source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43 #include "system/threads.h"
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct tevent_timer *te;
  51         struct smb_perfcount_data pcd;
  52         uint32_t seqnum;
  53         bool encrypted;
  54         bool processed;
  55         DATA_BLOB buf;
  56         struct deferred_open_record *open_rec;
  57 };
  58
  59 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  60                                    char *outbuf);
  61 static struct pending_message_list *get_deferred_open_message_smb(
  62         struct smbd_server_connection *sconn, uint64_t mid);
  63 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  64
  65 void smbd_echo_init(struct smbd_server_connection *sconn)
  66 {
  67         sconn->smb1.echo_handler.trusted_fd = -1;
  68         sconn->smb1.echo_handler.socket_lock_fd = -1;
  69 #ifdef HAVE_ROBUST_MUTEXES
  70         sconn->smb1.echo_handler.socket_mutex = NULL;
  71 #endif
  72 }
  73
  74 static bool smbd_echo_active(struct smbd_server_connection *sconn)
  75 {
  76         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
  77                 return true;
  78         }
  79
  80 #ifdef HAVE_ROBUST_MUTEXES
  81         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
  82                 return true;
  83         }
  84 #endif
  85
  86         return false;
  87 }
  88
  89 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  90 {
  91         if (!smbd_echo_active(sconn)) {
  92                 return true;
  93         }
  94
  95         sconn->smb1.echo_handler.ref_count++;
  96
  97         if (sconn->smb1.echo_handler.ref_count > 1) {
  98                 return true;
  99         }
 100
 101         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 102
 103 #ifdef HAVE_ROBUST_MUTEXES
 104         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
 105                 int ret = EINTR;
 106
 107                 while (ret == EINTR) {
 108                         ret = pthread_mutex_lock(
 109                                 sconn->smb1.echo_handler.socket_mutex);
 110                         if (ret == 0) {
 111                                 break;
 112                         }
 113                 }
 114                 if (ret != 0) {
 115                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 116                                   strerror(ret)));
 117                         return false;
 118                 }
 119         }
 120 #endif
 121
 122         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
 123                 bool ok;
 124
 125                 do {
 126                         ok = fcntl_lock(
 127                                 sconn->smb1.echo_handler.socket_lock_fd,
 128                                 F_SETLKW, 0, 0, F_WRLCK);
 129                 } while (!ok && (errno == EINTR));
 130
 131                 if (!ok) {
 132                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 133                         return false;
 134                 }
 135         }
 136
 137         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 138
 139         return true;
 140 }
 141
 142 void smbd_lock_socket(struct smbd_server_connection *sconn)
 143 {
 144         if (!smbd_lock_socket_internal(sconn)) {
 145                 exit_server_cleanly("failed to lock socket");
 146         }
 147 }
 148
 149 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 150 {
 151         if (!smbd_echo_active(sconn)) {
 152                 return true;
 153         }
 154
 155         sconn->smb1.echo_handler.ref_count--;
 156
 157         if (sconn->smb1.echo_handler.ref_count > 0) {
 158                 return true;
 159         }
 160
 161 #ifdef HAVE_ROBUST_MUTEXES
 162         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
 163                 int ret = EINTR;
 164
 165                 while (ret == EINTR) {
 166                         ret = pthread_mutex_unlock(
 167                                 sconn->smb1.echo_handler.socket_mutex);
 168                         if (ret == 0) {
 169                                 break;
 170                         }
 171                 }
 172                 if (ret != 0) {
 173                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 174                                   strerror(ret)));
 175                         return false;
 176                 }
 177         }
 178 #endif
 179
 180         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
 181                 bool ok;
 182
 183                 do {
 184                         ok = fcntl_lock(
 185                                 sconn->smb1.echo_handler.socket_lock_fd,
 186                                 F_SETLKW, 0, 0, F_UNLCK);
 187                 } while (!ok && (errno == EINTR));
 188
 189                 if (!ok) {
 190                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 191                         return false;
 192                 }
 193         }
 194
 195         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 196
 197         return true;
 198 }
 199
 200 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 201 {
 202         if (!smbd_unlock_socket_internal(sconn)) {
 203                 exit_server_cleanly("failed to unlock socket");
 204         }
 205 }
 206
 207 /* Accessor function for smb_read_error for smbd functions. */
 208
 209 /****************************************************************************
 210  Send an smb to a fd.
 211 ****************************************************************************/
 212
 213 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 214                   bool do_signing, uint32_t seqnum,
 215                   bool do_encrypt,
 216                   struct smb_perfcount_data *pcd)
 217 {
 218         struct smbXsrv_connection *xconn = sconn->conn;
 219         size_t len = 0;
 220         ssize_t ret;
 221         char *buf_out = buffer;
 222
 223         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 224                 /*
 225                  * we're not supposed to do any io
 226                  */
 227                 return true;
 228         }
 229
 230         smbd_lock_socket(sconn);
 231
 232         if (do_signing) {
 233                 /* Sign the outgoing packet if required. */
 234                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 235         }
 236
 237         if (do_encrypt) {
 238                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 239                 if (!NT_STATUS_IS_OK(status)) {
 240                         DEBUG(0, ("send_smb: SMB encryption failed "
 241                                 "on outgoing packet! Error %s\n",
 242                                 nt_errstr(status) ));
 243                         ret = -1;
 244                         goto out;
 245                 }
 246         }
 247
 248         len = smb_len_large(buf_out) + 4;
 249
 250         ret = write_data(xconn->transport.sock, buf_out, len);
 251         if (ret <= 0) {
 252                 int saved_errno = errno;
 253                 /*
 254                  * Try and give an error message saying what
 255                  * client failed.
 256                  */
 257                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 258                          (int)getpid(), (int)len,
 259                          smbXsrv_connection_dbg(xconn),
 260                          (int)ret, strerror(saved_errno)));
 261                 errno = saved_errno;
 262
 263                 srv_free_enc_buffer(sconn, buf_out);
 264                 goto out;
 265         }
 266
 267         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 268         srv_free_enc_buffer(sconn, buf_out);
 269 out:
 270         SMB_PERFCOUNT_END(pcd);
 271
 272         smbd_unlock_socket(sconn);
 273         return (ret > 0);
 274 }
 275
 276 /*******************************************************************
 277  Setup the word count and byte count for a smb message.
 278 ********************************************************************/
 279
 280 int srv_set_message(char *buf,
 281                         int num_words,
 282                         int num_bytes,
 283                         bool zero)
 284 {
 285         if (zero && (num_words || num_bytes)) {
 286                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 287         }
 288         SCVAL(buf,smb_wct,num_words);
 289         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 290         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 291         return (smb_size + num_words*2 + num_bytes);
 292 }
 293
 294 static bool valid_smb_header(struct smbd_server_connection *sconn,
 295                              const uint8_t *inbuf)
 296 {
 297         if (is_encrypted_packet(sconn, inbuf)) {
 298                 return true;
 299         }
 300         /*
 301          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 302          * but it just looks weird to call strncmp for this one.
 303          */
 304         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 305 }
 306
 307 /* Socket functions for smbd packet processing. */
 308
 309 static bool valid_packet_size(size_t len)
 310 {
 311         /*
 312          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 313          * of header. Don't print the error if this fits.... JRA.
 314          */
 315
 316         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 317                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 318                                         (unsigned long)len));
 319                 return false;
 320         }
 321         return true;
 322 }
 323
 324 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 325                                       unsigned int timeout, ssize_t len)
 326 {
 327         NTSTATUS status;
 328
 329         if (len <= 0) {
 330                 return NT_STATUS_OK;
 331         }
 332
 333         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 char addr[INET6_ADDRSTRLEN];
 336                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 337                           "error = %s.\n",
 338                           get_peer_addr(fd, addr, sizeof(addr)),
 339                           nt_errstr(status)));
 340         }
 341         return status;
 342 }
 343
 344 /****************************************************************************
 345  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 346 ****************************************************************************/
 347
 348 /*
 349  * Unfortunately, earlier versions of smbclient/libsmbclient
 350  * don't send this "standard" writeX header. I've fixed this
 351  * for 3.2 but we'll use the old method with earlier versions.
 352  * Windows and CIFSFS at least use this standard size. Not
 353  * sure about MacOSX.
 354  */
 355
 356 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 357                                 (2*14) + /* word count (including bcc) */ \
 358                                 1 /* pad byte */)
 359
 360 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 361                                                     const char lenbuf[4],
 362                                                     struct smbd_server_connection *sconn,
 363                                                     int sock,
 364                                                     char **buffer,
 365                                                     unsigned int timeout,
 366                                                     size_t *p_unread,
 367                                                     size_t *len_ret)
 368 {
 369         /* Size of a WRITEX call (+4 byte len). */
 370         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 371         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 372         ssize_t toread;
 373         NTSTATUS status;
 374
 375         memcpy(writeX_header, lenbuf, 4);
 376
 377         status = read_fd_with_timeout(
 378                 sock, writeX_header + 4,
 379                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 380                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 381                 timeout, NULL);
 382
 383         if (!NT_STATUS_IS_OK(status)) {
 384                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 385                           "error = %s.\n",
 386                           tsocket_address_string(sconn->remote_address,
 387                                                  talloc_tos()),
 388                           nt_errstr(status)));
 389                 return status;
 390         }
 391
 392         /*
 393          * Ok - now try and see if this is a possible
 394          * valid writeX call.
 395          */
 396
 397         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 398                 /*
 399                  * If the data offset is beyond what
 400                  * we've read, drain the extra bytes.
 401                  */
 402                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 403                 ssize_t newlen;
 404
 405                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 406                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 407                         if (drain_socket(sock, drain) != drain) {
 408                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 409                                         " failed to drain pending bytes");
 410                         }
 411                 } else {
 412                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 413                 }
 414
 415                 /* Spoof down the length and null out the bcc. */
 416                 set_message_bcc(writeX_header, 0);
 417                 newlen = smb_len(writeX_header);
 418
 419                 /* Copy the header we've written. */
 420
 421                 *buffer = (char *)talloc_memdup(mem_ctx,
 422                                 writeX_header,
 423                                 sizeof(writeX_header));
 424
 425                 if (*buffer == NULL) {
 426                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 427                                   (int)sizeof(writeX_header)));
 428                         return NT_STATUS_NO_MEMORY;
 429                 }
 430
 431                 /* Work out the remaining bytes. */
 432                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 433                 *len_ret = newlen + 4;
 434                 return NT_STATUS_OK;
 435         }
 436
 437         if (!valid_packet_size(len)) {
 438                 return NT_STATUS_INVALID_PARAMETER;
 439         }
 440
 441         /*
 442          * Not a valid writeX call. Just do the standard
 443          * talloc and return.
 444          */
 445
 446         *buffer = talloc_array(mem_ctx, char, len+4);
 447
 448         if (*buffer == NULL) {
 449                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 450                           (int)len+4));
 451                 return NT_STATUS_NO_MEMORY;
 452         }
 453
 454         /* Copy in what we already read. */
 455         memcpy(*buffer,
 456                 writeX_header,
 457                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 458         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 459
 460         if(toread > 0) {
 461                 status = read_packet_remainder(
 462                         sock,
 463                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 464                         timeout, toread);
 465
 466                 if (!NT_STATUS_IS_OK(status)) {
 467                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 468                                    nt_errstr(status)));
 469                         return status;
 470                 }
 471         }
 472
 473         *len_ret = len + 4;
 474         return NT_STATUS_OK;
 475 }
 476
 477 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 478                                        struct smbd_server_connection *sconn,
 479                                        int sock,
 480                                        char **buffer, unsigned int timeout,
 481                                        size_t *p_unread, size_t *plen)
 482 {
 483         struct smbXsrv_connection *xconn = sconn->conn;
 484         char lenbuf[4];
 485         size_t len;
 486         int min_recv_size = lp_min_receive_file_size();
 487         NTSTATUS status;
 488
 489         *p_unread = 0;
 490
 491         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 492                                                   &len);
 493         if (!NT_STATUS_IS_OK(status)) {
 494                 return status;
 495         }
 496
 497         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 498             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 499                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 500             !srv_is_signing_active(xconn) &&
 501             sconn->smb1.echo_handler.trusted_fde == NULL) {
 502
 503                 return receive_smb_raw_talloc_partial_read(
 504                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 505                         p_unread, plen);
 506         }
 507
 508         if (!valid_packet_size(len)) {
 509                 return NT_STATUS_INVALID_PARAMETER;
 510         }
 511
 512         /*
 513          * The +4 here can't wrap, we've checked the length above already.
 514          */
 515
 516         *buffer = talloc_array(mem_ctx, char, len+4);
 517
 518         if (*buffer == NULL) {
 519                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 520                           (int)len+4));
 521                 return NT_STATUS_NO_MEMORY;
 522         }
 523
 524         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 525
 526         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 527         if (!NT_STATUS_IS_OK(status)) {
 528                 return status;
 529         }
 530
 531         *plen = len + 4;
 532         return NT_STATUS_OK;
 533 }
 534
 535 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 536                                    struct smbd_server_connection *sconn,
 537                                    int sock,
 538                                    char **buffer, unsigned int timeout,
 539                                    size_t *p_unread, bool *p_encrypted,
 540                                    size_t *p_len,
 541                                    uint32_t *seqnum,
 542                                    bool trusted_channel)
 543 {
 544         struct smbXsrv_connection *xconn = sconn->conn;
 545         size_t len = 0;
 546         NTSTATUS status;
 547
 548         *p_encrypted = false;
 549
 550         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 551                                         p_unread, &len);
 552         if (!NT_STATUS_IS_OK(status)) {
 553                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 554                       ("receive_smb_raw_talloc failed for client %s "
 555                        "read error = %s.\n",
 556                        tsocket_address_string(sconn->remote_address,
 557                                               talloc_tos()),
 558                        nt_errstr(status)) );
 559                 return status;
 560         }
 561
 562         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 563                 status = srv_decrypt_buffer(sconn, *buffer);
 564                 if (!NT_STATUS_IS_OK(status)) {
 565                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 566                                 "incoming packet! Error %s\n",
 567                                 nt_errstr(status) ));
 568                         return status;
 569                 }
 570                 *p_encrypted = true;
 571         }
 572
 573         /* Check the incoming SMB signature. */
 574         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 575                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 576                           "incoming packet!\n"));
 577                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 578         }
 579
 580         *p_len = len;
 581         return NT_STATUS_OK;
 582 }
 583
 584 /*
 585  * Initialize a struct smb_request from an inbuf
 586  */
 587
 588 static bool init_smb_request(struct smb_request *req,
 589                              struct smbd_server_connection *sconn,
 590                              const uint8 *inbuf,
 591                              size_t unread_bytes, bool encrypted,
 592                              uint32_t seqnum)
 593 {
 594         struct smbXsrv_tcon *tcon;
 595         NTSTATUS status;
 596         NTTIME now;
 597         size_t req_size = smb_len(inbuf) + 4;
 598
 599         /* Ensure we have at least smb_size bytes. */
 600         if (req_size < smb_size) {
 601                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 602                         (unsigned int)req_size ));
 603                 return false;
 604         }
 605
 606         req->request_time = timeval_current();
 607         now = timeval_to_nttime(&req->request_time);
 608
 609         req->cmd    = CVAL(inbuf, smb_com);
 610         req->flags2 = SVAL(inbuf, smb_flg2);
 611         req->smbpid = SVAL(inbuf, smb_pid);
 612         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 613         req->seqnum = seqnum;
 614         req->vuid   = SVAL(inbuf, smb_uid);
 615         req->tid    = SVAL(inbuf, smb_tid);
 616         req->wct    = CVAL(inbuf, smb_wct);
 617         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 618         req->buflen = smb_buflen(inbuf);
 619         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 620         req->unread_bytes = unread_bytes;
 621         req->encrypted = encrypted;
 622         req->sconn = sconn;
 623         status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
 624         if (NT_STATUS_IS_OK(status)) {
 625                 req->conn = tcon->compat;
 626         } else {
 627                 req->conn = NULL;
 628         }
 629         req->chain_fsp = NULL;
 630         req->smb2req = NULL;
 631         req->priv_paths = NULL;
 632         req->chain = NULL;
 633         smb_init_perfcount_data(&req->pcd);
 634
 635         /* Ensure we have at least wct words and 2 bytes of bcc. */
 636         if (smb_size + req->wct*2 > req_size) {
 637                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 638                         (unsigned int)req->wct,
 639                         (unsigned int)req_size));
 640                 return false;
 641         }
 642         /* Ensure bcc is correct. */
 643         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 644                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 645                         "(wct = %u, size %u)\n",
 646                         (unsigned int)req->buflen,
 647                         (unsigned int)req->wct,
 648                         (unsigned int)req_size));
 649                 return false;
 650         }
 651
 652         req->outbuf = NULL;
 653         return true;
 654 }
 655
 656 static void process_smb(struct smbd_server_connection *conn,
 657                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 658                         uint32_t seqnum, bool encrypted,
 659                         struct smb_perfcount_data *deferred_pcd);
 660
 661 static void smbd_deferred_open_timer(struct tevent_context *ev,
 662                                      struct tevent_timer *te,
 663                                      struct timeval _tval,
 664                                      void *private_data)
 665 {
 666         struct pending_message_list *msg = talloc_get_type(private_data,
 667                                            struct pending_message_list);
 668         struct smbd_server_connection *sconn = msg->sconn;
 669         TALLOC_CTX *mem_ctx = talloc_tos();
 670         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 671         uint8_t *inbuf;
 672
 673         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 674                                          msg->buf.length);
 675         if (inbuf == NULL) {
 676                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 677                 return;
 678         }
 679
 680         /* We leave this message on the queue so the open code can
 681            know this is a retry. */
 682         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 683                 (unsigned long long)mid ));
 684
 685         /* Mark the message as processed so this is not
 686          * re-processed in error. */
 687         msg->processed = true;
 688
 689         process_smb(sconn, inbuf,
 690                     msg->buf.length, 0,
 691                     msg->seqnum, msg->encrypted, &msg->pcd);
 692
 693         /* If it's still there and was processed, remove it. */
 694         msg = get_deferred_open_message_smb(sconn, mid);
 695         if (msg && msg->processed) {
 696                 remove_deferred_open_message_smb(sconn, mid);
 697         }
 698 }
 699
 700 /****************************************************************************
 701  Function to push a message onto the tail of a linked list of smb messages ready
 702  for processing.
 703 ****************************************************************************/
 704
 705 static bool push_queued_message(struct smb_request *req,
 706                                 struct timeval request_time,
 707                                 struct timeval end_time,
 708                                 struct deferred_open_record *open_rec)
 709 {
 710         int msg_len = smb_len(req->inbuf) + 4;
 711         struct pending_message_list *msg;
 712
 713         msg = talloc_zero(NULL, struct pending_message_list);
 714
 715         if(msg == NULL) {
 716                 DEBUG(0,("push_message: malloc fail (1)\n"));
 717                 return False;
 718         }
 719         msg->sconn = req->sconn;
 720
 721         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 722         if(msg->buf.data == NULL) {
 723                 DEBUG(0,("push_message: malloc fail (2)\n"));
 724                 TALLOC_FREE(msg);
 725                 return False;
 726         }
 727
 728         msg->request_time = request_time;
 729         msg->seqnum = req->seqnum;
 730         msg->encrypted = req->encrypted;
 731         msg->processed = false;
 732         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 733
 734         if (open_rec) {
 735                 msg->open_rec = talloc_move(msg, &open_rec);
 736         }
 737
 738 #if 0
 739         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 740                                    msg,
 741                                    end_time,
 742                                    smbd_deferred_open_timer,
 743                                    msg);
 744         if (!msg->te) {
 745                 DEBUG(0,("push_message: event_add_timed failed\n"));
 746                 TALLOC_FREE(msg);
 747                 return false;
 748         }
 749 #endif
 750
 751         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 752                       struct pending_message_list *);
 753
 754         DEBUG(10,("push_message: pushed message length %u on "
 755                   "deferred_open_queue\n", (unsigned int)msg_len));
 756
 757         return True;
 758 }
 759
 760 /****************************************************************************
 761  Function to delete a sharing violation open message by mid.
 762 ****************************************************************************/
 763
 764 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 765                                       uint64_t mid)
 766 {
 767         struct pending_message_list *pml;
 768
 769         if (sconn->using_smb2) {
 770                 remove_deferred_open_message_smb2(sconn, mid);
 771                 return;
 772         }
 773
 774         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 775                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 776                         DEBUG(10,("remove_deferred_open_message_smb: "
 777                                   "deleting mid %llu len %u\n",
 778                                   (unsigned long long)mid,
 779                                   (unsigned int)pml->buf.length ));
 780                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 781                         TALLOC_FREE(pml);
 782                         return;
 783                 }
 784         }
 785 }
 786
 787 /****************************************************************************
 788  Move a sharing violation open retry message to the front of the list and
 789  schedule it for immediate processing.
 790 ****************************************************************************/
 791
 792 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 793                                         uint64_t mid)
 794 {
 795         struct pending_message_list *pml;
 796         int i = 0;
 797
 798         if (sconn->using_smb2) {
 799                 return schedule_deferred_open_message_smb2(sconn, mid);
 800         }
 801
 802         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 803                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 804
 805                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 806                         "msg_mid = %llu\n",
 807                         i++,
 808                         (unsigned long long)msg_mid ));
 809
 810                 if (mid == msg_mid) {
 811                         struct tevent_timer *te;
 812
 813                         if (pml->processed) {
 814                                 /* A processed message should not be
 815                                  * rescheduled. */
 816                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 817                                         "message mid %llu was already processed\n",
 818                                         (unsigned long long)msg_mid ));
 819                                 continue;
 820                         }
 821
 822                         DEBUG(10,("schedule_deferred_open_message_smb: "
 823                                 "scheduling mid %llu\n",
 824                                 (unsigned long long)mid ));
 825
 826                         te = tevent_add_timer(pml->sconn->ev_ctx,
 827                                               pml,
 828                                               timeval_zero(),
 829                                               smbd_deferred_open_timer,
 830                                               pml);
 831                         if (!te) {
 832                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 833                                         "event_add_timed() failed, "
 834                                         "skipping mid %llu\n",
 835                                         (unsigned long long)msg_mid ));
 836                         }
 837
 838                         TALLOC_FREE(pml->te);
 839                         pml->te = te;
 840                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 841                         return true;
 842                 }
 843         }
 844
 845         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 846                 "find message mid %llu\n",
 847                 (unsigned long long)mid ));
 848
 849         return false;
 850 }
 851
 852 /****************************************************************************
 853  Return true if this mid is on the deferred queue and was not yet processed.
 854 ****************************************************************************/
 855
 856 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 857 {
 858         struct pending_message_list *pml;
 859
 860         if (sconn->using_smb2) {
 861                 return open_was_deferred_smb2(sconn, mid);
 862         }
 863
 864         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 865                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 866                         return True;
 867                 }
 868         }
 869         return False;
 870 }
 871
 872 /****************************************************************************
 873  Return the message queued by this mid.
 874 ****************************************************************************/
 875
 876 static struct pending_message_list *get_deferred_open_message_smb(
 877         struct smbd_server_connection *sconn, uint64_t mid)
 878 {
 879         struct pending_message_list *pml;
 880
 881         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 882                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 883                         return pml;
 884                 }
 885         }
 886         return NULL;
 887 }
 888
 889 /****************************************************************************
 890  Get the state data queued by this mid.
 891 ****************************************************************************/
 892
 893 bool get_deferred_open_message_state(struct smb_request *smbreq,
 894                                 struct timeval *p_request_time,
 895                                 struct deferred_open_record **open_rec)
 896 {
 897         struct pending_message_list *pml;
 898
 899         if (smbreq->sconn->using_smb2) {
 900                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 901                                         p_request_time,
 902                                         open_rec);
 903         }
 904
 905         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 906         if (!pml) {
 907                 return false;
 908         }
 909         if (p_request_time) {
 910                 *p_request_time = pml->request_time;
 911         }
 912         if (open_rec != NULL) {
 913                 *open_rec = pml->open_rec;
 914         }
 915         return true;
 916 }
 917
 918 /****************************************************************************
 919  Function to push a deferred open smb message onto a linked list of local smb
 920  messages ready for processing.
 921 ****************************************************************************/
 922
 923 bool push_deferred_open_message_smb(struct smb_request *req,
 924                                struct timeval request_time,
 925                                struct timeval timeout,
 926                                struct file_id id,
 927                                struct deferred_open_record *open_rec)
 928 {
 929         struct timeval end_time;
 930
 931         if (req->smb2req) {
 932                 return push_deferred_open_message_smb2(req->smb2req,
 933                                                 request_time,
 934                                                 timeout,
 935                                                 id,
 936                                                 open_rec);
 937         }
 938
 939         if (req->unread_bytes) {
 940                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 941                         "unread_bytes = %u\n",
 942                         (unsigned int)req->unread_bytes ));
 943                 smb_panic("push_deferred_open_message_smb: "
 944                         "logic error unread_bytes != 0" );
 945         }
 946
 947         end_time = timeval_sum(&request_time, &timeout);
 948
 949         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 950                 "len %u mid %llu timeout time [%u.%06u]\n",
 951                 (unsigned int) smb_len(req->inbuf)+4,
 952                 (unsigned long long)req->mid,
 953                 (unsigned int)end_time.tv_sec,
 954                 (unsigned int)end_time.tv_usec));
 955
 956         return push_queued_message(req, request_time, end_time, open_rec);
 957 }
 958
 959 static void smbd_sig_term_handler(struct tevent_context *ev,
 960                                   struct tevent_signal *se,
 961                                   int signum,
 962                                   int count,
 963                                   void *siginfo,
 964                                   void *private_data)
 965 {
 966         exit_server_cleanly("termination signal");
 967 }
 968
 969 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 970 {
 971         struct tevent_signal *se;
 972
 973         se = tevent_add_signal(sconn->ev_ctx,
 974                                sconn,
 975                                SIGTERM, 0,
 976                                smbd_sig_term_handler,
 977                                sconn);
 978         if (!se) {
 979                 exit_server("failed to setup SIGTERM handler");
 980         }
 981 }
 982
 983 static void smbd_sig_hup_handler(struct tevent_context *ev,
 984                                   struct tevent_signal *se,
 985                                   int signum,
 986                                   int count,
 987                                   void *siginfo,
 988                                   void *private_data)
 989 {
 990         struct smbd_server_connection *sconn =
 991                 talloc_get_type_abort(private_data,
 992                 struct smbd_server_connection);
 993
 994         change_to_root_user();
 995         DEBUG(1,("Reloading services after SIGHUP\n"));
 996         reload_services(sconn, conn_snum_used, false);
 997 }
 998
 999 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1000 {
1001         struct tevent_signal *se;
1002
1003         se = tevent_add_signal(sconn->ev_ctx,
1004                                sconn,
1005                                SIGHUP, 0,
1006                                smbd_sig_hup_handler,
1007                                sconn);
1008         if (!se) {
1009                 exit_server("failed to setup SIGHUP handler");
1010         }
1011 }
1012
1013 static void smbd_conf_updated(struct messaging_context *msg,
1014                               void *private_data,
1015                               uint32_t msg_type,
1016                               struct server_id server_id,
1017                               DATA_BLOB *data)
1018 {
1019         struct smbd_server_connection *sconn =
1020                 talloc_get_type_abort(private_data,
1021                 struct smbd_server_connection);
1022
1023         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1024                   "updated. Reloading.\n"));
1025         change_to_root_user();
1026         reload_services(sconn, conn_snum_used, false);
1027 }
1028
1029 /*
1030  * Only allow 5 outstanding trans requests. We're allocating memory, so
1031  * prevent a DoS.
1032  */
1033
1034 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1035 {
1036         int count = 0;
1037         for (; list != NULL; list = list->next) {
1038
1039                 if (list->mid == mid) {
1040                         return NT_STATUS_INVALID_PARAMETER;
1041                 }
1042
1043                 count += 1;
1044         }
1045         if (count > 5) {
1046                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1047         }
1048
1049         return NT_STATUS_OK;
1050 }
1051
1052 /*
1053 These flags determine some of the permissions required to do an operation
1054
1055 Note that I don't set NEED_WRITE on some write operations because they
1056 are used by some brain-dead clients when printing, and I don't want to
1057 force write permissions on print services.
1058 */
1059 #define AS_USER (1<<0)
1060 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1061 #define TIME_INIT (1<<2)
1062 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1063 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1064 #define DO_CHDIR (1<<6)
1065
1066 /*
1067    define a list of possible SMB messages and their corresponding
1068    functions. Any message that has a NULL function is unimplemented -
1069    please feel free to contribute implementations!
1070 */
1071 static const struct smb_message_struct {
1072         const char *name;
1073         void (*fn)(struct smb_request *req);
1074         int flags;
1075 } smb_messages[256] = {
1076
1077 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1078 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1079 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1080 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1081 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1082 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1083 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1084 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1085 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1086 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1087 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1088 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1089 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1090 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1091 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1092 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1093 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1094 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1095 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1096 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1097 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1098 /* 0x15 */ { NULL, NULL, 0 },
1099 /* 0x16 */ { NULL, NULL, 0 },
1100 /* 0x17 */ { NULL, NULL, 0 },
1101 /* 0x18 */ { NULL, NULL, 0 },
1102 /* 0x19 */ { NULL, NULL, 0 },
1103 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1104 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1105 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1106 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1107 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1108 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1109 /* 0x20 */ { "SMBwritec", NULL,0},
1110 /* 0x21 */ { NULL, NULL, 0 },
1111 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1112 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1113 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1114 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1115 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1116 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1117 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1118 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1119 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1120 /* 0x2b */ { "SMBecho",reply_echo,0},
1121 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1122 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1123 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1124 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1125 /* 0x30 */ { NULL, NULL, 0 },
1126 /* 0x31 */ { NULL, NULL, 0 },
1127 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1128 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1129 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1130 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1131 /* 0x36 */ { NULL, NULL, 0 },
1132 /* 0x37 */ { NULL, NULL, 0 },
1133 /* 0x38 */ { NULL, NULL, 0 },
1134 /* 0x39 */ { NULL, NULL, 0 },
1135 /* 0x3a */ { NULL, NULL, 0 },
1136 /* 0x3b */ { NULL, NULL, 0 },
1137 /* 0x3c */ { NULL, NULL, 0 },
1138 /* 0x3d */ { NULL, NULL, 0 },
1139 /* 0x3e */ { NULL, NULL, 0 },
1140 /* 0x3f */ { NULL, NULL, 0 },
1141 /* 0x40 */ { NULL, NULL, 0 },
1142 /* 0x41 */ { NULL, NULL, 0 },
1143 /* 0x42 */ { NULL, NULL, 0 },
1144 /* 0x43 */ { NULL, NULL, 0 },
1145 /* 0x44 */ { NULL, NULL, 0 },
1146 /* 0x45 */ { NULL, NULL, 0 },
1147 /* 0x46 */ { NULL, NULL, 0 },
1148 /* 0x47 */ { NULL, NULL, 0 },
1149 /* 0x48 */ { NULL, NULL, 0 },
1150 /* 0x49 */ { NULL, NULL, 0 },
1151 /* 0x4a */ { NULL, NULL, 0 },
1152 /* 0x4b */ { NULL, NULL, 0 },
1153 /* 0x4c */ { NULL, NULL, 0 },
1154 /* 0x4d */ { NULL, NULL, 0 },
1155 /* 0x4e */ { NULL, NULL, 0 },
1156 /* 0x4f */ { NULL, NULL, 0 },
1157 /* 0x50 */ { NULL, NULL, 0 },
1158 /* 0x51 */ { NULL, NULL, 0 },
1159 /* 0x52 */ { NULL, NULL, 0 },
1160 /* 0x53 */ { NULL, NULL, 0 },
1161 /* 0x54 */ { NULL, NULL, 0 },
1162 /* 0x55 */ { NULL, NULL, 0 },
1163 /* 0x56 */ { NULL, NULL, 0 },
1164 /* 0x57 */ { NULL, NULL, 0 },
1165 /* 0x58 */ { NULL, NULL, 0 },
1166 /* 0x59 */ { NULL, NULL, 0 },
1167 /* 0x5a */ { NULL, NULL, 0 },
1168 /* 0x5b */ { NULL, NULL, 0 },
1169 /* 0x5c */ { NULL, NULL, 0 },
1170 /* 0x5d */ { NULL, NULL, 0 },
1171 /* 0x5e */ { NULL, NULL, 0 },
1172 /* 0x5f */ { NULL, NULL, 0 },
1173 /* 0x60 */ { NULL, NULL, 0 },
1174 /* 0x61 */ { NULL, NULL, 0 },
1175 /* 0x62 */ { NULL, NULL, 0 },
1176 /* 0x63 */ { NULL, NULL, 0 },
1177 /* 0x64 */ { NULL, NULL, 0 },
1178 /* 0x65 */ { NULL, NULL, 0 },
1179 /* 0x66 */ { NULL, NULL, 0 },
1180 /* 0x67 */ { NULL, NULL, 0 },
1181 /* 0x68 */ { NULL, NULL, 0 },
1182 /* 0x69 */ { NULL, NULL, 0 },
1183 /* 0x6a */ { NULL, NULL, 0 },
1184 /* 0x6b */ { NULL, NULL, 0 },
1185 /* 0x6c */ { NULL, NULL, 0 },
1186 /* 0x6d */ { NULL, NULL, 0 },
1187 /* 0x6e */ { NULL, NULL, 0 },
1188 /* 0x6f */ { NULL, NULL, 0 },
1189 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1190 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1191 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1192 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1193 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1194 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1195 /* 0x76 */ { NULL, NULL, 0 },
1196 /* 0x77 */ { NULL, NULL, 0 },
1197 /* 0x78 */ { NULL, NULL, 0 },
1198 /* 0x79 */ { NULL, NULL, 0 },
1199 /* 0x7a */ { NULL, NULL, 0 },
1200 /* 0x7b */ { NULL, NULL, 0 },
1201 /* 0x7c */ { NULL, NULL, 0 },
1202 /* 0x7d */ { NULL, NULL, 0 },
1203 /* 0x7e */ { NULL, NULL, 0 },
1204 /* 0x7f */ { NULL, NULL, 0 },
1205 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1206 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1207 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1208 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1209 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1210 /* 0x85 */ { NULL, NULL, 0 },
1211 /* 0x86 */ { NULL, NULL, 0 },
1212 /* 0x87 */ { NULL, NULL, 0 },
1213 /* 0x88 */ { NULL, NULL, 0 },
1214 /* 0x89 */ { NULL, NULL, 0 },
1215 /* 0x8a */ { NULL, NULL, 0 },
1216 /* 0x8b */ { NULL, NULL, 0 },
1217 /* 0x8c */ { NULL, NULL, 0 },
1218 /* 0x8d */ { NULL, NULL, 0 },
1219 /* 0x8e */ { NULL, NULL, 0 },
1220 /* 0x8f */ { NULL, NULL, 0 },
1221 /* 0x90 */ { NULL, NULL, 0 },
1222 /* 0x91 */ { NULL, NULL, 0 },
1223 /* 0x92 */ { NULL, NULL, 0 },
1224 /* 0x93 */ { NULL, NULL, 0 },
1225 /* 0x94 */ { NULL, NULL, 0 },
1226 /* 0x95 */ { NULL, NULL, 0 },
1227 /* 0x96 */ { NULL, NULL, 0 },
1228 /* 0x97 */ { NULL, NULL, 0 },
1229 /* 0x98 */ { NULL, NULL, 0 },
1230 /* 0x99 */ { NULL, NULL, 0 },
1231 /* 0x9a */ { NULL, NULL, 0 },
1232 /* 0x9b */ { NULL, NULL, 0 },
1233 /* 0x9c */ { NULL, NULL, 0 },
1234 /* 0x9d */ { NULL, NULL, 0 },
1235 /* 0x9e */ { NULL, NULL, 0 },
1236 /* 0x9f */ { NULL, NULL, 0 },
1237 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1238 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1239 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1240 /* 0xa3 */ { NULL, NULL, 0 },
1241 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1242 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1243 /* 0xa6 */ { NULL, NULL, 0 },
1244 /* 0xa7 */ { NULL, NULL, 0 },
1245 /* 0xa8 */ { NULL, NULL, 0 },
1246 /* 0xa9 */ { NULL, NULL, 0 },
1247 /* 0xaa */ { NULL, NULL, 0 },
1248 /* 0xab */ { NULL, NULL, 0 },
1249 /* 0xac */ { NULL, NULL, 0 },
1250 /* 0xad */ { NULL, NULL, 0 },
1251 /* 0xae */ { NULL, NULL, 0 },
1252 /* 0xaf */ { NULL, NULL, 0 },
1253 /* 0xb0 */ { NULL, NULL, 0 },
1254 /* 0xb1 */ { NULL, NULL, 0 },
1255 /* 0xb2 */ { NULL, NULL, 0 },
1256 /* 0xb3 */ { NULL, NULL, 0 },
1257 /* 0xb4 */ { NULL, NULL, 0 },
1258 /* 0xb5 */ { NULL, NULL, 0 },
1259 /* 0xb6 */ { NULL, NULL, 0 },
1260 /* 0xb7 */ { NULL, NULL, 0 },
1261 /* 0xb8 */ { NULL, NULL, 0 },
1262 /* 0xb9 */ { NULL, NULL, 0 },
1263 /* 0xba */ { NULL, NULL, 0 },
1264 /* 0xbb */ { NULL, NULL, 0 },
1265 /* 0xbc */ { NULL, NULL, 0 },
1266 /* 0xbd */ { NULL, NULL, 0 },
1267 /* 0xbe */ { NULL, NULL, 0 },
1268 /* 0xbf */ { NULL, NULL, 0 },
1269 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1270 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1271 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1272 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1273 /* 0xc4 */ { NULL, NULL, 0 },
1274 /* 0xc5 */ { NULL, NULL, 0 },
1275 /* 0xc6 */ { NULL, NULL, 0 },
1276 /* 0xc7 */ { NULL, NULL, 0 },
1277 /* 0xc8 */ { NULL, NULL, 0 },
1278 /* 0xc9 */ { NULL, NULL, 0 },
1279 /* 0xca */ { NULL, NULL, 0 },
1280 /* 0xcb */ { NULL, NULL, 0 },
1281 /* 0xcc */ { NULL, NULL, 0 },
1282 /* 0xcd */ { NULL, NULL, 0 },
1283 /* 0xce */ { NULL, NULL, 0 },
1284 /* 0xcf */ { NULL, NULL, 0 },
1285 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1286 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1287 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1288 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1289 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1290 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1291 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1292 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1293 /* 0xd8 */ { NULL, NULL, 0 },
1294 /* 0xd9 */ { NULL, NULL, 0 },
1295 /* 0xda */ { NULL, NULL, 0 },
1296 /* 0xdb */ { NULL, NULL, 0 },
1297 /* 0xdc */ { NULL, NULL, 0 },
1298 /* 0xdd */ { NULL, NULL, 0 },
1299 /* 0xde */ { NULL, NULL, 0 },
1300 /* 0xdf */ { NULL, NULL, 0 },
1301 /* 0xe0 */ { NULL, NULL, 0 },
1302 /* 0xe1 */ { NULL, NULL, 0 },
1303 /* 0xe2 */ { NULL, NULL, 0 },
1304 /* 0xe3 */ { NULL, NULL, 0 },
1305 /* 0xe4 */ { NULL, NULL, 0 },
1306 /* 0xe5 */ { NULL, NULL, 0 },
1307 /* 0xe6 */ { NULL, NULL, 0 },
1308 /* 0xe7 */ { NULL, NULL, 0 },
1309 /* 0xe8 */ { NULL, NULL, 0 },
1310 /* 0xe9 */ { NULL, NULL, 0 },
1311 /* 0xea */ { NULL, NULL, 0 },
1312 /* 0xeb */ { NULL, NULL, 0 },
1313 /* 0xec */ { NULL, NULL, 0 },
1314 /* 0xed */ { NULL, NULL, 0 },
1315 /* 0xee */ { NULL, NULL, 0 },
1316 /* 0xef */ { NULL, NULL, 0 },
1317 /* 0xf0 */ { NULL, NULL, 0 },
1318 /* 0xf1 */ { NULL, NULL, 0 },
1319 /* 0xf2 */ { NULL, NULL, 0 },
1320 /* 0xf3 */ { NULL, NULL, 0 },
1321 /* 0xf4 */ { NULL, NULL, 0 },
1322 /* 0xf5 */ { NULL, NULL, 0 },
1323 /* 0xf6 */ { NULL, NULL, 0 },
1324 /* 0xf7 */ { NULL, NULL, 0 },
1325 /* 0xf8 */ { NULL, NULL, 0 },
1326 /* 0xf9 */ { NULL, NULL, 0 },
1327 /* 0xfa */ { NULL, NULL, 0 },
1328 /* 0xfb */ { NULL, NULL, 0 },
1329 /* 0xfc */ { NULL, NULL, 0 },
1330 /* 0xfd */ { NULL, NULL, 0 },
1331 /* 0xfe */ { NULL, NULL, 0 },
1332 /* 0xff */ { NULL, NULL, 0 }
1333
1334 };
1335
1336 /*******************************************************************
1337  allocate and initialize a reply packet
1338 ********************************************************************/
1339
1340 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1341                           const char *inbuf, char **outbuf, uint8_t num_words,
1342                           uint32_t num_bytes)
1343 {
1344         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1345
1346         /*
1347          * Protect against integer wrap.
1348          * The SMB layer reply can be up to 0xFFFFFF bytes.
1349          */
1350         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1351                 char *msg;
1352                 if (asprintf(&msg, "num_bytes too large: %u",
1353                              (unsigned)num_bytes) == -1) {
1354                         msg = discard_const_p(char, "num_bytes too large");
1355                 }
1356                 smb_panic(msg);
1357         }
1358
1359         /*
1360          * Here we include the NBT header for now.
1361          */
1362         *outbuf = talloc_array(mem_ctx, char,
1363                                NBT_HDR_SIZE + smb_len);
1364         if (*outbuf == NULL) {
1365                 return false;
1366         }
1367
1368         construct_reply_common(req, inbuf, *outbuf);
1369         srv_set_message(*outbuf, num_words, num_bytes, false);
1370         /*
1371          * Zero out the word area, the caller has to take care of the bcc area
1372          * himself
1373          */
1374         if (num_words != 0) {
1375                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1376         }
1377
1378         return true;
1379 }
1380
1381 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1382 {
1383         char *outbuf;
1384         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1385                            num_bytes)) {
1386                 smb_panic("could not allocate output buffer\n");
1387         }
1388         req->outbuf = (uint8_t *)outbuf;
1389 }
1390
1391
1392 /*******************************************************************
1393  Dump a packet to a file.
1394 ********************************************************************/
1395
1396 static void smb_dump(const char *name, int type, const char *data)
1397 {
1398         size_t len;
1399         int fd, i;
1400         char *fname = NULL;
1401         if (DEBUGLEVEL < 50) {
1402                 return;
1403         }
1404
1405         len = smb_len_tcp(data)+4;
1406         for (i=1;i<100;i++) {
1407                 fname = talloc_asprintf(talloc_tos(),
1408                                 "/tmp/%s.%d.%s",
1409                                 name,
1410                                 i,
1411                                 type ? "req" : "resp");
1412                 if (fname == NULL) {
1413                         return;
1414                 }
1415                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1416                 if (fd != -1 || errno != EEXIST) break;
1417                 TALLOC_FREE(fname);
1418         }
1419         if (fd != -1) {
1420                 ssize_t ret = write(fd, data, len);
1421                 if (ret != len)
1422                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1423                 close(fd);
1424                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1425         }
1426         TALLOC_FREE(fname);
1427 }
1428
1429 /****************************************************************************
1430  Prepare everything for calling the actual request function, and potentially
1431  call the request function via the "new" interface.
1432
1433  Return False if the "legacy" function needs to be called, everything is
1434  prepared.
1435
1436  Return True if we're done.
1437
1438  I know this API sucks, but it is the one with the least code change I could
1439  find.
1440 ****************************************************************************/
1441
1442 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1443 {
1444         int flags;
1445         uint64_t session_tag;
1446         connection_struct *conn = NULL;
1447         struct smbd_server_connection *sconn = req->sconn;
1448         NTTIME now = timeval_to_nttime(&req->request_time);
1449         struct smbXsrv_session *session = NULL;
1450         NTSTATUS status;
1451
1452         errno = 0;
1453
1454         if (smb_messages[type].fn == NULL) {
1455                 DEBUG(0,("Unknown message type %d!\n",type));
1456                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1457                 reply_unknown_new(req, type);
1458                 return NULL;
1459         }
1460
1461         flags = smb_messages[type].flags;
1462
1463         /* In share mode security we must ignore the vuid. */
1464         session_tag = req->vuid;
1465         conn = req->conn;
1466
1467         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1468                  (int)getpid(), (unsigned long)conn));
1469
1470         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1471
1472         /* Ensure this value is replaced in the incoming packet. */
1473         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1474
1475         /*
1476          * Ensure the correct username is in current_user_info.  This is a
1477          * really ugly bugfix for problems with multiple session_setup_and_X's
1478          * being done and allowing %U and %G substitutions to work correctly.
1479          * There is a reason this code is done here, don't move it unless you
1480          * know what you're doing... :-).
1481          * JRA.
1482          */
1483
1484         /*
1485          * lookup an existing session
1486          *
1487          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1488          * here, the main check is still in change_to_user()
1489          */
1490         status = smb1srv_session_lookup(sconn->conn,
1491                                         session_tag,
1492                                         now,
1493                                         &session);
1494         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1495                 switch (type) {
1496                 case SMBsesssetupX:
1497                         status = NT_STATUS_OK;
1498                         break;
1499                 default:
1500                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1501                                  (unsigned long long)session_tag,
1502                                  (unsigned long long)req->mid));
1503                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1504                         return conn;
1505                 }
1506         }
1507
1508         if (session_tag != sconn->conn->last_session_id) {
1509                 struct user_struct *vuser = NULL;
1510
1511                 sconn->conn->last_session_id = session_tag;
1512                 if (session) {
1513                         vuser = session->compat;
1514                 }
1515                 if (vuser) {
1516                         set_current_user_info(
1517                                 vuser->session_info->unix_info->sanitized_username,
1518                                 vuser->session_info->unix_info->unix_name,
1519                                 vuser->session_info->info->domain_name);
1520                 }
1521         }
1522
1523         /* Does this call need to be run as the connected user? */
1524         if (flags & AS_USER) {
1525
1526                 /* Does this call need a valid tree connection? */
1527                 if (!conn) {
1528                         /*
1529                          * Amazingly, the error code depends on the command
1530                          * (from Samba4).
1531                          */
1532                         if (type == SMBntcreateX) {
1533                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1534                         } else {
1535                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1536                         }
1537                         return NULL;
1538                 }
1539
1540                 if (!change_to_user(conn,session_tag)) {
1541                         DEBUG(0, ("Error: Could not change to user. Removing "
1542                                 "deferred open, mid=%llu.\n",
1543                                 (unsigned long long)req->mid));
1544                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1545                         return conn;
1546                 }
1547
1548                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1549
1550                 /* Does it need write permission? */
1551                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1552                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1553                         return conn;
1554                 }
1555
1556                 /* IPC services are limited */
1557                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1558                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1559                         return conn;
1560                 }
1561         } else {
1562                 /* This call needs to be run as root */
1563                 change_to_root_user();
1564         }
1565
1566         /* load service specific parameters */
1567         if (conn) {
1568                 if (req->encrypted) {
1569                         conn->encrypted_tid = true;
1570                         /* encrypted required from now on. */
1571                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1572                 } else if (ENCRYPTION_REQUIRED(conn)) {
1573                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1574                                 DEBUG(1,("service[%s] requires encryption"
1575                                         "%s ACCESS_DENIED. mid=%llu\n",
1576                                         lp_servicename(talloc_tos(), SNUM(conn)),
1577                                         smb_fn_name(type),
1578                                         (unsigned long long)req->mid));
1579                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1580                                 return conn;
1581                         }
1582                 }
1583
1584                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1585                                          (flags & (AS_USER|DO_CHDIR)
1586                                           ?True:False))) {
1587                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1588                         return conn;
1589                 }
1590                 conn->num_smb_operations++;
1591         }
1592
1593         /*
1594          * Does this protocol need to be run as guest? (Only archane
1595          * messenger service requests have this...)
1596          */
1597         if (flags & AS_GUEST) {
1598                 char *raddr;
1599                 bool ok;
1600
1601                 if (!change_to_guest()) {
1602                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1603                         return conn;
1604                 }
1605
1606                 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1607                                                          talloc_tos());
1608                 if (raddr == NULL) {
1609                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1610                         return conn;
1611                 }
1612
1613                 /*
1614                  * Haven't we checked this in smbd_process already???
1615                  */
1616
1617                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1618                                   sconn->remote_hostname, raddr);
1619                 TALLOC_FREE(raddr);
1620
1621                 if (!ok) {
1622                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1623                         return conn;
1624                 }
1625         }
1626
1627         smb_messages[type].fn(req);
1628         return req->conn;
1629 }
1630
1631 /****************************************************************************
1632  Construct a reply to the incoming packet.
1633 ****************************************************************************/
1634
1635 static void construct_reply(struct smbd_server_connection *sconn,
1636                             char *inbuf, int size, size_t unread_bytes,
1637                             uint32_t seqnum, bool encrypted,
1638                             struct smb_perfcount_data *deferred_pcd)
1639 {
1640         connection_struct *conn;
1641         struct smb_request *req;
1642
1643         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1644                 smb_panic("could not allocate smb_request");
1645         }
1646
1647         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1648                               encrypted, seqnum)) {
1649                 exit_server_cleanly("Invalid SMB request");
1650         }
1651
1652         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1653
1654         /* we popped this message off the queue - keep original perf data */
1655         if (deferred_pcd)
1656                 req->pcd = *deferred_pcd;
1657         else {
1658                 SMB_PERFCOUNT_START(&req->pcd);
1659                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1660                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1661         }
1662
1663         conn = switch_message(req->cmd, req);
1664
1665         if (req->outbuf == NULL) {
1666                 return;
1667         }
1668
1669         if (CVAL(req->outbuf,0) == 0) {
1670                 show_msg((char *)req->outbuf);
1671         }
1672
1673         if (!srv_send_smb(req->sconn,
1674                         (char *)req->outbuf,
1675                         true, req->seqnum+1,
1676                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1677                         &req->pcd)) {
1678                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1679         }
1680
1681         TALLOC_FREE(req);
1682
1683         return;
1684 }
1685
1686 static void construct_reply_chain(struct smbd_server_connection *sconn,
1687                                   char *inbuf, int size, uint32_t seqnum,
1688                                   bool encrypted,
1689                                   struct smb_perfcount_data *deferred_pcd)
1690 {
1691         struct smb_request **reqs = NULL;
1692         struct smb_request *req;
1693         unsigned num_reqs;
1694         bool ok;
1695
1696         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1697                               seqnum, &reqs, &num_reqs);
1698         if (!ok) {
1699                 char errbuf[smb_size];
1700                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1701                              __LINE__, __FILE__);
1702                 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1703                                   NULL)) {
1704                         exit_server_cleanly("construct_reply_chain: "
1705                                             "srv_send_smb failed.");
1706                 }
1707                 return;
1708         }
1709
1710         req = reqs[0];
1711         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1712
1713         req->conn = switch_message(req->cmd, req);
1714
1715         if (req->outbuf == NULL) {
1716                 /*
1717                  * Request has suspended itself, will come
1718                  * back here.
1719                  */
1720                 return;
1721         }
1722         smb_request_done(req);
1723 }
1724
1725 /*
1726  * To be called from an async SMB handler that is potentially chained
1727  * when it is finished for shipping.
1728  */
1729
1730 void smb_request_done(struct smb_request *req)
1731 {
1732         struct smb_request **reqs = NULL;
1733         struct smb_request *first_req;
1734         size_t i, num_reqs, next_index;
1735         NTSTATUS status;
1736
1737         if (req->chain == NULL) {
1738                 first_req = req;
1739                 goto shipit;
1740         }
1741
1742         reqs = req->chain;
1743         num_reqs = talloc_array_length(reqs);
1744
1745         for (i=0; i<num_reqs; i++) {
1746                 if (reqs[i] == req) {
1747                         break;
1748                 }
1749         }
1750         if (i == num_reqs) {
1751                 /*
1752                  * Invalid chain, should not happen
1753                  */
1754                 status = NT_STATUS_INTERNAL_ERROR;
1755                 goto error;
1756         }
1757         next_index = i+1;
1758
1759         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1760                 struct smb_request *next = reqs[next_index];
1761                 struct smbXsrv_tcon *tcon;
1762                 NTTIME now = timeval_to_nttime(&req->request_time);
1763
1764                 next->vuid = SVAL(req->outbuf, smb_uid);
1765                 next->tid  = SVAL(req->outbuf, smb_tid);
1766                 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1767                                              now, &tcon);
1768                 if (NT_STATUS_IS_OK(status)) {
1769                         req->conn = tcon->compat;
1770                 } else {
1771                         req->conn = NULL;
1772                 }
1773                 next->chain_fsp = req->chain_fsp;
1774                 next->inbuf = req->inbuf;
1775
1776                 req = next;
1777                 req->conn = switch_message(req->cmd, req);
1778
1779                 if (req->outbuf == NULL) {
1780                         /*
1781                          * Request has suspended itself, will come
1782                          * back here.
1783                          */
1784                         return;
1785                 }
1786                 next_index += 1;
1787         }
1788
1789         first_req = reqs[0];
1790
1791         for (i=1; i<next_index; i++) {
1792                 bool ok;
1793
1794                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1795                 if (!ok) {
1796                         status = NT_STATUS_INTERNAL_ERROR;
1797                         goto error;
1798                 }
1799         }
1800
1801         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1802         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1803
1804         /*
1805          * This scary statement intends to set the
1806          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1807          * to the value last_req->outbuf carries
1808          */
1809         SSVAL(first_req->outbuf, smb_flg2,
1810               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1811               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1812
1813         /*
1814          * Transfer the error codes from the subrequest to the main one
1815          */
1816         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1817         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1818
1819         _smb_setlen_large(
1820                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1821
1822 shipit:
1823         if (!srv_send_smb(first_req->sconn,
1824                           (char *)first_req->outbuf,
1825                           true, first_req->seqnum+1,
1826                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1827                           &first_req->pcd)) {
1828                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1829                                     "failed.");
1830         }
1831         TALLOC_FREE(req);       /* non-chained case */
1832         TALLOC_FREE(reqs);      /* chained case */
1833         return;
1834
1835 error:
1836         {
1837                 char errbuf[smb_size];
1838                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1839                 if (!srv_send_smb(req->sconn, errbuf, true,
1840                                   req->seqnum+1, req->encrypted,
1841                                   NULL)) {
1842                         exit_server_cleanly("construct_reply_chain: "
1843                                             "srv_send_smb failed.");
1844                 }
1845         }
1846         TALLOC_FREE(req);       /* non-chained case */
1847         TALLOC_FREE(reqs);      /* chained case */
1848 }
1849
1850 /****************************************************************************
1851  Process an smb from the client
1852 ****************************************************************************/
1853 static void process_smb(struct smbd_server_connection *sconn,
1854                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1855                         uint32_t seqnum, bool encrypted,
1856                         struct smb_perfcount_data *deferred_pcd)
1857 {
1858         int msg_type = CVAL(inbuf,0);
1859
1860         DO_PROFILE_INC(smb_count);
1861
1862         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1863                     smb_len(inbuf) ) );
1864         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1865                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1866
1867         if (msg_type != NBSSmessage) {
1868                 /*
1869                  * NetBIOS session request, keepalive, etc.
1870                  */
1871                 reply_special(sconn, (char *)inbuf, nread);
1872                 goto done;
1873         }
1874
1875         if (sconn->using_smb2) {
1876                 /* At this point we're not really using smb2,
1877                  * we make the decision here.. */
1878                 if (smbd_is_smb2_header(inbuf, nread)) {
1879                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1880                         return;
1881                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1882                                 && CVAL(inbuf, smb_com) != 0x72) {
1883                         /* This is a non-negprot SMB1 packet.
1884                            Disable SMB2 from now on. */
1885                         sconn->using_smb2 = false;
1886                 }
1887         }
1888
1889         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1890          * so subtract 4 from it. */
1891         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1892                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1893                          smb_len(inbuf)));
1894
1895                 /* special magic for immediate exit */
1896                 if ((nread == 9) &&
1897                     (IVAL(inbuf, 4) == 0x74697865) &&
1898                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1899                         uint8_t exitcode = CVAL(inbuf, 8);
1900                         DEBUG(1, ("Exiting immediately with code %d\n",
1901                                   (int)exitcode));
1902                         exit(exitcode);
1903                 }
1904
1905                 exit_server_cleanly("Non-SMB packet");
1906         }
1907
1908         show_msg((char *)inbuf);
1909
1910         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1911                 construct_reply_chain(sconn, (char *)inbuf, nread,
1912                                       seqnum, encrypted, deferred_pcd);
1913         } else {
1914                 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1915                                 seqnum, encrypted, deferred_pcd);
1916         }
1917
1918         sconn->trans_num++;
1919
1920 done:
1921         sconn->num_requests++;
1922
1923         /* The timeout_processing function isn't run nearly
1924            often enough to implement 'max log size' without
1925            overrunning the size of the file by many megabytes.
1926            This is especially true if we are running at debug
1927            level 10.  Checking every 50 SMBs is a nice
1928            tradeoff of performance vs log file size overrun. */
1929
1930         if ((sconn->num_requests % 50) == 0 &&
1931             need_to_check_log_size()) {
1932                 change_to_root_user();
1933                 check_log_size();
1934         }
1935 }
1936
1937 /****************************************************************************
1938  Return a string containing the function name of a SMB command.
1939 ****************************************************************************/
1940
1941 const char *smb_fn_name(int type)
1942 {
1943         const char *unknown_name = "SMBunknown";
1944
1945         if (smb_messages[type].name == NULL)
1946                 return(unknown_name);
1947
1948         return(smb_messages[type].name);
1949 }
1950
1951 /****************************************************************************
1952  Helper functions for contruct_reply.
1953 ****************************************************************************/
1954
1955 void add_to_common_flags2(uint32 v)
1956 {
1957         common_flags2 |= v;
1958 }
1959
1960 void remove_from_common_flags2(uint32 v)
1961 {
1962         common_flags2 &= ~v;
1963 }
1964
1965 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1966                                    char *outbuf)
1967 {
1968         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1969         uint16_t out_flags2 = common_flags2;
1970
1971         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1972         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1973         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1974
1975         srv_set_message(outbuf,0,0,false);
1976
1977         SCVAL(outbuf, smb_com, req->cmd);
1978         SIVAL(outbuf,smb_rcls,0);
1979         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1980         SSVAL(outbuf,smb_flg2, out_flags2);
1981         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1982         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1983
1984         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1985         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1986         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1987         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1988 }
1989
1990 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1991 {
1992         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1993 }
1994
1995 /**
1996  * @brief Find the smb_cmd offset of the last command pushed
1997  * @param[in] buf       The buffer we're building up
1998  * @retval              Where can we put our next andx cmd?
1999  *
2000  * While chaining requests, the "next" request we're looking at needs to put
2001  * its SMB_Command before the data the previous request already built up added
2002  * to the chain. Find the offset to the place where we have to put our cmd.
2003  */
2004
2005 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2006 {
2007         uint8_t cmd;
2008         size_t ofs;
2009
2010         cmd = CVAL(buf, smb_com);
2011
2012         if (!is_andx_req(cmd)) {
2013                 return false;
2014         }
2015
2016         ofs = smb_vwv0;
2017
2018         while (CVAL(buf, ofs) != 0xff) {
2019
2020                 if (!is_andx_req(CVAL(buf, ofs))) {
2021                         return false;
2022                 }
2023
2024                 /*
2025                  * ofs is from start of smb header, so add the 4 length
2026                  * bytes. The next cmd is right after the wct field.
2027                  */
2028                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2029
2030                 if (ofs+4 >= talloc_get_size(buf)) {
2031                         return false;
2032                 }
2033         }
2034
2035         *pofs = ofs;
2036         return true;
2037 }
2038
2039 /**
2040  * @brief Do the smb chaining at a buffer level
2041  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2042  * @param[in] andx_buf          Buffer to be appended
2043  */
2044
2045 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2046 {
2047         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2048         uint8_t wct             = CVAL(andx_buf, smb_wct);
2049         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2050         uint32_t num_bytes      = smb_buflen(andx_buf);
2051         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2052
2053         uint8_t *outbuf;
2054         size_t old_size, new_size;
2055         size_t ofs;
2056         size_t chain_padding = 0;
2057         size_t andx_cmd_ofs;
2058
2059
2060         old_size = talloc_get_size(*poutbuf);
2061
2062         if ((old_size % 4) != 0) {
2063                 /*
2064                  * Align the wct field of subsequent requests to a 4-byte
2065                  * boundary
2066                  */
2067                 chain_padding = 4 - (old_size % 4);
2068         }
2069
2070         /*
2071          * After the old request comes the new wct field (1 byte), the vwv's
2072          * and the num_bytes field.
2073          */
2074
2075         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2076         new_size += num_bytes;
2077
2078         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2079                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2080                           (unsigned)new_size));
2081                 return false;
2082         }
2083
2084         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2085         if (outbuf == NULL) {
2086                 DEBUG(0, ("talloc failed\n"));
2087                 return false;
2088         }
2089         *poutbuf = outbuf;
2090
2091         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2092                 DEBUG(1, ("invalid command chain\n"));
2093                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2094                 return false;
2095         }
2096
2097         if (chain_padding != 0) {
2098                 memset(outbuf + old_size, 0, chain_padding);
2099                 old_size += chain_padding;
2100         }
2101
2102         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2103         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2104
2105         ofs = old_size;
2106
2107         /*
2108          * Push the chained request:
2109          *
2110          * wct field
2111          */
2112
2113         SCVAL(outbuf, ofs, wct);
2114         ofs += 1;
2115
2116         /*
2117          * vwv array
2118          */
2119
2120         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2121
2122         /*
2123          * HACK ALERT
2124          *
2125          * Read&X has an offset into its data buffer at
2126          * vwv[6]. reply_read_andx has no idea anymore that it's
2127          * running from within a chain, so we have to fix up the
2128          * offset here.
2129          *
2130          * Although it looks disgusting at this place, I want to keep
2131          * it here. The alternative would be to push knowledge about
2132          * the andx chain down into read&x again.
2133          */
2134
2135         if (smb_command == SMBreadX) {
2136                 uint8_t *bytes_addr;
2137
2138                 if (wct < 7) {
2139                         /*
2140                          * Invalid read&x response
2141                          */
2142                         return false;
2143                 }
2144
2145                 bytes_addr = outbuf + ofs        /* vwv start */
2146                         + sizeof(uint16_t) * wct /* vwv array */
2147                         + sizeof(uint16_t);      /* bcc */
2148
2149                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2150                       bytes_addr - outbuf - 4);
2151         }
2152
2153         ofs += sizeof(uint16_t) * wct;
2154
2155         /*
2156          * bcc (byte count)
2157          */
2158
2159         SSVAL(outbuf, ofs, num_bytes);
2160         ofs += sizeof(uint16_t);
2161
2162         /*
2163          * The bytes field
2164          */
2165
2166         memcpy(outbuf + ofs, bytes, num_bytes);
2167
2168         return true;
2169 }
2170
2171 bool smb1_is_chain(const uint8_t *buf)
2172 {
2173         uint8_t cmd, wct, andx_cmd;
2174
2175         cmd = CVAL(buf, smb_com);
2176         if (!is_andx_req(cmd)) {
2177                 return false;
2178         }
2179         wct = CVAL(buf, smb_wct);
2180         if (wct < 2) {
2181                 return false;
2182         }
2183         andx_cmd = CVAL(buf, smb_vwv);
2184         return (andx_cmd != 0xFF);
2185 }
2186
2187 bool smb1_walk_chain(const uint8_t *buf,
2188                      bool (*fn)(uint8_t cmd,
2189                                 uint8_t wct, const uint16_t *vwv,
2190                                 uint16_t num_bytes, const uint8_t *bytes,
2191                                 void *private_data),
2192                      void *private_data)
2193 {
2194         size_t smblen = smb_len(buf);
2195         const char *smb_buf = smb_base(buf);
2196         uint8_t cmd, chain_cmd;
2197         uint8_t wct;
2198         const uint16_t *vwv;
2199         uint16_t num_bytes;
2200         const uint8_t *bytes;
2201
2202         cmd = CVAL(buf, smb_com);
2203         wct = CVAL(buf, smb_wct);
2204         vwv = (const uint16_t *)(buf + smb_vwv);
2205         num_bytes = smb_buflen(buf);
2206         bytes = (const uint8_t *)smb_buf_const(buf);
2207
2208         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2209                 return false;
2210         }
2211
2212         if (!is_andx_req(cmd)) {
2213                 return true;
2214         }
2215         if (wct < 2) {
2216                 return false;
2217         }
2218
2219         chain_cmd = CVAL(vwv, 0);
2220
2221         while (chain_cmd != 0xff) {
2222                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2223                 size_t length_needed;
2224                 ptrdiff_t vwv_offset;
2225
2226                 chain_offset = SVAL(vwv+1, 0);
2227
2228                 /*
2229                  * Check if the client tries to fool us. The chain
2230                  * offset needs to point beyond the current request in
2231                  * the chain, it needs to strictly grow. Otherwise we
2232                  * might be tricked into an endless loop always
2233                  * processing the same request over and over again. We
2234                  * used to assume that vwv and the byte buffer array
2235                  * in a chain are always attached, but OS/2 the
2236                  * Write&X/Read&X chain puts the Read&X vwv array
2237                  * right behind the Write&X vwv chain. The Write&X bcc
2238                  * array is put behind the Read&X vwv array. So now we
2239                  * check whether the chain offset points strictly
2240                  * behind the previous vwv array. req->buf points
2241                  * right after the vwv array of the previous
2242                  * request. See
2243                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2244                  * more information.
2245                  */
2246
2247                 vwv_offset = ((const char *)vwv - smb_buf);
2248                 if (chain_offset <= vwv_offset) {
2249                         return false;
2250                 }
2251
2252                 /*
2253                  * Next check: Make sure the chain offset does not
2254                  * point beyond the overall smb request length.
2255                  */
2256
2257                 length_needed = chain_offset+1; /* wct */
2258                 if (length_needed > smblen) {
2259                         return false;
2260                 }
2261
2262                 /*
2263                  * Now comes the pointer magic. Goal here is to set up
2264                  * vwv and buf correctly again. The chain offset (the
2265                  * former vwv[1]) points at the new wct field.
2266                  */
2267
2268                 wct = CVAL(smb_buf, chain_offset);
2269
2270                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2271                         return false;
2272                 }
2273
2274                 /*
2275                  * Next consistency check: Make the new vwv array fits
2276                  * in the overall smb request.
2277                  */
2278
2279                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2280                 if (length_needed > smblen) {
2281                         return false;
2282                 }
2283                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2284
2285                 /*
2286                  * Now grab the new byte buffer....
2287                  */
2288
2289                 num_bytes = SVAL(vwv+wct, 0);
2290
2291                 /*
2292                  * .. and check that it fits.
2293                  */
2294
2295                 length_needed += num_bytes;
2296                 if (length_needed > smblen) {
2297                         return false;
2298                 }
2299                 bytes = (const uint8_t *)(vwv+wct+1);
2300
2301                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2302                         return false;
2303                 }
2304
2305                 if (!is_andx_req(chain_cmd)) {
2306                         return true;
2307                 }
2308                 chain_cmd = CVAL(vwv, 0);
2309         }
2310         return true;
2311 }
2312
2313 static bool smb1_chain_length_cb(uint8_t cmd,
2314                                  uint8_t wct, const uint16_t *vwv,
2315                                  uint16_t num_bytes, const uint8_t *bytes,
2316                                  void *private_data)
2317 {
2318         unsigned *count = (unsigned *)private_data;
2319         *count += 1;
2320         return true;
2321 }
2322
2323 unsigned smb1_chain_length(const uint8_t *buf)
2324 {
2325         unsigned count = 0;
2326
2327         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2328                 return 0;
2329         }
2330         return count;
2331 }
2332
2333 struct smb1_parse_chain_state {
2334         TALLOC_CTX *mem_ctx;
2335         const uint8_t *buf;
2336         struct smbd_server_connection *sconn;
2337         bool encrypted;
2338         uint32_t seqnum;
2339
2340         struct smb_request **reqs;
2341         unsigned num_reqs;
2342 };
2343
2344 static bool smb1_parse_chain_cb(uint8_t cmd,
2345                                 uint8_t wct, const uint16_t *vwv,
2346                                 uint16_t num_bytes, const uint8_t *bytes,
2347                                 void *private_data)
2348 {
2349         struct smb1_parse_chain_state *state =
2350                 (struct smb1_parse_chain_state *)private_data;
2351         struct smb_request **reqs;
2352         struct smb_request *req;
2353         bool ok;
2354
2355         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2356                               struct smb_request *, state->num_reqs+1);
2357         if (reqs == NULL) {
2358                 return false;
2359         }
2360         state->reqs = reqs;
2361
2362         req = talloc(reqs, struct smb_request);
2363         if (req == NULL) {
2364                 return false;
2365         }
2366
2367         ok = init_smb_request(req, state->sconn, state->buf, 0,
2368                               state->encrypted, state->seqnum);
2369         if (!ok) {
2370                 return false;
2371         }
2372         req->cmd = cmd;
2373         req->wct = wct;
2374         req->vwv = vwv;
2375         req->buflen = num_bytes;
2376         req->buf = bytes;
2377
2378         reqs[state->num_reqs] = req;
2379         state->num_reqs += 1;
2380         return true;
2381 }
2382
2383 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2384                       struct smbd_server_connection *sconn,
2385                       bool encrypted, uint32_t seqnum,
2386                       struct smb_request ***reqs, unsigned *num_reqs)
2387 {
2388         struct smb1_parse_chain_state state;
2389         unsigned i;
2390
2391         state.mem_ctx = mem_ctx;
2392         state.buf = buf;
2393         state.sconn = sconn;
2394         state.encrypted = encrypted;
2395         state.seqnum = seqnum;
2396         state.reqs = NULL;
2397         state.num_reqs = 0;
2398
2399         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2400                 TALLOC_FREE(state.reqs);
2401                 return false;
2402         }
2403         for (i=0; i<state.num_reqs; i++) {
2404                 state.reqs[i]->chain = state.reqs;
2405         }
2406         *reqs = state.reqs;
2407         *num_reqs = state.num_reqs;
2408         return true;
2409 }
2410
2411 /****************************************************************************
2412  Check if services need reloading.
2413 ****************************************************************************/
2414
2415 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2416 {
2417
2418         if (last_smb_conf_reload_time == 0) {
2419                 last_smb_conf_reload_time = t;
2420         }
2421
2422         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2423                 reload_services(sconn, conn_snum_used, true);
2424                 last_smb_conf_reload_time = t;
2425         }
2426 }
2427
2428 static bool fd_is_readable(int fd)
2429 {
2430         int ret, revents;
2431
2432         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2433
2434         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2435
2436 }
2437
2438 static void smbd_server_connection_write_handler(
2439         struct smbd_server_connection *sconn)
2440 {
2441         /* TODO: make write nonblocking */
2442 }
2443
2444 static void smbd_server_connection_read_handler(
2445         struct smbd_server_connection *sconn, int fd)
2446 {
2447         struct smbXsrv_connection *xconn = sconn->conn;
2448         uint8_t *inbuf = NULL;
2449         size_t inbuf_len = 0;
2450         size_t unread_bytes = 0;
2451         bool encrypted = false;
2452         TALLOC_CTX *mem_ctx = talloc_tos();
2453         NTSTATUS status;
2454         uint32_t seqnum;
2455
2456         bool async_echo = lp_async_smb_echo_handler();
2457         bool from_client = false;
2458
2459         if (async_echo) {
2460                 if (fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2461                         /*
2462                          * This is the super-ugly hack to prefer the packets
2463                          * forwarded by the echo handler over the ones by the
2464                          * client directly
2465                          */
2466                         fd = sconn->smb1.echo_handler.trusted_fd;
2467                 }
2468         }
2469
2470         from_client = (xconn->transport.sock == fd);
2471
2472         if (async_echo && from_client) {
2473                 smbd_lock_socket(sconn);
2474
2475                 if (!fd_is_readable(fd)) {
2476                         DEBUG(10,("the echo listener was faster\n"));
2477                         smbd_unlock_socket(sconn);
2478                         return;
2479                 }
2480         }
2481
2482         /* TODO: make this completely nonblocking */
2483         status = receive_smb_talloc(mem_ctx, sconn, fd,
2484                                     (char **)(void *)&inbuf,
2485                                     0, /* timeout */
2486                                     &unread_bytes,
2487                                     &encrypted,
2488                                     &inbuf_len, &seqnum,
2489                                     !from_client /* trusted channel */);
2490
2491         if (async_echo && from_client) {
2492                 smbd_unlock_socket(sconn);
2493         }
2494
2495         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2496                 goto process;
2497         }
2498         if (NT_STATUS_IS_ERR(status)) {
2499                 exit_server_cleanly("failed to receive smb request");
2500         }
2501         if (!NT_STATUS_IS_OK(status)) {
2502                 return;
2503         }
2504
2505 process:
2506         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2507                     seqnum, encrypted, NULL);
2508 }
2509
2510 static void smbd_server_connection_handler(struct tevent_context *ev,
2511                                            struct tevent_fd *fde,
2512                                            uint16_t flags,
2513                                            void *private_data)
2514 {
2515         struct smbd_server_connection *conn = talloc_get_type(private_data,
2516                                               struct smbd_server_connection);
2517         struct smbXsrv_connection *xconn = conn->conn;
2518
2519         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2520                 /*
2521                  * we're not supposed to do any io
2522                  */
2523                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2524                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2525                 return;
2526         }
2527
2528         if (flags & TEVENT_FD_WRITE) {
2529                 smbd_server_connection_write_handler(conn);
2530                 return;
2531         }
2532         if (flags & TEVENT_FD_READ) {
2533                 smbd_server_connection_read_handler(conn, xconn->transport.sock);
2534                 return;
2535         }
2536 }
2537
2538 static void smbd_server_echo_handler(struct tevent_context *ev,
2539                                      struct tevent_fd *fde,
2540                                      uint16_t flags,
2541                                      void *private_data)
2542 {
2543         struct smbd_server_connection *conn = talloc_get_type(private_data,
2544                                               struct smbd_server_connection);
2545         struct smbXsrv_connection *xconn = conn->conn;
2546
2547         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2548                 /*
2549                  * we're not supposed to do any io
2550                  */
2551                 TEVENT_FD_NOT_READABLE(conn->smb1.echo_handler.trusted_fde);
2552                 TEVENT_FD_NOT_WRITEABLE(conn->smb1.echo_handler.trusted_fde);
2553                 return;
2554         }
2555
2556         if (flags & TEVENT_FD_WRITE) {
2557                 smbd_server_connection_write_handler(conn);
2558                 return;
2559         }
2560         if (flags & TEVENT_FD_READ) {
2561                 smbd_server_connection_read_handler(
2562                         conn, conn->smb1.echo_handler.trusted_fd);
2563                 return;
2564         }
2565 }
2566
2567 struct smbd_release_ip_state {
2568         struct smbd_server_connection *sconn;
2569         struct tevent_immediate *im;
2570         char addr[INET6_ADDRSTRLEN];
2571 };
2572
2573 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2574                                       struct tevent_immediate *im,
2575                                       void *private_data)
2576 {
2577         struct smbd_release_ip_state *state =
2578                 talloc_get_type_abort(private_data,
2579                 struct smbd_release_ip_state);
2580         struct smbXsrv_connection *xconn = state->sconn->conn;
2581
2582         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2583                 /*
2584                  * smbd_server_connection_terminate() already triggered ?
2585                  */
2586                 return;
2587         }
2588
2589         smbd_server_connection_terminate(state->sconn, "CTDB_SRVID_RELEASE_IP");
2590 }
2591
2592 /****************************************************************************
2593 received when we should release a specific IP
2594 ****************************************************************************/
2595 static bool release_ip(const char *ip, void *priv)
2596 {
2597         struct smbd_release_ip_state *state =
2598                 talloc_get_type_abort(priv,
2599                 struct smbd_release_ip_state);
2600         struct smbXsrv_connection *xconn = state->sconn->conn;
2601         const char *addr = state->addr;
2602         const char *p = addr;
2603
2604         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2605                 /* avoid recursion */
2606                 return false;
2607         }
2608
2609         if (strncmp("::ffff:", addr, 7) == 0) {
2610                 p = addr + 7;
2611         }
2612
2613         DEBUG(10, ("Got release IP message for %s, "
2614                    "our address is %s\n", ip, p));
2615
2616         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2617                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2618                         ip));
2619                 /*
2620                  * With SMB2 we should do a clean disconnect,
2621                  * the previous_session_id in the session setup
2622                  * will cleanup the old session, tcons and opens.
2623                  *
2624                  * A clean disconnect is needed in order to support
2625                  * durable handles.
2626                  *
2627                  * Note: typically this is never triggered
2628                  *       as we got a TCP RST (triggered by ctdb event scripts)
2629                  *       before we get CTDB_SRVID_RELEASE_IP.
2630                  *
2631                  * We used to call _exit(1) here, but as this was mostly never
2632                  * triggered and has implication on our process model,
2633                  * we can just use smbd_server_connection_terminate()
2634                  * (also for SMB1).
2635                  *
2636                  * We don't call smbd_server_connection_terminate() directly
2637                  * as we might be called from within ctdbd_migrate(),
2638                  * we need to defer our action to the next event loop
2639                  */
2640                 tevent_schedule_immediate(state->im, state->sconn->ev_ctx,
2641                                           smbd_release_ip_immediate, state);
2642
2643                 /*
2644                  * Make sure we don't get any io on the connection.
2645                  */
2646                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2647                 return true;
2648         }
2649
2650         return false;
2651 }
2652
2653 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2654                                   struct sockaddr_storage *srv,
2655                                   struct sockaddr_storage *clnt)
2656 {
2657         struct smbd_release_ip_state *state;
2658         struct ctdbd_connection *cconn;
2659
2660         cconn = messaging_ctdbd_connection();
2661         if (cconn == NULL) {
2662                 return NT_STATUS_NO_MEMORY;
2663         }
2664
2665         state = talloc_zero(sconn, struct smbd_release_ip_state);
2666         if (state == NULL) {
2667                 return NT_STATUS_NO_MEMORY;
2668         }
2669         state->sconn = sconn;
2670         state->im = tevent_create_immediate(state);
2671         if (state->im == NULL) {
2672                 return NT_STATUS_NO_MEMORY;
2673         }
2674         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2675                 return NT_STATUS_NO_MEMORY;
2676         }
2677
2678         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2679 }
2680
2681 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2682                                   void *private_data, uint32_t msg_type,
2683                                   struct server_id server_id, DATA_BLOB *data)
2684 {
2685         struct smbd_server_connection *sconn = talloc_get_type_abort(
2686                 private_data, struct smbd_server_connection);
2687         const char *ip = (char *) data->data;
2688         char *client_ip;
2689
2690         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2691
2692         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2693                                                      talloc_tos());
2694         if (client_ip == NULL) {
2695                 return;
2696         }
2697
2698         if (strequal(ip, client_ip)) {
2699                 DEBUG(1, ("Got kill client message for %s - "
2700                           "exiting immediately\n", ip));
2701                 exit_server_cleanly("Forced disconnect for client");
2702         }
2703
2704         TALLOC_FREE(client_ip);
2705 }
2706
2707 /*
2708  * Send keepalive packets to our client
2709  */
2710 static bool keepalive_fn(const struct timeval *now, void *private_data)
2711 {
2712         struct smbd_server_connection *sconn = talloc_get_type_abort(
2713                 private_data, struct smbd_server_connection);
2714         struct smbXsrv_connection *xconn = sconn->conn;
2715         bool ret;
2716
2717         if (sconn->using_smb2) {
2718                 /* Don't do keepalives on an SMB2 connection. */
2719                 return false;
2720         }
2721
2722         smbd_lock_socket(sconn);
2723         ret = send_keepalive(xconn->transport.sock);
2724         smbd_unlock_socket(sconn);
2725
2726         if (!ret) {
2727                 int saved_errno = errno;
2728                 /*
2729                  * Try and give an error message saying what
2730                  * client failed.
2731                  */
2732                 DEBUG(0, ("send_keepalive failed for client %s. "
2733                           "Error %s - exiting\n",
2734                           smbXsrv_connection_dbg(xconn),
2735                           strerror(saved_errno)));
2736                 errno = saved_errno;
2737                 return False;
2738         }
2739         return True;
2740 }
2741
2742 /*
2743  * Do the recurring check if we're idle
2744  */
2745 static bool deadtime_fn(const struct timeval *now, void *private_data)
2746 {
2747         struct smbd_server_connection *sconn =
2748                 (struct smbd_server_connection *)private_data;
2749
2750         if ((conn_num_open(sconn) == 0)
2751             || (conn_idle_all(sconn, now->tv_sec))) {
2752                 DEBUG( 2, ( "Closing idle connection\n" ) );
2753                 messaging_send(sconn->msg_ctx,
2754                                messaging_server_id(sconn->msg_ctx),
2755                                MSG_SHUTDOWN, &data_blob_null);
2756                 return False;
2757         }
2758
2759         return True;
2760 }
2761
2762 /*
2763  * Do the recurring log file and smb.conf reload checks.
2764  */
2765
2766 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2767 {
2768         struct smbd_server_connection *sconn = talloc_get_type_abort(
2769                 private_data, struct smbd_server_connection);
2770
2771         DEBUG(5, ("housekeeping\n"));
2772
2773         change_to_root_user();
2774
2775         /* update printer queue caches if necessary */
2776         update_monitored_printq_cache(sconn->msg_ctx);
2777
2778         /* check if we need to reload services */
2779         check_reload(sconn, time_mono(NULL));
2780
2781         /*
2782          * Force a log file check.
2783          */
2784         force_check_log_size();
2785         check_log_size();
2786         return true;
2787 }
2788
2789 /*
2790  * Read an smb packet in the echo handler child, giving the parent
2791  * smbd one second to react once the socket becomes readable.
2792  */
2793
2794 struct smbd_echo_read_state {
2795         struct tevent_context *ev;
2796         struct smbd_server_connection *sconn;
2797
2798         char *buf;
2799         size_t buflen;
2800         uint32_t seqnum;
2801 };
2802
2803 static void smbd_echo_read_readable(struct tevent_req *subreq);
2804 static void smbd_echo_read_waited(struct tevent_req *subreq);
2805
2806 static struct tevent_req *smbd_echo_read_send(
2807         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2808         struct smbd_server_connection *sconn)
2809 {
2810         struct tevent_req *req, *subreq;
2811         struct smbd_echo_read_state *state;
2812         struct smbXsrv_connection *xconn = sconn->conn;
2813
2814         req = tevent_req_create(mem_ctx, &state,
2815                                 struct smbd_echo_read_state);
2816         if (req == NULL) {
2817                 return NULL;
2818         }
2819         state->ev = ev;
2820         state->sconn = sconn;
2821
2822         subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2823         if (tevent_req_nomem(subreq, req)) {
2824                 return tevent_req_post(req, ev);
2825         }
2826         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2827         return req;
2828 }
2829
2830 static void smbd_echo_read_readable(struct tevent_req *subreq)
2831 {
2832         struct tevent_req *req = tevent_req_callback_data(
2833                 subreq, struct tevent_req);
2834         struct smbd_echo_read_state *state = tevent_req_data(
2835                 req, struct smbd_echo_read_state);
2836         bool ok;
2837         int err;
2838
2839         ok = wait_for_read_recv(subreq, &err);
2840         TALLOC_FREE(subreq);
2841         if (!ok) {
2842                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2843                 return;
2844         }
2845
2846         /*
2847          * Give the parent smbd one second to step in
2848          */
2849
2850         subreq = tevent_wakeup_send(
2851                 state, state->ev, timeval_current_ofs(1, 0));
2852         if (tevent_req_nomem(subreq, req)) {
2853                 return;
2854         }
2855         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2856 }
2857
2858 static void smbd_echo_read_waited(struct tevent_req *subreq)
2859 {
2860         struct tevent_req *req = tevent_req_callback_data(
2861                 subreq, struct tevent_req);
2862         struct smbd_echo_read_state *state = tevent_req_data(
2863                 req, struct smbd_echo_read_state);
2864         struct smbd_server_connection *sconn = state->sconn;
2865         struct smbXsrv_connection *xconn = sconn->conn;
2866         bool ok;
2867         NTSTATUS status;
2868         size_t unread = 0;
2869         bool encrypted;
2870
2871         ok = tevent_wakeup_recv(subreq);
2872         TALLOC_FREE(subreq);
2873         if (!ok) {
2874                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2875                 return;
2876         }
2877
2878         ok = smbd_lock_socket_internal(sconn);
2879         if (!ok) {
2880                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2881                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2882                 return;
2883         }
2884
2885         if (!fd_is_readable(xconn->transport.sock)) {
2886                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2887                           (int)getpid()));
2888
2889                 ok = smbd_unlock_socket_internal(sconn);
2890                 if (!ok) {
2891                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2892                         DEBUG(1, ("%s: failed to unlock socket\n",
2893                                 __location__));
2894                         return;
2895                 }
2896
2897                 subreq = wait_for_read_send(state, state->ev,
2898                                             xconn->transport.sock);
2899                 if (tevent_req_nomem(subreq, req)) {
2900                         return;
2901                 }
2902                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2903                 return;
2904         }
2905
2906         status = receive_smb_talloc(state, sconn,
2907                                     xconn->transport.sock,
2908                                     &state->buf,
2909                                     0 /* timeout */,
2910                                     &unread,
2911                                     &encrypted,
2912                                     &state->buflen,
2913                                     &state->seqnum,
2914                                     false /* trusted_channel*/);
2915
2916         if (tevent_req_nterror(req, status)) {
2917                 tevent_req_nterror(req, status);
2918                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2919                           (int)getpid(), nt_errstr(status)));
2920                 return;
2921         }
2922
2923         ok = smbd_unlock_socket_internal(sconn);
2924         if (!ok) {
2925                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2926                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2927                 return;
2928         }
2929         tevent_req_done(req);
2930 }
2931
2932 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2933                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2934 {
2935         struct smbd_echo_read_state *state = tevent_req_data(
2936                 req, struct smbd_echo_read_state);
2937         NTSTATUS status;
2938
2939         if (tevent_req_is_nterror(req, &status)) {
2940                 return status;
2941         }
2942         *pbuf = talloc_move(mem_ctx, &state->buf);
2943         *pbuflen = state->buflen;
2944         *pseqnum = state->seqnum;
2945         return NT_STATUS_OK;
2946 }
2947
2948 struct smbd_echo_state {
2949         struct tevent_context *ev;
2950         struct iovec *pending;
2951         struct smbd_server_connection *sconn;
2952         int parent_pipe;
2953
2954         struct tevent_fd *parent_fde;
2955
2956         struct tevent_req *write_req;
2957 };
2958
2959 static void smbd_echo_writer_done(struct tevent_req *req);
2960
2961 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2962 {
2963         int num_pending;
2964
2965         if (state->write_req != NULL) {
2966                 return;
2967         }
2968
2969         num_pending = talloc_array_length(state->pending);
2970         if (num_pending == 0) {
2971                 return;
2972         }
2973
2974         state->write_req = writev_send(state, state->ev, NULL,
2975                                        state->parent_pipe, false,
2976                                        state->pending, num_pending);
2977         if (state->write_req == NULL) {
2978                 DEBUG(1, ("writev_send failed\n"));
2979                 exit(1);
2980         }
2981
2982         talloc_steal(state->write_req, state->pending);
2983         state->pending = NULL;
2984
2985         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2986                                 state);
2987 }
2988
2989 static void smbd_echo_writer_done(struct tevent_req *req)
2990 {
2991         struct smbd_echo_state *state = tevent_req_callback_data(
2992                 req, struct smbd_echo_state);
2993         ssize_t written;
2994         int err;
2995
2996         written = writev_recv(req, &err);
2997         TALLOC_FREE(req);
2998         state->write_req = NULL;
2999         if (written == -1) {
3000                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3001                 exit(1);
3002         }
3003         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3004         smbd_echo_activate_writer(state);
3005 }
3006
3007 static bool smbd_echo_reply(struct smbd_echo_state *state,
3008                             uint8_t *inbuf, size_t inbuf_len,
3009                             uint32_t seqnum)
3010 {
3011         struct smb_request req;
3012         uint16_t num_replies;
3013         char *outbuf;
3014         bool ok;
3015
3016         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3017                 DEBUG(10, ("Got netbios keepalive\n"));
3018                 /*
3019                  * Just swallow it
3020                  */
3021                 return true;
3022         }
3023
3024         if (inbuf_len < smb_size) {
3025                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3026                 return false;
3027         }
3028         if (!valid_smb_header(state->sconn, inbuf)) {
3029                 DEBUG(10, ("Got invalid SMB header\n"));
3030                 return false;
3031         }
3032
3033         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
3034                               seqnum)) {
3035                 return false;
3036         }
3037         req.inbuf = inbuf;
3038
3039         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3040                    smb_messages[req.cmd].name
3041                    ? smb_messages[req.cmd].name : "unknown"));
3042
3043         if (req.cmd != SMBecho) {
3044                 return false;
3045         }
3046         if (req.wct < 1) {
3047                 return false;
3048         }
3049
3050         num_replies = SVAL(req.vwv+0, 0);
3051         if (num_replies != 1) {
3052                 /* Not a Windows "Hey, you're still there?" request */
3053                 return false;
3054         }
3055
3056         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3057                            1, req.buflen)) {
3058                 DEBUG(10, ("create_outbuf failed\n"));
3059                 return false;
3060         }
3061         req.outbuf = (uint8_t *)outbuf;
3062
3063         SSVAL(req.outbuf, smb_vwv0, num_replies);
3064
3065         if (req.buflen > 0) {
3066                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3067         }
3068
3069         ok = srv_send_smb(req.sconn,
3070                           (char *)outbuf,
3071                           true, seqnum+1,
3072                           false, &req.pcd);
3073         TALLOC_FREE(outbuf);
3074         if (!ok) {
3075                 exit(1);
3076         }
3077
3078         return true;
3079 }
3080
3081 static void smbd_echo_exit(struct tevent_context *ev,
3082                            struct tevent_fd *fde, uint16_t flags,
3083                            void *private_data)
3084 {
3085         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3086         exit(0);
3087 }
3088
3089 static void smbd_echo_got_packet(struct tevent_req *req);
3090
3091 static void smbd_echo_loop(struct smbd_server_connection *sconn,
3092                            int parent_pipe)
3093 {
3094         struct smbd_echo_state *state;
3095         struct tevent_req *read_req;
3096
3097         state = talloc_zero(sconn, struct smbd_echo_state);
3098         if (state == NULL) {
3099                 DEBUG(1, ("talloc failed\n"));
3100                 return;
3101         }
3102         state->sconn = sconn;
3103         state->parent_pipe = parent_pipe;
3104         state->ev = s3_tevent_context_init(state);
3105         if (state->ev == NULL) {
3106                 DEBUG(1, ("tevent_context_init failed\n"));
3107                 TALLOC_FREE(state);
3108                 return;
3109         }
3110         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3111                                         TEVENT_FD_READ, smbd_echo_exit,
3112                                         state);
3113         if (state->parent_fde == NULL) {
3114                 DEBUG(1, ("tevent_add_fd failed\n"));
3115                 TALLOC_FREE(state);
3116                 return;
3117         }
3118
3119         read_req = smbd_echo_read_send(state, state->ev, sconn);
3120         if (read_req == NULL) {
3121                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3122                 TALLOC_FREE(state);
3123                 return;
3124         }
3125         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3126
3127         while (true) {
3128                 if (tevent_loop_once(state->ev) == -1) {
3129                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3130                                   strerror(errno)));
3131                         break;
3132                 }
3133         }
3134         TALLOC_FREE(state);
3135 }
3136
3137 static void smbd_echo_got_packet(struct tevent_req *req)
3138 {
3139         struct smbd_echo_state *state = tevent_req_callback_data(
3140                 req, struct smbd_echo_state);
3141         NTSTATUS status;
3142         char *buf = NULL;
3143         size_t buflen = 0;
3144         uint32_t seqnum = 0;
3145         bool reply;
3146
3147         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3148         TALLOC_FREE(req);
3149         if (!NT_STATUS_IS_OK(status)) {
3150                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3151                           nt_errstr(status)));
3152                 exit(1);
3153         }
3154
3155         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3156         if (!reply) {
3157                 size_t num_pending;
3158                 struct iovec *tmp;
3159                 struct iovec *iov;
3160
3161                 num_pending = talloc_array_length(state->pending);
3162                 tmp = talloc_realloc(state, state->pending, struct iovec,
3163                                      num_pending+1);
3164                 if (tmp == NULL) {
3165                         DEBUG(1, ("talloc_realloc failed\n"));
3166                         exit(1);
3167                 }
3168                 state->pending = tmp;
3169
3170                 if (buflen >= smb_size) {
3171                         /*
3172                          * place the seqnum in the packet so that the main process
3173                          * can reply with signing
3174                          */
3175                         SIVAL(buf, smb_ss_field, seqnum);
3176                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3177                 }
3178
3179                 iov = &state->pending[num_pending];
3180                 iov->iov_base = talloc_move(state->pending, &buf);
3181                 iov->iov_len = buflen;
3182
3183                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3184                           (int)getpid()));
3185                 smbd_echo_activate_writer(state);
3186         }
3187
3188         req = smbd_echo_read_send(state, state->ev, state->sconn);
3189         if (req == NULL) {
3190                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3191                 exit(1);
3192         }
3193         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3194 }
3195
3196
3197 /*
3198  * Handle SMBecho requests in a forked child process
3199  */
3200 bool fork_echo_handler(struct smbd_server_connection *sconn)
3201 {
3202         int listener_pipe[2];
3203         int res;
3204         pid_t child;
3205         bool use_mutex = false;
3206
3207         res = pipe(listener_pipe);
3208         if (res == -1) {
3209                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3210                 return false;
3211         }
3212
3213 #ifdef HAVE_ROBUST_MUTEXES
3214         use_mutex = tdb_runtime_check_for_robust_mutexes();
3215
3216         if (use_mutex) {
3217                 pthread_mutexattr_t a;
3218
3219                 sconn->smb1.echo_handler.socket_mutex =
3220                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3221                 if (sconn->smb1.echo_handler.socket_mutex == NULL) {
3222                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3223                                   strerror(errno)));
3224                         goto fail;
3225                 }
3226
3227                 res = pthread_mutexattr_init(&a);
3228                 if (res != 0) {
3229                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3230                                   strerror(res)));
3231                         goto fail;
3232                 }
3233                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3234                 if (res != 0) {
3235                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3236                                   strerror(res)));
3237                         pthread_mutexattr_destroy(&a);
3238                         goto fail;
3239                 }
3240                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3241                 if (res != 0) {
3242                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3243                                   strerror(res)));
3244                         pthread_mutexattr_destroy(&a);
3245                         goto fail;
3246                 }
3247                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3248                 if (res != 0) {
3249                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3250                                   "%s\n", strerror(res)));
3251                         pthread_mutexattr_destroy(&a);
3252                         goto fail;
3253                 }
3254                 res = pthread_mutex_init(sconn->smb1.echo_handler.socket_mutex,
3255                                          &a);
3256                 pthread_mutexattr_destroy(&a);
3257                 if (res != 0) {
3258                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3259                                   strerror(res)));
3260                         goto fail;
3261                 }
3262         }
3263 #endif
3264
3265         if (!use_mutex) {
3266                 sconn->smb1.echo_handler.socket_lock_fd =
3267                         create_unlink_tmp(lp_lock_directory());
3268                 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3269                         DEBUG(1, ("Could not create lock fd: %s\n",
3270                                   strerror(errno)));
3271                         goto fail;
3272                 }
3273         }
3274
3275         child = fork();
3276         if (child == 0) {
3277                 NTSTATUS status;
3278
3279                 close(listener_pipe[0]);
3280                 set_blocking(listener_pipe[1], false);
3281
3282                 status = reinit_after_fork(sconn->msg_ctx,
3283                                            sconn->ev_ctx,
3284                                            true);
3285                 if (!NT_STATUS_IS_OK(status)) {
3286                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3287                                   nt_errstr(status)));
3288                         exit(1);
3289                 }
3290                 smbd_echo_loop(sconn, listener_pipe[1]);
3291                 exit(0);
3292         }
3293         close(listener_pipe[1]);
3294         listener_pipe[1] = -1;
3295         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3296
3297         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3298
3299         /*
3300          * Without smb signing this is the same as the normal smbd
3301          * listener. This needs to change once signing comes in.
3302          */
3303         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3304                                         sconn,
3305                                         sconn->smb1.echo_handler.trusted_fd,
3306                                         TEVENT_FD_READ,
3307                                         smbd_server_echo_handler,
3308                                         sconn);
3309         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3310                 DEBUG(1, ("event_add_fd failed\n"));
3311                 goto fail;
3312         }
3313
3314         return true;
3315
3316 fail:
3317         if (listener_pipe[0] != -1) {
3318                 close(listener_pipe[0]);
3319         }
3320         if (listener_pipe[1] != -1) {
3321                 close(listener_pipe[1]);
3322         }
3323         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3324                 close(sconn->smb1.echo_handler.socket_lock_fd);
3325         }
3326
3327 #ifdef HAVE_ROBUST_MUTEXES
3328         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
3329                 pthread_mutex_destroy(sconn->smb1.echo_handler.socket_mutex);
3330                 anonymous_shared_free(sconn->smb1.echo_handler.socket_mutex);
3331         }
3332 #endif
3333         smbd_echo_init(sconn);
3334
3335         return false;
3336 }
3337
3338 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3339 {
3340         while (user) {
3341                 if (user->session_info &&
3342                     (user->session_info->unix_token->uid == uid)) {
3343                         return true;
3344                 }
3345                 user = user->next;
3346         }
3347         return false;
3348 }
3349
3350 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3351 {
3352         while (user) {
3353                 if (user->session_info != NULL) {
3354                         int i;
3355                         struct security_unix_token *utok;
3356
3357                         utok = user->session_info->unix_token;
3358                         if (utok->gid == gid) {
3359                                 return true;
3360                         }
3361                         for(i=0; i<utok->ngroups; i++) {
3362                                 if (utok->groups[i] == gid) {
3363                                         return true;
3364                                 }
3365                         }
3366                 }
3367                 user = user->next;
3368         }
3369         return false;
3370 }
3371
3372 static bool sid_in_use(const struct user_struct *user,
3373                        const struct dom_sid *psid)
3374 {
3375         while (user) {
3376                 struct security_token *tok;
3377
3378                 if (user->session_info == NULL) {
3379                         continue;
3380                 }
3381                 tok = user->session_info->security_token;
3382                 if (tok == NULL) {
3383                         /*
3384                          * Not sure session_info->security_token can
3385                          * ever be NULL. This check might be not
3386                          * necessary.
3387                          */
3388                         continue;
3389                 }
3390                 if (security_token_has_sid(tok, psid)) {
3391                         return true;
3392                 }
3393                 user = user->next;
3394         }
3395         return false;
3396 }
3397
3398 static bool id_in_use(const struct user_struct *user,
3399                       const struct id_cache_ref *id)
3400 {
3401         switch(id->type) {
3402         case UID:
3403                 return uid_in_use(user, id->id.uid);
3404         case GID:
3405                 return gid_in_use(user, id->id.gid);
3406         case SID:
3407                 return sid_in_use(user, &id->id.sid);
3408         default:
3409                 break;
3410         }
3411         return false;
3412 }
3413
3414 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3415                                void *private_data,
3416                                uint32_t msg_type,
3417                                struct server_id server_id,
3418                                DATA_BLOB* data)
3419 {
3420         const char *msg = (data && data->data)
3421                 ? (const char *)data->data : "<NULL>";
3422         struct id_cache_ref id;
3423         struct smbd_server_connection *sconn =
3424                 talloc_get_type_abort(private_data,
3425                 struct smbd_server_connection);
3426
3427         if (!id_cache_ref_parse(msg, &id)) {
3428                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3429                 return;
3430         }
3431
3432         if (id_in_use(sconn->users, &id)) {
3433                 exit_server_cleanly(msg);
3434         }
3435         id_cache_delete_from_cache(&id);
3436 }
3437
3438 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3439                                         enum protocol_types protocol)
3440 {
3441         NTSTATUS status;
3442
3443         set_Protocol(protocol);
3444         conn->protocol = protocol;
3445
3446         if (protocol >= PROTOCOL_SMB2_02) {
3447                 status = smb2srv_session_table_init(conn);
3448                 if (!NT_STATUS_IS_OK(status)) {
3449                         return status;
3450                 }
3451
3452                 status = smb2srv_open_table_init(conn);
3453                 if (!NT_STATUS_IS_OK(status)) {
3454                         return status;
3455                 }
3456         } else {
3457                 status = smb1srv_session_table_init(conn);
3458                 if (!NT_STATUS_IS_OK(status)) {
3459                         return status;
3460                 }
3461
3462                 status = smb1srv_tcon_table_init(conn);
3463                 if (!NT_STATUS_IS_OK(status)) {
3464                         return status;
3465                 }
3466
3467                 status = smb1srv_open_table_init(conn);
3468                 if (!NT_STATUS_IS_OK(status)) {
3469                         return status;
3470                 }
3471         }
3472
3473         return NT_STATUS_OK;
3474 }
3475
3476 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3477                                        void *private_data)
3478 {
3479         struct smbXsrv_connection *conn =
3480                 talloc_get_type_abort(private_data,
3481                 struct smbXsrv_connection);
3482
3483         switch (point) {
3484         case TEVENT_TRACE_BEFORE_WAIT:
3485                 /*
3486                  * This just removes compiler warning
3487                  * without profile support
3488                  */
3489                 conn->smbd_idle_profstamp = 0;
3490                 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3491                 break;
3492         case TEVENT_TRACE_AFTER_WAIT:
3493                 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3494                 break;
3495 #ifdef TEVENT_HAS_LOOP_ONCE_TRACE_POINTS
3496         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3497         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3498                 break;
3499 #endif
3500         }
3501 }
3502
3503 /**
3504  * Create a debug string for the connection
3505  *
3506  * This is allocated to talloc_tos() or a string constant
3507  * in certain corner cases. The returned string should
3508  * hence not be free'd directly but only via the talloc stack.
3509  */
3510 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3511 {
3512         const char *ret;
3513
3514         /*
3515          * TODO: this can be improved later
3516          * maybe including the client guid or more
3517          */
3518         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3519         if (ret == NULL) {
3520                 return "<tsocket_address_string() failed>";
3521         }
3522
3523         return ret;
3524 }
3525
3526 /****************************************************************************
3527  Process commands from the client
3528 ****************************************************************************/
3529
3530 void smbd_process(struct tevent_context *ev_ctx,
3531                   struct messaging_context *msg_ctx,
3532                   int sock_fd,
3533                   bool interactive)
3534 {
3535         TALLOC_CTX *frame = talloc_stackframe();
3536         struct smbXsrv_connection *conn;
3537         struct smbd_server_connection *sconn;
3538         struct sockaddr_storage ss_srv;
3539         void *sp_srv = (void *)&ss_srv;
3540         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3541         struct sockaddr_storage ss_clnt;
3542         void *sp_clnt = (void *)&ss_clnt;
3543         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3544         socklen_t sa_socklen;
3545         struct tsocket_address *local_address = NULL;
3546         struct tsocket_address *remote_address = NULL;
3547         const char *locaddr = NULL;
3548         const char *remaddr = NULL;
3549         char *rhost;
3550         int ret;
3551         int tmp;
3552
3553         conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3554         if (conn == NULL) {
3555                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3556                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3557         }
3558
3559         conn->ev_ctx = ev_ctx;
3560         conn->msg_ctx = msg_ctx;
3561         conn->transport.sock = sock_fd;
3562
3563         sconn = talloc_zero(conn, struct smbd_server_connection);
3564         if (!sconn) {
3565                 exit_server("failed to create smbd_server_connection");
3566         }
3567
3568         conn->sconn = sconn;
3569         sconn->conn = conn;
3570
3571         /*
3572          * TODO: remove this...:-)
3573          */
3574         global_smbXsrv_connection = conn;
3575
3576         sconn->ev_ctx = ev_ctx;
3577         sconn->msg_ctx = msg_ctx;
3578         smbd_echo_init(sconn);
3579
3580         if (!interactive) {
3581                 smbd_setup_sig_term_handler(sconn);
3582                 smbd_setup_sig_hup_handler(sconn);
3583
3584                 if (!serverid_register(messaging_server_id(msg_ctx),
3585                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3586                                        |FLAG_MSG_DBWRAP
3587                                        |FLAG_MSG_PRINT_GENERAL)) {
3588                         exit_server_cleanly("Could not register myself in "
3589                                             "serverid.tdb");
3590                 }
3591         }
3592
3593         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3594                 /*
3595                  * We're not making the decision here,
3596                  * we're just allowing the client
3597                  * to decide between SMB1 and SMB2
3598                  * with the first negprot
3599                  * packet.
3600                  */
3601                 sconn->using_smb2 = true;
3602         }
3603
3604         /* Ensure child is set to blocking mode */
3605         set_blocking(sock_fd,True);
3606
3607         set_socket_options(sock_fd, "SO_KEEPALIVE");
3608         set_socket_options(sock_fd, lp_socket_options());
3609
3610         sa_socklen = sizeof(ss_clnt);
3611         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3612         if (ret != 0) {
3613                 int level = (errno == ENOTCONN)?2:0;
3614                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3615                 exit_server_cleanly("getpeername() failed.\n");
3616         }
3617         ret = tsocket_address_bsd_from_sockaddr(sconn,
3618                                                 sa_clnt, sa_socklen,
3619                                                 &remote_address);
3620         if (ret != 0) {
3621                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3622                         __location__, strerror(errno)));
3623                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3624         }
3625
3626         sa_socklen = sizeof(ss_srv);
3627         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3628         if (ret != 0) {
3629                 int level = (errno == ENOTCONN)?2:0;
3630                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3631                 exit_server_cleanly("getsockname() failed.\n");
3632         }
3633         ret = tsocket_address_bsd_from_sockaddr(sconn,
3634                                                 sa_srv, sa_socklen,
3635                                                 &local_address);
3636         if (ret != 0) {
3637                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3638                         __location__, strerror(errno)));
3639                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3640         }
3641
3642         sconn->local_address = local_address;
3643         sconn->remote_address = remote_address;
3644
3645         if (tsocket_address_is_inet(local_address, "ip")) {
3646                 locaddr = tsocket_address_inet_addr_string(
3647                                 sconn->local_address,
3648                                 talloc_tos());
3649                 if (locaddr == NULL) {
3650                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3651                                  __location__, strerror(errno)));
3652                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3653                 }
3654         } else {
3655                 locaddr = "0.0.0.0";
3656         }
3657
3658         if (tsocket_address_is_inet(remote_address, "ip")) {
3659                 remaddr = tsocket_address_inet_addr_string(
3660                                 sconn->remote_address,
3661                                 talloc_tos());
3662                 if (remaddr == NULL) {
3663                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3664                                  __location__, strerror(errno)));
3665                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3666                 }
3667         } else {
3668                 remaddr = "0.0.0.0";
3669         }
3670
3671         /* this is needed so that we get decent entries
3672            in smbstatus for port 445 connects */
3673         set_remote_machine_name(remaddr, false);
3674         reload_services(sconn, conn_snum_used, true);
3675
3676         /*
3677          * Before the first packet, check the global hosts allow/ hosts deny
3678          * parameters before doing any parsing of packets passed to us by the
3679          * client. This prevents attacks on our parsing code from hosts not in
3680          * the hosts allow list.
3681          */
3682
3683         ret = get_remote_hostname(remote_address,
3684                                   &rhost,
3685                                   talloc_tos());
3686         if (ret < 0) {
3687                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3688                         __location__, strerror(errno)));
3689                 exit_server_cleanly("get_remote_hostname failed.\n");
3690         }
3691         if (strequal(rhost, "UNKNOWN")) {
3692                 rhost = talloc_strdup(talloc_tos(), remaddr);
3693         }
3694         sconn->remote_hostname = talloc_move(sconn, &rhost);
3695
3696         sub_set_socket_ids(remaddr,
3697                            sconn->remote_hostname,
3698                            locaddr);
3699
3700         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3701                           sconn->remote_hostname,
3702                           remaddr)) {
3703                 /*
3704                  * send a negative session response "not listening on calling
3705                  * name"
3706                  */
3707                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3708                 DEBUG( 1, ("Connection denied from %s to %s\n",
3709                            tsocket_address_string(remote_address, talloc_tos()),
3710                            tsocket_address_string(local_address, talloc_tos())));
3711                 (void)srv_send_smb(sconn,(char *)buf, false,
3712                                    0, false, NULL);
3713                 exit_server_cleanly("connection denied");
3714         }
3715
3716         DEBUG(10, ("Connection allowed from %s to %s\n",
3717                    tsocket_address_string(remote_address, talloc_tos()),
3718                    tsocket_address_string(local_address, talloc_tos())));
3719
3720         if (lp_preload_modules()) {
3721                 smb_load_modules(lp_preload_modules());
3722         }
3723
3724         smb_perfcount_init();
3725
3726         if (!init_account_policy()) {
3727                 exit_server("Could not open account policy tdb.\n");
3728         }
3729
3730         if (*lp_root_directory(talloc_tos())) {
3731                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3732                         DEBUG(0,("Failed to change root to %s\n",
3733                                  lp_root_directory(talloc_tos())));
3734                         exit_server("Failed to chroot()");
3735                 }
3736                 if (chdir("/") == -1) {
3737                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3738                         exit_server("Failed to chroot()");
3739                 }
3740                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3741         }
3742
3743         if (!srv_init_signing(conn)) {
3744                 exit_server("Failed to init smb_signing");
3745         }
3746
3747         if (!file_init(sconn)) {
3748                 exit_server("file_init() failed");
3749         }
3750
3751         /* Setup oplocks */
3752         if (!init_oplocks(sconn))
3753                 exit_server("Failed to init oplocks");
3754
3755         /* register our message handlers */
3756         messaging_register(sconn->msg_ctx, sconn,
3757                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3758         messaging_register(sconn->msg_ctx, sconn,
3759                            MSG_SMB_CLOSE_FILE, msg_close_file);
3760         messaging_register(sconn->msg_ctx, sconn,
3761                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3762
3763         id_cache_register_msgs(sconn->msg_ctx);
3764         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3765         messaging_register(sconn->msg_ctx, sconn,
3766                            ID_CACHE_KILL, smbd_id_cache_kill);
3767
3768         messaging_deregister(sconn->msg_ctx,
3769                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3770         messaging_register(sconn->msg_ctx, sconn,
3771                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3772
3773         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3774                              NULL);
3775         messaging_register(sconn->msg_ctx, sconn,
3776                            MSG_SMB_KILL_CLIENT_IP,
3777                            msg_kill_client_ip);
3778
3779         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3780
3781         /*
3782          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3783          * MSGs to all child processes
3784          */
3785         messaging_deregister(sconn->msg_ctx,
3786                              MSG_DEBUG, NULL);
3787         messaging_register(sconn->msg_ctx, NULL,
3788                            MSG_DEBUG, debug_message);
3789
3790         if ((lp_keepalive() != 0)
3791             && !(event_add_idle(ev_ctx, NULL,
3792                                 timeval_set(lp_keepalive(), 0),
3793                                 "keepalive", keepalive_fn,
3794                                 sconn))) {
3795                 DEBUG(0, ("Could not add keepalive event\n"));
3796                 exit(1);
3797         }
3798
3799         if (!(event_add_idle(ev_ctx, NULL,
3800                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3801                              "deadtime", deadtime_fn, sconn))) {
3802                 DEBUG(0, ("Could not add deadtime event\n"));
3803                 exit(1);
3804         }
3805
3806         if (!(event_add_idle(ev_ctx, NULL,
3807                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3808                              "housekeeping", housekeeping_fn, sconn))) {
3809                 DEBUG(0, ("Could not add housekeeping event\n"));
3810                 exit(1);
3811         }
3812
3813         if (lp_clustering()) {
3814                 /*
3815                  * We need to tell ctdb about our client's TCP
3816                  * connection, so that for failover ctdbd can send
3817                  * tickle acks, triggering a reconnection by the
3818                  * client.
3819                  */
3820                 NTSTATUS status;
3821
3822                 status = smbd_register_ips(sconn, &ss_srv, &ss_clnt);
3823                 if (!NT_STATUS_IS_OK(status)) {
3824                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3825                                   nt_errstr(status)));
3826                 }
3827         }
3828
3829         tmp = lp_max_xmit();
3830         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3831         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3832
3833         conn->smb1.negprot.max_recv = tmp;
3834
3835         conn->smb1.sessions.done_sesssetup = false;
3836         conn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3837
3838         if (!init_dptrs(sconn)) {
3839                 exit_server("init_dptrs() failed");
3840         }
3841
3842         conn->transport.fde = tevent_add_fd(ev_ctx,
3843                                             sconn,
3844                                             sock_fd,
3845                                             TEVENT_FD_READ,
3846                                             smbd_server_connection_handler,
3847                                             sconn);
3848         if (!conn->transport.fde) {
3849                 exit_server("failed to create smbd_server_connection fde");
3850         }
3851
3852         sconn->conn->local_address = sconn->local_address;
3853         sconn->conn->remote_address = sconn->remote_address;
3854         sconn->conn->remote_hostname = sconn->remote_hostname;
3855         sconn->conn->protocol = PROTOCOL_NONE;
3856
3857         TALLOC_FREE(frame);
3858
3859         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3860
3861         while (True) {
3862                 frame = talloc_stackframe_pool(8192);
3863
3864                 errno = 0;
3865                 if (tevent_loop_once(ev_ctx) == -1) {
3866                         if (errno != EINTR) {
3867                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3868                                           " exiting\n", strerror(errno) ));
3869                                 break;
3870                         }
3871                 }
3872
3873                 TALLOC_FREE(frame);
3874         }
3875
3876         exit_server_cleanly(NULL);
3877 }
3878
3879 bool req_is_in_chain(const struct smb_request *req)
3880 {
3881         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3882                 /*
3883                  * We're right now handling a subsequent request, so we must
3884                  * be in a chain
3885                  */
3886                 return true;
3887         }
3888
3889         if (!is_andx_req(req->cmd)) {
3890                 return false;
3891         }
3892
3893         if (req->wct < 2) {
3894                 /*
3895                  * Okay, an illegal request, but definitely not chained :-)
3896                  */
3897                 return false;
3898         }
3899
3900         return (CVAL(req->vwv+0, 0) != 0xFF);
3901 }