddr = "0.0.0.0";
3045         }
3046
3047         if (tsocket_address_is_inet(remote_address, "ip")) {
3048                 remaddr = tsocket_address_inet_addr_string(
3049                                 sconn->remote_address,
3050                                 talloc_tos());
3051                 if (remaddr == NULL) {
3052                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3053                                  __location__, strerror(errno)));
3054                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3055                 }
3056         } else {
3057                 remaddr = "0.0.0.0";
3058         }
3059
3060         /* this is needed so that we get decent entries
3061            in smbstatus for port 445 connects */
3062         set_remote_machine_name(remaddr, false);
3063         reload_services(sconn->msg_ctx, sconn->sock, true);
3064
3065         /*
3066          * Before the first packet, check the global hosts allow/ hosts deny
3067          * parameters before doing any parsing of packets passed to us by the
3068          * client. This prevents attacks on our parsing code from hosts not in
3069          * the hosts allow list.
3070          */
3071
3072         ret = get_remote_hostname(remote_address,
3073                                   &rhost,
3074                                   talloc_tos());
3075         if (ret < 0) {
3076                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3077                         __location__, strerror(errno)));
3078                 exit_server_cleanly("get_remote_hostname failed.\n");
3079         }
3080         if (strequal(rhost, "UNKNOWN")) {
3081                 rhost = talloc_strdup(talloc_tos(), remaddr);
3082         }
3083         sconn->remote_hostname = talloc_move(sconn, &rhost);
3084
3085         sub_set_socket_ids(remaddr,
3086                            sconn->remote_hostname,
3087                            locaddr);
3088
3089         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3090                           sconn->remote_hostname,
3091                           remaddr)) {
3092                 /*
3093                  * send a negative session response "not listening on calling
3094                  * name"
3095                  */
3096                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3097                 DEBUG( 1, ("Connection denied from %s to %s\n",
3098                            tsocket_address_string(remote_address, talloc_tos()),
3099                            tsocket_address_string(local_address, talloc_tos())));
3100                 (void)srv_send_smb(sconn,(char *)buf, false,
3101                                    0, false, NULL);
3102                 exit_server_cleanly("connection denied");
3103         }
3104
3105         DEBUG(10, ("Connection allowed from %s to %s\n",
3106                    tsocket_address_string(remote_address, talloc_tos()),
3107                    tsocket_address_string(local_address, talloc_tos())));
3108
3109         init_modules();
3110
3111         smb_perfcount_init();
3112
3113         if (!init_account_policy()) {
3114                 exit_server("Could not open account policy tdb.\n");
3115         }
3116
3117         if (*lp_rootdir()) {
3118                 if (chroot(lp_rootdir()) != 0) {
3119                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3120                         exit_server("Failed to chroot()");
3121                 }
3122                 if (chdir("/") == -1) {
3123                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3124                         exit_server("Failed to chroot()");
3125                 }
3126                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3127         }
3128
3129         if (!srv_init_signing(sconn)) {
3130                 exit_server("Failed to init smb_signing");
3131         }
3132
3133         /* Setup oplocks */
3134         if (!init_oplocks(sconn->msg_ctx))
3135                 exit_server("Failed to init oplocks");
3136
3137         /* register our message handlers */
3138         messaging_register(sconn->msg_ctx, sconn,
3139                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3140         messaging_register(sconn->msg_ctx, sconn,
3141                            MSG_SMB_CLOSE_FILE, msg_close_file);
3142
3143         /*
3144          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3145          * MSGs to all child processes
3146          */
3147         messaging_deregister(sconn->msg_ctx,
3148                              MSG_DEBUG, NULL);
3149         messaging_register(sconn->msg_ctx, NULL,
3150                            MSG_DEBUG, debug_message);
3151
3152         if ((lp_keepalive() != 0)
3153             && !(event_add_idle(ev_ctx, NULL,
3154                                 timeval_set(lp_keepalive(), 0),
3155                                 "keepalive", keepalive_fn,
3156                                 sconn))) {
3157                 DEBUG(0, ("Could not add keepalive event\n"));
3158                 exit(1);
3159         }
3160
3161         if (!(event_add_idle(ev_ctx, NULL,
3162                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3163                              "deadtime", deadtime_fn, sconn))) {
3164                 DEBUG(0, ("Could not add deadtime event\n"));
3165                 exit(1);
3166         }
3167
3168         if (!(event_add_idle(ev_ctx, NULL,
3169                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3170                              "housekeeping", housekeeping_fn, sconn))) {
3171                 DEBUG(0, ("Could not add housekeeping event\n"));
3172                 exit(1);
3173         }
3174
3175 #ifdef CLUSTER_SUPPORT
3176
3177         if (lp_clustering()) {
3178                 /*
3179                  * We need to tell ctdb about our client's TCP
3180                  * connection, so that for failover ctdbd can send
3181                  * tickle acks, triggering a reconnection by the
3182                  * client.
3183                  */
3184
3185                 struct sockaddr_storage srv, clnt;
3186
3187                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3188                         NTSTATUS status;
3189                         status = smbd_register_ips(sconn, &srv, &clnt);
3190                         if (!NT_STATUS_IS_OK(status)) {
3191                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3192                                           nt_errstr(status)));
3193                         }
3194                 } else
3195                 {
3196                         DEBUG(0,("Unable to get tcp info for "
3197                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3198                                  strerror(errno)));
3199                 }
3200         }
3201
3202 #endif
3203
3204         sconn->nbt.got_session = false;
3205
3206         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3207
3208         sconn->smb1.sessions.done_sesssetup = false;
3209         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3210         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3211         /* users from session setup */
3212         sconn->smb1.sessions.session_userlist = NULL;
3213         /* workgroup from session setup. */
3214         sconn->smb1.sessions.session_workgroup = NULL;
3215         /* this holds info on user ids that are already validated for this VC */
3216         sconn->smb1.sessions.validated_users = NULL;
3217         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3218         sconn->smb1.sessions.num_validated_vuids = 0;
3219
3220         conn_init(sconn);
3221         if (!init_dptrs(sconn)) {
3222                 exit_server("init_dptrs() failed");
3223         }
3224
3225         sconn->smb1.fde = event_add_fd(ev_ctx,
3226                                                   sconn,
3227                                                   sconn->sock,
3228                                                   EVENT_FD_READ,
3229                                                   smbd_server_connection_handler,
3230                                                   sconn);
3231         if (!sconn->smb1.fde) {
3232                 exit_server("failed to create smbd_server_connection fde");
3233         }
3234
3235         TALLOC_FREE(frame);
3236
3237         while (True) {
3238                 NTSTATUS status;
3239
3240                 frame = talloc_stackframe_pool(8192);
3241
3242                 errno = 0;
3243
3244                 status = smbd_server_connection_loop_once(ev_ctx, sconn);
3245                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3246                     !NT_STATUS_IS_OK(status)) {
3247                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3248                                   " exiting\n", nt_errstr(status)));
3249                         break;
3250                 }
3251
3252                 TALLOC_FREE(frame);
3253         }
3254
3255         exit_server_cleanly(NULL);
3256 }
3257
3258 bool req_is_in_chain(struct smb_request *req)
3259 {
3260         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3261                 /*
3262                  * We're right now handling a subsequent request, so we must
3263                  * be in a chain
3264                  */
3265                 return true;
3266         }
3267
3268         if (!is_andx_req(req->cmd)) {
3269                 return false;
3270         }
3271
3272         if (req->wct < 2) {
3273                 /*
3274                  * Okay, an illegal request, but definitely not chained :-)
3275                  */
3276                 return false;
3277         }
3278
3279         return (CVAL(req->vwv+0, 0) != 0xFF);
3280 }