source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42
  43 extern bool global_machine_password_needs_changing;
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct timed_event *te;
  51         struct smb_perfcount_data pcd;
  52         uint32_t seqnum;
  53         bool encrypted;
  54         bool processed;
  55         DATA_BLOB buf;
  56         DATA_BLOB private_data;
  57 };
  58
  59 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  60                                    char *outbuf);
  61 static struct pending_message_list *get_deferred_open_message_smb(
  62         struct smbd_server_connection *sconn, uint64_t mid);
  63
  64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  65 {
  66         bool ok;
  67
  68         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  69                 return true;
  70         }
  71
  72         sconn->smb1.echo_handler.ref_count++;
  73
  74         if (sconn->smb1.echo_handler.ref_count > 1) {
  75                 return true;
  76         }
  77
  78         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  79
  80         do {
  81                 ok = fcntl_lock(
  82                         sconn->smb1.echo_handler.socket_lock_fd,
  83                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  84         } while (!ok && (errno == EINTR));
  85
  86         if (!ok) {
  87                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  88                 return false;
  89         }
  90
  91         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  92
  93         return true;
  94 }
  95
  96 void smbd_lock_socket(struct smbd_server_connection *sconn)
  97 {
  98         if (!smbd_lock_socket_internal(sconn)) {
  99                 exit_server_cleanly("failed to lock socket");
 100         }
 101 }
 102
 103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 104 {
 105         bool ok;
 106
 107         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
 108                 return true;
 109         }
 110
 111         sconn->smb1.echo_handler.ref_count--;
 112
 113         if (sconn->smb1.echo_handler.ref_count > 0) {
 114                 return true;
 115         }
 116
 117         do {
 118                 ok = fcntl_lock(
 119                         sconn->smb1.echo_handler.socket_lock_fd,
 120                         SMB_F_SETLKW, 0, 0, F_UNLCK);
 121         } while (!ok && (errno == EINTR));
 122
 123         if (!ok) {
 124                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 125                 return false;
 126         }
 127
 128         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 129
 130         return true;
 131 }
 132
 133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 134 {
 135         if (!smbd_unlock_socket_internal(sconn)) {
 136                 exit_server_cleanly("failed to unlock socket");
 137         }
 138 }
 139
 140 /* Accessor function for smb_read_error for smbd functions. */
 141
 142 /****************************************************************************
 143  Send an smb to a fd.
 144 ****************************************************************************/
 145
 146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 147                   bool do_signing, uint32_t seqnum,
 148                   bool do_encrypt,
 149                   struct smb_perfcount_data *pcd)
 150 {
 151         size_t len = 0;
 152         size_t nwritten=0;
 153         ssize_t ret;
 154         char *buf_out = buffer;
 155
 156         smbd_lock_socket(sconn);
 157
 158         if (do_signing) {
 159                 /* Sign the outgoing packet if required. */
 160                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 161         }
 162
 163         if (do_encrypt) {
 164                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 165                 if (!NT_STATUS_IS_OK(status)) {
 166                         DEBUG(0, ("send_smb: SMB encryption failed "
 167                                 "on outgoing packet! Error %s\n",
 168                                 nt_errstr(status) ));
 169                         goto out;
 170                 }
 171         }
 172
 173         len = smb_len(buf_out) + 4;
 174
 175         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 176         if (ret <= 0) {
 177
 178                 char addr[INET6_ADDRSTRLEN];
 179                 /*
 180                  * Try and give an error message saying what
 181                  * client failed.
 182                  */
 183                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 184                          (int)sys_getpid(), (int)len,
 185                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 186                          (int)ret, strerror(errno) ));
 187
 188                 srv_free_enc_buffer(sconn, buf_out);
 189                 goto out;
 190         }
 191
 192         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 193         srv_free_enc_buffer(sconn, buf_out);
 194 out:
 195         SMB_PERFCOUNT_END(pcd);
 196
 197         smbd_unlock_socket(sconn);
 198         return true;
 199 }
 200
 201 /*******************************************************************
 202  Setup the word count and byte count for a smb message.
 203 ********************************************************************/
 204
 205 int srv_set_message(char *buf,
 206                         int num_words,
 207                         int num_bytes,
 208                         bool zero)
 209 {
 210         if (zero && (num_words || num_bytes)) {
 211                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 212         }
 213         SCVAL(buf,smb_wct,num_words);
 214         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 215         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 216         return (smb_size + num_words*2 + num_bytes);
 217 }
 218
 219 static bool valid_smb_header(struct smbd_server_connection *sconn,
 220                              const uint8_t *inbuf)
 221 {
 222         if (is_encrypted_packet(sconn, inbuf)) {
 223                 return true;
 224         }
 225         /*
 226          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 227          * but it just looks weird to call strncmp for this one.
 228          */
 229         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 230 }
 231
 232 /* Socket functions for smbd packet processing. */
 233
 234 static bool valid_packet_size(size_t len)
 235 {
 236         /*
 237          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 238          * of header. Don't print the error if this fits.... JRA.
 239          */
 240
 241         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 242                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 243                                         (unsigned long)len));
 244                 return false;
 245         }
 246         return true;
 247 }
 248
 249 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 250                                       unsigned int timeout, ssize_t len)
 251 {
 252         NTSTATUS status;
 253
 254         if (len <= 0) {
 255                 return NT_STATUS_OK;
 256         }
 257
 258         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 259         if (!NT_STATUS_IS_OK(status)) {
 260                 char addr[INET6_ADDRSTRLEN];
 261                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 262                           "error = %s.\n",
 263                           get_peer_addr(fd, addr, sizeof(addr)),
 264                           nt_errstr(status)));
 265         }
 266         return status;
 267 }
 268
 269 /****************************************************************************
 270  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 271 ****************************************************************************/
 272
 273 /*
 274  * Unfortunately, earlier versions of smbclient/libsmbclient
 275  * don't send this "standard" writeX header. I've fixed this
 276  * for 3.2 but we'll use the old method with earlier versions.
 277  * Windows and CIFSFS at least use this standard size. Not
 278  * sure about MacOSX.
 279  */
 280
 281 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 282                                 (2*14) + /* word count (including bcc) */ \
 283                                 1 /* pad byte */)
 284
 285 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 286                                                     const char lenbuf[4],
 287                                                     struct smbd_server_connection *sconn,
 288                                                     int sock,
 289                                                     char **buffer,
 290                                                     unsigned int timeout,
 291                                                     size_t *p_unread,
 292                                                     size_t *len_ret)
 293 {
 294         /* Size of a WRITEX call (+4 byte len). */
 295         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 296         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 297         ssize_t toread;
 298         NTSTATUS status;
 299
 300         memcpy(writeX_header, lenbuf, 4);
 301
 302         status = read_fd_with_timeout(
 303                 sock, writeX_header + 4,
 304                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 305                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 306                 timeout, NULL);
 307
 308         if (!NT_STATUS_IS_OK(status)) {
 309                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 310                           "error = %s.\n",
 311                           tsocket_address_string(sconn->remote_address,
 312                                                  talloc_tos()),
 313                           nt_errstr(status)));
 314                 return status;
 315         }
 316
 317         /*
 318          * Ok - now try and see if this is a possible
 319          * valid writeX call.
 320          */
 321
 322         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 323                 /*
 324                  * If the data offset is beyond what
 325                  * we've read, drain the extra bytes.
 326                  */
 327                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 328                 ssize_t newlen;
 329
 330                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 331                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 332                         if (drain_socket(sock, drain) != drain) {
 333                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 334                                         " failed to drain pending bytes");
 335                         }
 336                 } else {
 337                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 338                 }
 339
 340                 /* Spoof down the length and null out the bcc. */
 341                 set_message_bcc(writeX_header, 0);
 342                 newlen = smb_len(writeX_header);
 343
 344                 /* Copy the header we've written. */
 345
 346                 *buffer = (char *)talloc_memdup(mem_ctx,
 347                                 writeX_header,
 348                                 sizeof(writeX_header));
 349
 350                 if (*buffer == NULL) {
 351                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 352                                   (int)sizeof(writeX_header)));
 353                         return NT_STATUS_NO_MEMORY;
 354                 }
 355
 356                 /* Work out the remaining bytes. */
 357                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 358                 *len_ret = newlen + 4;
 359                 return NT_STATUS_OK;
 360         }
 361
 362         if (!valid_packet_size(len)) {
 363                 return NT_STATUS_INVALID_PARAMETER;
 364         }
 365
 366         /*
 367          * Not a valid writeX call. Just do the standard
 368          * talloc and return.
 369          */
 370
 371         *buffer = talloc_array(mem_ctx, char, len+4);
 372
 373         if (*buffer == NULL) {
 374                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 375                           (int)len+4));
 376                 return NT_STATUS_NO_MEMORY;
 377         }
 378
 379         /* Copy in what we already read. */
 380         memcpy(*buffer,
 381                 writeX_header,
 382                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 383         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 384
 385         if(toread > 0) {
 386                 status = read_packet_remainder(
 387                         sock,
 388                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 389                         timeout, toread);
 390
 391                 if (!NT_STATUS_IS_OK(status)) {
 392                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 393                                    nt_errstr(status)));
 394                         return status;
 395                 }
 396         }
 397
 398         *len_ret = len + 4;
 399         return NT_STATUS_OK;
 400 }
 401
 402 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 403                                        struct smbd_server_connection *sconn,
 404                                        int sock,
 405                                        char **buffer, unsigned int timeout,
 406                                        size_t *p_unread, size_t *plen)
 407 {
 408         char lenbuf[4];
 409         size_t len;
 410         int min_recv_size = lp_min_receive_file_size();
 411         NTSTATUS status;
 412
 413         *p_unread = 0;
 414
 415         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 416                                                   &len);
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 return status;
 419         }
 420
 421         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 422             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 423                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 424             !srv_is_signing_active(sconn) &&
 425             sconn->smb1.echo_handler.trusted_fde == NULL) {
 426
 427                 return receive_smb_raw_talloc_partial_read(
 428                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 429                         p_unread, plen);
 430         }
 431
 432         if (!valid_packet_size(len)) {
 433                 return NT_STATUS_INVALID_PARAMETER;
 434         }
 435
 436         /*
 437          * The +4 here can't wrap, we've checked the length above already.
 438          */
 439
 440         *buffer = talloc_array(mem_ctx, char, len+4);
 441
 442         if (*buffer == NULL) {
 443                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 444                           (int)len+4));
 445                 return NT_STATUS_NO_MEMORY;
 446         }
 447
 448         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 449
 450         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 return status;
 453         }
 454
 455         *plen = len + 4;
 456         return NT_STATUS_OK;
 457 }
 458
 459 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 460                                    struct smbd_server_connection *sconn,
 461                                    int sock,
 462                                    char **buffer, unsigned int timeout,
 463                                    size_t *p_unread, bool *p_encrypted,
 464                                    size_t *p_len,
 465                                    uint32_t *seqnum,
 466                                    bool trusted_channel)
 467 {
 468         size_t len = 0;
 469         NTSTATUS status;
 470
 471         *p_encrypted = false;
 472
 473         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 474                                         p_unread, &len);
 475         if (!NT_STATUS_IS_OK(status)) {
 476                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 477                       ("receive_smb_raw_talloc failed for client %s "
 478                        "read error = %s.\n",
 479                        tsocket_address_string(sconn->remote_address,
 480                                               talloc_tos()),
 481                        nt_errstr(status)) );
 482                 return status;
 483         }
 484
 485         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 486                 status = srv_decrypt_buffer(sconn, *buffer);
 487                 if (!NT_STATUS_IS_OK(status)) {
 488                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 489                                 "incoming packet! Error %s\n",
 490                                 nt_errstr(status) ));
 491                         return status;
 492                 }
 493                 *p_encrypted = true;
 494         }
 495
 496         /* Check the incoming SMB signature. */
 497         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 498                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 499                           "incoming packet!\n"));
 500                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 501         }
 502
 503         *p_len = len;
 504         return NT_STATUS_OK;
 505 }
 506
 507 /*
 508  * Initialize a struct smb_request from an inbuf
 509  */
 510
 511 static bool init_smb_request(struct smb_request *req,
 512                              struct smbd_server_connection *sconn,
 513                              const uint8 *inbuf,
 514                              size_t unread_bytes, bool encrypted,
 515                              uint32_t seqnum)
 516 {
 517         size_t req_size = smb_len(inbuf) + 4;
 518         /* Ensure we have at least smb_size bytes. */
 519         if (req_size < smb_size) {
 520                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 521                         (unsigned int)req_size ));
 522                 return false;
 523         }
 524         req->cmd    = CVAL(inbuf, smb_com);
 525         req->flags2 = SVAL(inbuf, smb_flg2);
 526         req->smbpid = SVAL(inbuf, smb_pid);
 527         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 528         req->seqnum = seqnum;
 529         req->vuid   = SVAL(inbuf, smb_uid);
 530         req->tid    = SVAL(inbuf, smb_tid);
 531         req->wct    = CVAL(inbuf, smb_wct);
 532         req->vwv    = discard_const_p(uint16_t, (inbuf+smb_vwv));
 533         req->buflen = smb_buflen(inbuf);
 534         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 535         req->unread_bytes = unread_bytes;
 536         req->encrypted = encrypted;
 537         req->sconn = sconn;
 538         req->conn = conn_find(sconn,req->tid);
 539         req->chain_fsp = NULL;
 540         req->chain_outbuf = NULL;
 541         req->done = false;
 542         req->smb2req = NULL;
 543         smb_init_perfcount_data(&req->pcd);
 544
 545         /* Ensure we have at least wct words and 2 bytes of bcc. */
 546         if (smb_size + req->wct*2 > req_size) {
 547                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 548                         (unsigned int)req->wct,
 549                         (unsigned int)req_size));
 550                 return false;
 551         }
 552         /* Ensure bcc is correct. */
 553         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 554                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 555                         "(wct = %u, size %u)\n",
 556                         (unsigned int)req->buflen,
 557                         (unsigned int)req->wct,
 558                         (unsigned int)req_size));
 559                 return false;
 560         }
 561
 562         req->outbuf = NULL;
 563         return true;
 564 }
 565
 566 static void process_smb(struct smbd_server_connection *conn,
 567                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 568                         uint32_t seqnum, bool encrypted,
 569                         struct smb_perfcount_data *deferred_pcd);
 570
 571 static void smbd_deferred_open_timer(struct event_context *ev,
 572                                      struct timed_event *te,
 573                                      struct timeval _tval,
 574                                      void *private_data)
 575 {
 576         struct pending_message_list *msg = talloc_get_type(private_data,
 577                                            struct pending_message_list);
 578         struct smbd_server_connection *sconn = msg->sconn;
 579         TALLOC_CTX *mem_ctx = talloc_tos();
 580         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 581         uint8_t *inbuf;
 582
 583         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 584                                          msg->buf.length);
 585         if (inbuf == NULL) {
 586                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 587                 return;
 588         }
 589
 590         /* We leave this message on the queue so the open code can
 591            know this is a retry. */
 592         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 593                 (unsigned long long)mid ));
 594
 595         /* Mark the message as processed so this is not
 596          * re-processed in error. */
 597         msg->processed = true;
 598
 599         process_smb(sconn, inbuf,
 600                     msg->buf.length, 0,
 601                     msg->seqnum, msg->encrypted, &msg->pcd);
 602
 603         /* If it's still there and was processed, remove it. */
 604         msg = get_deferred_open_message_smb(sconn, mid);
 605         if (msg && msg->processed) {
 606                 remove_deferred_open_message_smb(sconn, mid);
 607         }
 608 }
 609
 610 /****************************************************************************
 611  Function to push a message onto the tail of a linked list of smb messages ready
 612  for processing.
 613 ****************************************************************************/
 614
 615 static bool push_queued_message(struct smb_request *req,
 616                                 struct timeval request_time,
 617                                 struct timeval end_time,
 618                                 char *private_data, size_t private_len)
 619 {
 620         int msg_len = smb_len(req->inbuf) + 4;
 621         struct pending_message_list *msg;
 622
 623         msg = talloc_zero(NULL, struct pending_message_list);
 624
 625         if(msg == NULL) {
 626                 DEBUG(0,("push_message: malloc fail (1)\n"));
 627                 return False;
 628         }
 629         msg->sconn = req->sconn;
 630
 631         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 632         if(msg->buf.data == NULL) {
 633                 DEBUG(0,("push_message: malloc fail (2)\n"));
 634                 TALLOC_FREE(msg);
 635                 return False;
 636         }
 637
 638         msg->request_time = request_time;
 639         msg->seqnum = req->seqnum;
 640         msg->encrypted = req->encrypted;
 641         msg->processed = false;
 642         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 643
 644         if (private_data) {
 645                 msg->private_data = data_blob_talloc(msg, private_data,
 646                                                      private_len);
 647                 if (msg->private_data.data == NULL) {
 648                         DEBUG(0,("push_message: malloc fail (3)\n"));
 649                         TALLOC_FREE(msg);
 650                         return False;
 651                 }
 652         }
 653
 654         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 655                                    msg,
 656                                    end_time,
 657                                    smbd_deferred_open_timer,
 658                                    msg);
 659         if (!msg->te) {
 660                 DEBUG(0,("push_message: event_add_timed failed\n"));
 661                 TALLOC_FREE(msg);
 662                 return false;
 663         }
 664
 665         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 666                       struct pending_message_list *);
 667
 668         DEBUG(10,("push_message: pushed message length %u on "
 669                   "deferred_open_queue\n", (unsigned int)msg_len));
 670
 671         return True;
 672 }
 673
 674 /****************************************************************************
 675  Function to delete a sharing violation open message by mid.
 676 ****************************************************************************/
 677
 678 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 679                                       uint64_t mid)
 680 {
 681         struct pending_message_list *pml;
 682
 683         if (sconn->using_smb2) {
 684                 remove_deferred_open_message_smb2(sconn, mid);
 685                 return;
 686         }
 687
 688         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 689                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 690                         DEBUG(10,("remove_deferred_open_message_smb: "
 691                                   "deleting mid %llu len %u\n",
 692                                   (unsigned long long)mid,
 693                                   (unsigned int)pml->buf.length ));
 694                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 695                         TALLOC_FREE(pml);
 696                         return;
 697                 }
 698         }
 699 }
 700
 701 /****************************************************************************
 702  Move a sharing violation open retry message to the front of the list and
 703  schedule it for immediate processing.
 704 ****************************************************************************/
 705
 706 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 707                                         uint64_t mid)
 708 {
 709         struct pending_message_list *pml;
 710         int i = 0;
 711
 712         if (sconn->using_smb2) {
 713                 schedule_deferred_open_message_smb2(sconn, mid);
 714                 return;
 715         }
 716
 717         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 718                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 719
 720                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 721                         "msg_mid = %llu\n",
 722                         i++,
 723                         (unsigned long long)msg_mid ));
 724
 725                 if (mid == msg_mid) {
 726                         struct timed_event *te;
 727
 728                         if (pml->processed) {
 729                                 /* A processed message should not be
 730                                  * rescheduled. */
 731                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 732                                         "message mid %llu was already processed\n",
 733                                         (unsigned long long)msg_mid ));
 734                                 continue;
 735                         }
 736
 737                         DEBUG(10,("schedule_deferred_open_message_smb: "
 738                                 "scheduling mid %llu\n",
 739                                 (unsigned long long)mid ));
 740
 741                         te = tevent_add_timer(pml->sconn->ev_ctx,
 742                                               pml,
 743                                               timeval_zero(),
 744                                               smbd_deferred_open_timer,
 745                                               pml);
 746                         if (!te) {
 747                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 748                                         "event_add_timed() failed, "
 749                                         "skipping mid %llu\n",
 750                                         (unsigned long long)msg_mid ));
 751                         }
 752
 753                         TALLOC_FREE(pml->te);
 754                         pml->te = te;
 755                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 756                         return;
 757                 }
 758         }
 759
 760         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 761                 "find message mid %llu\n",
 762                 (unsigned long long)mid ));
 763 }
 764
 765 /****************************************************************************
 766  Return true if this mid is on the deferred queue and was not yet processed.
 767 ****************************************************************************/
 768
 769 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 770 {
 771         struct pending_message_list *pml;
 772
 773         if (sconn->using_smb2) {
 774                 return open_was_deferred_smb2(sconn, mid);
 775         }
 776
 777         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 778                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 779                         return True;
 780                 }
 781         }
 782         return False;
 783 }
 784
 785 /****************************************************************************
 786  Return the message queued by this mid.
 787 ****************************************************************************/
 788
 789 static struct pending_message_list *get_deferred_open_message_smb(
 790         struct smbd_server_connection *sconn, uint64_t mid)
 791 {
 792         struct pending_message_list *pml;
 793
 794         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 795                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 796                         return pml;
 797                 }
 798         }
 799         return NULL;
 800 }
 801
 802 /****************************************************************************
 803  Get the state data queued by this mid.
 804 ****************************************************************************/
 805
 806 bool get_deferred_open_message_state(struct smb_request *smbreq,
 807                                 struct timeval *p_request_time,
 808                                 void **pp_state)
 809 {
 810         struct pending_message_list *pml;
 811
 812         if (smbreq->sconn->using_smb2) {
 813                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 814                                         p_request_time,
 815                                         pp_state);
 816         }
 817
 818         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 819         if (!pml) {
 820                 return false;
 821         }
 822         if (p_request_time) {
 823                 *p_request_time = pml->request_time;
 824         }
 825         if (pp_state) {
 826                 *pp_state = (void *)pml->private_data.data;
 827         }
 828         return true;
 829 }
 830
 831 /****************************************************************************
 832  Function to push a deferred open smb message onto a linked list of local smb
 833  messages ready for processing.
 834 ****************************************************************************/
 835
 836 bool push_deferred_open_message_smb(struct smb_request *req,
 837                                struct timeval request_time,
 838                                struct timeval timeout,
 839                                struct file_id id,
 840                                char *private_data, size_t priv_len)
 841 {
 842         struct timeval end_time;
 843
 844         if (req->smb2req) {
 845                 return push_deferred_open_message_smb2(req->smb2req,
 846                                                 request_time,
 847                                                 timeout,
 848                                                 id,
 849                                                 private_data,
 850                                                 priv_len);
 851         }
 852
 853         if (req->unread_bytes) {
 854                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 855                         "unread_bytes = %u\n",
 856                         (unsigned int)req->unread_bytes ));
 857                 smb_panic("push_deferred_open_message_smb: "
 858                         "logic error unread_bytes != 0" );
 859         }
 860
 861         end_time = timeval_sum(&request_time, &timeout);
 862
 863         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 864                 "len %u mid %llu timeout time [%u.%06u]\n",
 865                 (unsigned int) smb_len(req->inbuf)+4,
 866                 (unsigned long long)req->mid,
 867                 (unsigned int)end_time.tv_sec,
 868                 (unsigned int)end_time.tv_usec));
 869
 870         return push_queued_message(req, request_time, end_time,
 871                                    private_data, priv_len);
 872 }
 873
 874 static void smbd_sig_term_handler(struct tevent_context *ev,
 875                                   struct tevent_signal *se,
 876                                   int signum,
 877                                   int count,
 878                                   void *siginfo,
 879                                   void *private_data)
 880 {
 881         exit_server_cleanly("termination signal");
 882 }
 883
 884 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 885 {
 886         struct tevent_signal *se;
 887
 888         se = tevent_add_signal(sconn->ev_ctx,
 889                                sconn,
 890                                SIGTERM, 0,
 891                                smbd_sig_term_handler,
 892                                sconn);
 893         if (!se) {
 894                 exit_server("failed to setup SIGTERM handler");
 895         }
 896 }
 897
 898 static void smbd_sig_hup_handler(struct tevent_context *ev,
 899                                   struct tevent_signal *se,
 900                                   int signum,
 901                                   int count,
 902                                   void *siginfo,
 903                                   void *private_data)
 904 {
 905         struct smbd_server_connection *sconn =
 906                 talloc_get_type_abort(private_data,
 907                 struct smbd_server_connection);
 908
 909         change_to_root_user();
 910         DEBUG(1,("Reloading services after SIGHUP\n"));
 911         reload_services(sconn, conn_snum_used, false);
 912 }
 913
 914 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
 915 {
 916         struct tevent_signal *se;
 917
 918         se = tevent_add_signal(sconn->ev_ctx,
 919                                sconn,
 920                                SIGHUP, 0,
 921                                smbd_sig_hup_handler,
 922                                sconn);
 923         if (!se) {
 924                 exit_server("failed to setup SIGHUP handler");
 925         }
 926 }
 927
 928 static void smbd_conf_updated(struct messaging_context *msg,
 929                               void *private_data,
 930                               uint32_t msg_type,
 931                               struct server_id server_id,
 932                               DATA_BLOB *data)
 933 {
 934         struct smbd_server_connection *sconn =
 935                 talloc_get_type_abort(private_data,
 936                 struct smbd_server_connection);
 937
 938         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
 939                   "updated. Reloading.\n"));
 940         change_to_root_user();
 941         reload_services(sconn, conn_snum_used, false);
 942 }
 943
 944 /*
 945  * Only allow 5 outstanding trans requests. We're allocating memory, so
 946  * prevent a DoS.
 947  */
 948
 949 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 950 {
 951         int count = 0;
 952         for (; list != NULL; list = list->next) {
 953
 954                 if (list->mid == mid) {
 955                         return NT_STATUS_INVALID_PARAMETER;
 956                 }
 957
 958                 count += 1;
 959         }
 960         if (count > 5) {
 961                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 962         }
 963
 964         return NT_STATUS_OK;
 965 }
 966
 967 /*
 968 These flags determine some of the permissions required to do an operation
 969
 970 Note that I don't set NEED_WRITE on some write operations because they
 971 are used by some brain-dead clients when printing, and I don't want to
 972 force write permissions on print services.
 973 */
 974 #define AS_USER (1<<0)
 975 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 976 #define TIME_INIT (1<<2)
 977 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 978 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 979 #define DO_CHDIR (1<<6)
 980
 981 /*
 982    define a list of possible SMB messages and their corresponding
 983    functions. Any message that has a NULL function is unimplemented -
 984    please feel free to contribute implementations!
 985 */
 986 static const struct smb_message_struct {
 987         const char *name;
 988         void (*fn)(struct smb_request *req);
 989         int flags;
 990 } smb_messages[256] = {
 991
 992 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 993 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 994 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 995 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 996 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 997 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 998 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 999 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1000 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1001 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1002 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1003 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1004 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1005 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1006 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1007 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1008 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1009 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1010 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1011 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1012 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1013 /* 0x15 */ { NULL, NULL, 0 },
1014 /* 0x16 */ { NULL, NULL, 0 },
1015 /* 0x17 */ { NULL, NULL, 0 },
1016 /* 0x18 */ { NULL, NULL, 0 },
1017 /* 0x19 */ { NULL, NULL, 0 },
1018 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1019 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1020 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1021 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1022 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1023 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1024 /* 0x20 */ { "SMBwritec", NULL,0},
1025 /* 0x21 */ { NULL, NULL, 0 },
1026 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1027 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1028 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1029 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1030 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1031 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1032 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1033 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1034 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1035 /* 0x2b */ { "SMBecho",reply_echo,0},
1036 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1037 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1038 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1039 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1040 /* 0x30 */ { NULL, NULL, 0 },
1041 /* 0x31 */ { NULL, NULL, 0 },
1042 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1043 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1044 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1045 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1046 /* 0x36 */ { NULL, NULL, 0 },
1047 /* 0x37 */ { NULL, NULL, 0 },
1048 /* 0x38 */ { NULL, NULL, 0 },
1049 /* 0x39 */ { NULL, NULL, 0 },
1050 /* 0x3a */ { NULL, NULL, 0 },
1051 /* 0x3b */ { NULL, NULL, 0 },
1052 /* 0x3c */ { NULL, NULL, 0 },
1053 /* 0x3d */ { NULL, NULL, 0 },
1054 /* 0x3e */ { NULL, NULL, 0 },
1055 /* 0x3f */ { NULL, NULL, 0 },
1056 /* 0x40 */ { NULL, NULL, 0 },
1057 /* 0x41 */ { NULL, NULL, 0 },
1058 /* 0x42 */ { NULL, NULL, 0 },
1059 /* 0x43 */ { NULL, NULL, 0 },
1060 /* 0x44 */ { NULL, NULL, 0 },
1061 /* 0x45 */ { NULL, NULL, 0 },
1062 /* 0x46 */ { NULL, NULL, 0 },
1063 /* 0x47 */ { NULL, NULL, 0 },
1064 /* 0x48 */ { NULL, NULL, 0 },
1065 /* 0x49 */ { NULL, NULL, 0 },
1066 /* 0x4a */ { NULL, NULL, 0 },
1067 /* 0x4b */ { NULL, NULL, 0 },
1068 /* 0x4c */ { NULL, NULL, 0 },
1069 /* 0x4d */ { NULL, NULL, 0 },
1070 /* 0x4e */ { NULL, NULL, 0 },
1071 /* 0x4f */ { NULL, NULL, 0 },
1072 /* 0x50 */ { NULL, NULL, 0 },
1073 /* 0x51 */ { NULL, NULL, 0 },
1074 /* 0x52 */ { NULL, NULL, 0 },
1075 /* 0x53 */ { NULL, NULL, 0 },
1076 /* 0x54 */ { NULL, NULL, 0 },
1077 /* 0x55 */ { NULL, NULL, 0 },
1078 /* 0x56 */ { NULL, NULL, 0 },
1079 /* 0x57 */ { NULL, NULL, 0 },
1080 /* 0x58 */ { NULL, NULL, 0 },
1081 /* 0x59 */ { NULL, NULL, 0 },
1082 /* 0x5a */ { NULL, NULL, 0 },
1083 /* 0x5b */ { NULL, NULL, 0 },
1084 /* 0x5c */ { NULL, NULL, 0 },
1085 /* 0x5d */ { NULL, NULL, 0 },
1086 /* 0x5e */ { NULL, NULL, 0 },
1087 /* 0x5f */ { NULL, NULL, 0 },
1088 /* 0x60 */ { NULL, NULL, 0 },
1089 /* 0x61 */ { NULL, NULL, 0 },
1090 /* 0x62 */ { NULL, NULL, 0 },
1091 /* 0x63 */ { NULL, NULL, 0 },
1092 /* 0x64 */ { NULL, NULL, 0 },
1093 /* 0x65 */ { NULL, NULL, 0 },
1094 /* 0x66 */ { NULL, NULL, 0 },
1095 /* 0x67 */ { NULL, NULL, 0 },
1096 /* 0x68 */ { NULL, NULL, 0 },
1097 /* 0x69 */ { NULL, NULL, 0 },
1098 /* 0x6a */ { NULL, NULL, 0 },
1099 /* 0x6b */ { NULL, NULL, 0 },
1100 /* 0x6c */ { NULL, NULL, 0 },
1101 /* 0x6d */ { NULL, NULL, 0 },
1102 /* 0x6e */ { NULL, NULL, 0 },
1103 /* 0x6f */ { NULL, NULL, 0 },
1104 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1105 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1106 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1107 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1108 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1109 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1110 /* 0x76 */ { NULL, NULL, 0 },
1111 /* 0x77 */ { NULL, NULL, 0 },
1112 /* 0x78 */ { NULL, NULL, 0 },
1113 /* 0x79 */ { NULL, NULL, 0 },
1114 /* 0x7a */ { NULL, NULL, 0 },
1115 /* 0x7b */ { NULL, NULL, 0 },
1116 /* 0x7c */ { NULL, NULL, 0 },
1117 /* 0x7d */ { NULL, NULL, 0 },
1118 /* 0x7e */ { NULL, NULL, 0 },
1119 /* 0x7f */ { NULL, NULL, 0 },
1120 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1121 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1122 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1123 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1124 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1125 /* 0x85 */ { NULL, NULL, 0 },
1126 /* 0x86 */ { NULL, NULL, 0 },
1127 /* 0x87 */ { NULL, NULL, 0 },
1128 /* 0x88 */ { NULL, NULL, 0 },
1129 /* 0x89 */ { NULL, NULL, 0 },
1130 /* 0x8a */ { NULL, NULL, 0 },
1131 /* 0x8b */ { NULL, NULL, 0 },
1132 /* 0x8c */ { NULL, NULL, 0 },
1133 /* 0x8d */ { NULL, NULL, 0 },
1134 /* 0x8e */ { NULL, NULL, 0 },
1135 /* 0x8f */ { NULL, NULL, 0 },
1136 /* 0x90 */ { NULL, NULL, 0 },
1137 /* 0x91 */ { NULL, NULL, 0 },
1138 /* 0x92 */ { NULL, NULL, 0 },
1139 /* 0x93 */ { NULL, NULL, 0 },
1140 /* 0x94 */ { NULL, NULL, 0 },
1141 /* 0x95 */ { NULL, NULL, 0 },
1142 /* 0x96 */ { NULL, NULL, 0 },
1143 /* 0x97 */ { NULL, NULL, 0 },
1144 /* 0x98 */ { NULL, NULL, 0 },
1145 /* 0x99 */ { NULL, NULL, 0 },
1146 /* 0x9a */ { NULL, NULL, 0 },
1147 /* 0x9b */ { NULL, NULL, 0 },
1148 /* 0x9c */ { NULL, NULL, 0 },
1149 /* 0x9d */ { NULL, NULL, 0 },
1150 /* 0x9e */ { NULL, NULL, 0 },
1151 /* 0x9f */ { NULL, NULL, 0 },
1152 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1153 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1154 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1155 /* 0xa3 */ { NULL, NULL, 0 },
1156 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1157 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1158 /* 0xa6 */ { NULL, NULL, 0 },
1159 /* 0xa7 */ { NULL, NULL, 0 },
1160 /* 0xa8 */ { NULL, NULL, 0 },
1161 /* 0xa9 */ { NULL, NULL, 0 },
1162 /* 0xaa */ { NULL, NULL, 0 },
1163 /* 0xab */ { NULL, NULL, 0 },
1164 /* 0xac */ { NULL, NULL, 0 },
1165 /* 0xad */ { NULL, NULL, 0 },
1166 /* 0xae */ { NULL, NULL, 0 },
1167 /* 0xaf */ { NULL, NULL, 0 },
1168 /* 0xb0 */ { NULL, NULL, 0 },
1169 /* 0xb1 */ { NULL, NULL, 0 },
1170 /* 0xb2 */ { NULL, NULL, 0 },
1171 /* 0xb3 */ { NULL, NULL, 0 },
1172 /* 0xb4 */ { NULL, NULL, 0 },
1173 /* 0xb5 */ { NULL, NULL, 0 },
1174 /* 0xb6 */ { NULL, NULL, 0 },
1175 /* 0xb7 */ { NULL, NULL, 0 },
1176 /* 0xb8 */ { NULL, NULL, 0 },
1177 /* 0xb9 */ { NULL, NULL, 0 },
1178 /* 0xba */ { NULL, NULL, 0 },
1179 /* 0xbb */ { NULL, NULL, 0 },
1180 /* 0xbc */ { NULL, NULL, 0 },
1181 /* 0xbd */ { NULL, NULL, 0 },
1182 /* 0xbe */ { NULL, NULL, 0 },
1183 /* 0xbf */ { NULL, NULL, 0 },
1184 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1185 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1186 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1187 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1188 /* 0xc4 */ { NULL, NULL, 0 },
1189 /* 0xc5 */ { NULL, NULL, 0 },
1190 /* 0xc6 */ { NULL, NULL, 0 },
1191 /* 0xc7 */ { NULL, NULL, 0 },
1192 /* 0xc8 */ { NULL, NULL, 0 },
1193 /* 0xc9 */ { NULL, NULL, 0 },
1194 /* 0xca */ { NULL, NULL, 0 },
1195 /* 0xcb */ { NULL, NULL, 0 },
1196 /* 0xcc */ { NULL, NULL, 0 },
1197 /* 0xcd */ { NULL, NULL, 0 },
1198 /* 0xce */ { NULL, NULL, 0 },
1199 /* 0xcf */ { NULL, NULL, 0 },
1200 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1201 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1202 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1203 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1204 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1205 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1206 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1207 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1208 /* 0xd8 */ { NULL, NULL, 0 },
1209 /* 0xd9 */ { NULL, NULL, 0 },
1210 /* 0xda */ { NULL, NULL, 0 },
1211 /* 0xdb */ { NULL, NULL, 0 },
1212 /* 0xdc */ { NULL, NULL, 0 },
1213 /* 0xdd */ { NULL, NULL, 0 },
1214 /* 0xde */ { NULL, NULL, 0 },
1215 /* 0xdf */ { NULL, NULL, 0 },
1216 /* 0xe0 */ { NULL, NULL, 0 },
1217 /* 0xe1 */ { NULL, NULL, 0 },
1218 /* 0xe2 */ { NULL, NULL, 0 },
1219 /* 0xe3 */ { NULL, NULL, 0 },
1220 /* 0xe4 */ { NULL, NULL, 0 },
1221 /* 0xe5 */ { NULL, NULL, 0 },
1222 /* 0xe6 */ { NULL, NULL, 0 },
1223 /* 0xe7 */ { NULL, NULL, 0 },
1224 /* 0xe8 */ { NULL, NULL, 0 },
1225 /* 0xe9 */ { NULL, NULL, 0 },
1226 /* 0xea */ { NULL, NULL, 0 },
1227 /* 0xeb */ { NULL, NULL, 0 },
1228 /* 0xec */ { NULL, NULL, 0 },
1229 /* 0xed */ { NULL, NULL, 0 },
1230 /* 0xee */ { NULL, NULL, 0 },
1231 /* 0xef */ { NULL, NULL, 0 },
1232 /* 0xf0 */ { NULL, NULL, 0 },
1233 /* 0xf1 */ { NULL, NULL, 0 },
1234 /* 0xf2 */ { NULL, NULL, 0 },
1235 /* 0xf3 */ { NULL, NULL, 0 },
1236 /* 0xf4 */ { NULL, NULL, 0 },
1237 /* 0xf5 */ { NULL, NULL, 0 },
1238 /* 0xf6 */ { NULL, NULL, 0 },
1239 /* 0xf7 */ { NULL, NULL, 0 },
1240 /* 0xf8 */ { NULL, NULL, 0 },
1241 /* 0xf9 */ { NULL, NULL, 0 },
1242 /* 0xfa */ { NULL, NULL, 0 },
1243 /* 0xfb */ { NULL, NULL, 0 },
1244 /* 0xfc */ { NULL, NULL, 0 },
1245 /* 0xfd */ { NULL, NULL, 0 },
1246 /* 0xfe */ { NULL, NULL, 0 },
1247 /* 0xff */ { NULL, NULL, 0 }
1248
1249 };
1250
1251 /*******************************************************************
1252  allocate and initialize a reply packet
1253 ********************************************************************/
1254
1255 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1256                           const char *inbuf, char **outbuf, uint8_t num_words,
1257                           uint32_t num_bytes)
1258 {
1259         /*
1260          * Protect against integer wrap
1261          */
1262         if ((num_bytes > 0xffffff)
1263             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1264                 char *msg;
1265                 if (asprintf(&msg, "num_bytes too large: %u",
1266                              (unsigned)num_bytes) == -1) {
1267                         msg = discard_const_p(char, "num_bytes too large");
1268                 }
1269                 smb_panic(msg);
1270         }
1271
1272         *outbuf = talloc_array(mem_ctx, char,
1273                                smb_size + num_words*2 + num_bytes);
1274         if (*outbuf == NULL) {
1275                 return false;
1276         }
1277
1278         construct_reply_common(req, inbuf, *outbuf);
1279         srv_set_message(*outbuf, num_words, num_bytes, false);
1280         /*
1281          * Zero out the word area, the caller has to take care of the bcc area
1282          * himself
1283          */
1284         if (num_words != 0) {
1285                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1286         }
1287
1288         return true;
1289 }
1290
1291 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1292 {
1293         char *outbuf;
1294         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1295                            num_bytes)) {
1296                 smb_panic("could not allocate output buffer\n");
1297         }
1298         req->outbuf = (uint8_t *)outbuf;
1299 }
1300
1301
1302 /*******************************************************************
1303  Dump a packet to a file.
1304 ********************************************************************/
1305
1306 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1307 {
1308         int fd, i;
1309         char *fname = NULL;
1310         if (DEBUGLEVEL < 50) {
1311                 return;
1312         }
1313
1314         if (len < 4) len = smb_len(data)+4;
1315         for (i=1;i<100;i++) {
1316                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1317                              type ? "req" : "resp") == -1) {
1318                         return;
1319                 }
1320                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1321                 if (fd != -1 || errno != EEXIST) break;
1322         }
1323         if (fd != -1) {
1324                 ssize_t ret = write(fd, data, len);
1325                 if (ret != len)
1326                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1327                 close(fd);
1328                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1329         }
1330         SAFE_FREE(fname);
1331 }
1332
1333 /****************************************************************************
1334  Prepare everything for calling the actual request function, and potentially
1335  call the request function via the "new" interface.
1336
1337  Return False if the "legacy" function needs to be called, everything is
1338  prepared.
1339
1340  Return True if we're done.
1341
1342  I know this API sucks, but it is the one with the least code change I could
1343  find.
1344 ****************************************************************************/
1345
1346 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1347 {
1348         int flags;
1349         uint16 session_tag;
1350         connection_struct *conn = NULL;
1351         struct smbd_server_connection *sconn = req->sconn;
1352         char *raddr;
1353
1354         errno = 0;
1355
1356         if (smb_messages[type].fn == NULL) {
1357                 DEBUG(0,("Unknown message type %d!\n",type));
1358                 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1359                 reply_unknown_new(req, type);
1360                 return NULL;
1361         }
1362
1363         flags = smb_messages[type].flags;
1364
1365         /* In share mode security we must ignore the vuid. */
1366         session_tag = (lp_security() == SEC_SHARE)
1367                 ? UID_FIELD_INVALID : req->vuid;
1368         conn = req->conn;
1369
1370         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1371                  (int)sys_getpid(), (unsigned long)conn));
1372
1373         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1374
1375         /* Ensure this value is replaced in the incoming packet. */
1376         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1377
1378         /*
1379          * Ensure the correct username is in current_user_info.  This is a
1380          * really ugly bugfix for problems with multiple session_setup_and_X's
1381          * being done and allowing %U and %G substitutions to work correctly.
1382          * There is a reason this code is done here, don't move it unless you
1383          * know what you're doing... :-).
1384          * JRA.
1385          */
1386
1387         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1388                 user_struct *vuser = NULL;
1389
1390                 sconn->smb1.sessions.last_session_tag = session_tag;
1391                 if(session_tag != UID_FIELD_INVALID) {
1392                         vuser = get_valid_user_struct(sconn, session_tag);
1393                         if (vuser) {
1394                                 set_current_user_info(
1395                                         vuser->session_info->unix_info->sanitized_username,
1396                                         vuser->session_info->unix_info->unix_name,
1397                                         vuser->session_info->info->domain_name);
1398                         }
1399                 }
1400         }
1401
1402         /* Does this call need to be run as the connected user? */
1403         if (flags & AS_USER) {
1404
1405                 /* Does this call need a valid tree connection? */
1406                 if (!conn) {
1407                         /*
1408                          * Amazingly, the error code depends on the command
1409                          * (from Samba4).
1410                          */
1411                         if (type == SMBntcreateX) {
1412                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1413                         } else {
1414                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1415                         }
1416                         return NULL;
1417                 }
1418
1419                 if (!change_to_user(conn,session_tag)) {
1420                         DEBUG(0, ("Error: Could not change to user. Removing "
1421                                 "deferred open, mid=%llu.\n",
1422                                 (unsigned long long)req->mid));
1423                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1424                         return conn;
1425                 }
1426
1427                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1428
1429                 /* Does it need write permission? */
1430                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1431                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1432                         return conn;
1433                 }
1434
1435                 /* IPC services are limited */
1436                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1437                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1438                         return conn;
1439                 }
1440         } else {
1441                 /* This call needs to be run as root */
1442                 change_to_root_user();
1443         }
1444
1445         /* load service specific parameters */
1446         if (conn) {
1447                 if (req->encrypted) {
1448                         conn->encrypted_tid = true;
1449                         /* encrypted required from now on. */
1450                         conn->encrypt_level = Required;
1451                 } else if (ENCRYPTION_REQUIRED(conn)) {
1452                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1453                                 exit_server_cleanly("encryption required "
1454                                         "on connection");
1455                                 return conn;
1456                         }
1457                 }
1458
1459                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1460                                          (flags & (AS_USER|DO_CHDIR)
1461                                           ?True:False))) {
1462                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1463                         return conn;
1464                 }
1465                 conn->num_smb_operations++;
1466         }
1467
1468         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1469                                                  talloc_tos());
1470         if (raddr == NULL) {
1471                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1472                 return conn;
1473         }
1474
1475         /* does this protocol need to be run as guest? */
1476         if ((flags & AS_GUEST)
1477             && (!change_to_guest() ||
1478                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1479                               sconn->remote_hostname,
1480                               raddr))) {
1481                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1482                 return conn;
1483         }
1484
1485         smb_messages[type].fn(req);
1486         return req->conn;
1487 }
1488
1489 /****************************************************************************
1490  Construct a reply to the incoming packet.
1491 ****************************************************************************/
1492
1493 static void construct_reply(struct smbd_server_connection *sconn,
1494                             char *inbuf, int size, size_t unread_bytes,
1495                             uint32_t seqnum, bool encrypted,
1496                             struct smb_perfcount_data *deferred_pcd)
1497 {
1498         connection_struct *conn;
1499         struct smb_request *req;
1500
1501         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1502                 smb_panic("could not allocate smb_request");
1503         }
1504
1505         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1506                               encrypted, seqnum)) {
1507                 exit_server_cleanly("Invalid SMB request");
1508         }
1509
1510         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1511
1512         /* we popped this message off the queue - keep original perf data */
1513         if (deferred_pcd)
1514                 req->pcd = *deferred_pcd;
1515         else {
1516                 SMB_PERFCOUNT_START(&req->pcd);
1517                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1518                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1519         }
1520
1521         conn = switch_message(req->cmd, req, size);
1522
1523         if (req->unread_bytes) {
1524                 /* writeX failed. drain socket. */
1525                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1526                                 req->unread_bytes) {
1527                         smb_panic("failed to drain pending bytes");
1528                 }
1529                 req->unread_bytes = 0;
1530         }
1531
1532         if (req->done) {
1533                 TALLOC_FREE(req);
1534                 return;
1535         }
1536
1537         if (req->outbuf == NULL) {
1538                 return;
1539         }
1540
1541         if (CVAL(req->outbuf,0) == 0) {
1542                 show_msg((char *)req->outbuf);
1543         }
1544
1545         if (!srv_send_smb(req->sconn,
1546                         (char *)req->outbuf,
1547                         true, req->seqnum+1,
1548                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1549                         &req->pcd)) {
1550                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1551         }
1552
1553         TALLOC_FREE(req);
1554
1555         return;
1556 }
1557
1558 /****************************************************************************
1559  Process an smb from the client
1560 ****************************************************************************/
1561 static void process_smb(struct smbd_server_connection *sconn,
1562                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1563                         uint32_t seqnum, bool encrypted,
1564                         struct smb_perfcount_data *deferred_pcd)
1565 {
1566         int msg_type = CVAL(inbuf,0);
1567
1568         DO_PROFILE_INC(smb_count);
1569
1570         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1571                     smb_len(inbuf) ) );
1572         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1573                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1574
1575         if (msg_type != NBSSmessage) {
1576                 /*
1577                  * NetBIOS session request, keepalive, etc.
1578                  */
1579                 reply_special(sconn, (char *)inbuf, nread);
1580                 goto done;
1581         }
1582
1583         if (sconn->using_smb2) {
1584                 /* At this point we're not really using smb2,
1585                  * we make the decision here.. */
1586                 if (smbd_is_smb2_header(inbuf, nread)) {
1587                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1588                         return;
1589                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1590                                 && CVAL(inbuf, smb_com) != 0x72) {
1591                         /* This is a non-negprot SMB1 packet.
1592                            Disable SMB2 from now on. */
1593                         sconn->using_smb2 = false;
1594                 }
1595         }
1596
1597         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1598          * so subtract 4 from it. */
1599         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1600                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1601                          smb_len(inbuf)));
1602
1603                 /* special magic for immediate exit */
1604                 if ((nread == 9) &&
1605                     (IVAL(inbuf, 4) == 0x74697865) &&
1606                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1607                         uint8_t exitcode = CVAL(inbuf, 8);
1608                         DEBUG(1, ("Exiting immediately with code %d\n",
1609                                   (int)exitcode));
1610                         exit(exitcode);
1611                 }
1612
1613                 exit_server_cleanly("Non-SMB packet");
1614         }
1615
1616         show_msg((char *)inbuf);
1617
1618         construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1619                         encrypted, deferred_pcd);
1620         sconn->trans_num++;
1621
1622 done:
1623         sconn->num_requests++;
1624
1625         /* The timeout_processing function isn't run nearly
1626            often enough to implement 'max log size' without
1627            overrunning the size of the file by many megabytes.
1628            This is especially true if we are running at debug
1629            level 10.  Checking every 50 SMBs is a nice
1630            tradeoff of performance vs log file size overrun. */
1631
1632         if ((sconn->num_requests % 50) == 0 &&
1633             need_to_check_log_size()) {
1634                 change_to_root_user();
1635                 check_log_size();
1636         }
1637 }
1638
1639 /****************************************************************************
1640  Return a string containing the function name of a SMB command.
1641 ****************************************************************************/
1642
1643 const char *smb_fn_name(int type)
1644 {
1645         const char *unknown_name = "SMBunknown";
1646
1647         if (smb_messages[type].name == NULL)
1648                 return(unknown_name);
1649
1650         return(smb_messages[type].name);
1651 }
1652
1653 /****************************************************************************
1654  Helper functions for contruct_reply.
1655 ****************************************************************************/
1656
1657 void add_to_common_flags2(uint32 v)
1658 {
1659         common_flags2 |= v;
1660 }
1661
1662 void remove_from_common_flags2(uint32 v)
1663 {
1664         common_flags2 &= ~v;
1665 }
1666
1667 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1668                                    char *outbuf)
1669 {
1670         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1671         uint16_t out_flags2 = common_flags2;
1672
1673         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1674         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1675         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1676
1677         srv_set_message(outbuf,0,0,false);
1678
1679         SCVAL(outbuf, smb_com, req->cmd);
1680         SIVAL(outbuf,smb_rcls,0);
1681         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1682         SSVAL(outbuf,smb_flg2, out_flags2);
1683         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1684         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1685
1686         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1687         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1688         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1689         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1690 }
1691
1692 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1693 {
1694         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1695 }
1696
1697 /*
1698  * How many bytes have we already accumulated up to the current wct field
1699  * offset?
1700  */
1701
1702 size_t req_wct_ofs(struct smb_request *req)
1703 {
1704         size_t buf_size;
1705
1706         if (req->chain_outbuf == NULL) {
1707                 return smb_wct - 4;
1708         }
1709         buf_size = talloc_get_size(req->chain_outbuf);
1710         if ((buf_size % 4) != 0) {
1711                 buf_size += (4 - (buf_size % 4));
1712         }
1713         return buf_size - 4;
1714 }
1715
1716 /*
1717  * Hack around reply_nterror & friends not being aware of chained requests,
1718  * generating illegal (i.e. wct==0) chain replies.
1719  */
1720
1721 static void fixup_chain_error_packet(struct smb_request *req)
1722 {
1723         uint8_t *outbuf = req->outbuf;
1724         req->outbuf = NULL;
1725         reply_outbuf(req, 2, 0);
1726         memcpy(req->outbuf, outbuf, smb_wct);
1727         TALLOC_FREE(outbuf);
1728         SCVAL(req->outbuf, smb_vwv0, 0xff);
1729 }
1730
1731 /**
1732  * @brief Find the smb_cmd offset of the last command pushed
1733  * @param[in] buf       The buffer we're building up
1734  * @retval              Where can we put our next andx cmd?
1735  *
1736  * While chaining requests, the "next" request we're looking at needs to put
1737  * its SMB_Command before the data the previous request already built up added
1738  * to the chain. Find the offset to the place where we have to put our cmd.
1739  */
1740
1741 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1742 {
1743         uint8_t cmd;
1744         size_t ofs;
1745
1746         cmd = CVAL(buf, smb_com);
1747
1748         SMB_ASSERT(is_andx_req(cmd));
1749
1750         ofs = smb_vwv0;
1751
1752         while (CVAL(buf, ofs) != 0xff) {
1753
1754                 if (!is_andx_req(CVAL(buf, ofs))) {
1755                         return false;
1756                 }
1757
1758                 /*
1759                  * ofs is from start of smb header, so add the 4 length
1760                  * bytes. The next cmd is right after the wct field.
1761                  */
1762                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1763
1764                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1765         }
1766
1767         *pofs = ofs;
1768         return true;
1769 }
1770
1771 /**
1772  * @brief Do the smb chaining at a buffer level
1773  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1774  * @param[in] smb_command       The command that we want to issue
1775  * @param[in] wct               How many words?
1776  * @param[in] vwv               The words, already in network order
1777  * @param[in] bytes_alignment   How shall we align "bytes"?
1778  * @param[in] num_bytes         How many bytes?
1779  * @param[in] bytes             The data the request ships
1780  *
1781  * smb_splice_chain() adds the vwv and bytes to the request already present in
1782  * *poutbuf.
1783  */
1784
1785 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1786                              uint8_t wct, const uint16_t *vwv,
1787                              size_t bytes_alignment,
1788                              uint32_t num_bytes, const uint8_t *bytes)
1789 {
1790         uint8_t *outbuf;
1791         size_t old_size, new_size;
1792         size_t ofs;
1793         size_t chain_padding = 0;
1794         size_t bytes_padding = 0;
1795         bool first_request;
1796
1797         old_size = talloc_get_size(*poutbuf);
1798
1799         /*
1800          * old_size == smb_wct means we're pushing the first request in for
1801          * libsmb/
1802          */
1803
1804         first_request = (old_size == smb_wct);
1805
1806         if (!first_request && ((old_size % 4) != 0)) {
1807                 /*
1808                  * Align the wct field of subsequent requests to a 4-byte
1809                  * boundary
1810                  */
1811                 chain_padding = 4 - (old_size % 4);
1812         }
1813
1814         /*
1815          * After the old request comes the new wct field (1 byte), the vwv's
1816          * and the num_bytes field. After at we might need to align the bytes
1817          * given to us to "bytes_alignment", increasing the num_bytes value.
1818          */
1819
1820         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1821
1822         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1823                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1824         }
1825
1826         new_size += bytes_padding + num_bytes;
1827
1828         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1829                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1830                           (unsigned)new_size));
1831                 return false;
1832         }
1833
1834         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1835         if (outbuf == NULL) {
1836                 DEBUG(0, ("talloc failed\n"));
1837                 return false;
1838         }
1839         *poutbuf = outbuf;
1840
1841         if (first_request) {
1842                 SCVAL(outbuf, smb_com, smb_command);
1843         } else {
1844                 size_t andx_cmd_ofs;
1845
1846                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1847                         DEBUG(1, ("invalid command chain\n"));
1848                         *poutbuf = talloc_realloc(
1849                                 NULL, *poutbuf, uint8_t, old_size);
1850                         return false;
1851                 }
1852
1853                 if (chain_padding != 0) {
1854                         memset(outbuf + old_size, 0, chain_padding);
1855                         old_size += chain_padding;
1856                 }
1857
1858                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1859                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1860         }
1861
1862         ofs = old_size;
1863
1864         /*
1865          * Push the chained request:
1866          *
1867          * wct field
1868          */
1869
1870         SCVAL(outbuf, ofs, wct);
1871         ofs += 1;
1872
1873         /*
1874          * vwv array
1875          */
1876
1877         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1878         ofs += sizeof(uint16_t) * wct;
1879
1880         /*
1881          * bcc (byte count)
1882          */
1883
1884         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1885         ofs += sizeof(uint16_t);
1886
1887         /*
1888          * padding
1889          */
1890
1891         if (bytes_padding != 0) {
1892                 memset(outbuf + ofs, 0, bytes_padding);
1893                 ofs += bytes_padding;
1894         }
1895
1896         /*
1897          * The bytes field
1898          */
1899
1900         memcpy(outbuf + ofs, bytes, num_bytes);
1901
1902         return true;
1903 }
1904
1905 /****************************************************************************
1906  Construct a chained reply and add it to the already made reply
1907 ****************************************************************************/
1908
1909 void chain_reply(struct smb_request *req)
1910 {
1911         size_t smblen = smb_len(req->inbuf);
1912         size_t already_used, length_needed;
1913         uint8_t chain_cmd;
1914         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1915
1916         uint8_t wct;
1917         const uint16_t *vwv;
1918         uint16_t buflen;
1919         const uint8_t *buf;
1920
1921         if (IVAL(req->outbuf, smb_rcls) != 0) {
1922                 fixup_chain_error_packet(req);
1923         }
1924
1925         /*
1926          * Any of the AndX requests and replies have at least a wct of
1927          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1928          * beginning of the SMB header to the next wct field.
1929          *
1930          * None of the AndX requests put anything valuable in vwv[0] and [1],
1931          * so we can overwrite it here to form the chain.
1932          */
1933
1934         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1935                 if (req->chain_outbuf == NULL) {
1936                         req->chain_outbuf = talloc_realloc(
1937                                 req, req->outbuf, uint8_t,
1938                                 smb_len(req->outbuf) + 4);
1939                         if (req->chain_outbuf == NULL) {
1940                                 smb_panic("talloc failed");
1941                         }
1942                 }
1943                 req->outbuf = NULL;
1944                 goto error;
1945         }
1946
1947         /*
1948          * Here we assume that this is the end of the chain. For that we need
1949          * to set "next command" to 0xff and the offset to 0. If we later find
1950          * more commands in the chain, this will be overwritten again.
1951          */
1952
1953         SCVAL(req->outbuf, smb_vwv0, 0xff);
1954         SCVAL(req->outbuf, smb_vwv0+1, 0);
1955         SSVAL(req->outbuf, smb_vwv1, 0);
1956
1957         if (req->chain_outbuf == NULL) {
1958                 /*
1959                  * In req->chain_outbuf we collect all the replies. Start the
1960                  * chain by copying in the first reply.
1961                  *
1962                  * We do the realloc because later on we depend on
1963                  * talloc_get_size to determine the length of
1964                  * chain_outbuf. The reply_xxx routines might have
1965                  * over-allocated (reply_pipe_read_and_X used to be such an
1966                  * example).
1967                  */
1968                 req->chain_outbuf = talloc_realloc(
1969                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1970                 if (req->chain_outbuf == NULL) {
1971                         smb_panic("talloc failed");
1972                 }
1973                 req->outbuf = NULL;
1974         } else {
1975                 /*
1976                  * Update smb headers where subsequent chained commands
1977                  * may have updated them.
1978                  */
1979                 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1980                 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1981
1982                 if (!smb_splice_chain(&req->chain_outbuf,
1983                                       CVAL(req->outbuf, smb_com),
1984                                       CVAL(req->outbuf, smb_wct),
1985                                       (uint16_t *)(req->outbuf + smb_vwv),
1986                                       0, smb_buflen(req->outbuf),
1987                                       (uint8_t *)smb_buf(req->outbuf))) {
1988                         goto error;
1989                 }
1990                 TALLOC_FREE(req->outbuf);
1991         }
1992
1993         /*
1994          * We use the old request's vwv field to grab the next chained command
1995          * and offset into the chained fields.
1996          */
1997
1998         chain_cmd = CVAL(req->vwv+0, 0);
1999         chain_offset = SVAL(req->vwv+1, 0);
2000
2001         if (chain_cmd == 0xff) {
2002                 /*
2003                  * End of chain, no more requests from the client. So ship the
2004                  * replies.
2005                  */
2006                 smb_setlen((char *)(req->chain_outbuf),
2007                            talloc_get_size(req->chain_outbuf) - 4);
2008
2009                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2010                                   true, req->seqnum+1,
2011                                   IS_CONN_ENCRYPTED(req->conn)
2012                                   ||req->encrypted,
2013                                   &req->pcd)) {
2014                         exit_server_cleanly("chain_reply: srv_send_smb "
2015                                             "failed.");
2016                 }
2017                 TALLOC_FREE(req->chain_outbuf);
2018                 req->done = true;
2019                 return;
2020         }
2021
2022         /* add a new perfcounter for this element of chain */
2023         SMB_PERFCOUNT_ADD(&req->pcd);
2024         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2025         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2026
2027         /*
2028          * Check if the client tries to fool us. The chain offset
2029          * needs to point beyond the current request in the chain, it
2030          * needs to strictly grow. Otherwise we might be tricked into
2031          * an endless loop always processing the same request over and
2032          * over again. We used to assume that vwv and the byte buffer
2033          * array in a chain are always attached, but OS/2 the
2034          * Write&X/Read&X chain puts the Read&X vwv array right behind
2035          * the Write&X vwv chain. The Write&X bcc array is put behind
2036          * the Read&X vwv array. So now we check whether the chain
2037          * offset points strictly behind the previous vwv
2038          * array. req->buf points right after the vwv array of the
2039          * previous request. See
2040          * https://bugzilla.samba.org/show_bug.cgi?id=8360 for more
2041          * information.
2042          */
2043
2044         already_used = PTR_DIFF(req->buf, smb_base(req->inbuf));
2045         if (chain_offset <= already_used) {
2046                 goto error;
2047         }
2048
2049         /*
2050          * Next check: Make sure the chain offset does not point beyond the
2051          * overall smb request length.
2052          */
2053
2054         length_needed = chain_offset+1; /* wct */
2055         if (length_needed > smblen) {
2056                 goto error;
2057         }
2058
2059         /*
2060          * Now comes the pointer magic. Goal here is to set up req->vwv and
2061          * req->buf correctly again to be able to call the subsequent
2062          * switch_message(). The chain offset (the former vwv[1]) points at
2063          * the new wct field.
2064          */
2065
2066         wct = CVAL(smb_base(req->inbuf), chain_offset);
2067
2068         /*
2069          * Next consistency check: Make the new vwv array fits in the overall
2070          * smb request.
2071          */
2072
2073         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2074         if (length_needed > smblen) {
2075                 goto error;
2076         }
2077         vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2078
2079         /*
2080          * Now grab the new byte buffer....
2081          */
2082
2083         buflen = SVAL(vwv+wct, 0);
2084
2085         /*
2086          * .. and check that it fits.
2087          */
2088
2089         length_needed += buflen;
2090         if (length_needed > smblen) {
2091                 goto error;
2092         }
2093         buf = (const uint8_t *)(vwv+wct+1);
2094
2095         req->cmd = chain_cmd;
2096         req->wct = wct;
2097         req->vwv = discard_const_p(uint16_t, vwv);
2098         req->buflen = buflen;
2099         req->buf = buf;
2100
2101         switch_message(chain_cmd, req, smblen);
2102
2103         if (req->outbuf == NULL) {
2104                 /*
2105                  * This happens if the chained command has suspended itself or
2106                  * if it has called srv_send_smb() itself.
2107                  */
2108                 return;
2109         }
2110
2111         /*
2112          * We end up here if the chained command was not itself chained or
2113          * suspended, but for example a close() command. We now need to splice
2114          * the chained commands' outbuf into the already built up chain_outbuf
2115          * and ship the result.
2116          */
2117         goto done;
2118
2119  error:
2120         /*
2121          * We end up here if there's any error in the chain syntax. Report a
2122          * DOS error, just like Windows does.
2123          */
2124         reply_force_doserror(req, ERRSRV, ERRerror);
2125         fixup_chain_error_packet(req);
2126
2127  done:
2128         /*
2129          * This scary statement intends to set the
2130          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2131          * to the value req->outbuf carries
2132          */
2133         SSVAL(req->chain_outbuf, smb_flg2,
2134               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2135               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2136
2137         /*
2138          * Transfer the error codes from the subrequest to the main one
2139          */
2140         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2141         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2142
2143         if (!smb_splice_chain(&req->chain_outbuf,
2144                               CVAL(req->outbuf, smb_com),
2145                               CVAL(req->outbuf, smb_wct),
2146                               (uint16_t *)(req->outbuf + smb_vwv),
2147                               0, smb_buflen(req->outbuf),
2148                               (uint8_t *)smb_buf(req->outbuf))) {
2149                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2150         }
2151         TALLOC_FREE(req->outbuf);
2152
2153         smb_setlen((char *)(req->chain_outbuf),
2154                    talloc_get_size(req->chain_outbuf) - 4);
2155
2156         show_msg((char *)(req->chain_outbuf));
2157
2158         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2159                           true, req->seqnum+1,
2160                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2161                           &req->pcd)) {
2162                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2163         }
2164         TALLOC_FREE(req->chain_outbuf);
2165         req->done = true;
2166 }
2167
2168 /****************************************************************************
2169  Check if services need reloading.
2170 ****************************************************************************/
2171
2172 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2173 {
2174
2175         if (last_smb_conf_reload_time == 0) {
2176                 last_smb_conf_reload_time = t;
2177         }
2178
2179         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2180                 reload_services(sconn, conn_snum_used, true);
2181                 last_smb_conf_reload_time = t;
2182         }
2183 }
2184
2185 static bool fd_is_readable(int fd)
2186 {
2187         int ret, revents;
2188
2189         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2190
2191         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2192
2193 }
2194
2195 static void smbd_server_connection_write_handler(
2196         struct smbd_server_connection *sconn)
2197 {
2198         /* TODO: make write nonblocking */
2199 }
2200
2201 static void smbd_server_connection_read_handler(
2202         struct smbd_server_connection *sconn, int fd)
2203 {
2204         uint8_t *inbuf = NULL;
2205         size_t inbuf_len = 0;
2206         size_t unread_bytes = 0;
2207         bool encrypted = false;
2208         TALLOC_CTX *mem_ctx = talloc_tos();
2209         NTSTATUS status;
2210         uint32_t seqnum;
2211
2212         bool from_client;
2213
2214         if (lp_async_smb_echo_handler()
2215             && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2216                 /*
2217                  * This is the super-ugly hack to prefer the packets
2218                  * forwarded by the echo handler over the ones by the
2219                  * client directly
2220                  */
2221                 fd = sconn->smb1.echo_handler.trusted_fd;
2222         }
2223
2224         from_client = (sconn->sock == fd);
2225
2226         if (from_client) {
2227                 smbd_lock_socket(sconn);
2228
2229                 if (!fd_is_readable(fd)) {
2230                         DEBUG(10,("the echo listener was faster\n"));
2231                         smbd_unlock_socket(sconn);
2232                         return;
2233                 }
2234         }
2235
2236         /* TODO: make this completely nonblocking */
2237         status = receive_smb_talloc(mem_ctx, sconn, fd,
2238                                     (char **)(void *)&inbuf,
2239                                     0, /* timeout */
2240                                     &unread_bytes,
2241                                     &encrypted,
2242                                     &inbuf_len, &seqnum,
2243                                     false /* trusted channel */);
2244
2245         if (from_client) {
2246                 smbd_unlock_socket(sconn);
2247         }
2248
2249         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2250                 goto process;
2251         }
2252         if (NT_STATUS_IS_ERR(status)) {
2253                 exit_server_cleanly("failed to receive smb request");
2254         }
2255         if (!NT_STATUS_IS_OK(status)) {
2256                 return;
2257         }
2258
2259 process:
2260         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2261                     seqnum, encrypted, NULL);
2262 }
2263
2264 static void smbd_server_connection_handler(struct event_context *ev,
2265                                            struct fd_event *fde,
2266                                            uint16_t flags,
2267                                            void *private_data)
2268 {
2269         struct smbd_server_connection *conn = talloc_get_type(private_data,
2270                                               struct smbd_server_connection);
2271
2272         if (flags & EVENT_FD_WRITE) {
2273                 smbd_server_connection_write_handler(conn);
2274                 return;
2275         }
2276         if (flags & EVENT_FD_READ) {
2277                 smbd_server_connection_read_handler(conn, conn->sock);
2278                 return;
2279         }
2280 }
2281
2282 static void smbd_server_echo_handler(struct event_context *ev,
2283                                      struct fd_event *fde,
2284                                      uint16_t flags,
2285                                      void *private_data)
2286 {
2287         struct smbd_server_connection *conn = talloc_get_type(private_data,
2288                                               struct smbd_server_connection);
2289
2290         if (flags & EVENT_FD_WRITE) {
2291                 smbd_server_connection_write_handler(conn);
2292                 return;
2293         }
2294         if (flags & EVENT_FD_READ) {
2295                 smbd_server_connection_read_handler(
2296                         conn, conn->smb1.echo_handler.trusted_fd);
2297                 return;
2298         }
2299 }
2300
2301 #ifdef CLUSTER_SUPPORT
2302 /****************************************************************************
2303 received when we should release a specific IP
2304 ****************************************************************************/
2305 static void release_ip(const char *ip, void *priv)
2306 {
2307         const char *addr = (const char *)priv;
2308         const char *p = addr;
2309
2310         if (strncmp("::ffff:", addr, 7) == 0) {
2311                 p = addr + 7;
2312         }
2313
2314         DEBUG(10, ("Got release IP message for %s, "
2315                    "our address is %s\n", ip, p));
2316
2317         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2318                 /* we can't afford to do a clean exit - that involves
2319                    database writes, which would potentially mean we
2320                    are still running after the failover has finished -
2321                    we have to get rid of this process ID straight
2322                    away */
2323                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2324                         ip));
2325                 /* note we must exit with non-zero status so the unclean handler gets
2326                    called in the parent, so that the brl database is tickled */
2327                 _exit(1);
2328         }
2329 }
2330
2331 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2332                                struct sockaddr_storage *client)
2333 {
2334         socklen_t length;
2335         length = sizeof(*server);
2336         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2337                 return -1;
2338         }
2339         length = sizeof(*client);
2340         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2341                 return -1;
2342         }
2343         return 0;
2344 }
2345 #endif
2346
2347 /*
2348  * Send keepalive packets to our client
2349  */
2350 static bool keepalive_fn(const struct timeval *now, void *private_data)
2351 {
2352         struct smbd_server_connection *sconn = talloc_get_type_abort(
2353                 private_data, struct smbd_server_connection);
2354         bool ret;
2355
2356         if (sconn->using_smb2) {
2357                 /* Don't do keepalives on an SMB2 connection. */
2358                 return false;
2359         }
2360
2361         smbd_lock_socket(sconn);
2362         ret = send_keepalive(sconn->sock);
2363         smbd_unlock_socket(sconn);
2364
2365         if (!ret) {
2366                 char addr[INET6_ADDRSTRLEN];
2367                 /*
2368                  * Try and give an error message saying what
2369                  * client failed.
2370                  */
2371                 DEBUG(0, ("send_keepalive failed for client %s. "
2372                           "Error %s - exiting\n",
2373                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2374                           strerror(errno)));
2375                 return False;
2376         }
2377         return True;
2378 }
2379
2380 /*
2381  * Do the recurring check if we're idle
2382  */
2383 static bool deadtime_fn(const struct timeval *now, void *private_data)
2384 {
2385         struct smbd_server_connection *sconn =
2386                 (struct smbd_server_connection *)private_data;
2387
2388         if ((conn_num_open(sconn) == 0)
2389             || (conn_idle_all(sconn, now->tv_sec))) {
2390                 DEBUG( 2, ( "Closing idle connection\n" ) );
2391                 messaging_send(sconn->msg_ctx,
2392                                messaging_server_id(sconn->msg_ctx),
2393                                MSG_SHUTDOWN, &data_blob_null);
2394                 return False;
2395         }
2396
2397         return True;
2398 }
2399
2400 /*
2401  * Do the recurring log file and smb.conf reload checks.
2402  */
2403
2404 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2405 {
2406         struct smbd_server_connection *sconn = talloc_get_type_abort(
2407                 private_data, struct smbd_server_connection);
2408
2409         DEBUG(5, ("housekeeping\n"));
2410
2411         change_to_root_user();
2412
2413         /* update printer queue caches if necessary */
2414         update_monitored_printq_cache(sconn->msg_ctx);
2415
2416         /* check if we need to reload services */
2417         check_reload(sconn, time_mono(NULL));
2418
2419         /* Change machine password if neccessary. */
2420         attempt_machine_password_change();
2421
2422         /*
2423          * Force a log file check.
2424          */
2425         force_check_log_size();
2426         check_log_size();
2427         return true;
2428 }
2429
2430 /*
2431  * Read an smb packet in the echo handler child, giving the parent
2432  * smbd one second to react once the socket becomes readable.
2433  */
2434
2435 struct smbd_echo_read_state {
2436         struct tevent_context *ev;
2437         struct smbd_server_connection *sconn;
2438
2439         char *buf;
2440         size_t buflen;
2441         uint32_t seqnum;
2442 };
2443
2444 static void smbd_echo_read_readable(struct tevent_req *subreq);
2445 static void smbd_echo_read_waited(struct tevent_req *subreq);
2446
2447 static struct tevent_req *smbd_echo_read_send(
2448         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2449         struct smbd_server_connection *sconn)
2450 {
2451         struct tevent_req *req, *subreq;
2452         struct smbd_echo_read_state *state;
2453
2454         req = tevent_req_create(mem_ctx, &state,
2455                                 struct smbd_echo_read_state);
2456         if (req == NULL) {
2457                 return NULL;
2458         }
2459         state->ev = ev;
2460         state->sconn = sconn;
2461
2462         subreq = wait_for_read_send(state, ev, sconn->sock);
2463         if (tevent_req_nomem(subreq, req)) {
2464                 return tevent_req_post(req, ev);
2465         }
2466         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2467         return req;
2468 }
2469
2470 static void smbd_echo_read_readable(struct tevent_req *subreq)
2471 {
2472         struct tevent_req *req = tevent_req_callback_data(
2473                 subreq, struct tevent_req);
2474         struct smbd_echo_read_state *state = tevent_req_data(
2475                 req, struct smbd_echo_read_state);
2476         bool ok;
2477         int err;
2478
2479         ok = wait_for_read_recv(subreq, &err);
2480         TALLOC_FREE(subreq);
2481         if (!ok) {
2482                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2483                 return;
2484         }
2485
2486         /*
2487          * Give the parent smbd one second to step in
2488          */
2489
2490         subreq = tevent_wakeup_send(
2491                 state, state->ev, timeval_current_ofs(1, 0));
2492         if (tevent_req_nomem(subreq, req)) {
2493                 return;
2494         }
2495         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2496 }
2497
2498 static void smbd_echo_read_waited(struct tevent_req *subreq)
2499 {
2500         struct tevent_req *req = tevent_req_callback_data(
2501                 subreq, struct tevent_req);
2502         struct smbd_echo_read_state *state = tevent_req_data(
2503                 req, struct smbd_echo_read_state);
2504         struct smbd_server_connection *sconn = state->sconn;
2505         bool ok;
2506         NTSTATUS status;
2507         size_t unread = 0;
2508         bool encrypted;
2509
2510         ok = tevent_wakeup_recv(subreq);
2511         TALLOC_FREE(subreq);
2512         if (!ok) {
2513                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2514                 return;
2515         }
2516
2517         ok = smbd_lock_socket_internal(sconn);
2518         if (!ok) {
2519                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2520                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2521                 return;
2522         }
2523
2524         if (!fd_is_readable(sconn->sock)) {
2525                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2526                           (int)sys_getpid()));
2527
2528                 ok = smbd_unlock_socket_internal(sconn);
2529                 if (!ok) {
2530                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2531                         DEBUG(1, ("%s: failed to unlock socket\n",
2532                                 __location__));
2533                         return;
2534                 }
2535
2536                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2537                 if (tevent_req_nomem(subreq, req)) {
2538                         return;
2539                 }
2540                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2541                 return;
2542         }
2543
2544         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2545                                     0 /* timeout */,
2546                                     &unread,
2547                                     &encrypted,
2548                                     &state->buflen,
2549                                     &state->seqnum,
2550                                     false /* trusted_channel*/);
2551
2552         if (tevent_req_nterror(req, status)) {
2553                 tevent_req_nterror(req, status);
2554                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2555                           (int)sys_getpid(), nt_errstr(status)));
2556                 return;
2557         }
2558
2559         ok = smbd_unlock_socket_internal(sconn);
2560         if (!ok) {
2561                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2562                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2563                 return;
2564         }
2565         tevent_req_done(req);
2566 }
2567
2568 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2569                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2570 {
2571         struct smbd_echo_read_state *state = tevent_req_data(
2572                 req, struct smbd_echo_read_state);
2573         NTSTATUS status;
2574
2575         if (tevent_req_is_nterror(req, &status)) {
2576                 return status;
2577         }
2578         *pbuf = talloc_move(mem_ctx, &state->buf);
2579         *pbuflen = state->buflen;
2580         *pseqnum = state->seqnum;
2581         return NT_STATUS_OK;
2582 }
2583
2584 struct smbd_echo_state {
2585         struct tevent_context *ev;
2586         struct iovec *pending;
2587         struct smbd_server_connection *sconn;
2588         int parent_pipe;
2589
2590         struct tevent_fd *parent_fde;
2591
2592         struct tevent_req *write_req;
2593 };
2594
2595 static void smbd_echo_writer_done(struct tevent_req *req);
2596
2597 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2598 {
2599         int num_pending;
2600
2601         if (state->write_req != NULL) {
2602                 return;
2603         }
2604
2605         num_pending = talloc_array_length(state->pending);
2606         if (num_pending == 0) {
2607                 return;
2608         }
2609
2610         state->write_req = writev_send(state, state->ev, NULL,
2611                                        state->parent_pipe, false,
2612                                        state->pending, num_pending);
2613         if (state->write_req == NULL) {
2614                 DEBUG(1, ("writev_send failed\n"));
2615                 exit(1);
2616         }
2617
2618         talloc_steal(state->write_req, state->pending);
2619         state->pending = NULL;
2620
2621         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2622                                 state);
2623 }
2624
2625 static void smbd_echo_writer_done(struct tevent_req *req)
2626 {
2627         struct smbd_echo_state *state = tevent_req_callback_data(
2628                 req, struct smbd_echo_state);
2629         ssize_t written;
2630         int err;
2631
2632         written = writev_recv(req, &err);
2633         TALLOC_FREE(req);
2634         state->write_req = NULL;
2635         if (written == -1) {
2636                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2637                 exit(1);
2638         }
2639         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2640         smbd_echo_activate_writer(state);
2641 }
2642
2643 static bool smbd_echo_reply(struct smbd_echo_state *state,
2644                             uint8_t *inbuf, size_t inbuf_len,
2645                             uint32_t seqnum)
2646 {
2647         struct smb_request req;
2648         uint16_t num_replies;
2649         char *outbuf;
2650         bool ok;
2651
2652         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2653                 DEBUG(10, ("Got netbios keepalive\n"));
2654                 /*
2655                  * Just swallow it
2656                  */
2657                 return true;
2658         }
2659
2660         if (inbuf_len < smb_size) {
2661                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2662                 return false;
2663         }
2664         if (!valid_smb_header(state->sconn, inbuf)) {
2665                 DEBUG(10, ("Got invalid SMB header\n"));
2666                 return false;
2667         }
2668
2669         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2670                               seqnum)) {
2671                 return false;
2672         }
2673         req.inbuf = inbuf;
2674
2675         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2676                    smb_messages[req.cmd].name
2677                    ? smb_messages[req.cmd].name : "unknown"));
2678
2679         if (req.cmd != SMBecho) {
2680                 return false;
2681         }
2682         if (req.wct < 1) {
2683                 return false;
2684         }
2685
2686         num_replies = SVAL(req.vwv+0, 0);
2687         if (num_replies != 1) {
2688                 /* Not a Windows "Hey, you're still there?" request */
2689                 return false;
2690         }
2691
2692         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2693                            1, req.buflen)) {
2694                 DEBUG(10, ("create_outbuf failed\n"));
2695                 return false;
2696         }
2697         req.outbuf = (uint8_t *)outbuf;
2698
2699         SSVAL(req.outbuf, smb_vwv0, num_replies);
2700
2701         if (req.buflen > 0) {
2702                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2703         }
2704
2705         ok = srv_send_smb(req.sconn,
2706                           (char *)outbuf,
2707                           true, seqnum+1,
2708                           false, &req.pcd);
2709         TALLOC_FREE(outbuf);
2710         if (!ok) {
2711                 exit(1);
2712         }
2713
2714         return true;
2715 }
2716
2717 static void smbd_echo_exit(struct tevent_context *ev,
2718                            struct tevent_fd *fde, uint16_t flags,
2719                            void *private_data)
2720 {
2721         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2722         exit(0);
2723 }
2724
2725 static void smbd_echo_got_packet(struct tevent_req *req);
2726
2727 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2728                            int parent_pipe)
2729 {
2730         struct smbd_echo_state *state;
2731         struct tevent_req *read_req;
2732
2733         state = talloc_zero(sconn, struct smbd_echo_state);
2734         if (state == NULL) {
2735                 DEBUG(1, ("talloc failed\n"));
2736                 return;
2737         }
2738         state->sconn = sconn;
2739         state->parent_pipe = parent_pipe;
2740         state->ev = s3_tevent_context_init(state);
2741         if (state->ev == NULL) {
2742                 DEBUG(1, ("tevent_context_init failed\n"));
2743                 TALLOC_FREE(state);
2744                 return;
2745         }
2746         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2747                                         TEVENT_FD_READ, smbd_echo_exit,
2748                                         state);
2749         if (state->parent_fde == NULL) {
2750                 DEBUG(1, ("tevent_add_fd failed\n"));
2751                 TALLOC_FREE(state);
2752                 return;
2753         }
2754
2755         read_req = smbd_echo_read_send(state, state->ev, sconn);
2756         if (read_req == NULL) {
2757                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2758                 TALLOC_FREE(state);
2759                 return;
2760         }
2761         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2762
2763         while (true) {
2764                 if (tevent_loop_once(state->ev) == -1) {
2765                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2766                                   strerror(errno)));
2767                         break;
2768                 }
2769         }
2770         TALLOC_FREE(state);
2771 }
2772
2773 static void smbd_echo_got_packet(struct tevent_req *req)
2774 {
2775         struct smbd_echo_state *state = tevent_req_callback_data(
2776                 req, struct smbd_echo_state);
2777         NTSTATUS status;
2778         char *buf = NULL;
2779         size_t buflen = 0;
2780         uint32_t seqnum = 0;
2781         bool reply;
2782
2783         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2784         TALLOC_FREE(req);
2785         if (!NT_STATUS_IS_OK(status)) {
2786                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2787                           nt_errstr(status)));
2788                 exit(1);
2789         }
2790
2791         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2792         if (!reply) {
2793                 size_t num_pending;
2794                 struct iovec *tmp;
2795                 struct iovec *iov;
2796
2797                 num_pending = talloc_array_length(state->pending);
2798                 tmp = talloc_realloc(state, state->pending, struct iovec,
2799                                      num_pending+1);
2800                 if (tmp == NULL) {
2801                         DEBUG(1, ("talloc_realloc failed\n"));
2802                         exit(1);
2803                 }
2804                 state->pending = tmp;
2805
2806                 if (buflen >= smb_size) {
2807                         /*
2808                          * place the seqnum in the packet so that the main process
2809                          * can reply with signing
2810                          */
2811                         SIVAL(buf, smb_ss_field, seqnum);
2812                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2813                 }
2814
2815                 iov = &state->pending[num_pending];
2816                 iov->iov_base = buf;
2817                 iov->iov_len = buflen;
2818
2819                 DEBUG(10,("echo_handler[%d]: forward to main\n",
2820                           (int)sys_getpid()));
2821                 smbd_echo_activate_writer(state);
2822         }
2823
2824         req = smbd_echo_read_send(state, state->ev, state->sconn);
2825         if (req == NULL) {
2826                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2827                 exit(1);
2828         }
2829         tevent_req_set_callback(req, smbd_echo_got_packet, state);
2830 }
2831
2832
2833 /*
2834  * Handle SMBecho requests in a forked child process
2835  */
2836 bool fork_echo_handler(struct smbd_server_connection *sconn)
2837 {
2838         int listener_pipe[2];
2839         int res;
2840         pid_t child;
2841
2842         res = pipe(listener_pipe);
2843         if (res == -1) {
2844                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2845                 return false;
2846         }
2847         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2848         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2849                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2850                 goto fail;
2851         }
2852
2853         child = sys_fork();
2854         if (child == 0) {
2855                 NTSTATUS status;
2856
2857                 close(listener_pipe[0]);
2858                 set_blocking(listener_pipe[1], false);
2859
2860                 status = reinit_after_fork(sconn->msg_ctx,
2861                                            sconn->ev_ctx,
2862                                            false);
2863                 if (!NT_STATUS_IS_OK(status)) {
2864                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2865                                   nt_errstr(status)));
2866                         exit(1);
2867                 }
2868                 smbd_echo_loop(sconn, listener_pipe[1]);
2869                 exit(0);
2870         }
2871         close(listener_pipe[1]);
2872         listener_pipe[1] = -1;
2873         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2874
2875         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2876
2877         /*
2878          * Without smb signing this is the same as the normal smbd
2879          * listener. This needs to change once signing comes in.
2880          */
2881         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
2882                                         sconn,
2883                                         sconn->smb1.echo_handler.trusted_fd,
2884                                         TEVENT_FD_READ,
2885                                         smbd_server_echo_handler,
2886                                         sconn);
2887         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2888                 DEBUG(1, ("event_add_fd failed\n"));
2889                 goto fail;
2890         }
2891
2892         return true;
2893
2894 fail:
2895         if (listener_pipe[0] != -1) {
2896                 close(listener_pipe[0]);
2897         }
2898         if (listener_pipe[1] != -1) {
2899                 close(listener_pipe[1]);
2900         }
2901         sconn->smb1.echo_handler.trusted_fd = -1;
2902         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2903                 close(sconn->smb1.echo_handler.socket_lock_fd);
2904         }
2905         sconn->smb1.echo_handler.trusted_fd = -1;
2906         sconn->smb1.echo_handler.socket_lock_fd = -1;
2907         return false;
2908 }
2909
2910 #if CLUSTER_SUPPORT
2911
2912 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2913                                   struct sockaddr_storage *srv,
2914                                   struct sockaddr_storage *clnt)
2915 {
2916         struct ctdbd_connection *cconn;
2917         char tmp_addr[INET6_ADDRSTRLEN];
2918         char *addr;
2919
2920         cconn = messaging_ctdbd_connection();
2921         if (cconn == NULL) {
2922                 return NT_STATUS_NO_MEMORY;
2923         }
2924
2925         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2926         addr = talloc_strdup(cconn, tmp_addr);
2927         if (addr == NULL) {
2928                 return NT_STATUS_NO_MEMORY;
2929         }
2930         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2931 }
2932
2933 #endif
2934
2935 static bool uid_in_use(const struct user_struct *user, uid_t uid)
2936 {
2937         while (user) {
2938                 if (user->session_info &&
2939                     (user->session_info->unix_token->uid == uid)) {
2940                         return true;
2941                 }
2942                 user = user->next;
2943         }
2944         return false;
2945 }
2946
2947 static bool gid_in_use(const struct user_struct *user, gid_t gid)
2948 {
2949         while (user) {
2950                 if (user->session_info != NULL) {
2951                         int i;
2952                         struct security_unix_token *utok;
2953
2954                         utok = user->session_info->unix_token;
2955                         if (utok->gid == gid) {
2956                                 return true;
2957                         }
2958                         for(i=0; i<utok->ngroups; i++) {
2959                                 if (utok->groups[i] == gid) {
2960                                         return true;
2961                                 }
2962                         }
2963                 }
2964                 user = user->next;
2965         }
2966         return false;
2967 }
2968
2969 static bool sid_in_use(const struct user_struct *user,
2970                        const struct dom_sid *psid)
2971 {
2972         while (user) {
2973                 struct security_token *tok;
2974
2975                 if (user->session_info == NULL) {
2976                         continue;
2977                 }
2978                 tok = user->session_info->security_token;
2979                 if (tok == NULL) {
2980                         /*
2981                          * Not sure session_info->security_token can
2982                          * ever be NULL. This check might be not
2983                          * necessary.
2984                          */
2985                         continue;
2986                 }
2987                 if (security_token_has_sid(tok, psid)) {
2988                         return true;
2989                 }
2990                 user = user->next;
2991         }
2992         return false;
2993 }
2994
2995 static bool id_in_use(const struct user_struct *user,
2996                       const struct id_cache_ref *id)
2997 {
2998         switch(id->type) {
2999         case UID:
3000                 return uid_in_use(user, id->id.uid);
3001         case GID:
3002                 return gid_in_use(user, id->id.gid);
3003         case SID:
3004                 return sid_in_use(user, &id->id.sid);
3005         default:
3006                 break;
3007         }
3008         return false;
3009 }
3010
3011 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3012                                void *private_data,
3013                                uint32_t msg_type,
3014                                struct server_id server_id,
3015                                DATA_BLOB* data)
3016 {
3017         const char *msg = (data && data->data)
3018                 ? (const char *)data->data : "<NULL>";
3019         struct user_struct *validated_users;
3020         struct id_cache_ref id;
3021         struct smbd_server_connection *sconn =
3022                 talloc_get_type_abort(private_data,
3023                 struct smbd_server_connection);
3024
3025         validated_users = sconn->smb1.sessions.validated_users;
3026
3027         if (!id_cache_ref_parse(msg, &id)) {
3028                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3029                 return;
3030         }
3031
3032         if (id_in_use(validated_users, &id)) {
3033                 exit_server_cleanly(msg);
3034         }
3035         id_cache_delete_from_cache(&id);
3036 }
3037
3038 /****************************************************************************
3039  Process commands from the client
3040 ****************************************************************************/
3041
3042 void smbd_process(struct tevent_context *ev_ctx,
3043                   struct smbd_server_connection *sconn)
3044 {
3045         TALLOC_CTX *frame = talloc_stackframe();
3046         struct sockaddr_storage ss;
3047         struct sockaddr *sa = NULL;
3048         socklen_t sa_socklen;
3049         struct tsocket_address *local_address = NULL;
3050         struct tsocket_address *remote_address = NULL;
3051         const char *locaddr = NULL;
3052         const char *remaddr = NULL;
3053         char *rhost;
3054         int ret;
3055
3056         if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
3057                 /*
3058                  * We're not making the decision here,
3059                  * we're just allowing the client
3060                  * to decide between SMB1 and SMB2
3061                  * with the first negprot
3062                  * packet.
3063                  */
3064                 sconn->using_smb2 = true;
3065         }
3066
3067         /* Ensure child is set to blocking mode */
3068         set_blocking(sconn->sock,True);
3069
3070         set_socket_options(sconn->sock, "SO_KEEPALIVE");
3071         set_socket_options(sconn->sock, lp_socket_options());
3072
3073         sa = (struct sockaddr *)(void *)&ss;
3074         sa_socklen = sizeof(ss);
3075         ret = getpeername(sconn->sock, sa, &sa_socklen);
3076         if (ret != 0) {
3077                 int level = (errno == ENOTCONN)?2:0;
3078                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3079                 exit_server_cleanly("getpeername() failed.\n");
3080         }
3081         ret = tsocket_address_bsd_from_sockaddr(sconn,
3082                                                 sa, sa_socklen,
3083                                                 &remote_address);
3084         if (ret != 0) {
3085                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3086                         __location__, strerror(errno)));
3087                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3088         }
3089
3090         sa = (struct sockaddr *)(void *)&ss;
3091         sa_socklen = sizeof(ss);
3092         ret = getsockname(sconn->sock, sa, &sa_socklen);
3093         if (ret != 0) {
3094                 int level = (errno == ENOTCONN)?2:0;
3095                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3096                 exit_server_cleanly("getsockname() failed.\n");
3097         }
3098         ret = tsocket_address_bsd_from_sockaddr(sconn,
3099                                                 sa, sa_socklen,
3100                                                 &local_address);
3101         if (ret != 0) {
3102                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3103                         __location__, strerror(errno)));
3104                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3105         }
3106
3107         sconn->local_address = local_address;
3108         sconn->remote_address = remote_address;
3109
3110         if (tsocket_address_is_inet(local_address, "ip")) {
3111                 locaddr = tsocket_address_inet_addr_string(
3112                                 sconn->local_address,
3113                                 talloc_tos());
3114                 if (locaddr == NULL) {
3115                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3116                                  __location__, strerror(errno)));
3117                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3118                 }
3119         } else {
3120                 locaddr = "0.0.0.0";
3121         }
3122
3123         if (tsocket_address_is_inet(remote_address, "ip")) {
3124                 remaddr = tsocket_address_inet_addr_string(
3125                                 sconn->remote_address,
3126                                 talloc_tos());
3127                 if (remaddr == NULL) {
3128                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3129                                  __location__, strerror(errno)));
3130                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3131                 }
3132         } else {
3133                 remaddr = "0.0.0.0";
3134         }
3135
3136         /* this is needed so that we get decent entries
3137            in smbstatus for port 445 connects */
3138         set_remote_machine_name(remaddr, false);
3139         reload_services(sconn, conn_snum_used, true);
3140
3141         /*
3142          * Before the first packet, check the global hosts allow/ hosts deny
3143          * parameters before doing any parsing of packets passed to us by the
3144          * client. This prevents attacks on our parsing code from hosts not in
3145          * the hosts allow list.
3146          */
3147
3148         ret = get_remote_hostname(remote_address,
3149                                   &rhost,
3150                                   talloc_tos());
3151         if (ret < 0) {
3152                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3153                         __location__, strerror(errno)));
3154                 exit_server_cleanly("get_remote_hostname failed.\n");
3155         }
3156         if (strequal(rhost, "UNKNOWN")) {
3157                 rhost = talloc_strdup(talloc_tos(), remaddr);
3158         }
3159         sconn->remote_hostname = talloc_move(sconn, &rhost);
3160
3161         sub_set_socket_ids(remaddr,
3162                            sconn->remote_hostname,
3163                            locaddr);
3164
3165         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3166                           sconn->remote_hostname,
3167                           remaddr)) {
3168                 /*
3169                  * send a negative session response "not listening on calling
3170                  * name"
3171                  */
3172                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3173                 DEBUG( 1, ("Connection denied from %s to %s\n",
3174                            tsocket_address_string(remote_address, talloc_tos()),
3175                            tsocket_address_string(local_address, talloc_tos())));
3176                 (void)srv_send_smb(sconn,(char *)buf, false,
3177                                    0, false, NULL);
3178                 exit_server_cleanly("connection denied");
3179         }
3180
3181         DEBUG(10, ("Connection allowed from %s to %s\n",
3182                    tsocket_address_string(remote_address, talloc_tos()),
3183                    tsocket_address_string(local_address, talloc_tos())));
3184
3185         init_modules();
3186
3187         smb_perfcount_init();
3188
3189         if (!init_account_policy()) {
3190                 exit_server("Could not open account policy tdb.\n");
3191         }
3192
3193         if (*lp_rootdir()) {
3194                 if (chroot(lp_rootdir()) != 0) {
3195                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3196                         exit_server("Failed to chroot()");
3197                 }
3198                 if (chdir("/") == -1) {
3199                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3200                         exit_server("Failed to chroot()");
3201                 }
3202                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3203         }
3204
3205         if (!srv_init_signing(sconn)) {
3206                 exit_server("Failed to init smb_signing");
3207         }
3208
3209         /* Setup oplocks */
3210         if (!init_oplocks(sconn))
3211                 exit_server("Failed to init oplocks");
3212
3213         /* register our message handlers */
3214         messaging_register(sconn->msg_ctx, sconn,
3215                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3216         messaging_register(sconn->msg_ctx, sconn,
3217                            MSG_SMB_CLOSE_FILE, msg_close_file);
3218         messaging_register(sconn->msg_ctx, sconn,
3219                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3220
3221         id_cache_register_msgs(sconn->msg_ctx);
3222         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3223         messaging_register(sconn->msg_ctx, sconn,
3224                            ID_CACHE_KILL, smbd_id_cache_kill);
3225
3226         messaging_deregister(sconn->msg_ctx,
3227                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3228         messaging_register(sconn->msg_ctx, sconn,
3229                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3230
3231         /*
3232          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3233          * MSGs to all child processes
3234          */
3235         messaging_deregister(sconn->msg_ctx,
3236                              MSG_DEBUG, NULL);
3237         messaging_register(sconn->msg_ctx, NULL,
3238                            MSG_DEBUG, debug_message);
3239
3240         if ((lp_keepalive() != 0)
3241             && !(event_add_idle(ev_ctx, NULL,
3242                                 timeval_set(lp_keepalive(), 0),
3243                                 "keepalive", keepalive_fn,
3244                                 sconn))) {
3245                 DEBUG(0, ("Could not add keepalive event\n"));
3246                 exit(1);
3247         }
3248
3249         if (!(event_add_idle(ev_ctx, NULL,
3250                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3251                              "deadtime", deadtime_fn, sconn))) {
3252                 DEBUG(0, ("Could not add deadtime event\n"));
3253                 exit(1);
3254         }
3255
3256         if (!(event_add_idle(ev_ctx, NULL,
3257                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3258                              "housekeeping", housekeeping_fn, sconn))) {
3259                 DEBUG(0, ("Could not add housekeeping event\n"));
3260                 exit(1);
3261         }
3262
3263 #ifdef CLUSTER_SUPPORT
3264
3265         if (lp_clustering()) {
3266                 /*
3267                  * We need to tell ctdb about our client's TCP
3268                  * connection, so that for failover ctdbd can send
3269                  * tickle acks, triggering a reconnection by the
3270                  * client.
3271                  */
3272
3273                 struct sockaddr_storage srv, clnt;
3274
3275                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3276                         NTSTATUS status;
3277                         status = smbd_register_ips(sconn, &srv, &clnt);
3278                         if (!NT_STATUS_IS_OK(status)) {
3279                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3280                                           nt_errstr(status)));
3281                         }
3282                 } else
3283                 {
3284                         DEBUG(0,("Unable to get tcp info for "
3285                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3286                                  strerror(errno)));
3287                 }
3288         }
3289
3290 #endif
3291
3292         sconn->nbt.got_session = false;
3293
3294         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3295
3296         sconn->smb1.sessions.done_sesssetup = false;
3297         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3298         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3299         /* users from session setup */
3300         sconn->smb1.sessions.session_userlist = NULL;
3301         /* workgroup from session setup. */
3302         sconn->smb1.sessions.session_workgroup = NULL;
3303         /* this holds info on user ids that are already validated for this VC */
3304         sconn->smb1.sessions.validated_users = NULL;
3305         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3306         sconn->smb1.sessions.num_validated_vuids = 0;
3307
3308         conn_init(sconn);
3309         if (!init_dptrs(sconn)) {
3310                 exit_server("init_dptrs() failed");
3311         }
3312
3313         sconn->smb1.fde = event_add_fd(ev_ctx,
3314                                                   sconn,
3315                                                   sconn->sock,
3316                                                   EVENT_FD_READ,
3317                                                   smbd_server_connection_handler,
3318                                                   sconn);
3319         if (!sconn->smb1.fde) {
3320                 exit_server("failed to create smbd_server_connection fde");
3321         }
3322
3323         TALLOC_FREE(frame);
3324
3325         while (True) {
3326                 frame = talloc_stackframe_pool(8192);
3327
3328                 errno = 0;
3329                 if (tevent_loop_once(ev_ctx) == -1) {
3330                         if (errno != EINTR) {
3331                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3332                                           " exiting\n", strerror(errno) ));
3333                                 break;
3334                         }
3335                 }
3336
3337                 TALLOC_FREE(frame);
3338         }
3339
3340         exit_server_cleanly(NULL);
3341 }
3342
3343 bool req_is_in_chain(struct smb_request *req)
3344 {
3345         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3346                 /*
3347                  * We're right now handling a subsequent request, so we must
3348                  * be in a chain
3349                  */
3350                 return true;
3351         }
3352
3353         if (!is_andx_req(req->cmd)) {
3354                 return false;
3355         }
3356
3357         if (req->wct < 2) {
3358                 /*
3359                  * Okay, an illegal request, but definitely not chained :-)
3360                  */
3361                 return false;
3362         }
3363
3364         return (CVAL(req->vwv+0, 0) != 0xFF);
3365 }