8e1add3fb14fd6c41046a0bfab43299ff2cf1c53
[nivanova/samba-autobuild/.git] / source3 / smbd / process.c
1 /* 
2    Unix SMB/CIFS implementation.
3    process incoming packets - main loop
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Volker Lendecke 2005-2007
6    
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11    
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16    
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 /*
24  * Size of data we can send to client. Set
25  *  by the client for all protocols above CORE.
26  *  Set by us for CORE protocol.
27  */
28 int max_send = BUFFER_SIZE;
29 /*
30  * Size of the data we can receive. Set by us.
31  * Can be modified by the max xmit parameter.
32  */
33 int max_recv = BUFFER_SIZE;
34
35 SIG_ATOMIC_T reload_after_sighup = 0;
36 SIG_ATOMIC_T got_sig_term = 0;
37 extern bool global_machine_password_needs_changing;
38 extern int max_send;
39
40 /* Accessor function for smb_read_error for smbd functions. */
41
42 /****************************************************************************
43  Send an smb to a fd.
44 ****************************************************************************/
45
46 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
47 {
48         size_t len;
49         size_t nwritten=0;
50         ssize_t ret;
51         char *buf_out = buffer;
52
53         /* Sign the outgoing packet if required. */
54         srv_calculate_sign_mac(buf_out);
55
56         if (do_encrypt) {
57                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
58                 if (!NT_STATUS_IS_OK(status)) {
59                         DEBUG(0, ("send_smb: SMB encryption failed "
60                                 "on outgoing packet! Error %s\n",
61                                 nt_errstr(status) ));
62                         return false;
63                 }
64         }
65
66         len = smb_len(buf_out) + 4;
67
68         while (nwritten < len) {
69                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
70                 if (ret <= 0) {
71                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
72                                 (int)len,(int)ret, strerror(errno) ));
73                         srv_free_enc_buffer(buf_out);
74                         return false;
75                 }
76                 nwritten += ret;
77         }
78
79         srv_free_enc_buffer(buf_out);
80         return true;
81 }
82
83 /*******************************************************************
84  Setup the word count and byte count for a smb message.
85 ********************************************************************/
86
87 int srv_set_message(char *buf,
88                         int num_words,
89                         int num_bytes,
90                         bool zero)
91 {
92         if (zero && (num_words || num_bytes)) {
93                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
94         }
95         SCVAL(buf,smb_wct,num_words);
96         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
97         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
98         return (smb_size + num_words*2 + num_bytes);
99 }
100
101 static bool valid_smb_header(const uint8_t *inbuf)
102 {
103         if (is_encrypted_packet(inbuf)) {
104                 return true;
105         }
106         /*
107          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
108          * but it just looks weird to call strncmp for this one.
109          */
110         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
111 }
112
113 /* Socket functions for smbd packet processing. */
114
115 static bool valid_packet_size(size_t len)
116 {
117         /*
118          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
119          * of header. Don't print the error if this fits.... JRA.
120          */
121
122         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
123                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
124                                         (unsigned long)len));
125                 return false;
126         }
127         return true;
128 }
129
130 static NTSTATUS read_packet_remainder(int fd, char *buffer,
131                                       unsigned int timeout, ssize_t len)
132 {
133         if (len <= 0) {
134                 return NT_STATUS_OK;
135         }
136
137         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
138 }
139
140 /****************************************************************************
141  Attempt a zerocopy writeX read. We know here that len > smb_size-4
142 ****************************************************************************/
143
144 /*
145  * Unfortunately, earlier versions of smbclient/libsmbclient
146  * don't send this "standard" writeX header. I've fixed this
147  * for 3.2 but we'll use the old method with earlier versions.
148  * Windows and CIFSFS at least use this standard size. Not
149  * sure about MacOSX.
150  */
151
152 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
153                                 (2*14) + /* word count (including bcc) */ \
154                                 1 /* pad byte */)
155
156 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
157                                                     const char lenbuf[4],
158                                                     int fd, char **buffer,
159                                                     unsigned int timeout,
160                                                     size_t *p_unread,
161                                                     size_t *len_ret)
162 {
163         /* Size of a WRITEX call (+4 byte len). */
164         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
165         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
166         ssize_t toread;
167         NTSTATUS status;
168
169         memcpy(writeX_header, lenbuf, 4);
170
171         status = read_socket_with_timeout(
172                 fd, writeX_header + 4,
173                 STANDARD_WRITE_AND_X_HEADER_SIZE,
174                 STANDARD_WRITE_AND_X_HEADER_SIZE,
175                 timeout, NULL);
176
177         if (!NT_STATUS_IS_OK(status)) {
178                 return status;
179         }
180
181         /*
182          * Ok - now try and see if this is a possible
183          * valid writeX call.
184          */
185
186         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
187                 /*
188                  * If the data offset is beyond what
189                  * we've read, drain the extra bytes.
190                  */
191                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
192                 ssize_t newlen;
193
194                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
195                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
196                         if (drain_socket(smbd_server_fd(), drain) != drain) {
197                                 smb_panic("receive_smb_raw_talloc_partial_read:"
198                                         " failed to drain pending bytes");
199                         }
200                 } else {
201                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
202                 }
203
204                 /* Spoof down the length and null out the bcc. */
205                 set_message_bcc(writeX_header, 0);
206                 newlen = smb_len(writeX_header);
207
208                 /* Copy the header we've written. */
209
210                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
211                                 writeX_header,
212                                 sizeof(writeX_header));
213
214                 if (*buffer == NULL) {
215                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
216                                   (int)sizeof(writeX_header)));
217                         return NT_STATUS_NO_MEMORY;
218                 }
219
220                 /* Work out the remaining bytes. */
221                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
222                 *len_ret = newlen + 4;
223                 return NT_STATUS_OK;
224         }
225
226         if (!valid_packet_size(len)) {
227                 return NT_STATUS_INVALID_PARAMETER;
228         }
229
230         /*
231          * Not a valid writeX call. Just do the standard
232          * talloc and return.
233          */
234
235         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
236
237         if (*buffer == NULL) {
238                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
239                           (int)len+4));
240                 return NT_STATUS_NO_MEMORY;
241         }
242
243         /* Copy in what we already read. */
244         memcpy(*buffer,
245                 writeX_header,
246                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
247         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
248
249         if(toread > 0) {
250                 status = read_packet_remainder(
251                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
252                         timeout, toread);
253
254                 if (!NT_STATUS_IS_OK(status)) {
255                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
256                                    nt_errstr(status)));
257                         return status;
258                 }
259         }
260
261         *len_ret = len + 4;
262         return NT_STATUS_OK;
263 }
264
265 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
266                                        char **buffer, unsigned int timeout,
267                                        size_t *p_unread, size_t *plen)
268 {
269         char lenbuf[4];
270         size_t len;
271         int min_recv_size = lp_min_receive_file_size();
272         NTSTATUS status;
273
274         *p_unread = 0;
275
276         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
277         if (!NT_STATUS_IS_OK(status)) {
278                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
279                 return status;
280         }
281
282         if (CVAL(lenbuf,0) == 0 &&
283                         min_recv_size &&
284                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
285                         !srv_is_signing_active()) {
286
287                 return receive_smb_raw_talloc_partial_read(
288                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
289         }
290
291         if (!valid_packet_size(len)) {
292                 return NT_STATUS_INVALID_PARAMETER;
293         }
294
295         /*
296          * The +4 here can't wrap, we've checked the length above already.
297          */
298
299         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
300
301         if (*buffer == NULL) {
302                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
303                           (int)len+4));
304                 return NT_STATUS_NO_MEMORY;
305         }
306
307         memcpy(*buffer, lenbuf, sizeof(lenbuf));
308
309         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
310         if (!NT_STATUS_IS_OK(status)) {
311                 return status;
312         }
313
314         *plen = len + 4;
315         return NT_STATUS_OK;
316 }
317
318 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
319                                    char **buffer, unsigned int timeout,
320                                    size_t *p_unread, bool *p_encrypted,
321                                    size_t *p_len)
322 {
323         size_t len = 0;
324         NTSTATUS status;
325
326         *p_encrypted = false;
327
328         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
329                                         p_unread, &len);
330         if (!NT_STATUS_IS_OK(status)) {
331                 return status;
332         }
333
334         if (is_encrypted_packet((uint8_t *)*buffer)) {
335                 status = srv_decrypt_buffer(*buffer);
336                 if (!NT_STATUS_IS_OK(status)) {
337                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
338                                 "incoming packet! Error %s\n",
339                                 nt_errstr(status) ));
340                         return status;
341                 }
342                 *p_encrypted = true;
343         }
344
345         /* Check the incoming SMB signature. */
346         if (!srv_check_sign_mac(*buffer, true)) {
347                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
348                           "incoming packet!\n"));
349                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
350         }
351
352         *p_len = len;
353         return NT_STATUS_OK;
354 }
355
356 /*
357  * Initialize a struct smb_request from an inbuf
358  */
359
360 void init_smb_request(struct smb_request *req,
361                         const uint8 *inbuf,
362                         size_t unread_bytes,
363                         bool encrypted)
364 {
365         size_t req_size = smb_len(inbuf) + 4;
366         /* Ensure we have at least smb_size bytes. */
367         if (req_size < smb_size) {
368                 DEBUG(0,("init_smb_request: invalid request size %u\n",
369                         (unsigned int)req_size ));
370                 exit_server_cleanly("Invalid SMB request");
371         }
372         req->flags2 = SVAL(inbuf, smb_flg2);
373         req->smbpid = SVAL(inbuf, smb_pid);
374         req->mid    = SVAL(inbuf, smb_mid);
375         req->vuid   = SVAL(inbuf, smb_uid);
376         req->tid    = SVAL(inbuf, smb_tid);
377         req->wct    = CVAL(inbuf, smb_wct);
378         req->buflen = smb_buflen(inbuf);
379         req->unread_bytes = unread_bytes;
380         req->encrypted = encrypted;
381         req->conn = conn_find(req->tid);
382         req->chain_fsp = NULL;
383
384         /* Ensure we have at least wct words and 2 bytes of bcc. */
385         if (smb_size + req->wct*2 > req_size) {
386                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
387                         (unsigned int)req->wct,
388                         (unsigned int)req_size));
389                 exit_server_cleanly("Invalid SMB request");
390         }
391         /* Ensure bcc is correct. */
392         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
393                 DEBUG(0,("init_smb_request: invalid bcc number %u "
394                         "(wct = %u, size %u)\n",
395                         (unsigned int)req->buflen,
396                         (unsigned int)req->wct,
397                         (unsigned int)req_size));
398                 exit_server_cleanly("Invalid SMB request");
399         }
400         req->inbuf  = inbuf;
401         req->outbuf = NULL;
402 }
403
404 /****************************************************************************
405  structure to hold a linked list of queued messages.
406  for processing.
407 ****************************************************************************/
408
409 static struct pending_message_list *deferred_open_queue;
410
411 /****************************************************************************
412  Function to push a message onto the tail of a linked list of smb messages ready
413  for processing.
414 ****************************************************************************/
415
416 static bool push_queued_message(struct smb_request *req,
417                                 struct timeval request_time,
418                                 struct timeval end_time,
419                                 char *private_data, size_t private_len)
420 {
421         int msg_len = smb_len(req->inbuf) + 4;
422         struct pending_message_list *msg;
423
424         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
425
426         if(msg == NULL) {
427                 DEBUG(0,("push_message: malloc fail (1)\n"));
428                 return False;
429         }
430
431         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
432         if(msg->buf.data == NULL) {
433                 DEBUG(0,("push_message: malloc fail (2)\n"));
434                 TALLOC_FREE(msg);
435                 return False;
436         }
437
438         msg->request_time = request_time;
439         msg->end_time = end_time;
440         msg->encrypted = req->encrypted;
441
442         if (private_data) {
443                 msg->private_data = data_blob_talloc(msg, private_data,
444                                                      private_len);
445                 if (msg->private_data.data == NULL) {
446                         DEBUG(0,("push_message: malloc fail (3)\n"));
447                         TALLOC_FREE(msg);
448                         return False;
449                 }
450         }
451
452         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
453
454         DEBUG(10,("push_message: pushed message length %u on "
455                   "deferred_open_queue\n", (unsigned int)msg_len));
456
457         return True;
458 }
459
460 /****************************************************************************
461  Function to delete a sharing violation open message by mid.
462 ****************************************************************************/
463
464 void remove_deferred_open_smb_message(uint16 mid)
465 {
466         struct pending_message_list *pml;
467
468         for (pml = deferred_open_queue; pml; pml = pml->next) {
469                 if (mid == SVAL(pml->buf.data,smb_mid)) {
470                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
471                                   "deleting mid %u len %u\n",
472                                   (unsigned int)mid,
473                                   (unsigned int)pml->buf.length ));
474                         DLIST_REMOVE(deferred_open_queue, pml);
475                         TALLOC_FREE(pml);
476                         return;
477                 }
478         }
479 }
480
481 /****************************************************************************
482  Move a sharing violation open retry message to the front of the list and
483  schedule it for immediate processing.
484 ****************************************************************************/
485
486 void schedule_deferred_open_smb_message(uint16 mid)
487 {
488         struct pending_message_list *pml;
489         int i = 0;
490
491         for (pml = deferred_open_queue; pml; pml = pml->next) {
492                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
493                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
494                         (unsigned int)msg_mid ));
495                 if (mid == msg_mid) {
496                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
497                                 mid ));
498                         pml->end_time.tv_sec = 0;
499                         pml->end_time.tv_usec = 0;
500                         DLIST_PROMOTE(deferred_open_queue, pml);
501                         return;
502                 }
503         }
504
505         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
506                 mid ));
507 }
508
509 /****************************************************************************
510  Return true if this mid is on the deferred queue.
511 ****************************************************************************/
512
513 bool open_was_deferred(uint16 mid)
514 {
515         struct pending_message_list *pml;
516
517         for (pml = deferred_open_queue; pml; pml = pml->next) {
518                 if (SVAL(pml->buf.data,smb_mid) == mid) {
519                         return True;
520                 }
521         }
522         return False;
523 }
524
525 /****************************************************************************
526  Return the message queued by this mid.
527 ****************************************************************************/
528
529 struct pending_message_list *get_open_deferred_message(uint16 mid)
530 {
531         struct pending_message_list *pml;
532
533         for (pml = deferred_open_queue; pml; pml = pml->next) {
534                 if (SVAL(pml->buf.data,smb_mid) == mid) {
535                         return pml;
536                 }
537         }
538         return NULL;
539 }
540
541 /****************************************************************************
542  Function to push a deferred open smb message onto a linked list of local smb
543  messages ready for processing.
544 ****************************************************************************/
545
546 bool push_deferred_smb_message(struct smb_request *req,
547                                struct timeval request_time,
548                                struct timeval timeout,
549                                char *private_data, size_t priv_len)
550 {
551         struct timeval end_time;
552
553         if (req->unread_bytes) {
554                 DEBUG(0,("push_deferred_smb_message: logic error ! "
555                         "unread_bytes = %u\n",
556                         (unsigned int)req->unread_bytes ));
557                 smb_panic("push_deferred_smb_message: "
558                         "logic error unread_bytes != 0" );
559         }
560
561         end_time = timeval_sum(&request_time, &timeout);
562
563         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
564                   "timeout time [%u.%06u]\n",
565                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
566                   (unsigned int)end_time.tv_sec,
567                   (unsigned int)end_time.tv_usec));
568
569         return push_queued_message(req, request_time, end_time,
570                                    private_data, priv_len);
571 }
572
573 struct idle_event {
574         struct timed_event *te;
575         struct timeval interval;
576         char *name;
577         bool (*handler)(const struct timeval *now, void *private_data);
578         void *private_data;
579 };
580
581 static void idle_event_handler(struct event_context *ctx,
582                                struct timed_event *te,
583                                const struct timeval *now,
584                                void *private_data)
585 {
586         struct idle_event *event =
587                 talloc_get_type_abort(private_data, struct idle_event);
588
589         TALLOC_FREE(event->te);
590
591         if (!event->handler(now, event->private_data)) {
592                 /* Don't repeat, delete ourselves */
593                 TALLOC_FREE(event);
594                 return;
595         }
596
597         event->te = event_add_timed(ctx, event,
598                                     timeval_sum(now, &event->interval),
599                                     event->name,
600                                     idle_event_handler, event);
601
602         /* We can't do much but fail here. */
603         SMB_ASSERT(event->te != NULL);
604 }
605
606 struct idle_event *event_add_idle(struct event_context *event_ctx,
607                                   TALLOC_CTX *mem_ctx,
608                                   struct timeval interval,
609                                   const char *name,
610                                   bool (*handler)(const struct timeval *now,
611                                                   void *private_data),
612                                   void *private_data)
613 {
614         struct idle_event *result;
615         struct timeval now = timeval_current();
616
617         result = TALLOC_P(mem_ctx, struct idle_event);
618         if (result == NULL) {
619                 DEBUG(0, ("talloc failed\n"));
620                 return NULL;
621         }
622
623         result->interval = interval;
624         result->handler = handler;
625         result->private_data = private_data;
626
627         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
628                 DEBUG(0, ("talloc failed\n"));
629                 TALLOC_FREE(result);
630                 return NULL;
631         }
632
633         result->te = event_add_timed(event_ctx, result,
634                                      timeval_sum(&now, &interval),
635                                      result->name,
636                                      idle_event_handler, result);
637         if (result->te == NULL) {
638                 DEBUG(0, ("event_add_timed failed\n"));
639                 TALLOC_FREE(result);
640                 return NULL;
641         }
642
643         return result;
644 }
645
646 /****************************************************************************
647  Do all async processing in here. This includes kernel oplock messages, change
648  notify events etc.
649 ****************************************************************************/
650
651 static void async_processing(fd_set *pfds)
652 {
653         DEBUG(10,("async_processing: Doing async processing.\n"));
654
655         process_aio_queue();
656
657         process_kernel_oplocks(smbd_messaging_context(), pfds);
658
659         /* Do the aio check again after receive_local_message as it does a
660            select and may have eaten our signal. */
661         /* Is this till true? -- vl */
662         process_aio_queue();
663
664         if (got_sig_term) {
665                 exit_server_cleanly("termination signal");
666         }
667
668         /* check for sighup processing */
669         if (reload_after_sighup) {
670                 change_to_root_user();
671                 DEBUG(1,("Reloading services after SIGHUP\n"));
672                 reload_services(False);
673                 reload_after_sighup = 0;
674         }
675 }
676
677 /****************************************************************************
678  Add a fd to the set we will be select(2)ing on.
679 ****************************************************************************/
680
681 static int select_on_fd(int fd, int maxfd, fd_set *fds)
682 {
683         if (fd != -1) {
684                 FD_SET(fd, fds);
685                 maxfd = MAX(maxfd, fd);
686         }
687
688         return maxfd;
689 }
690
691 /****************************************************************************
692   Do a select on an two fd's - with timeout. 
693
694   If a local udp message has been pushed onto the
695   queue (this can only happen during oplock break
696   processing) call async_processing()
697
698   If a pending smb message has been pushed onto the
699   queue (this can only happen during oplock break
700   processing) return this next.
701
702   If the first smbfd is ready then read an smb from it.
703   if the second (loopback UDP) fd is ready then read a message
704   from it and setup the buffer header to identify the length
705   and from address.
706   Returns False on timeout or error.
707   Else returns True.
708
709 The timeout is in milliseconds
710 ****************************************************************************/
711
712 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
713                                        size_t *buffer_len,
714                                        size_t *p_unread, bool *p_encrypted)
715 {
716         fd_set r_fds, w_fds;
717         int selrtn;
718         struct timeval to;
719         int maxfd = 0;
720         size_t len = 0;
721         NTSTATUS status;
722
723         *p_unread = 0;
724
725  again:
726
727         to.tv_sec = SMBD_SELECT_TIMEOUT;
728         to.tv_usec = 0;
729
730         /*
731          * Note that this call must be before processing any SMB
732          * messages as we need to synchronously process any messages
733          * we may have sent to ourselves from the previous SMB.
734          */
735         message_dispatch(smbd_messaging_context());
736
737         /*
738          * Check to see if we already have a message on the deferred open queue
739          * and it's time to schedule.
740          */
741         if(deferred_open_queue != NULL) {
742                 bool pop_message = False;
743                 struct pending_message_list *msg = deferred_open_queue;
744
745                 if (timeval_is_zero(&msg->end_time)) {
746                         pop_message = True;
747                 } else {
748                         struct timeval tv;
749                         int64_t tdif;
750
751                         GetTimeOfDay(&tv);
752                         tdif = usec_time_diff(&msg->end_time, &tv);
753                         if (tdif <= 0) {
754                                 /* Timed out. Schedule...*/
755                                 pop_message = True;
756                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
757                         } else {
758                                 /* Make a more accurate select timeout. */
759                                 to.tv_sec = tdif / 1000000;
760                                 to.tv_usec = tdif % 1000000;
761                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
762                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
763                         }
764                 }
765
766                 if (pop_message) {
767
768                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
769                                                         msg->buf.length);
770                         if (*buffer == NULL) {
771                                 DEBUG(0, ("talloc failed\n"));
772                                 return NT_STATUS_NO_MEMORY;
773                         }
774                         *buffer_len = msg->buf.length;
775                         *p_encrypted = msg->encrypted;
776
777                         /* We leave this message on the queue so the open code can
778                            know this is a retry. */
779                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
780                         return NT_STATUS_OK;
781                 }
782         }
783
784         /*
785          * Setup the select fd sets.
786          */
787
788         FD_ZERO(&r_fds);
789         FD_ZERO(&w_fds);
790
791         /*
792          * Ensure we process oplock break messages by preference.
793          * We have to do this before the select, after the select
794          * and if the select returns EINTR. This is due to the fact
795          * that the selects called from async_processing can eat an EINTR
796          * caused by a signal (we can't take the break message there).
797          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
798          */
799
800         if (oplock_message_waiting(&r_fds)) {
801                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
802                 async_processing(&r_fds);
803                 /*
804                  * After async processing we must go and do the select again, as
805                  * the state of the flag in fds for the server file descriptor is
806                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
807                  */
808                 goto again;
809         }
810
811         /*
812          * Are there any timed events waiting ? If so, ensure we don't
813          * select for longer than it would take to wait for them.
814          */
815
816         {
817                 struct timeval now;
818                 GetTimeOfDay(&now);
819
820                 event_add_to_select_args(smbd_event_context(), &now,
821                                          &r_fds, &w_fds, &to, &maxfd);
822         }
823
824         if (timeval_is_zero(&to)) {
825                 /* Process a timed event now... */
826                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
827                         goto again;
828                 }
829         }
830         
831         {
832                 int sav;
833                 START_PROFILE(smbd_idle);
834
835                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
836                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
837
838                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
839                 sav = errno;
840
841                 END_PROFILE(smbd_idle);
842                 errno = sav;
843         }
844
845         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
846                 goto again;
847         }
848
849         /* if we get EINTR then maybe we have received an oplock
850            signal - treat this as select returning 1. This is ugly, but
851            is the best we can do until the oplock code knows more about
852            signals */
853         if (selrtn == -1 && errno == EINTR) {
854                 async_processing(&r_fds);
855                 /*
856                  * After async processing we must go and do the select again, as
857                  * the state of the flag in fds for the server file descriptor is
858                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
859                  */
860                 goto again;
861         }
862
863         /* Check if error */
864         if (selrtn == -1) {
865                 /* something is wrong. Maybe the socket is dead? */
866                 return map_nt_error_from_unix(errno);
867         }
868
869         /* Did we timeout ? */
870         if (selrtn == 0) {
871                 goto again;
872         }
873
874         /*
875          * Ensure we process oplock break messages by preference.
876          * This is IMPORTANT ! Otherwise we can starve other processes
877          * sending us an oplock break message. JRA.
878          */
879
880         if (oplock_message_waiting(&r_fds)) {
881                 async_processing(&r_fds);
882                 /*
883                  * After async processing we must go and do the select again, as
884                  * the state of the flag in fds for the server file descriptor is
885                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
886                  */
887                 goto again;
888         }
889
890         /*
891          * We've just woken up from a protentially long select sleep.
892          * Ensure we process local messages as we need to synchronously
893          * process any messages from other smbd's to avoid file rename race
894          * conditions. This call is cheap if there are no messages waiting.
895          * JRA.
896          */
897         message_dispatch(smbd_messaging_context());
898
899         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
900                                     p_unread, p_encrypted, &len);
901
902         if (!NT_STATUS_IS_OK(status)) {
903                 return status;
904         }
905
906         *buffer_len = len;
907
908         return NT_STATUS_OK;
909 }
910
911 /*
912  * Only allow 5 outstanding trans requests. We're allocating memory, so
913  * prevent a DoS.
914  */
915
916 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
917 {
918         int count = 0;
919         for (; list != NULL; list = list->next) {
920
921                 if (list->mid == mid) {
922                         return NT_STATUS_INVALID_PARAMETER;
923                 }
924
925                 count += 1;
926         }
927         if (count > 5) {
928                 return NT_STATUS_INSUFFICIENT_RESOURCES;
929         }
930
931         return NT_STATUS_OK;
932 }
933
934 /****************************************************************************
935  We're terminating and have closed all our files/connections etc.
936  If there are any pending local messages we need to respond to them
937  before termination so that other smbds don't think we just died whilst
938  holding oplocks.
939 ****************************************************************************/
940
941 void respond_to_all_remaining_local_messages(void)
942 {
943         /*
944          * Assert we have no exclusive open oplocks.
945          */
946
947         if(get_number_of_exclusive_open_oplocks()) {
948                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
949                         get_number_of_exclusive_open_oplocks() ));
950                 return;
951         }
952
953         process_kernel_oplocks(smbd_messaging_context(), NULL);
954
955         return;
956 }
957
958
959 /*
960 These flags determine some of the permissions required to do an operation 
961
962 Note that I don't set NEED_WRITE on some write operations because they
963 are used by some brain-dead clients when printing, and I don't want to
964 force write permissions on print services.
965 */
966 #define AS_USER (1<<0)
967 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
968 #define TIME_INIT (1<<2)
969 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
970 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
971 #define DO_CHDIR (1<<6)
972
973 /* 
974    define a list of possible SMB messages and their corresponding
975    functions. Any message that has a NULL function is unimplemented -
976    please feel free to contribute implementations!
977 */
978 static const struct smb_message_struct {
979         const char *name;
980         void (*fn)(struct smb_request *req);
981         int flags;
982 } smb_messages[256] = {
983
984 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
985 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
986 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
987 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
988 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
989 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
990 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
991 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
992 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
993 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
994 /* 0x0a */ { "SMBread",reply_read,AS_USER},
995 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
996 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
997 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
998 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
999 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1000 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1001 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1002 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1003 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1004 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1005 /* 0x15 */ { NULL, NULL, 0 },
1006 /* 0x16 */ { NULL, NULL, 0 },
1007 /* 0x17 */ { NULL, NULL, 0 },
1008 /* 0x18 */ { NULL, NULL, 0 },
1009 /* 0x19 */ { NULL, NULL, 0 },
1010 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1011 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1012 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1013 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1014 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1015 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1016 /* 0x20 */ { "SMBwritec", NULL,0},
1017 /* 0x21 */ { NULL, NULL, 0 },
1018 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1019 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1020 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1021 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1022 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1023 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1024 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1025 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1026 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1027 /* 0x2b */ { "SMBecho",reply_echo,0},
1028 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1029 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1030 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1031 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1032 /* 0x30 */ { NULL, NULL, 0 },
1033 /* 0x31 */ { NULL, NULL, 0 },
1034 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1035 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1036 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1037 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1038 /* 0x36 */ { NULL, NULL, 0 },
1039 /* 0x37 */ { NULL, NULL, 0 },
1040 /* 0x38 */ { NULL, NULL, 0 },
1041 /* 0x39 */ { NULL, NULL, 0 },
1042 /* 0x3a */ { NULL, NULL, 0 },
1043 /* 0x3b */ { NULL, NULL, 0 },
1044 /* 0x3c */ { NULL, NULL, 0 },
1045 /* 0x3d */ { NULL, NULL, 0 },
1046 /* 0x3e */ { NULL, NULL, 0 },
1047 /* 0x3f */ { NULL, NULL, 0 },
1048 /* 0x40 */ { NULL, NULL, 0 },
1049 /* 0x41 */ { NULL, NULL, 0 },
1050 /* 0x42 */ { NULL, NULL, 0 },
1051 /* 0x43 */ { NULL, NULL, 0 },
1052 /* 0x44 */ { NULL, NULL, 0 },
1053 /* 0x45 */ { NULL, NULL, 0 },
1054 /* 0x46 */ { NULL, NULL, 0 },
1055 /* 0x47 */ { NULL, NULL, 0 },
1056 /* 0x48 */ { NULL, NULL, 0 },
1057 /* 0x49 */ { NULL, NULL, 0 },
1058 /* 0x4a */ { NULL, NULL, 0 },
1059 /* 0x4b */ { NULL, NULL, 0 },
1060 /* 0x4c */ { NULL, NULL, 0 },
1061 /* 0x4d */ { NULL, NULL, 0 },
1062 /* 0x4e */ { NULL, NULL, 0 },
1063 /* 0x4f */ { NULL, NULL, 0 },
1064 /* 0x50 */ { NULL, NULL, 0 },
1065 /* 0x51 */ { NULL, NULL, 0 },
1066 /* 0x52 */ { NULL, NULL, 0 },
1067 /* 0x53 */ { NULL, NULL, 0 },
1068 /* 0x54 */ { NULL, NULL, 0 },
1069 /* 0x55 */ { NULL, NULL, 0 },
1070 /* 0x56 */ { NULL, NULL, 0 },
1071 /* 0x57 */ { NULL, NULL, 0 },
1072 /* 0x58 */ { NULL, NULL, 0 },
1073 /* 0x59 */ { NULL, NULL, 0 },
1074 /* 0x5a */ { NULL, NULL, 0 },
1075 /* 0x5b */ { NULL, NULL, 0 },
1076 /* 0x5c */ { NULL, NULL, 0 },
1077 /* 0x5d */ { NULL, NULL, 0 },
1078 /* 0x5e */ { NULL, NULL, 0 },
1079 /* 0x5f */ { NULL, NULL, 0 },
1080 /* 0x60 */ { NULL, NULL, 0 },
1081 /* 0x61 */ { NULL, NULL, 0 },
1082 /* 0x62 */ { NULL, NULL, 0 },
1083 /* 0x63 */ { NULL, NULL, 0 },
1084 /* 0x64 */ { NULL, NULL, 0 },
1085 /* 0x65 */ { NULL, NULL, 0 },
1086 /* 0x66 */ { NULL, NULL, 0 },
1087 /* 0x67 */ { NULL, NULL, 0 },
1088 /* 0x68 */ { NULL, NULL, 0 },
1089 /* 0x69 */ { NULL, NULL, 0 },
1090 /* 0x6a */ { NULL, NULL, 0 },
1091 /* 0x6b */ { NULL, NULL, 0 },
1092 /* 0x6c */ { NULL, NULL, 0 },
1093 /* 0x6d */ { NULL, NULL, 0 },
1094 /* 0x6e */ { NULL, NULL, 0 },
1095 /* 0x6f */ { NULL, NULL, 0 },
1096 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1097 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1098 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1099 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1100 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1101 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1102 /* 0x76 */ { NULL, NULL, 0 },
1103 /* 0x77 */ { NULL, NULL, 0 },
1104 /* 0x78 */ { NULL, NULL, 0 },
1105 /* 0x79 */ { NULL, NULL, 0 },
1106 /* 0x7a */ { NULL, NULL, 0 },
1107 /* 0x7b */ { NULL, NULL, 0 },
1108 /* 0x7c */ { NULL, NULL, 0 },
1109 /* 0x7d */ { NULL, NULL, 0 },
1110 /* 0x7e */ { NULL, NULL, 0 },
1111 /* 0x7f */ { NULL, NULL, 0 },
1112 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1113 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1114 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1115 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1116 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1117 /* 0x85 */ { NULL, NULL, 0 },
1118 /* 0x86 */ { NULL, NULL, 0 },
1119 /* 0x87 */ { NULL, NULL, 0 },
1120 /* 0x88 */ { NULL, NULL, 0 },
1121 /* 0x89 */ { NULL, NULL, 0 },
1122 /* 0x8a */ { NULL, NULL, 0 },
1123 /* 0x8b */ { NULL, NULL, 0 },
1124 /* 0x8c */ { NULL, NULL, 0 },
1125 /* 0x8d */ { NULL, NULL, 0 },
1126 /* 0x8e */ { NULL, NULL, 0 },
1127 /* 0x8f */ { NULL, NULL, 0 },
1128 /* 0x90 */ { NULL, NULL, 0 },
1129 /* 0x91 */ { NULL, NULL, 0 },
1130 /* 0x92 */ { NULL, NULL, 0 },
1131 /* 0x93 */ { NULL, NULL, 0 },
1132 /* 0x94 */ { NULL, NULL, 0 },
1133 /* 0x95 */ { NULL, NULL, 0 },
1134 /* 0x96 */ { NULL, NULL, 0 },
1135 /* 0x97 */ { NULL, NULL, 0 },
1136 /* 0x98 */ { NULL, NULL, 0 },
1137 /* 0x99 */ { NULL, NULL, 0 },
1138 /* 0x9a */ { NULL, NULL, 0 },
1139 /* 0x9b */ { NULL, NULL, 0 },
1140 /* 0x9c */ { NULL, NULL, 0 },
1141 /* 0x9d */ { NULL, NULL, 0 },
1142 /* 0x9e */ { NULL, NULL, 0 },
1143 /* 0x9f */ { NULL, NULL, 0 },
1144 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1145 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1146 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1147 /* 0xa3 */ { NULL, NULL, 0 },
1148 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1149 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1150 /* 0xa6 */ { NULL, NULL, 0 },
1151 /* 0xa7 */ { NULL, NULL, 0 },
1152 /* 0xa8 */ { NULL, NULL, 0 },
1153 /* 0xa9 */ { NULL, NULL, 0 },
1154 /* 0xaa */ { NULL, NULL, 0 },
1155 /* 0xab */ { NULL, NULL, 0 },
1156 /* 0xac */ { NULL, NULL, 0 },
1157 /* 0xad */ { NULL, NULL, 0 },
1158 /* 0xae */ { NULL, NULL, 0 },
1159 /* 0xaf */ { NULL, NULL, 0 },
1160 /* 0xb0 */ { NULL, NULL, 0 },
1161 /* 0xb1 */ { NULL, NULL, 0 },
1162 /* 0xb2 */ { NULL, NULL, 0 },
1163 /* 0xb3 */ { NULL, NULL, 0 },
1164 /* 0xb4 */ { NULL, NULL, 0 },
1165 /* 0xb5 */ { NULL, NULL, 0 },
1166 /* 0xb6 */ { NULL, NULL, 0 },
1167 /* 0xb7 */ { NULL, NULL, 0 },
1168 /* 0xb8 */ { NULL, NULL, 0 },
1169 /* 0xb9 */ { NULL, NULL, 0 },
1170 /* 0xba */ { NULL, NULL, 0 },
1171 /* 0xbb */ { NULL, NULL, 0 },
1172 /* 0xbc */ { NULL, NULL, 0 },
1173 /* 0xbd */ { NULL, NULL, 0 },
1174 /* 0xbe */ { NULL, NULL, 0 },
1175 /* 0xbf */ { NULL, NULL, 0 },
1176 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1177 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1178 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1179 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1180 /* 0xc4 */ { NULL, NULL, 0 },
1181 /* 0xc5 */ { NULL, NULL, 0 },
1182 /* 0xc6 */ { NULL, NULL, 0 },
1183 /* 0xc7 */ { NULL, NULL, 0 },
1184 /* 0xc8 */ { NULL, NULL, 0 },
1185 /* 0xc9 */ { NULL, NULL, 0 },
1186 /* 0xca */ { NULL, NULL, 0 },
1187 /* 0xcb */ { NULL, NULL, 0 },
1188 /* 0xcc */ { NULL, NULL, 0 },
1189 /* 0xcd */ { NULL, NULL, 0 },
1190 /* 0xce */ { NULL, NULL, 0 },
1191 /* 0xcf */ { NULL, NULL, 0 },
1192 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1193 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1194 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1195 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1196 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1197 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1198 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1199 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1200 /* 0xd8 */ { NULL, NULL, 0 },
1201 /* 0xd9 */ { NULL, NULL, 0 },
1202 /* 0xda */ { NULL, NULL, 0 },
1203 /* 0xdb */ { NULL, NULL, 0 },
1204 /* 0xdc */ { NULL, NULL, 0 },
1205 /* 0xdd */ { NULL, NULL, 0 },
1206 /* 0xde */ { NULL, NULL, 0 },
1207 /* 0xdf */ { NULL, NULL, 0 },
1208 /* 0xe0 */ { NULL, NULL, 0 },
1209 /* 0xe1 */ { NULL, NULL, 0 },
1210 /* 0xe2 */ { NULL, NULL, 0 },
1211 /* 0xe3 */ { NULL, NULL, 0 },
1212 /* 0xe4 */ { NULL, NULL, 0 },
1213 /* 0xe5 */ { NULL, NULL, 0 },
1214 /* 0xe6 */ { NULL, NULL, 0 },
1215 /* 0xe7 */ { NULL, NULL, 0 },
1216 /* 0xe8 */ { NULL, NULL, 0 },
1217 /* 0xe9 */ { NULL, NULL, 0 },
1218 /* 0xea */ { NULL, NULL, 0 },
1219 /* 0xeb */ { NULL, NULL, 0 },
1220 /* 0xec */ { NULL, NULL, 0 },
1221 /* 0xed */ { NULL, NULL, 0 },
1222 /* 0xee */ { NULL, NULL, 0 },
1223 /* 0xef */ { NULL, NULL, 0 },
1224 /* 0xf0 */ { NULL, NULL, 0 },
1225 /* 0xf1 */ { NULL, NULL, 0 },
1226 /* 0xf2 */ { NULL, NULL, 0 },
1227 /* 0xf3 */ { NULL, NULL, 0 },
1228 /* 0xf4 */ { NULL, NULL, 0 },
1229 /* 0xf5 */ { NULL, NULL, 0 },
1230 /* 0xf6 */ { NULL, NULL, 0 },
1231 /* 0xf7 */ { NULL, NULL, 0 },
1232 /* 0xf8 */ { NULL, NULL, 0 },
1233 /* 0xf9 */ { NULL, NULL, 0 },
1234 /* 0xfa */ { NULL, NULL, 0 },
1235 /* 0xfb */ { NULL, NULL, 0 },
1236 /* 0xfc */ { NULL, NULL, 0 },
1237 /* 0xfd */ { NULL, NULL, 0 },
1238 /* 0xfe */ { NULL, NULL, 0 },
1239 /* 0xff */ { NULL, NULL, 0 }
1240
1241 };
1242
1243 /*******************************************************************
1244  allocate and initialize a reply packet
1245 ********************************************************************/
1246
1247 bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
1248                    uint8_t num_words, uint32_t num_bytes)
1249 {
1250         /*
1251          * Protect against integer wrap
1252          */
1253         if ((num_bytes > 0xffffff)
1254             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1255                 char *msg;
1256                 if (asprintf(&msg, "num_bytes too large: %u",
1257                              (unsigned)num_bytes) == -1) {
1258                         msg = CONST_DISCARD(char *, "num_bytes too large");
1259                 }
1260                 smb_panic(msg);
1261         }
1262
1263         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1264                                smb_size + num_words*2 + num_bytes);
1265         if (*outbuf == NULL) {
1266                 return false;
1267         }
1268
1269         construct_reply_common(inbuf, *outbuf);
1270         srv_set_message(*outbuf, num_words, num_bytes, false);
1271         /*
1272          * Zero out the word area, the caller has to take care of the bcc area
1273          * himself
1274          */
1275         if (num_words != 0) {
1276                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1277         }
1278
1279         return true;
1280 }
1281
1282 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1283 {
1284         char *outbuf;
1285         if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
1286                            num_bytes)) {
1287                 smb_panic("could not allocate output buffer\n");
1288         }
1289         req->outbuf = (uint8_t *)outbuf;
1290 }
1291
1292
1293 /*******************************************************************
1294  Dump a packet to a file.
1295 ********************************************************************/
1296
1297 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1298 {
1299         int fd, i;
1300         char *fname = NULL;
1301         if (DEBUGLEVEL < 50) {
1302                 return;
1303         }
1304
1305         if (len < 4) len = smb_len(data)+4;
1306         for (i=1;i<100;i++) {
1307                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1308                              type ? "req" : "resp") == -1) {
1309                         return;
1310                 }
1311                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1312                 if (fd != -1 || errno != EEXIST) break;
1313         }
1314         if (fd != -1) {
1315                 ssize_t ret = write(fd, data, len);
1316                 if (ret != len)
1317                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1318                 close(fd);
1319                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1320         }
1321         SAFE_FREE(fname);
1322 }
1323
1324 /****************************************************************************
1325  Prepare everything for calling the actual request function, and potentially
1326  call the request function via the "new" interface.
1327
1328  Return False if the "legacy" function needs to be called, everything is
1329  prepared.
1330
1331  Return True if we're done.
1332
1333  I know this API sucks, but it is the one with the least code change I could
1334  find.
1335 ****************************************************************************/
1336
1337 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1338 {
1339         int flags;
1340         uint16 session_tag;
1341         connection_struct *conn = NULL;
1342
1343         static uint16 last_session_tag = UID_FIELD_INVALID;
1344
1345         errno = 0;
1346
1347         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1348          * so subtract 4 from it. */
1349         if (!valid_smb_header(req->inbuf)
1350             || (size < (smb_size - 4))) {
1351                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1352                          smb_len(req->inbuf)));
1353                 exit_server_cleanly("Non-SMB packet");
1354         }
1355
1356         if (smb_messages[type].fn == NULL) {
1357                 DEBUG(0,("Unknown message type %d!\n",type));
1358                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1359                 reply_unknown_new(req, type);
1360                 return NULL;
1361         }
1362
1363         flags = smb_messages[type].flags;
1364
1365         /* In share mode security we must ignore the vuid. */
1366         session_tag = (lp_security() == SEC_SHARE)
1367                 ? UID_FIELD_INVALID : req->vuid;
1368         conn = req->conn;
1369
1370         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1371                  (int)sys_getpid(), (unsigned long)conn));
1372
1373         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1374
1375         /* Ensure this value is replaced in the incoming packet. */
1376         SSVAL(req->inbuf,smb_uid,session_tag);
1377
1378         /*
1379          * Ensure the correct username is in current_user_info.  This is a
1380          * really ugly bugfix for problems with multiple session_setup_and_X's
1381          * being done and allowing %U and %G substitutions to work correctly.
1382          * There is a reason this code is done here, don't move it unless you
1383          * know what you're doing... :-).
1384          * JRA.
1385          */
1386
1387         if (session_tag != last_session_tag) {
1388                 user_struct *vuser = NULL;
1389
1390                 last_session_tag = session_tag;
1391                 if(session_tag != UID_FIELD_INVALID) {
1392                         vuser = get_valid_user_struct(session_tag);
1393                         if (vuser) {
1394                                 set_current_user_info(
1395                                         vuser->server_info->sanitized_username,
1396                                         vuser->server_info->unix_name,
1397                                         pdb_get_fullname(vuser->server_info
1398                                                          ->sam_account),
1399                                         pdb_get_domain(vuser->server_info
1400                                                        ->sam_account));
1401                         }
1402                 }
1403         }
1404
1405         /* Does this call need to be run as the connected user? */
1406         if (flags & AS_USER) {
1407
1408                 /* Does this call need a valid tree connection? */
1409                 if (!conn) {
1410                         /*
1411                          * Amazingly, the error code depends on the command
1412                          * (from Samba4).
1413                          */
1414                         if (type == SMBntcreateX) {
1415                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1416                         } else {
1417                                 reply_doserror(req, ERRSRV, ERRinvnid);
1418                         }
1419                         return NULL;
1420                 }
1421
1422                 if (!change_to_user(conn,session_tag)) {
1423                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1424                         return conn;
1425                 }
1426
1427                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1428
1429                 /* Does it need write permission? */
1430                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1431                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1432                         return conn;
1433                 }
1434
1435                 /* IPC services are limited */
1436                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1437                         reply_doserror(req, ERRSRV,ERRaccess);
1438                         return conn;
1439                 }
1440         } else {
1441                 /* This call needs to be run as root */
1442                 change_to_root_user();
1443         }
1444
1445         /* load service specific parameters */
1446         if (conn) {
1447                 if (req->encrypted) {
1448                         conn->encrypted_tid = true;
1449                         /* encrypted required from now on. */
1450                         conn->encrypt_level = Required;
1451                 } else if (ENCRYPTION_REQUIRED(conn)) {
1452                         uint8 com = CVAL(req->inbuf,smb_com);
1453                         if (com != SMBtrans2 && com != SMBtranss2) {
1454                                 exit_server_cleanly("encryption required "
1455                                         "on connection");
1456                                 return conn;
1457                         }
1458                 }
1459
1460                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1461                                          (flags & (AS_USER|DO_CHDIR)
1462                                           ?True:False))) {
1463                         reply_doserror(req, ERRSRV, ERRaccess);
1464                         return conn;
1465                 }
1466                 conn->num_smb_operations++;
1467         }
1468
1469         /* does this protocol need to be run as guest? */
1470         if ((flags & AS_GUEST)
1471             && (!change_to_guest() ||
1472                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1473                               lp_hostsdeny(-1)))) {
1474                 reply_doserror(req, ERRSRV, ERRaccess);
1475                 return conn;
1476         }
1477
1478         smb_messages[type].fn(req);
1479         return req->conn;
1480 }
1481
1482 /****************************************************************************
1483  Construct a reply to the incoming packet.
1484 ****************************************************************************/
1485
1486 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1487 {
1488         uint8 type = CVAL(inbuf,smb_com);
1489         connection_struct *conn;
1490         struct smb_request *req;
1491
1492         chain_size = 0;
1493
1494         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1495                 smb_panic("could not allocate smb_request");
1496         }
1497         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1498
1499         conn = switch_message(type, req, size);
1500
1501         if (req->unread_bytes) {
1502                 /* writeX failed. drain socket. */
1503                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1504                                 req->unread_bytes) {
1505                         smb_panic("failed to drain pending bytes");
1506                 }
1507                 req->unread_bytes = 0;
1508         }
1509
1510         if (req->outbuf == NULL) {
1511                 return;
1512         }
1513
1514         if (CVAL(req->outbuf,0) == 0) {
1515                 show_msg((char *)req->outbuf);
1516         }
1517
1518         if (!srv_send_smb(smbd_server_fd(),
1519                         (char *)req->outbuf,
1520                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1521                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1522         }
1523
1524         TALLOC_FREE(req);
1525
1526         return;
1527 }
1528
1529 /****************************************************************************
1530  Process an smb from the client
1531 ****************************************************************************/
1532
1533 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1534 {
1535         static int trans_num;
1536         int msg_type = CVAL(inbuf,0);
1537
1538         DO_PROFILE_INC(smb_count);
1539
1540         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1541                     smb_len(inbuf) ) );
1542         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1543                                 (int)nread,
1544                                 (unsigned int)unread_bytes ));
1545
1546         if (msg_type != 0) {
1547                 /*
1548                  * NetBIOS session request, keepalive, etc.
1549                  */
1550                 reply_special(inbuf);
1551                 return;
1552         }
1553
1554         show_msg(inbuf);
1555
1556         construct_reply(inbuf,nread,unread_bytes,encrypted);
1557
1558         trans_num++;
1559 }
1560
1561 /****************************************************************************
1562  Return a string containing the function name of a SMB command.
1563 ****************************************************************************/
1564
1565 const char *smb_fn_name(int type)
1566 {
1567         const char *unknown_name = "SMBunknown";
1568
1569         if (smb_messages[type].name == NULL)
1570                 return(unknown_name);
1571
1572         return(smb_messages[type].name);
1573 }
1574
1575 /****************************************************************************
1576  Helper functions for contruct_reply.
1577 ****************************************************************************/
1578
1579 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1580
1581 void add_to_common_flags2(uint32 v)
1582 {
1583         common_flags2 |= v;
1584 }
1585
1586 void remove_from_common_flags2(uint32 v)
1587 {
1588         common_flags2 &= ~v;
1589 }
1590
1591 void construct_reply_common(const char *inbuf, char *outbuf)
1592 {
1593         srv_set_message(outbuf,0,0,false);
1594         
1595         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1596         SIVAL(outbuf,smb_rcls,0);
1597         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES)); 
1598         SSVAL(outbuf,smb_flg2,
1599                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1600                 common_flags2);
1601         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1602
1603         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1604         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1605         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1606         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1607 }
1608
1609 /****************************************************************************
1610  Construct a chained reply and add it to the already made reply
1611 ****************************************************************************/
1612
1613 void chain_reply(struct smb_request *req)
1614 {
1615         static char *orig_inbuf;
1616
1617         /*
1618          * Dirty little const_discard: We mess with req->inbuf, which is
1619          * declared as const. If maybe at some point this routine gets
1620          * rewritten, this const_discard could go away.
1621          */
1622         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1623         int size = smb_len(req->inbuf)+4;
1624
1625         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1626         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1627         char *inbuf2;
1628         int outsize2;
1629         int new_size;
1630         char inbuf_saved[smb_wct];
1631         char *outbuf = (char *)req->outbuf;
1632         size_t outsize = smb_len(outbuf) + 4;
1633         size_t outsize_padded;
1634         size_t padding;
1635         size_t ofs, to_move;
1636
1637         struct smb_request *req2;
1638         size_t caller_outputlen;
1639         char *caller_output;
1640
1641         /* Maybe its not chained, or it's an error packet. */
1642         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1643                 SCVAL(outbuf,smb_vwv0,0xFF);
1644                 return;
1645         }
1646
1647         if (chain_size == 0) {
1648                 /* this is the first part of the chain */
1649                 orig_inbuf = inbuf;
1650         }
1651
1652         /*
1653          * We need to save the output the caller added to the chain so that we
1654          * can splice it into the final output buffer later.
1655          */
1656
1657         caller_outputlen = outsize - smb_wct;
1658
1659         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1660
1661         if (caller_output == NULL) {
1662                 /* TODO: NT_STATUS_NO_MEMORY */
1663                 smb_panic("could not dup outbuf");
1664         }
1665
1666         /*
1667          * The original Win95 redirector dies on a reply to
1668          * a lockingX and read chain unless the chain reply is
1669          * 4 byte aligned. JRA.
1670          */
1671
1672         outsize_padded = (outsize + 3) & ~3;
1673         padding = outsize_padded - outsize;
1674
1675         /*
1676          * remember how much the caller added to the chain, only counting
1677          * stuff after the parameter words
1678          */
1679         chain_size += (outsize_padded - smb_wct);
1680
1681         /*
1682          * work out pointers into the original packets. The
1683          * headers on these need to be filled in
1684          */
1685         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1686
1687         /* remember the original command type */
1688         smb_com1 = CVAL(orig_inbuf,smb_com);
1689
1690         /* save the data which will be overwritten by the new headers */
1691         memcpy(inbuf_saved,inbuf2,smb_wct);
1692
1693         /* give the new packet the same header as the last part of the SMB */
1694         memmove(inbuf2,inbuf,smb_wct);
1695
1696         /* create the in buffer */
1697         SCVAL(inbuf2,smb_com,smb_com2);
1698
1699         /* work out the new size for the in buffer. */
1700         new_size = size - (inbuf2 - inbuf);
1701         if (new_size < 0) {
1702                 DEBUG(0,("chain_reply: chain packet size incorrect "
1703                          "(orig size = %d, offset = %d)\n",
1704                          size, (int)(inbuf2 - inbuf) ));
1705                 exit_server_cleanly("Bad chained packet");
1706                 return;
1707         }
1708
1709         /* And set it in the header. */
1710         smb_setlen(inbuf2, new_size - 4);
1711
1712         DEBUG(3,("Chained message\n"));
1713         show_msg(inbuf2);
1714
1715         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1716                 smb_panic("could not allocate smb_request");
1717         }
1718         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1719         req2->chain_fsp = req->chain_fsp;
1720
1721         /* process the request */
1722         switch_message(smb_com2, req2, new_size);
1723
1724         /*
1725          * We don't accept deferred operations in chained requests.
1726          */
1727         SMB_ASSERT(req2->outbuf != NULL);
1728         outsize2 = smb_len(req2->outbuf)+4;
1729
1730         /*
1731          * Move away the new command output so that caller_output fits in,
1732          * copy in the caller_output saved above.
1733          */
1734
1735         SMB_ASSERT(outsize_padded >= smb_wct);
1736
1737         /*
1738          * "ofs" is the space we need for caller_output. Equal to
1739          * caller_outputlen plus the padding.
1740          */
1741
1742         ofs = outsize_padded - smb_wct;
1743
1744         /*
1745          * "to_move" is the amount of bytes the secondary routine gave us
1746          */
1747
1748         to_move = outsize2 - smb_wct;
1749
1750         if (to_move + ofs + smb_wct + chain_size > max_send) {
1751                 smb_panic("replies too large -- would have to cut");
1752         }
1753
1754         /*
1755          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1756          * the first request in the chain. So we have to re-allocate it. In
1757          * the "old" API the only outbuf ever used is the global OutBuffer
1758          * which is always large enough.
1759          */
1760
1761         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1762                                       to_move + ofs + smb_wct);
1763         if (outbuf == NULL) {
1764                 smb_panic("could not realloc outbuf");
1765         }
1766
1767         req->outbuf = (uint8 *)outbuf;
1768
1769         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1770         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1771
1772         /*
1773          * copy the new reply header over the old one but preserve the smb_com
1774          * field
1775          */
1776         memmove(outbuf, req2->outbuf, smb_wct);
1777         SCVAL(outbuf, smb_com, smb_com1);
1778
1779         /*
1780          * We've just copied in the whole "wct" area from the secondary
1781          * function. Fix up the chaining: com2 and the offset need to be
1782          * readjusted.
1783          */
1784
1785         SCVAL(outbuf, smb_vwv0, smb_com2);
1786         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1787
1788         if (padding != 0) {
1789
1790                 /*
1791                  * Due to padding we have some uninitialized bytes after the
1792                  * caller's output
1793                  */
1794
1795                 memset(outbuf + outsize, 0, padding);
1796         }
1797
1798         smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1799
1800         /*
1801          * restore the saved data, being careful not to overwrite any data
1802          * from the reply header
1803          */
1804         memcpy(inbuf2,inbuf_saved,smb_wct);
1805
1806         SAFE_FREE(caller_output);
1807         TALLOC_FREE(req2);
1808
1809         /*
1810          * Reset the chain_size for our caller's offset calculations
1811          */
1812
1813         chain_size -= (outsize_padded - smb_wct);
1814
1815         return;
1816 }
1817
1818 /****************************************************************************
1819  Check if services need reloading.
1820 ****************************************************************************/
1821
1822 void check_reload(time_t t)
1823 {
1824         static pid_t mypid = 0;
1825         static time_t last_smb_conf_reload_time = 0;
1826         static time_t last_printer_reload_time = 0;
1827         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1828
1829         if(last_smb_conf_reload_time == 0) {
1830                 last_smb_conf_reload_time = t;
1831                 /* Our printing subsystem might not be ready at smbd start up.
1832                    Then no printer is available till the first printers check
1833                    is performed.  A lower initial interval circumvents this. */
1834                 if ( printcap_cache_time > 60 )
1835                         last_printer_reload_time = t - printcap_cache_time + 60;
1836                 else
1837                         last_printer_reload_time = t;
1838         }
1839
1840         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1841                 /* randomize over 60 second the printcap reload to avoid all
1842                  * process hitting cupsd at the same time */
1843                 int time_range = 60;
1844
1845                 last_printer_reload_time += random() % time_range;
1846                 mypid = getpid();
1847         }
1848
1849         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1850                 reload_services(True);
1851                 reload_after_sighup = False;
1852                 last_smb_conf_reload_time = t;
1853         }
1854
1855         /* 'printcap cache time = 0' disable the feature */
1856         
1857         if ( printcap_cache_time != 0 )
1858         { 
1859                 /* see if it's time to reload or if the clock has been set back */
1860                 
1861                 if ( (t >= last_printer_reload_time+printcap_cache_time) 
1862                         || (t-last_printer_reload_time  < 0) ) 
1863                 {
1864                         DEBUG( 3,( "Printcap cache time expired.\n"));
1865                         reload_printers();
1866                         last_printer_reload_time = t;
1867                 }
1868         }
1869 }
1870
1871 /****************************************************************************
1872  Process commands from the client
1873 ****************************************************************************/
1874
1875 void smbd_process(void)
1876 {
1877         unsigned int num_smbs = 0;
1878         size_t unread_bytes = 0;
1879
1880         char addr[INET6_ADDRSTRLEN];
1881
1882         /*
1883          * Before the first packet, check the global hosts allow/ hosts deny
1884          * parameters before doing any parsing of packets passed to us by the
1885          * client. This prevents attacks on our parsing code from hosts not in
1886          * the hosts allow list.
1887          */
1888
1889         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1890                           lp_hostsdeny(-1))) {
1891                 /*
1892                  * send a negative session response "not listening on calling
1893                  * name"
1894                  */
1895                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1896                 DEBUG( 1, ("Connection denied from %s\n",
1897                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1898                 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1899                 exit_server_cleanly("connection denied");
1900         }
1901
1902         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1903
1904         while (True) {
1905                 NTSTATUS status;
1906                 char *inbuf = NULL;
1907                 size_t inbuf_len = 0;
1908                 bool encrypted = false;
1909                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1910
1911                 errno = 0;
1912
1913                 run_events(smbd_event_context(), 0, NULL, NULL);
1914
1915                 status = receive_message_or_smb(
1916                         talloc_tos(), &inbuf, &inbuf_len,
1917                         &unread_bytes, &encrypted);
1918
1919                 if (!NT_STATUS_IS_OK(status)) {
1920                         DEBUG(3, ("receive_message_or_smb failed: %s, "
1921                                   "exiting\n", nt_errstr(status)));
1922                         return;
1923                 }
1924
1925                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1926
1927                 TALLOC_FREE(inbuf);
1928
1929                 num_smbs++;
1930
1931                 /* The timeout_processing function isn't run nearly
1932                    often enough to implement 'max log size' without
1933                    overrunning the size of the file by many megabytes.
1934                    This is especially true if we are running at debug
1935                    level 10.  Checking every 50 SMBs is a nice
1936                    tradeoff of performance vs log file size overrun. */
1937
1938                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1939                         change_to_root_user();
1940                         check_log_size();
1941                 }
1942                 TALLOC_FREE(frame);
1943         }
1944 }