source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23 struct timeval smb_last_time;
  24
  25 static char *InBuffer = NULL;
  26 char *OutBuffer = NULL;
  27 char *last_inbuf = NULL;
  28
  29 /*
  30  * Size of data we can send to client. Set
  31  *  by the client for all protocols above CORE.
  32  *  Set by us for CORE protocol.
  33  */
  34 int max_send = BUFFER_SIZE;
  35 /*
  36  * Size of the data we can receive. Set by us.
  37  * Can be modified by the max xmit parameter.
  38  */
  39 int max_recv = BUFFER_SIZE;
  40
  41 extern int last_message;
  42 extern int global_oplock_break;
  43 extern userdom_struct current_user_info;
  44 extern int smb_read_error;
  45 SIG_ATOMIC_T reload_after_sighup = 0;
  46 SIG_ATOMIC_T got_sig_term = 0;
  47 BOOL global_machine_password_needs_changing = False;
  48 extern int max_send;
  49
  50 /****************************************************************************
  51  structure to hold a linked list of queued messages.
  52  for processing.
  53 ****************************************************************************/
  54
  55 typedef struct {
  56         ubi_slNode msg_next;
  57         char *msg_buf;
  58         int msg_len;
  59 } pending_message_list;
  60
  61 static ubi_slList smb_oplock_queue = { NULL, (ubi_slNodePtr)&smb_oplock_queue, 0};
  62
  63 /****************************************************************************
  64  Function to push a message onto the tail of a linked list of smb messages ready
  65  for processing.
  66 ****************************************************************************/
  67
  68 static BOOL push_message(ubi_slList *list_head, char *buf, int msg_len)
  69 {
  70         pending_message_list *msg = (pending_message_list *)
  71                                malloc(sizeof(pending_message_list));
  72
  73         if(msg == NULL) {
  74                 DEBUG(0,("push_message: malloc fail (1)\n"));
  75                 return False;
  76         }
  77
  78         msg->msg_buf = (char *)malloc(msg_len);
  79         if(msg->msg_buf == NULL) {
  80                 DEBUG(0,("push_message: malloc fail (2)\n"));
  81                 SAFE_FREE(msg);
  82                 return False;
  83         }
  84
  85         memcpy(msg->msg_buf, buf, msg_len);
  86         msg->msg_len = msg_len;
  87
  88         ubi_slAddTail( list_head, msg);
  89
  90         /* Push the MID of this packet on the signing queue. */
  91         srv_defer_sign_response(SVAL(buf,smb_mid));
  92
  93         return True;
  94 }
  95
  96 /****************************************************************************
  97  Function to push a smb message onto a linked list of local smb messages ready
  98  for processing.
  99 ****************************************************************************/
 100
 101 BOOL push_oplock_pending_smb_message(char *buf, int msg_len)
 102 {
 103         return push_message(&smb_oplock_queue, buf, msg_len);
 104 }
 105
 106 /****************************************************************************
 107  Do all async processing in here. This includes UDB oplock messages, kernel
 108  oplock messages, change notify events etc.
 109 ****************************************************************************/
 110
 111 static void async_processing(char *buffer, int buffer_len)
 112 {
 113         DEBUG(10,("async_processing: Doing async processing.\n"));
 114
 115         /* check for oplock messages (both UDP and kernel) */
 116         if (receive_local_message(buffer, buffer_len, 1)) {
 117                 process_local_message(buffer, buffer_len);
 118         }
 119
 120         if (got_sig_term) {
 121                 exit_server("Caught TERM signal");
 122         }
 123
 124         /* check for async change notify events */
 125         process_pending_change_notify_queue(0);
 126
 127         /* check for sighup processing */
 128         if (reload_after_sighup) {
 129                 change_to_root_user();
 130                 DEBUG(1,("Reloading services after SIGHUP\n"));
 131                 reload_services(False);
 132                 reload_after_sighup = 0;
 133         }
 134 }
 135
 136 /****************************************************************************
 137   Do a select on an two fd's - with timeout.
 138
 139   If a local udp message has been pushed onto the
 140   queue (this can only happen during oplock break
 141   processing) call async_processing()
 142
 143   If a pending smb message has been pushed onto the
 144   queue (this can only happen during oplock break
 145   processing) return this next.
 146
 147   If the first smbfd is ready then read an smb from it.
 148   if the second (loopback UDP) fd is ready then read a message
 149   from it and setup the buffer header to identify the length
 150   and from address.
 151   Returns False on timeout or error.
 152   Else returns True.
 153
 154 The timeout is in milliseconds
 155 ****************************************************************************/
 156
 157 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 158 {
 159         fd_set fds;
 160         int selrtn;
 161         struct timeval to;
 162         int maxfd;
 163
 164         smb_read_error = 0;
 165
 166  again:
 167
 168         /*
 169          * Note that this call must be before processing any SMB
 170          * messages as we need to synchronously process any messages
 171          * we may have sent to ourselves from the previous SMB.
 172          */
 173         message_dispatch();
 174
 175         /*
 176          * Check to see if we already have a message on the smb queue.
 177          * If so - copy and return it.
 178          */
 179         if(ubi_slCount(&smb_oplock_queue) != 0) {
 180                 pending_message_list *msg = (pending_message_list *)ubi_slRemHead(&smb_oplock_queue);
 181                 memcpy(buffer, msg->msg_buf, MIN(buffer_len, msg->msg_len));
 182
 183                 /* Free the message we just copied. */
 184                 SAFE_FREE(msg->msg_buf);
 185                 SAFE_FREE(msg);
 186
 187                 DEBUG(5,("receive_message_or_smb: returning queued smb message.\n"));
 188                 return True;
 189         }
 190
 191
 192         /*
 193          * Setup the select read fd set.
 194          */
 195
 196         FD_ZERO(&fds);
 197
 198         /*
 199          * Ensure we process oplock break messages by preference.
 200          * We have to do this before the select, after the select
 201          * and if the select returns EINTR. This is due to the fact
 202          * that the selects called from async_processing can eat an EINTR
 203          * caused by a signal (we can't take the break message there).
 204          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 205          */
 206
 207         if (oplock_message_waiting(&fds)) {
 208                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 209                 async_processing(buffer, buffer_len);
 210                 /*
 211                  * After async processing we must go and do the select again, as
 212                  * the state of the flag in fds for the server file descriptor is
 213                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 214                  */
 215                 goto again;
 216         }
 217
 218         FD_SET(smbd_server_fd(),&fds);
 219         maxfd = setup_oplock_select_set(&fds);
 220
 221         to.tv_sec = timeout / 1000;
 222         to.tv_usec = (timeout % 1000) * 1000;
 223
 224         selrtn = sys_select(MAX(maxfd,smbd_server_fd())+1,&fds,NULL,NULL,timeout>0?&to:NULL);
 225
 226         /* if we get EINTR then maybe we have received an oplock
 227            signal - treat this as select returning 1. This is ugly, but
 228            is the best we can do until the oplock code knows more about
 229            signals */
 230         if (selrtn == -1 && errno == EINTR) {
 231                 async_processing(buffer, buffer_len);
 232                 /*
 233                  * After async processing we must go and do the select again, as
 234                  * the state of the flag in fds for the server file descriptor is
 235                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 236                  */
 237                 goto again;
 238         }
 239
 240         /* Check if error */
 241         if (selrtn == -1) {
 242                 /* something is wrong. Maybe the socket is dead? */
 243                 smb_read_error = READ_ERROR;
 244                 return False;
 245         }
 246
 247         /* Did we timeout ? */
 248         if (selrtn == 0) {
 249                 smb_read_error = READ_TIMEOUT;
 250                 return False;
 251         }
 252
 253         /*
 254          * Ensure we process oplock break messages by preference.
 255          * This is IMPORTANT ! Otherwise we can starve other processes
 256          * sending us an oplock break message. JRA.
 257          */
 258
 259         if (oplock_message_waiting(&fds)) {
 260                 async_processing(buffer, buffer_len);
 261                 /*
 262                  * After async processing we must go and do the select again, as
 263                  * the state of the flag in fds for the server file descriptor is
 264                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 265                  */
 266                 goto again;
 267         }
 268
 269         return receive_smb(smbd_server_fd(), buffer, 0);
 270 }
 271
 272 /****************************************************************************
 273 Get the next SMB packet, doing the local message processing automatically.
 274 ****************************************************************************/
 275
 276 BOOL receive_next_smb(char *inbuf, int bufsize, int timeout)
 277 {
 278         BOOL got_keepalive;
 279         BOOL ret;
 280
 281         do {
 282                 ret = receive_message_or_smb(inbuf,bufsize,timeout);
 283
 284                 got_keepalive = (ret && (CVAL(inbuf,0) == SMBkeepalive));
 285         } while (ret && got_keepalive);
 286
 287         return ret;
 288 }
 289
 290 /****************************************************************************
 291  We're terminating and have closed all our files/connections etc.
 292  If there are any pending local messages we need to respond to them
 293  before termination so that other smbds don't think we just died whilst
 294  holding oplocks.
 295 ****************************************************************************/
 296
 297 void respond_to_all_remaining_local_messages(void)
 298 {
 299         char buffer[1024];
 300
 301         /*
 302          * Assert we have no exclusive open oplocks.
 303          */
 304
 305         if(get_number_of_exclusive_open_oplocks()) {
 306                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 307                         get_number_of_exclusive_open_oplocks() ));
 308                 return;
 309         }
 310
 311         /*
 312          * Keep doing receive_local_message with a 1 ms timeout until
 313          * we have no more messages.
 314          */
 315
 316         while(receive_local_message(buffer, sizeof(buffer), 1)) {
 317                 /* Deal with oplock break requests from other smbd's. */
 318                 process_local_message(buffer, sizeof(buffer));
 319         }
 320
 321         return;
 322 }
 323
 324
 325 /*
 326 These flags determine some of the permissions required to do an operation
 327
 328 Note that I don't set NEED_WRITE on some write operations because they
 329 are used by some brain-dead clients when printing, and I don't want to
 330 force write permissions on print services.
 331 */
 332 #define AS_USER (1<<0)
 333 #define NEED_WRITE (1<<1)
 334 #define TIME_INIT (1<<2)
 335 #define CAN_IPC (1<<3)
 336 #define AS_GUEST (1<<5)
 337 #define QUEUE_IN_OPLOCK (1<<6)
 338
 339 /*
 340    define a list of possible SMB messages and their corresponding
 341    functions. Any message that has a NULL function is unimplemented -
 342    please feel free to contribute implementations!
 343 */
 344 static const struct smb_message_struct {
 345         const char *name;
 346         int (*fn)(connection_struct *conn, char *, char *, int, int);
 347         int flags;
 348 } smb_messages[256] = {
 349
 350 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 351 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 352 /* 0x02 */ { "SMBopen",reply_open,AS_USER | QUEUE_IN_OPLOCK },
 353 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 354 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 355 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 356 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK},
 357 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK},
 358 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 359 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 360 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 361 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 362 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 363 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 364 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER | QUEUE_IN_OPLOCK },
 365 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 366 /* 0x10 */ { "SMBchkpth",reply_chkpth,AS_USER},
 367 /* 0x11 */ { "SMBexit",reply_exit,0},
 368 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 369 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 370 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 371 /* 0x15 */ { NULL, NULL, 0 },
 372 /* 0x16 */ { NULL, NULL, 0 },
 373 /* 0x17 */ { NULL, NULL, 0 },
 374 /* 0x18 */ { NULL, NULL, 0 },
 375 /* 0x19 */ { NULL, NULL, 0 },
 376 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 377 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 378 /* 0x1c */ { "SMBreadBs",NULL,0 },
 379 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 380 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 381 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 382 /* 0x20 */ { "SMBwritec",NULL,0},
 383 /* 0x21 */ { NULL, NULL, 0 },
 384 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 385 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 386 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 387 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 388 /* 0x26 */ { "SMBtranss",NULL,AS_USER | CAN_IPC},
 389 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 390 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 391 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK },
 392 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK },
 393 /* 0x2b */ { "SMBecho",reply_echo,0},
 394 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 395 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC | QUEUE_IN_OPLOCK },
 396 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 397 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 398 /* 0x30 */ { NULL, NULL, 0 },
 399 /* 0x31 */ { NULL, NULL, 0 },
 400 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 401 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 402 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 403 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 404 /* 0x36 */ { NULL, NULL, 0 },
 405 /* 0x37 */ { NULL, NULL, 0 },
 406 /* 0x38 */ { NULL, NULL, 0 },
 407 /* 0x39 */ { NULL, NULL, 0 },
 408 /* 0x3a */ { NULL, NULL, 0 },
 409 /* 0x3b */ { NULL, NULL, 0 },
 410 /* 0x3c */ { NULL, NULL, 0 },
 411 /* 0x3d */ { NULL, NULL, 0 },
 412 /* 0x3e */ { NULL, NULL, 0 },
 413 /* 0x3f */ { NULL, NULL, 0 },
 414 /* 0x40 */ { NULL, NULL, 0 },
 415 /* 0x41 */ { NULL, NULL, 0 },
 416 /* 0x42 */ { NULL, NULL, 0 },
 417 /* 0x43 */ { NULL, NULL, 0 },
 418 /* 0x44 */ { NULL, NULL, 0 },
 419 /* 0x45 */ { NULL, NULL, 0 },
 420 /* 0x46 */ { NULL, NULL, 0 },
 421 /* 0x47 */ { NULL, NULL, 0 },
 422 /* 0x48 */ { NULL, NULL, 0 },
 423 /* 0x49 */ { NULL, NULL, 0 },
 424 /* 0x4a */ { NULL, NULL, 0 },
 425 /* 0x4b */ { NULL, NULL, 0 },
 426 /* 0x4c */ { NULL, NULL, 0 },
 427 /* 0x4d */ { NULL, NULL, 0 },
 428 /* 0x4e */ { NULL, NULL, 0 },
 429 /* 0x4f */ { NULL, NULL, 0 },
 430 /* 0x50 */ { NULL, NULL, 0 },
 431 /* 0x51 */ { NULL, NULL, 0 },
 432 /* 0x52 */ { NULL, NULL, 0 },
 433 /* 0x53 */ { NULL, NULL, 0 },
 434 /* 0x54 */ { NULL, NULL, 0 },
 435 /* 0x55 */ { NULL, NULL, 0 },
 436 /* 0x56 */ { NULL, NULL, 0 },
 437 /* 0x57 */ { NULL, NULL, 0 },
 438 /* 0x58 */ { NULL, NULL, 0 },
 439 /* 0x59 */ { NULL, NULL, 0 },
 440 /* 0x5a */ { NULL, NULL, 0 },
 441 /* 0x5b */ { NULL, NULL, 0 },
 442 /* 0x5c */ { NULL, NULL, 0 },
 443 /* 0x5d */ { NULL, NULL, 0 },
 444 /* 0x5e */ { NULL, NULL, 0 },
 445 /* 0x5f */ { NULL, NULL, 0 },
 446 /* 0x60 */ { NULL, NULL, 0 },
 447 /* 0x61 */ { NULL, NULL, 0 },
 448 /* 0x62 */ { NULL, NULL, 0 },
 449 /* 0x63 */ { NULL, NULL, 0 },
 450 /* 0x64 */ { NULL, NULL, 0 },
 451 /* 0x65 */ { NULL, NULL, 0 },
 452 /* 0x66 */ { NULL, NULL, 0 },
 453 /* 0x67 */ { NULL, NULL, 0 },
 454 /* 0x68 */ { NULL, NULL, 0 },
 455 /* 0x69 */ { NULL, NULL, 0 },
 456 /* 0x6a */ { NULL, NULL, 0 },
 457 /* 0x6b */ { NULL, NULL, 0 },
 458 /* 0x6c */ { NULL, NULL, 0 },
 459 /* 0x6d */ { NULL, NULL, 0 },
 460 /* 0x6e */ { NULL, NULL, 0 },
 461 /* 0x6f */ { NULL, NULL, 0 },
 462 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 463 /* 0x71 */ { "SMBtdis",reply_tdis,0},
 464 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 465 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 466 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 467 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 468 /* 0x76 */ { NULL, NULL, 0 },
 469 /* 0x77 */ { NULL, NULL, 0 },
 470 /* 0x78 */ { NULL, NULL, 0 },
 471 /* 0x79 */ { NULL, NULL, 0 },
 472 /* 0x7a */ { NULL, NULL, 0 },
 473 /* 0x7b */ { NULL, NULL, 0 },
 474 /* 0x7c */ { NULL, NULL, 0 },
 475 /* 0x7d */ { NULL, NULL, 0 },
 476 /* 0x7e */ { NULL, NULL, 0 },
 477 /* 0x7f */ { NULL, NULL, 0 },
 478 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 479 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 480 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 481 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 482 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 483 /* 0x85 */ { NULL, NULL, 0 },
 484 /* 0x86 */ { NULL, NULL, 0 },
 485 /* 0x87 */ { NULL, NULL, 0 },
 486 /* 0x88 */ { NULL, NULL, 0 },
 487 /* 0x89 */ { NULL, NULL, 0 },
 488 /* 0x8a */ { NULL, NULL, 0 },
 489 /* 0x8b */ { NULL, NULL, 0 },
 490 /* 0x8c */ { NULL, NULL, 0 },
 491 /* 0x8d */ { NULL, NULL, 0 },
 492 /* 0x8e */ { NULL, NULL, 0 },
 493 /* 0x8f */ { NULL, NULL, 0 },
 494 /* 0x90 */ { NULL, NULL, 0 },
 495 /* 0x91 */ { NULL, NULL, 0 },
 496 /* 0x92 */ { NULL, NULL, 0 },
 497 /* 0x93 */ { NULL, NULL, 0 },
 498 /* 0x94 */ { NULL, NULL, 0 },
 499 /* 0x95 */ { NULL, NULL, 0 },
 500 /* 0x96 */ { NULL, NULL, 0 },
 501 /* 0x97 */ { NULL, NULL, 0 },
 502 /* 0x98 */ { NULL, NULL, 0 },
 503 /* 0x99 */ { NULL, NULL, 0 },
 504 /* 0x9a */ { NULL, NULL, 0 },
 505 /* 0x9b */ { NULL, NULL, 0 },
 506 /* 0x9c */ { NULL, NULL, 0 },
 507 /* 0x9d */ { NULL, NULL, 0 },
 508 /* 0x9e */ { NULL, NULL, 0 },
 509 /* 0x9f */ { NULL, NULL, 0 },
 510 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC | QUEUE_IN_OPLOCK},
 511 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 512 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC | QUEUE_IN_OPLOCK },
 513 /* 0xa3 */ { NULL, NULL, 0 },
 514 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 515 /* 0xa5 */ { NULL, NULL, 0 },
 516 /* 0xa6 */ { NULL, NULL, 0 },
 517 /* 0xa7 */ { NULL, NULL, 0 },
 518 /* 0xa8 */ { NULL, NULL, 0 },
 519 /* 0xa9 */ { NULL, NULL, 0 },
 520 /* 0xaa */ { NULL, NULL, 0 },
 521 /* 0xab */ { NULL, NULL, 0 },
 522 /* 0xac */ { NULL, NULL, 0 },
 523 /* 0xad */ { NULL, NULL, 0 },
 524 /* 0xae */ { NULL, NULL, 0 },
 525 /* 0xaf */ { NULL, NULL, 0 },
 526 /* 0xb0 */ { NULL, NULL, 0 },
 527 /* 0xb1 */ { NULL, NULL, 0 },
 528 /* 0xb2 */ { NULL, NULL, 0 },
 529 /* 0xb3 */ { NULL, NULL, 0 },
 530 /* 0xb4 */ { NULL, NULL, 0 },
 531 /* 0xb5 */ { NULL, NULL, 0 },
 532 /* 0xb6 */ { NULL, NULL, 0 },
 533 /* 0xb7 */ { NULL, NULL, 0 },
 534 /* 0xb8 */ { NULL, NULL, 0 },
 535 /* 0xb9 */ { NULL, NULL, 0 },
 536 /* 0xba */ { NULL, NULL, 0 },
 537 /* 0xbb */ { NULL, NULL, 0 },
 538 /* 0xbc */ { NULL, NULL, 0 },
 539 /* 0xbd */ { NULL, NULL, 0 },
 540 /* 0xbe */ { NULL, NULL, 0 },
 541 /* 0xbf */ { NULL, NULL, 0 },
 542 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER | QUEUE_IN_OPLOCK },
 543 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 544 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 545 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 546 /* 0xc4 */ { NULL, NULL, 0 },
 547 /* 0xc5 */ { NULL, NULL, 0 },
 548 /* 0xc6 */ { NULL, NULL, 0 },
 549 /* 0xc7 */ { NULL, NULL, 0 },
 550 /* 0xc8 */ { NULL, NULL, 0 },
 551 /* 0xc9 */ { NULL, NULL, 0 },
 552 /* 0xca */ { NULL, NULL, 0 },
 553 /* 0xcb */ { NULL, NULL, 0 },
 554 /* 0xcc */ { NULL, NULL, 0 },
 555 /* 0xcd */ { NULL, NULL, 0 },
 556 /* 0xce */ { NULL, NULL, 0 },
 557 /* 0xcf */ { NULL, NULL, 0 },
 558 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 559 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 560 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 561 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 562 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 563 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 564 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 565 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 566 /* 0xd8 */ { NULL, NULL, 0 },
 567 /* 0xd9 */ { NULL, NULL, 0 },
 568 /* 0xda */ { NULL, NULL, 0 },
 569 /* 0xdb */ { NULL, NULL, 0 },
 570 /* 0xdc */ { NULL, NULL, 0 },
 571 /* 0xdd */ { NULL, NULL, 0 },
 572 /* 0xde */ { NULL, NULL, 0 },
 573 /* 0xdf */ { NULL, NULL, 0 },
 574 /* 0xe0 */ { NULL, NULL, 0 },
 575 /* 0xe1 */ { NULL, NULL, 0 },
 576 /* 0xe2 */ { NULL, NULL, 0 },
 577 /* 0xe3 */ { NULL, NULL, 0 },
 578 /* 0xe4 */ { NULL, NULL, 0 },
 579 /* 0xe5 */ { NULL, NULL, 0 },
 580 /* 0xe6 */ { NULL, NULL, 0 },
 581 /* 0xe7 */ { NULL, NULL, 0 },
 582 /* 0xe8 */ { NULL, NULL, 0 },
 583 /* 0xe9 */ { NULL, NULL, 0 },
 584 /* 0xea */ { NULL, NULL, 0 },
 585 /* 0xeb */ { NULL, NULL, 0 },
 586 /* 0xec */ { NULL, NULL, 0 },
 587 /* 0xed */ { NULL, NULL, 0 },
 588 /* 0xee */ { NULL, NULL, 0 },
 589 /* 0xef */ { NULL, NULL, 0 },
 590 /* 0xf0 */ { NULL, NULL, 0 },
 591 /* 0xf1 */ { NULL, NULL, 0 },
 592 /* 0xf2 */ { NULL, NULL, 0 },
 593 /* 0xf3 */ { NULL, NULL, 0 },
 594 /* 0xf4 */ { NULL, NULL, 0 },
 595 /* 0xf5 */ { NULL, NULL, 0 },
 596 /* 0xf6 */ { NULL, NULL, 0 },
 597 /* 0xf7 */ { NULL, NULL, 0 },
 598 /* 0xf8 */ { NULL, NULL, 0 },
 599 /* 0xf9 */ { NULL, NULL, 0 },
 600 /* 0xfa */ { NULL, NULL, 0 },
 601 /* 0xfb */ { NULL, NULL, 0 },
 602 /* 0xfc */ { NULL, NULL, 0 },
 603 /* 0xfd */ { NULL, NULL, 0 },
 604 /* 0xfe */ { NULL, NULL, 0 },
 605 /* 0xff */ { NULL, NULL, 0 }
 606
 607 };
 608
 609 /*******************************************************************
 610  Dump a packet to a file.
 611 ********************************************************************/
 612
 613 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 614 {
 615         int fd, i;
 616         pstring fname;
 617         if (DEBUGLEVEL < 50) return;
 618
 619         if (len < 4) len = smb_len(data)+4;
 620         for (i=1;i<100;i++) {
 621                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 622                                 type ? "req" : "resp");
 623                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 624                 if (fd != -1 || errno != EEXIST) break;
 625         }
 626         if (fd != -1) {
 627                 ssize_t ret = write(fd, data, len);
 628                 if (ret != len)
 629                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 630                 close(fd);
 631                 DEBUG(0,("created %s len %d\n", fname, len));
 632         }
 633 }
 634
 635
 636 /****************************************************************************
 637  Do a switch on the message type, and return the response size
 638 ****************************************************************************/
 639
 640 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 641 {
 642         static pid_t pid= (pid_t)-1;
 643         int outsize = 0;
 644         extern uint16 global_smbpid;
 645
 646         type &= 0xff;
 647
 648         if (pid == (pid_t)-1)
 649                 pid = sys_getpid();
 650
 651         errno = 0;
 652         last_message = type;
 653
 654         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 655         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 656                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 657                 exit_server("Non-SMB packet");
 658                 return(-1);
 659         }
 660
 661         /* yuck! this is an interim measure before we get rid of our
 662                 current inbuf/outbuf system */
 663         global_smbpid = SVAL(inbuf,smb_pid);
 664
 665         if (smb_messages[type].fn == NULL) {
 666                 DEBUG(0,("Unknown message type %d!\n",type));
 667                 smb_dump("Unknown", 1, inbuf, size);
 668                 outsize = reply_unknown(inbuf,outbuf);
 669         } else {
 670                 int flags = smb_messages[type].flags;
 671                 static uint16 last_session_tag = UID_FIELD_INVALID;
 672                 /* In share mode security we must ignore the vuid. */
 673                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 674                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 675
 676                 DEBUG(3,("switch message %s (pid %d)\n",smb_fn_name(type),(int)pid));
 677
 678                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 679                 if(global_oplock_break) {
 680                         if(flags & QUEUE_IN_OPLOCK) {
 681                                 /*
 682                                  * Queue this message as we are the process of an oplock break.
 683                                  */
 684
 685                                 DEBUG( 2, ( "switch_message: queueing message due to being in " ) );
 686                                 DEBUGADD( 2, ( "oplock break state.\n" ) );
 687
 688                                 push_oplock_pending_smb_message( inbuf, size );
 689                                 return -1;
 690                         }
 691                 }
 692
 693                 /* Ensure this value is replaced in the incoming packet. */
 694                 SSVAL(inbuf,smb_uid,session_tag);
 695
 696                 /*
 697                  * Ensure the correct username is in current_user_info.
 698                  * This is a really ugly bugfix for problems with
 699                  * multiple session_setup_and_X's being done and
 700                  * allowing %U and %G substitutions to work correctly.
 701                  * There is a reason this code is done here, don't
 702                  * move it unless you know what you're doing... :-).
 703                  * JRA.
 704                  */
 705
 706                 if (session_tag != last_session_tag) {
 707                         user_struct *vuser = NULL;
 708
 709                         last_session_tag = session_tag;
 710                         if(session_tag != UID_FIELD_INVALID)
 711                                 vuser = get_valid_user_struct(session_tag);
 712                         if(vuser != NULL)
 713                                 current_user_info = vuser->user;
 714                 }
 715
 716                 /* does this protocol need to be run as root? */
 717                 if (!(flags & AS_USER))
 718                         change_to_root_user();
 719
 720                 /* does this protocol need a valid tree connection? */
 721                 if ((flags & AS_USER) && !conn)
 722                         return ERROR_DOS(ERRSRV, ERRinvnid);
 723
 724
 725                 /* does this protocol need to be run as the connected user? */
 726                 if ((flags & AS_USER) && !change_to_user(conn,session_tag)) {
 727                         if (flags & AS_GUEST)
 728                                 flags &= ~AS_USER;
 729                         else
 730                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 731                 }
 732
 733                 /* this code is to work around a bug is MS client 3 without
 734                         introducing a security hole - it needs to be able to do
 735                         print queue checks as guest if it isn't logged in properly */
 736                 if (flags & AS_USER)
 737                         flags &= ~AS_GUEST;
 738
 739                 /* does it need write permission? */
 740                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn))
 741                         return(ERROR_DOS(ERRSRV,ERRaccess));
 742
 743                 /* ipc services are limited */
 744                 if (IS_IPC(conn) && (flags & AS_USER) && !(flags & CAN_IPC))
 745                         return(ERROR_DOS(ERRSRV,ERRaccess));
 746
 747                 /* load service specific parameters */
 748                 if (conn && !set_current_service(conn,(flags & AS_USER)?True:False))
 749                         return(ERROR_DOS(ERRSRV,ERRaccess));
 750
 751                 /* does this protocol need to be run as guest? */
 752                 if ((flags & AS_GUEST) && (!change_to_guest() ||
 753                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))))
 754                         return(ERROR_DOS(ERRSRV,ERRaccess));
 755
 756                 last_inbuf = inbuf;
 757
 758                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
 759         }
 760
 761         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
 762
 763         return(outsize);
 764 }
 765
 766
 767 /****************************************************************************
 768  Construct a reply to the incoming packet.
 769 ****************************************************************************/
 770
 771 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
 772 {
 773         int type = CVAL(inbuf,smb_com);
 774         int outsize = 0;
 775         int msg_type = CVAL(inbuf,0);
 776
 777         GetTimeOfDay(&smb_last_time);
 778
 779         chain_size = 0;
 780         file_chain_reset();
 781         reset_chain_p();
 782
 783         if (msg_type != 0)
 784                 return(reply_special(inbuf,outbuf));
 785
 786         construct_reply_common(inbuf, outbuf);
 787
 788         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
 789
 790         outsize += chain_size;
 791
 792         if(outsize > 4)
 793                 smb_setlen(outbuf,outsize - 4);
 794         return(outsize);
 795 }
 796
 797 /****************************************************************************
 798  Keep track of the number of running smbd's. This functionality is used to
 799  'hard' limit Samba overhead on resource constrained systems.
 800 ****************************************************************************/
 801
 802 static BOOL process_count_update_successful = False;
 803
 804 static int32 increment_smbd_process_count(void)
 805 {
 806         int32 total_smbds;
 807
 808         if (lp_max_smbd_processes()) {
 809                 total_smbds = 0;
 810                 if (tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, 1) == -1)
 811                         return 1;
 812                 process_count_update_successful = True;
 813                 return total_smbds + 1;
 814         }
 815         return 1;
 816 }
 817
 818 void decrement_smbd_process_count(void)
 819 {
 820         int32 total_smbds;
 821
 822         if (lp_max_smbd_processes() && process_count_update_successful) {
 823                 total_smbds = 1;
 824                 tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, -1);
 825         }
 826 }
 827
 828 static BOOL smbd_process_limit(void)
 829 {
 830         int32  total_smbds;
 831
 832         if (lp_max_smbd_processes()) {
 833
 834                 /* Always add one to the smbd process count, as exit_server() always
 835                  * subtracts one.
 836                  */
 837
 838                 if (!conn_tdb_ctx()) {
 839                         DEBUG(0,("smbd_process_limit: max smbd processes parameter set with status parameter not \
 840 set. Ignoring max smbd restriction.\n"));
 841                         return False;
 842                 }
 843
 844                 total_smbds = increment_smbd_process_count();
 845                 return total_smbds > lp_max_smbd_processes();
 846         }
 847         else
 848                 return False;
 849 }
 850
 851 /****************************************************************************
 852  Process an smb from the client - split out from the smbd_process() code so
 853  it can be used by the oplock break code.
 854 ****************************************************************************/
 855
 856 void process_smb(char *inbuf, char *outbuf)
 857 {
 858         static int trans_num;
 859         int msg_type = CVAL(inbuf,0);
 860         int32 len = smb_len(inbuf);
 861         int nread = len + 4;
 862
 863         DO_PROFILE_INC(smb_count);
 864
 865         if (trans_num == 0) {
 866                 /* on the first packet, check the global hosts allow/ hosts
 867                 deny parameters before doing any parsing of the packet
 868                 passed to us by the client.  This prevents attacks on our
 869                 parsing code from hosts not in the hosts allow list */
 870                 if (smbd_process_limit() ||
 871                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))) {
 872                         /* send a negative session response "not listening on calling name" */
 873                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
 874                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
 875                         (void)send_smb(smbd_server_fd(),(char *)buf);
 876                         exit_server("connection denied");
 877                 }
 878         }
 879
 880         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
 881         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
 882
 883         if (msg_type == 0)
 884                 show_msg(inbuf);
 885         else if(msg_type == SMBkeepalive)
 886                 return; /* Keepalive packet. */
 887
 888         nread = construct_reply(inbuf,outbuf,nread,max_send);
 889
 890         if(nread > 0) {
 891                 if (CVAL(outbuf,0) == 0)
 892                         show_msg(outbuf);
 893
 894                 if (nread != smb_len(outbuf) + 4) {
 895                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
 896                                 nread, smb_len(outbuf)));
 897                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
 898                         exit_server("process_smb: send_smb failed.");
 899                 }
 900         }
 901         trans_num++;
 902 }
 903
 904 /****************************************************************************
 905  Return a string containing the function name of a SMB command.
 906 ****************************************************************************/
 907
 908 const char *smb_fn_name(int type)
 909 {
 910         const char *unknown_name = "SMBunknown";
 911
 912         if (smb_messages[type].name == NULL)
 913                 return(unknown_name);
 914
 915         return(smb_messages[type].name);
 916 }
 917
 918
 919 /****************************************************************************
 920  Helper function for contruct_reply.
 921 ****************************************************************************/
 922
 923 void construct_reply_common(char *inbuf,char *outbuf)
 924 {
 925         memset(outbuf,'\0',smb_size);
 926
 927         set_message(outbuf,0,0,True);
 928         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
 929
 930         memcpy(outbuf+4,inbuf+4,4);
 931         SCVAL(outbuf,smb_rcls,SMB_SUCCESS);
 932         SCVAL(outbuf,smb_reh,0);
 933         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
 934         SSVAL(outbuf,smb_flg2,
 935               (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
 936               FLAGS2_LONG_PATH_COMPONENTS |
 937               FLAGS2_32_BIT_ERROR_CODES | FLAGS2_EXTENDED_SECURITY);
 938
 939         SSVAL(outbuf,smb_err,SMB_SUCCESS);
 940         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
 941         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
 942         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
 943         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
 944 }
 945
 946 /****************************************************************************
 947  Construct a chained reply and add it to the already made reply
 948 ****************************************************************************/
 949
 950 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
 951 {
 952         static char *orig_inbuf;
 953         static char *orig_outbuf;
 954         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
 955         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
 956         char *inbuf2, *outbuf2;
 957         int outsize2;
 958         char inbuf_saved[smb_wct];
 959         char outbuf_saved[smb_wct];
 960         int wct = CVAL(outbuf,smb_wct);
 961         int outsize = smb_size + 2*wct + SVAL(outbuf,smb_vwv0+2*wct);
 962
 963         /* maybe its not chained */
 964         if (smb_com2 == 0xFF) {
 965                 SCVAL(outbuf,smb_vwv0,0xFF);
 966                 return outsize;
 967         }
 968
 969         if (chain_size == 0) {
 970                 /* this is the first part of the chain */
 971                 orig_inbuf = inbuf;
 972                 orig_outbuf = outbuf;
 973         }
 974
 975         /*
 976          * The original Win95 redirector dies on a reply to
 977          * a lockingX and read chain unless the chain reply is
 978          * 4 byte aligned. JRA.
 979          */
 980
 981         outsize = (outsize + 3) & ~3;
 982
 983         /* we need to tell the client where the next part of the reply will be */
 984         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
 985         SCVAL(outbuf,smb_vwv0,smb_com2);
 986
 987         /* remember how much the caller added to the chain, only counting stuff
 988                 after the parameter words */
 989         chain_size += outsize - smb_wct;
 990
 991         /* work out pointers into the original packets. The
 992                 headers on these need to be filled in */
 993         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
 994         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
 995
 996         /* remember the original command type */
 997         smb_com1 = CVAL(orig_inbuf,smb_com);
 998
 999         /* save the data which will be overwritten by the new headers */
1000         memcpy(inbuf_saved,inbuf2,smb_wct);
1001         memcpy(outbuf_saved,outbuf2,smb_wct);
1002
1003         /* give the new packet the same header as the last part of the SMB */
1004         memmove(inbuf2,inbuf,smb_wct);
1005
1006         /* create the in buffer */
1007         SCVAL(inbuf2,smb_com,smb_com2);
1008
1009         /* create the out buffer */
1010         construct_reply_common(inbuf2, outbuf2);
1011
1012         DEBUG(3,("Chained message\n"));
1013         show_msg(inbuf2);
1014
1015         /* process the request */
1016         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size,
1017                                 bufsize-chain_size);
1018
1019         /* copy the new reply and request headers over the old ones, but
1020                 preserve the smb_com field */
1021         memmove(orig_outbuf,outbuf2,smb_wct);
1022         SCVAL(orig_outbuf,smb_com,smb_com1);
1023
1024         /* restore the saved data, being careful not to overwrite any
1025                 data from the reply header */
1026         memcpy(inbuf2,inbuf_saved,smb_wct);
1027
1028         {
1029                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1030                 if (ofs < 0) ofs = 0;
1031                         memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1032         }
1033
1034         return outsize2;
1035 }
1036
1037 /****************************************************************************
1038  Setup the needed select timeout.
1039 ****************************************************************************/
1040
1041 static int setup_select_timeout(void)
1042 {
1043         int select_timeout;
1044         int t;
1045
1046         select_timeout = blocking_locks_timeout(SMBD_SELECT_TIMEOUT);
1047         select_timeout *= 1000;
1048
1049         t = change_notify_timeout();
1050         if (t != -1)
1051                 select_timeout = MIN(select_timeout, t*1000);
1052
1053         if (print_notify_messages_pending())
1054                 select_timeout = MIN(select_timeout, 1000);
1055
1056         return select_timeout;
1057 }
1058
1059 /****************************************************************************
1060  Check if services need reloading.
1061 ****************************************************************************/
1062
1063 void check_reload(int t)
1064 {
1065         static time_t last_smb_conf_reload_time = 0;
1066
1067         if(last_smb_conf_reload_time == 0)
1068                 last_smb_conf_reload_time = t;
1069
1070         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1071                 reload_services(True);
1072                 reload_after_sighup = False;
1073                 last_smb_conf_reload_time = t;
1074         }
1075 }
1076
1077 /****************************************************************************
1078  Process any timeout housekeeping. Return False if the caller should exit.
1079 ****************************************************************************/
1080
1081 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1082 {
1083         static time_t last_keepalive_sent_time = 0;
1084         static time_t last_idle_closed_check = 0;
1085         time_t t;
1086         BOOL allidle = True;
1087         extern int keepalive;
1088
1089         if (smb_read_error == READ_EOF) {
1090                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1091                 return False;
1092         }
1093
1094         if (smb_read_error == READ_ERROR) {
1095                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1096                         strerror(errno)));
1097                 return False;
1098         }
1099
1100         if (smb_read_error == READ_BAD_SIG) {
1101                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1102                 return False;
1103         }
1104
1105         *last_timeout_processing_time = t = time(NULL);
1106
1107         if(last_keepalive_sent_time == 0)
1108                 last_keepalive_sent_time = t;
1109
1110         if(last_idle_closed_check == 0)
1111                 last_idle_closed_check = t;
1112
1113         /* become root again if waiting */
1114         change_to_root_user();
1115
1116         /* run all registered idle events */
1117         smb_run_idle_events(t);
1118
1119         /* check if we need to reload services */
1120         check_reload(t);
1121
1122         /* automatic timeout if all connections are closed */
1123         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1124                 DEBUG( 2, ( "Closing idle connection\n" ) );
1125                 return False;
1126         } else {
1127                 last_idle_closed_check = t;
1128         }
1129
1130         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1131                 extern struct auth_context *negprot_global_auth_context;
1132                 if (!send_keepalive(smbd_server_fd())) {
1133                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1134                         return False;
1135                 }
1136
1137                 /* send a keepalive for a password server or the like.
1138                         This is attached to the auth_info created in the
1139                 negprot */
1140                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1141                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1142
1143                         negprot_global_auth_context->challenge_set_method->send_keepalive
1144                         (&negprot_global_auth_context->challenge_set_method->private_data);
1145                 }
1146
1147                 last_keepalive_sent_time = t;
1148         }
1149
1150         /* check for connection timeouts */
1151         allidle = conn_idle_all(t, deadtime);
1152
1153         if (allidle && conn_num_open()>0) {
1154                 DEBUG(2,("Closing idle connection 2.\n"));
1155                 return False;
1156         }
1157
1158         if(global_machine_password_needs_changing &&
1159                         /* for ADS we need to do a regular ADS password change, not a domain
1160                                         password change */
1161                         lp_security() == SEC_DOMAIN) {
1162
1163                 unsigned char trust_passwd_hash[16];
1164                 time_t lct;
1165
1166                 /*
1167                  * We're in domain level security, and the code that
1168                  * read the machine password flagged that the machine
1169                  * password needs changing.
1170                  */
1171
1172                 /*
1173                  * First, open the machine password file with an exclusive lock.
1174                  */
1175
1176                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1177                         DEBUG(0,("process: unable to lock the machine account password for \
1178 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1179                         return True;
1180                 }
1181
1182                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1183                         DEBUG(0,("process: unable to read the machine account password for \
1184 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1185                         secrets_lock_trust_account_password(lp_workgroup(), False);
1186                         return True;
1187                 }
1188
1189                 /*
1190                  * Make sure someone else hasn't already done this.
1191                  */
1192
1193                 if(t < lct + lp_machine_password_timeout()) {
1194                         global_machine_password_needs_changing = False;
1195                         secrets_lock_trust_account_password(lp_workgroup(), False);
1196                         return True;
1197                 }
1198
1199                 /* always just contact the PDC here */
1200
1201                 change_trust_account_password( lp_workgroup(), NULL);
1202                 global_machine_password_needs_changing = False;
1203                 secrets_lock_trust_account_password(lp_workgroup(), False);
1204         }
1205
1206         /*
1207          * Check to see if we have any blocking locks
1208          * outstanding on the queue.
1209          */
1210         process_blocking_lock_queue(t);
1211
1212         /* update printer queue caches if necessary */
1213
1214         update_monitored_printq_cache();
1215
1216         /*
1217          * Check to see if we have any change notifies
1218          * outstanding on the queue.
1219          */
1220         process_pending_change_notify_queue(t);
1221
1222         /*
1223          * Now we are root, check if the log files need pruning.
1224          * Force a log file check.
1225          */
1226         force_check_log_size();
1227         check_log_size();
1228
1229         /* Send any queued printer notify message to interested smbd's. */
1230
1231         print_notify_send_messages(0);
1232
1233         /*
1234          * Modify the select timeout depending upon
1235          * what we have remaining in our queues.
1236          */
1237
1238         *select_timeout = setup_select_timeout();
1239
1240         return True;
1241 }
1242
1243 /****************************************************************************
1244   process commands from the client
1245 ****************************************************************************/
1246
1247 void smbd_process(void)
1248 {
1249         extern int smb_echo_count;
1250         time_t last_timeout_processing_time = time(NULL);
1251         unsigned int num_smbs = 0;
1252         const size_t total_buffer_size = BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN;
1253
1254         InBuffer = (char *)malloc(total_buffer_size);
1255         OutBuffer = (char *)malloc(total_buffer_size);
1256         if ((InBuffer == NULL) || (OutBuffer == NULL))
1257                 return;
1258
1259         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1260         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1261
1262         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1263
1264         while (True) {
1265                 int deadtime = lp_deadtime()*60;
1266                 int select_timeout = setup_select_timeout();
1267                 int num_echos;
1268
1269                 if (deadtime <= 0)
1270                         deadtime = DEFAULT_SMBD_TIMEOUT;
1271
1272                 errno = 0;
1273
1274                 /* free up temporary memory */
1275                 lp_talloc_free();
1276                 main_loop_talloc_free();
1277
1278                 /* run all registered idle events */
1279                 smb_run_idle_events(time(NULL));
1280
1281
1282                 /* Did someone ask for immediate checks on things like blocking locks ? */
1283                 if (select_timeout == 0) {
1284                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1285                                 return;
1286                         num_smbs = 0; /* Reset smb counter. */
1287                 }
1288
1289                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1290
1291                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1292                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1293                                 return;
1294                         num_smbs = 0; /* Reset smb counter. */
1295                 }
1296
1297                 /*
1298                  * Ensure we do timeout processing if the SMB we just got was
1299                  * only an echo request. This allows us to set the select
1300                  * timeout in 'receive_message_or_smb()' to any value we like
1301                  * without worrying that the client will send echo requests
1302                  * faster than the select timeout, thus starving out the
1303                  * essential processing (change notify, blocking locks) that
1304                  * the timeout code does. JRA.
1305                  */
1306                 num_echos = smb_echo_count;
1307
1308                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1309
1310                 process_smb(InBuffer, OutBuffer);
1311
1312                 if (smb_echo_count != num_echos) {
1313                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1314                                 return;
1315                         num_smbs = 0; /* Reset smb counter. */
1316                 }
1317
1318                 num_smbs++;
1319
1320                 /*
1321                  * If we are getting smb requests in a constant stream
1322                  * with no echos, make sure we attempt timeout processing
1323                  * every select_timeout milliseconds - but only check for this
1324                  * every 200 smb requests.
1325                  */
1326
1327                 if ((num_smbs % 200) == 0) {
1328                         time_t new_check_time = time(NULL);
1329                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1330                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1331                                         return;
1332                                 num_smbs = 0; /* Reset smb counter. */
1333                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1334                         }
1335                 }
1336
1337                 /* The timeout_processing function isn't run nearly
1338                    often enough to implement 'max log size' without
1339                    overrunning the size of the file by many megabytes.
1340                    This is especially true if we are running at debug
1341                    level 10.  Checking every 50 SMBs is a nice
1342                    tradeoff of performance vs log file size overrun. */
1343
1344                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1345                         change_to_root_user();
1346                         check_log_size();
1347                 }
1348         }
1349 }