source/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 extern uint16 global_smbpid;
  25 extern int keepalive;
  26 extern struct auth_context *negprot_global_auth_context;
  27 extern int smb_echo_count;
  28
  29 static char *InBuffer = NULL;
  30 static char *OutBuffer = NULL;
  31 static char *current_inbuf = NULL;
  32
  33 /*
  34  * Size of data we can send to client. Set
  35  *  by the client for all protocols above CORE.
  36  *  Set by us for CORE protocol.
  37  */
  38 int max_send = BUFFER_SIZE;
  39 /*
  40  * Size of the data we can receive. Set by us.
  41  * Can be modified by the max xmit parameter.
  42  */
  43 int max_recv = BUFFER_SIZE;
  44
  45 extern int last_message;
  46 extern int smb_read_error;
  47 SIG_ATOMIC_T reload_after_sighup = 0;
  48 SIG_ATOMIC_T got_sig_term = 0;
  49 extern BOOL global_machine_password_needs_changing;
  50 extern int max_send;
  51
  52 /****************************************************************************
  53  Function to return the current request mid from Inbuffer.
  54 ****************************************************************************/
  55
  56 uint16 get_current_mid(void)
  57 {
  58         return SVAL(InBuffer,smb_mid);
  59 }
  60
  61 /****************************************************************************
  62  structure to hold a linked list of queued messages.
  63  for processing.
  64 ****************************************************************************/
  65
  66 static struct pending_message_list *deferred_open_queue;
  67
  68 /****************************************************************************
  69  Function to push a message onto the tail of a linked list of smb messages ready
  70  for processing.
  71 ****************************************************************************/
  72
  73 static BOOL push_queued_message(char *buf, int msg_len,
  74                                 struct timeval request_time,
  75                                 struct timeval end_time,
  76                                 char *private_data, size_t private_len)
  77 {
  78         struct pending_message_list *msg;
  79
  80         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
  81
  82         if(msg == NULL) {
  83                 DEBUG(0,("push_message: malloc fail (1)\n"));
  84                 return False;
  85         }
  86
  87         msg->buf = data_blob_talloc(msg, buf, msg_len);
  88         if(msg->buf.data == NULL) {
  89                 DEBUG(0,("push_message: malloc fail (2)\n"));
  90                 TALLOC_FREE(msg);
  91                 return False;
  92         }
  93
  94         msg->request_time = request_time;
  95         msg->end_time = end_time;
  96
  97         if (private_data) {
  98                 msg->private_data = data_blob_talloc(msg, private_data,
  99                                                      private_len);
 100                 if (msg->private_data.data == NULL) {
 101                         DEBUG(0,("push_message: malloc fail (3)\n"));
 102                         TALLOC_FREE(msg);
 103                         return False;
 104                 }
 105         }
 106
 107         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 108
 109         DEBUG(10,("push_message: pushed message length %u on "
 110                   "deferred_open_queue\n", (unsigned int)msg_len));
 111
 112         return True;
 113 }
 114
 115 /****************************************************************************
 116  Function to delete a sharing violation open message by mid.
 117 ****************************************************************************/
 118
 119 void remove_deferred_open_smb_message(uint16 mid)
 120 {
 121         struct pending_message_list *pml;
 122
 123         for (pml = deferred_open_queue; pml; pml = pml->next) {
 124                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 125                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 126                                   "deleting mid %u len %u\n",
 127                                   (unsigned int)mid,
 128                                   (unsigned int)pml->buf.length ));
 129                         DLIST_REMOVE(deferred_open_queue, pml);
 130                         TALLOC_FREE(pml);
 131                         return;
 132                 }
 133         }
 134 }
 135
 136 /****************************************************************************
 137  Move a sharing violation open retry message to the front of the list and
 138  schedule it for immediate processing.
 139 ****************************************************************************/
 140
 141 void schedule_deferred_open_smb_message(uint16 mid)
 142 {
 143         struct pending_message_list *pml;
 144         int i = 0;
 145
 146         for (pml = deferred_open_queue; pml; pml = pml->next) {
 147                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 148                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 149                         (unsigned int)msg_mid ));
 150                 if (mid == msg_mid) {
 151                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 152                                 mid ));
 153                         pml->end_time.tv_sec = 0;
 154                         pml->end_time.tv_usec = 0;
 155                         DLIST_PROMOTE(deferred_open_queue, pml);
 156                         return;
 157                 }
 158         }
 159
 160         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 161                 mid ));
 162 }
 163
 164 /****************************************************************************
 165  Return true if this mid is on the deferred queue.
 166 ****************************************************************************/
 167
 168 BOOL open_was_deferred(uint16 mid)
 169 {
 170         struct pending_message_list *pml;
 171
 172         for (pml = deferred_open_queue; pml; pml = pml->next) {
 173                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 174                         set_saved_ntstatus(NT_STATUS_OK);
 175                         return True;
 176                 }
 177         }
 178         return False;
 179 }
 180
 181 /****************************************************************************
 182  Return the message queued by this mid.
 183 ****************************************************************************/
 184
 185 struct pending_message_list *get_open_deferred_message(uint16 mid)
 186 {
 187         struct pending_message_list *pml;
 188
 189         for (pml = deferred_open_queue; pml; pml = pml->next) {
 190                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 191                         return pml;
 192                 }
 193         }
 194         return NULL;
 195 }
 196
 197 /****************************************************************************
 198  Function to push a deferred open smb message onto a linked list of local smb
 199  messages ready for processing.
 200 ****************************************************************************/
 201
 202 BOOL push_deferred_smb_message(uint16 mid,
 203                                struct timeval request_time,
 204                                struct timeval timeout,
 205                                char *private_data, size_t priv_len)
 206 {
 207         struct timeval end_time;
 208
 209         end_time = timeval_sum(&request_time, &timeout);
 210
 211         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 212                   "timeout time [%u.%06u]\n",
 213                   (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 214                   (unsigned int)end_time.tv_sec,
 215                   (unsigned int)end_time.tv_usec));
 216
 217         return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
 218                                    request_time, end_time,
 219                                    private_data, priv_len);
 220 }
 221
 222 struct idle_event {
 223         struct timed_event *te;
 224         struct timeval interval;
 225         BOOL (*handler)(const struct timeval *now, void *private_data);
 226         void *private_data;
 227 };
 228
 229 static void idle_event_handler(struct timed_event *te,
 230                                const struct timeval *now,
 231                                void *private_data)
 232 {
 233         struct idle_event *event =
 234                 talloc_get_type_abort(private_data, struct idle_event);
 235
 236         TALLOC_FREE(event->te);
 237
 238         if (!event->handler(now, event->private_data)) {
 239                 /* Don't repeat, delete ourselves */
 240                 TALLOC_FREE(event);
 241                 return;
 242         }
 243
 244         event->te = add_timed_event(event, timeval_sum(now, &event->interval),
 245                                     "idle_event_handler",
 246                                     idle_event_handler, event);
 247
 248         /* We can't do much but fail here. */
 249         SMB_ASSERT(event->te != NULL);
 250 }
 251
 252 struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
 253                                   struct timeval interval,
 254                                   BOOL (*handler)(const struct timeval *now,
 255                                                   void *private_data),
 256                                   void *private_data)
 257 {
 258         struct idle_event *result;
 259         struct timeval now = timeval_current();
 260
 261         result = TALLOC_P(mem_ctx, struct idle_event);
 262         if (result == NULL) {
 263                 DEBUG(0, ("talloc failed\n"));
 264                 return NULL;
 265         }
 266
 267         result->interval = interval;
 268         result->handler = handler;
 269         result->private_data = private_data;
 270
 271         result->te = add_timed_event(result, timeval_sum(&now, &interval),
 272                                      "idle_event_handler",
 273                                      idle_event_handler, result);
 274         if (result->te == NULL) {
 275                 DEBUG(0, ("add_timed_event failed\n"));
 276                 TALLOC_FREE(result);
 277                 return NULL;
 278         }
 279
 280         return result;
 281 }
 282
 283 /****************************************************************************
 284  Do all async processing in here. This includes kernel oplock messages, change
 285  notify events etc.
 286 ****************************************************************************/
 287
 288 static void async_processing(fd_set *pfds)
 289 {
 290         DEBUG(10,("async_processing: Doing async processing.\n"));
 291
 292         process_aio_queue();
 293
 294         process_kernel_oplocks(pfds);
 295
 296         /* Do the aio check again after receive_local_message as it does a
 297            select and may have eaten our signal. */
 298         /* Is this till true? -- vl */
 299         process_aio_queue();
 300
 301         if (got_sig_term) {
 302                 exit_server_cleanly("termination signal");
 303         }
 304
 305         /* check for async change notify events */
 306         process_pending_change_notify_queue(0);
 307
 308         /* check for sighup processing */
 309         if (reload_after_sighup) {
 310                 change_to_root_user();
 311                 DEBUG(1,("Reloading services after SIGHUP\n"));
 312                 reload_services(False);
 313                 reload_after_sighup = 0;
 314         }
 315 }
 316
 317 /****************************************************************************
 318  Add a fd to the set we will be select(2)ing on.
 319 ****************************************************************************/
 320
 321 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 322 {
 323         if (fd != -1) {
 324                 FD_SET(fd, fds);
 325                 maxfd = MAX(maxfd, fd);
 326         }
 327
 328         return maxfd;
 329 }
 330
 331 /****************************************************************************
 332   Do a select on an two fd's - with timeout.
 333
 334   If a local udp message has been pushed onto the
 335   queue (this can only happen during oplock break
 336   processing) call async_processing()
 337
 338   If a pending smb message has been pushed onto the
 339   queue (this can only happen during oplock break
 340   processing) return this next.
 341
 342   If the first smbfd is ready then read an smb from it.
 343   if the second (loopback UDP) fd is ready then read a message
 344   from it and setup the buffer header to identify the length
 345   and from address.
 346   Returns False on timeout or error.
 347   Else returns True.
 348
 349 The timeout is in milliseconds
 350 ****************************************************************************/
 351
 352 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 353 {
 354         fd_set fds;
 355         int selrtn;
 356         struct timeval to;
 357         int maxfd = 0;
 358
 359         smb_read_error = 0;
 360
 361  again:
 362
 363         if (timeout >= 0) {
 364                 to.tv_sec = timeout / 1000;
 365                 to.tv_usec = (timeout % 1000) * 1000;
 366         } else {
 367                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 368                 to.tv_usec = 0;
 369         }
 370
 371         /*
 372          * Note that this call must be before processing any SMB
 373          * messages as we need to synchronously process any messages
 374          * we may have sent to ourselves from the previous SMB.
 375          */
 376         message_dispatch();
 377
 378         /*
 379          * Check to see if we already have a message on the deferred open queue
 380          * and it's time to schedule.
 381          */
 382         if(deferred_open_queue != NULL) {
 383                 BOOL pop_message = False;
 384                 struct pending_message_list *msg = deferred_open_queue;
 385
 386                 if (timeval_is_zero(&msg->end_time)) {
 387                         pop_message = True;
 388                 } else {
 389                         struct timeval tv;
 390                         SMB_BIG_INT tdif;
 391
 392                         GetTimeOfDay(&tv);
 393                         tdif = usec_time_diff(&msg->end_time, &tv);
 394                         if (tdif <= 0) {
 395                                 /* Timed out. Schedule...*/
 396                                 pop_message = True;
 397                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 398                         } else {
 399                                 /* Make a more accurate select timeout. */
 400                                 to.tv_sec = tdif / 1000000;
 401                                 to.tv_usec = tdif % 1000000;
 402                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 403                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 404                         }
 405                 }
 406
 407                 if (pop_message) {
 408                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 409
 410                         /* We leave this message on the queue so the open code can
 411                            know this is a retry. */
 412                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 413                         return True;
 414                 }
 415         }
 416
 417         /*
 418          * Setup the select read fd set.
 419          */
 420
 421         FD_ZERO(&fds);
 422
 423         /*
 424          * Ensure we process oplock break messages by preference.
 425          * We have to do this before the select, after the select
 426          * and if the select returns EINTR. This is due to the fact
 427          * that the selects called from async_processing can eat an EINTR
 428          * caused by a signal (we can't take the break message there).
 429          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 430          */
 431
 432         if (oplock_message_waiting(&fds)) {
 433                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 434                 async_processing(&fds);
 435                 /*
 436                  * After async processing we must go and do the select again, as
 437                  * the state of the flag in fds for the server file descriptor is
 438                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 439                  */
 440                 goto again;
 441         }
 442
 443         /*
 444          * Are there any timed events waiting ? If so, ensure we don't
 445          * select for longer than it would take to wait for them.
 446          */
 447
 448         {
 449                 struct timeval tmp;
 450                 struct timeval *tp = get_timed_events_timeout(&tmp);
 451
 452                 if (tp) {
 453                         to = timeval_min(&to, tp);
 454                         if (timeval_is_zero(&to)) {
 455                                 /* Process a timed event now... */
 456                                 run_events();
 457                         }
 458                 }
 459         }
 460
 461         {
 462                 int sav;
 463                 START_PROFILE(smbd_idle);
 464
 465         maxfd = select_on_fd(smbd_server_fd(), maxfd, &fds);
 466         maxfd = select_on_fd(change_notify_fd(), maxfd, &fds);
 467         maxfd = select_on_fd(oplock_notify_fd(), maxfd, &fds);
 468
 469         selrtn = sys_select(maxfd+1,&fds,NULL,NULL,&to);
 470                 sav = errno;
 471
 472                 END_PROFILE(smbd_idle);
 473                 errno = sav;
 474         }
 475
 476         /* if we get EINTR then maybe we have received an oplock
 477            signal - treat this as select returning 1. This is ugly, but
 478            is the best we can do until the oplock code knows more about
 479            signals */
 480         if (selrtn == -1 && errno == EINTR) {
 481                 async_processing(&fds);
 482                 /*
 483                  * After async processing we must go and do the select again, as
 484                  * the state of the flag in fds for the server file descriptor is
 485                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 486                  */
 487                 goto again;
 488         }
 489
 490         /* Check if error */
 491         if (selrtn == -1) {
 492                 /* something is wrong. Maybe the socket is dead? */
 493                 smb_read_error = READ_ERROR;
 494                 return False;
 495         }
 496
 497         /* Did we timeout ? */
 498         if (selrtn == 0) {
 499                 smb_read_error = READ_TIMEOUT;
 500                 return False;
 501         }
 502
 503         /*
 504          * Ensure we process oplock break messages by preference.
 505          * This is IMPORTANT ! Otherwise we can starve other processes
 506          * sending us an oplock break message. JRA.
 507          */
 508
 509         if (oplock_message_waiting(&fds)) {
 510                 async_processing(&fds);
 511                 /*
 512                  * After async processing we must go and do the select again, as
 513                  * the state of the flag in fds for the server file descriptor is
 514                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 515                  */
 516                 goto again;
 517         }
 518
 519         return receive_smb(smbd_server_fd(), buffer, 0);
 520 }
 521
 522 /*
 523  * Only allow 5 outstanding trans requests. We're allocating memory, so
 524  * prevent a DoS.
 525  */
 526
 527 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 528 {
 529         int count = 0;
 530         for (; list != NULL; list = list->next) {
 531
 532                 if (list->mid == mid) {
 533                         return NT_STATUS_INVALID_PARAMETER;
 534                 }
 535
 536                 count += 1;
 537         }
 538         if (count > 5) {
 539                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 540         }
 541
 542         return NT_STATUS_OK;
 543 }
 544
 545 /****************************************************************************
 546  We're terminating and have closed all our files/connections etc.
 547  If there are any pending local messages we need to respond to them
 548  before termination so that other smbds don't think we just died whilst
 549  holding oplocks.
 550 ****************************************************************************/
 551
 552 void respond_to_all_remaining_local_messages(void)
 553 {
 554         /*
 555          * Assert we have no exclusive open oplocks.
 556          */
 557
 558         if(get_number_of_exclusive_open_oplocks()) {
 559                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 560                         get_number_of_exclusive_open_oplocks() ));
 561                 return;
 562         }
 563
 564         process_kernel_oplocks(NULL);
 565
 566         return;
 567 }
 568
 569
 570 /*
 571 These flags determine some of the permissions required to do an operation
 572
 573 Note that I don't set NEED_WRITE on some write operations because they
 574 are used by some brain-dead clients when printing, and I don't want to
 575 force write permissions on print services.
 576 */
 577 #define AS_USER (1<<0)
 578 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 579 #define TIME_INIT (1<<2)
 580 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 581 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 582 #define DO_CHDIR (1<<6)
 583
 584 /*
 585    define a list of possible SMB messages and their corresponding
 586    functions. Any message that has a NULL function is unimplemented -
 587    please feel free to contribute implementations!
 588 */
 589 static const struct smb_message_struct {
 590         const char *name;
 591         int (*fn)(connection_struct *conn, char *, char *, int, int);
 592         int flags;
 593 } smb_messages[256] = {
 594
 595 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 596 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 597 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 598 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 599 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 600 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 601 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 602 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 603 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 604 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 605 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 606 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 607 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 608 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 609 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 610 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 611 /* 0x10 */ { "SMBchkpth",reply_chkpth,AS_USER},
 612 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 613 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 614 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 615 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 616 /* 0x15 */ { NULL, NULL, 0 },
 617 /* 0x16 */ { NULL, NULL, 0 },
 618 /* 0x17 */ { NULL, NULL, 0 },
 619 /* 0x18 */ { NULL, NULL, 0 },
 620 /* 0x19 */ { NULL, NULL, 0 },
 621 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 622 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 623 /* 0x1c */ { "SMBreadBs",NULL,0 },
 624 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 625 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 626 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 627 /* 0x20 */ { "SMBwritec",NULL,0},
 628 /* 0x21 */ { NULL, NULL, 0 },
 629 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 630 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 631 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 632 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 633 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 634 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 635 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 636 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 637 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
 638 /* 0x2b */ { "SMBecho",reply_echo,0},
 639 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 640 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 641 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 642 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 643 /* 0x30 */ { NULL, NULL, 0 },
 644 /* 0x31 */ { NULL, NULL, 0 },
 645 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 646 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 647 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 648 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 649 /* 0x36 */ { NULL, NULL, 0 },
 650 /* 0x37 */ { NULL, NULL, 0 },
 651 /* 0x38 */ { NULL, NULL, 0 },
 652 /* 0x39 */ { NULL, NULL, 0 },
 653 /* 0x3a */ { NULL, NULL, 0 },
 654 /* 0x3b */ { NULL, NULL, 0 },
 655 /* 0x3c */ { NULL, NULL, 0 },
 656 /* 0x3d */ { NULL, NULL, 0 },
 657 /* 0x3e */ { NULL, NULL, 0 },
 658 /* 0x3f */ { NULL, NULL, 0 },
 659 /* 0x40 */ { NULL, NULL, 0 },
 660 /* 0x41 */ { NULL, NULL, 0 },
 661 /* 0x42 */ { NULL, NULL, 0 },
 662 /* 0x43 */ { NULL, NULL, 0 },
 663 /* 0x44 */ { NULL, NULL, 0 },
 664 /* 0x45 */ { NULL, NULL, 0 },
 665 /* 0x46 */ { NULL, NULL, 0 },
 666 /* 0x47 */ { NULL, NULL, 0 },
 667 /* 0x48 */ { NULL, NULL, 0 },
 668 /* 0x49 */ { NULL, NULL, 0 },
 669 /* 0x4a */ { NULL, NULL, 0 },
 670 /* 0x4b */ { NULL, NULL, 0 },
 671 /* 0x4c */ { NULL, NULL, 0 },
 672 /* 0x4d */ { NULL, NULL, 0 },
 673 /* 0x4e */ { NULL, NULL, 0 },
 674 /* 0x4f */ { NULL, NULL, 0 },
 675 /* 0x50 */ { NULL, NULL, 0 },
 676 /* 0x51 */ { NULL, NULL, 0 },
 677 /* 0x52 */ { NULL, NULL, 0 },
 678 /* 0x53 */ { NULL, NULL, 0 },
 679 /* 0x54 */ { NULL, NULL, 0 },
 680 /* 0x55 */ { NULL, NULL, 0 },
 681 /* 0x56 */ { NULL, NULL, 0 },
 682 /* 0x57 */ { NULL, NULL, 0 },
 683 /* 0x58 */ { NULL, NULL, 0 },
 684 /* 0x59 */ { NULL, NULL, 0 },
 685 /* 0x5a */ { NULL, NULL, 0 },
 686 /* 0x5b */ { NULL, NULL, 0 },
 687 /* 0x5c */ { NULL, NULL, 0 },
 688 /* 0x5d */ { NULL, NULL, 0 },
 689 /* 0x5e */ { NULL, NULL, 0 },
 690 /* 0x5f */ { NULL, NULL, 0 },
 691 /* 0x60 */ { NULL, NULL, 0 },
 692 /* 0x61 */ { NULL, NULL, 0 },
 693 /* 0x62 */ { NULL, NULL, 0 },
 694 /* 0x63 */ { NULL, NULL, 0 },
 695 /* 0x64 */ { NULL, NULL, 0 },
 696 /* 0x65 */ { NULL, NULL, 0 },
 697 /* 0x66 */ { NULL, NULL, 0 },
 698 /* 0x67 */ { NULL, NULL, 0 },
 699 /* 0x68 */ { NULL, NULL, 0 },
 700 /* 0x69 */ { NULL, NULL, 0 },
 701 /* 0x6a */ { NULL, NULL, 0 },
 702 /* 0x6b */ { NULL, NULL, 0 },
 703 /* 0x6c */ { NULL, NULL, 0 },
 704 /* 0x6d */ { NULL, NULL, 0 },
 705 /* 0x6e */ { NULL, NULL, 0 },
 706 /* 0x6f */ { NULL, NULL, 0 },
 707 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 708 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 709 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 710 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 711 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 712 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 713 /* 0x76 */ { NULL, NULL, 0 },
 714 /* 0x77 */ { NULL, NULL, 0 },
 715 /* 0x78 */ { NULL, NULL, 0 },
 716 /* 0x79 */ { NULL, NULL, 0 },
 717 /* 0x7a */ { NULL, NULL, 0 },
 718 /* 0x7b */ { NULL, NULL, 0 },
 719 /* 0x7c */ { NULL, NULL, 0 },
 720 /* 0x7d */ { NULL, NULL, 0 },
 721 /* 0x7e */ { NULL, NULL, 0 },
 722 /* 0x7f */ { NULL, NULL, 0 },
 723 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 724 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 725 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 726 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 727 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 728 /* 0x85 */ { NULL, NULL, 0 },
 729 /* 0x86 */ { NULL, NULL, 0 },
 730 /* 0x87 */ { NULL, NULL, 0 },
 731 /* 0x88 */ { NULL, NULL, 0 },
 732 /* 0x89 */ { NULL, NULL, 0 },
 733 /* 0x8a */ { NULL, NULL, 0 },
 734 /* 0x8b */ { NULL, NULL, 0 },
 735 /* 0x8c */ { NULL, NULL, 0 },
 736 /* 0x8d */ { NULL, NULL, 0 },
 737 /* 0x8e */ { NULL, NULL, 0 },
 738 /* 0x8f */ { NULL, NULL, 0 },
 739 /* 0x90 */ { NULL, NULL, 0 },
 740 /* 0x91 */ { NULL, NULL, 0 },
 741 /* 0x92 */ { NULL, NULL, 0 },
 742 /* 0x93 */ { NULL, NULL, 0 },
 743 /* 0x94 */ { NULL, NULL, 0 },
 744 /* 0x95 */ { NULL, NULL, 0 },
 745 /* 0x96 */ { NULL, NULL, 0 },
 746 /* 0x97 */ { NULL, NULL, 0 },
 747 /* 0x98 */ { NULL, NULL, 0 },
 748 /* 0x99 */ { NULL, NULL, 0 },
 749 /* 0x9a */ { NULL, NULL, 0 },
 750 /* 0x9b */ { NULL, NULL, 0 },
 751 /* 0x9c */ { NULL, NULL, 0 },
 752 /* 0x9d */ { NULL, NULL, 0 },
 753 /* 0x9e */ { NULL, NULL, 0 },
 754 /* 0x9f */ { NULL, NULL, 0 },
 755 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
 756 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 757 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
 758 /* 0xa3 */ { NULL, NULL, 0 },
 759 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 760 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
 761 /* 0xa6 */ { NULL, NULL, 0 },
 762 /* 0xa7 */ { NULL, NULL, 0 },
 763 /* 0xa8 */ { NULL, NULL, 0 },
 764 /* 0xa9 */ { NULL, NULL, 0 },
 765 /* 0xaa */ { NULL, NULL, 0 },
 766 /* 0xab */ { NULL, NULL, 0 },
 767 /* 0xac */ { NULL, NULL, 0 },
 768 /* 0xad */ { NULL, NULL, 0 },
 769 /* 0xae */ { NULL, NULL, 0 },
 770 /* 0xaf */ { NULL, NULL, 0 },
 771 /* 0xb0 */ { NULL, NULL, 0 },
 772 /* 0xb1 */ { NULL, NULL, 0 },
 773 /* 0xb2 */ { NULL, NULL, 0 },
 774 /* 0xb3 */ { NULL, NULL, 0 },
 775 /* 0xb4 */ { NULL, NULL, 0 },
 776 /* 0xb5 */ { NULL, NULL, 0 },
 777 /* 0xb6 */ { NULL, NULL, 0 },
 778 /* 0xb7 */ { NULL, NULL, 0 },
 779 /* 0xb8 */ { NULL, NULL, 0 },
 780 /* 0xb9 */ { NULL, NULL, 0 },
 781 /* 0xba */ { NULL, NULL, 0 },
 782 /* 0xbb */ { NULL, NULL, 0 },
 783 /* 0xbc */ { NULL, NULL, 0 },
 784 /* 0xbd */ { NULL, NULL, 0 },
 785 /* 0xbe */ { NULL, NULL, 0 },
 786 /* 0xbf */ { NULL, NULL, 0 },
 787 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
 788 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 789 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 790 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 791 /* 0xc4 */ { NULL, NULL, 0 },
 792 /* 0xc5 */ { NULL, NULL, 0 },
 793 /* 0xc6 */ { NULL, NULL, 0 },
 794 /* 0xc7 */ { NULL, NULL, 0 },
 795 /* 0xc8 */ { NULL, NULL, 0 },
 796 /* 0xc9 */ { NULL, NULL, 0 },
 797 /* 0xca */ { NULL, NULL, 0 },
 798 /* 0xcb */ { NULL, NULL, 0 },
 799 /* 0xcc */ { NULL, NULL, 0 },
 800 /* 0xcd */ { NULL, NULL, 0 },
 801 /* 0xce */ { NULL, NULL, 0 },
 802 /* 0xcf */ { NULL, NULL, 0 },
 803 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 804 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 805 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 806 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 807 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 808 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 809 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 810 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 811 /* 0xd8 */ { NULL, NULL, 0 },
 812 /* 0xd9 */ { NULL, NULL, 0 },
 813 /* 0xda */ { NULL, NULL, 0 },
 814 /* 0xdb */ { NULL, NULL, 0 },
 815 /* 0xdc */ { NULL, NULL, 0 },
 816 /* 0xdd */ { NULL, NULL, 0 },
 817 /* 0xde */ { NULL, NULL, 0 },
 818 /* 0xdf */ { NULL, NULL, 0 },
 819 /* 0xe0 */ { NULL, NULL, 0 },
 820 /* 0xe1 */ { NULL, NULL, 0 },
 821 /* 0xe2 */ { NULL, NULL, 0 },
 822 /* 0xe3 */ { NULL, NULL, 0 },
 823 /* 0xe4 */ { NULL, NULL, 0 },
 824 /* 0xe5 */ { NULL, NULL, 0 },
 825 /* 0xe6 */ { NULL, NULL, 0 },
 826 /* 0xe7 */ { NULL, NULL, 0 },
 827 /* 0xe8 */ { NULL, NULL, 0 },
 828 /* 0xe9 */ { NULL, NULL, 0 },
 829 /* 0xea */ { NULL, NULL, 0 },
 830 /* 0xeb */ { NULL, NULL, 0 },
 831 /* 0xec */ { NULL, NULL, 0 },
 832 /* 0xed */ { NULL, NULL, 0 },
 833 /* 0xee */ { NULL, NULL, 0 },
 834 /* 0xef */ { NULL, NULL, 0 },
 835 /* 0xf0 */ { NULL, NULL, 0 },
 836 /* 0xf1 */ { NULL, NULL, 0 },
 837 /* 0xf2 */ { NULL, NULL, 0 },
 838 /* 0xf3 */ { NULL, NULL, 0 },
 839 /* 0xf4 */ { NULL, NULL, 0 },
 840 /* 0xf5 */ { NULL, NULL, 0 },
 841 /* 0xf6 */ { NULL, NULL, 0 },
 842 /* 0xf7 */ { NULL, NULL, 0 },
 843 /* 0xf8 */ { NULL, NULL, 0 },
 844 /* 0xf9 */ { NULL, NULL, 0 },
 845 /* 0xfa */ { NULL, NULL, 0 },
 846 /* 0xfb */ { NULL, NULL, 0 },
 847 /* 0xfc */ { NULL, NULL, 0 },
 848 /* 0xfd */ { NULL, NULL, 0 },
 849 /* 0xfe */ { NULL, NULL, 0 },
 850 /* 0xff */ { NULL, NULL, 0 }
 851
 852 };
 853
 854 /*******************************************************************
 855  Dump a packet to a file.
 856 ********************************************************************/
 857
 858 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 859 {
 860         int fd, i;
 861         pstring fname;
 862         if (DEBUGLEVEL < 50) return;
 863
 864         if (len < 4) len = smb_len(data)+4;
 865         for (i=1;i<100;i++) {
 866                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 867                                 type ? "req" : "resp");
 868                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 869                 if (fd != -1 || errno != EEXIST) break;
 870         }
 871         if (fd != -1) {
 872                 ssize_t ret = write(fd, data, len);
 873                 if (ret != len)
 874                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 875                 close(fd);
 876                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 877         }
 878 }
 879
 880
 881 /****************************************************************************
 882  Do a switch on the message type, and return the response size
 883 ****************************************************************************/
 884
 885 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 886 {
 887         static pid_t pid= (pid_t)-1;
 888         int outsize = 0;
 889
 890         type &= 0xff;
 891
 892         if (pid == (pid_t)-1)
 893                 pid = sys_getpid();
 894
 895         errno = 0;
 896         set_saved_ntstatus(NT_STATUS_OK);
 897
 898         last_message = type;
 899
 900         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 901         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 902                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 903                 exit_server_cleanly("Non-SMB packet");
 904                 return(-1);
 905         }
 906
 907         /* yuck! this is an interim measure before we get rid of our
 908                 current inbuf/outbuf system */
 909         global_smbpid = SVAL(inbuf,smb_pid);
 910
 911         if (smb_messages[type].fn == NULL) {
 912                 DEBUG(0,("Unknown message type %d!\n",type));
 913                 smb_dump("Unknown", 1, inbuf, size);
 914                 outsize = reply_unknown(inbuf,outbuf);
 915         } else {
 916                 int flags = smb_messages[type].flags;
 917                 static uint16 last_session_tag = UID_FIELD_INVALID;
 918                 /* In share mode security we must ignore the vuid. */
 919                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 920                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 921
 922                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 923
 924                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 925
 926                 /* Ensure this value is replaced in the incoming packet. */
 927                 SSVAL(inbuf,smb_uid,session_tag);
 928
 929                 /*
 930                  * Ensure the correct username is in current_user_info.
 931                  * This is a really ugly bugfix for problems with
 932                  * multiple session_setup_and_X's being done and
 933                  * allowing %U and %G substitutions to work correctly.
 934                  * There is a reason this code is done here, don't
 935                  * move it unless you know what you're doing... :-).
 936                  * JRA.
 937                  */
 938
 939                 if (session_tag != last_session_tag) {
 940                         user_struct *vuser = NULL;
 941
 942                         last_session_tag = session_tag;
 943                         if(session_tag != UID_FIELD_INVALID) {
 944                                 vuser = get_valid_user_struct(session_tag);
 945                                 if (vuser) {
 946                                         set_current_user_info(&vuser->user);
 947                                 }
 948                         }
 949                 }
 950
 951                 /* Does this call need to be run as the connected user? */
 952                 if (flags & AS_USER) {
 953
 954                         /* Does this call need a valid tree connection? */
 955                         if (!conn) {
 956                                 /* Amazingly, the error code depends on the command (from Samba4). */
 957                                 if (type == SMBntcreateX) {
 958                                         return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 959                                 } else {
 960                                         return ERROR_DOS(ERRSRV, ERRinvnid);
 961                                 }
 962                         }
 963
 964                         if (!change_to_user(conn,session_tag)) {
 965                                 return(ERROR_FORCE_DOS(ERRSRV,ERRbaduid));
 966                         }
 967
 968                         /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
 969
 970                         /* Does it need write permission? */
 971                         if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 972                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 973                         }
 974
 975                         /* IPC services are limited */
 976                         if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 977                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 978                         }
 979                 } else {
 980                         /* This call needs to be run as root */
 981                         change_to_root_user();
 982                 }
 983
 984                 /* load service specific parameters */
 985                 if (conn) {
 986                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
 987                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 988                         }
 989                         conn->num_smb_operations++;
 990                 }
 991
 992                 /* does this protocol need to be run as guest? */
 993                 if ((flags & AS_GUEST) && (!change_to_guest() ||
 994                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
 995                         return(ERROR_DOS(ERRSRV,ERRaccess));
 996                 }
 997
 998                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
 999                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1000         }
1001
1002         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1003
1004         return(outsize);
1005 }
1006
1007 /****************************************************************************
1008  Construct a reply to the incoming packet.
1009 ****************************************************************************/
1010
1011 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1012 {
1013         int type = CVAL(inbuf,smb_com);
1014         int outsize = 0;
1015         int msg_type = CVAL(inbuf,0);
1016
1017         chain_size = 0;
1018         file_chain_reset();
1019         reset_chain_p();
1020
1021         if (msg_type != 0)
1022                 return(reply_special(inbuf,outbuf));
1023
1024         construct_reply_common(inbuf, outbuf);
1025
1026         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1027
1028         outsize += chain_size;
1029
1030         if(outsize > 4)
1031                 smb_setlen(outbuf,outsize - 4);
1032         return(outsize);
1033 }
1034
1035 /****************************************************************************
1036  Keep track of the number of running smbd's. This functionality is used to
1037  'hard' limit Samba overhead on resource constrained systems.
1038 ****************************************************************************/
1039
1040 static BOOL process_count_update_successful = False;
1041
1042 static int32 increment_smbd_process_count(void)
1043 {
1044         int32 total_smbds;
1045
1046         if (lp_max_smbd_processes()) {
1047                 total_smbds = 0;
1048                 if (tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, 1) == -1)
1049                         return 1;
1050                 process_count_update_successful = True;
1051                 return total_smbds + 1;
1052         }
1053         return 1;
1054 }
1055
1056 void decrement_smbd_process_count(void)
1057 {
1058         int32 total_smbds;
1059
1060         if (lp_max_smbd_processes() && process_count_update_successful) {
1061                 total_smbds = 1;
1062                 tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, -1);
1063         }
1064 }
1065
1066 static BOOL smbd_process_limit(void)
1067 {
1068         int32  total_smbds;
1069
1070         if (lp_max_smbd_processes()) {
1071
1072                 /* Always add one to the smbd process count, as exit_server() always
1073                  * subtracts one.
1074                  */
1075
1076                 if (!conn_tdb_ctx()) {
1077                         DEBUG(0,("smbd_process_limit: max smbd processes parameter set with status parameter not \
1078 set. Ignoring max smbd restriction.\n"));
1079                         return False;
1080                 }
1081
1082                 total_smbds = increment_smbd_process_count();
1083                 return total_smbds > lp_max_smbd_processes();
1084         }
1085         else
1086                 return False;
1087 }
1088
1089 /****************************************************************************
1090  Process an smb from the client
1091 ****************************************************************************/
1092
1093 static void process_smb(char *inbuf, char *outbuf)
1094 {
1095         static int trans_num;
1096         int msg_type = CVAL(inbuf,0);
1097         int32 len = smb_len(inbuf);
1098         int nread = len + 4;
1099
1100         DO_PROFILE_INC(smb_count);
1101
1102         if (trans_num == 0) {
1103                 /* on the first packet, check the global hosts allow/ hosts
1104                 deny parameters before doing any parsing of the packet
1105                 passed to us by the client.  This prevents attacks on our
1106                 parsing code from hosts not in the hosts allow list */
1107                 if (smbd_process_limit() ||
1108                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))) {
1109                         /* send a negative session response "not listening on calling name" */
1110                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1111                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1112                         (void)send_smb(smbd_server_fd(),(char *)buf);
1113                         exit_server_cleanly("connection denied");
1114                 }
1115         }
1116
1117         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1118         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1119
1120         if (msg_type == 0)
1121                 show_msg(inbuf);
1122         else if(msg_type == SMBkeepalive)
1123                 return; /* Keepalive packet. */
1124
1125         nread = construct_reply(inbuf,outbuf,nread,max_send);
1126
1127         if(nread > 0) {
1128                 if (CVAL(outbuf,0) == 0)
1129                         show_msg(outbuf);
1130
1131                 if (nread != smb_len(outbuf) + 4) {
1132                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1133                                 nread, smb_len(outbuf)));
1134                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1135                         exit_server_cleanly("process_smb: send_smb failed.");
1136                 }
1137         }
1138         trans_num++;
1139 }
1140
1141 /****************************************************************************
1142  Return a string containing the function name of a SMB command.
1143 ****************************************************************************/
1144
1145 const char *smb_fn_name(int type)
1146 {
1147         const char *unknown_name = "SMBunknown";
1148
1149         if (smb_messages[type].name == NULL)
1150                 return(unknown_name);
1151
1152         return(smb_messages[type].name);
1153 }
1154
1155 /****************************************************************************
1156  Helper functions for contruct_reply.
1157 ****************************************************************************/
1158
1159 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1160
1161 void add_to_common_flags2(uint32 v)
1162 {
1163         common_flags2 |= v;
1164 }
1165
1166 void remove_from_common_flags2(uint32 v)
1167 {
1168         common_flags2 &= ~v;
1169 }
1170
1171 void construct_reply_common(char *inbuf,char *outbuf)
1172 {
1173         set_message(outbuf,0,0,False);
1174
1175         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1176         SIVAL(outbuf,smb_rcls,0);
1177         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1178         SSVAL(outbuf,smb_flg2,
1179                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1180                 common_flags2);
1181         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1182
1183         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1184         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1185         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1186         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1187 }
1188
1189 /****************************************************************************
1190  Construct a chained reply and add it to the already made reply
1191 ****************************************************************************/
1192
1193 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1194 {
1195         static char *orig_inbuf;
1196         static char *orig_outbuf;
1197         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1198         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1199         char *inbuf2, *outbuf2;
1200         int outsize2;
1201         char inbuf_saved[smb_wct];
1202         char outbuf_saved[smb_wct];
1203         int outsize = smb_len(outbuf) + 4;
1204
1205         /* maybe its not chained */
1206         if (smb_com2 == 0xFF) {
1207                 SCVAL(outbuf,smb_vwv0,0xFF);
1208                 return outsize;
1209         }
1210
1211         if (chain_size == 0) {
1212                 /* this is the first part of the chain */
1213                 orig_inbuf = inbuf;
1214                 orig_outbuf = outbuf;
1215         }
1216
1217         /*
1218          * The original Win95 redirector dies on a reply to
1219          * a lockingX and read chain unless the chain reply is
1220          * 4 byte aligned. JRA.
1221          */
1222
1223         outsize = (outsize + 3) & ~3;
1224
1225         /* we need to tell the client where the next part of the reply will be */
1226         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1227         SCVAL(outbuf,smb_vwv0,smb_com2);
1228
1229         /* remember how much the caller added to the chain, only counting stuff
1230                 after the parameter words */
1231         chain_size += outsize - smb_wct;
1232
1233         /* work out pointers into the original packets. The
1234                 headers on these need to be filled in */
1235         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1236         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1237
1238         /* remember the original command type */
1239         smb_com1 = CVAL(orig_inbuf,smb_com);
1240
1241         /* save the data which will be overwritten by the new headers */
1242         memcpy(inbuf_saved,inbuf2,smb_wct);
1243         memcpy(outbuf_saved,outbuf2,smb_wct);
1244
1245         /* give the new packet the same header as the last part of the SMB */
1246         memmove(inbuf2,inbuf,smb_wct);
1247
1248         /* create the in buffer */
1249         SCVAL(inbuf2,smb_com,smb_com2);
1250
1251         /* create the out buffer */
1252         construct_reply_common(inbuf2, outbuf2);
1253
1254         DEBUG(3,("Chained message\n"));
1255         show_msg(inbuf2);
1256
1257         /* process the request */
1258         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size,
1259                                 bufsize-chain_size);
1260
1261         /* copy the new reply and request headers over the old ones, but
1262                 preserve the smb_com field */
1263         memmove(orig_outbuf,outbuf2,smb_wct);
1264         SCVAL(orig_outbuf,smb_com,smb_com1);
1265
1266         /* restore the saved data, being careful not to overwrite any
1267                 data from the reply header */
1268         memcpy(inbuf2,inbuf_saved,smb_wct);
1269
1270         {
1271                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1272                 if (ofs < 0) ofs = 0;
1273                         memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1274         }
1275
1276         return outsize2;
1277 }
1278
1279 /****************************************************************************
1280  Setup the needed select timeout.
1281 ****************************************************************************/
1282
1283 static int setup_select_timeout(void)
1284 {
1285         int select_timeout;
1286         int t;
1287
1288         select_timeout = blocking_locks_timeout(SMBD_SELECT_TIMEOUT);
1289         select_timeout *= 1000;
1290
1291         t = change_notify_timeout();
1292         DEBUG(10, ("change_notify_timeout: %d\n", t));
1293         if (t != -1)
1294                 select_timeout = MIN(select_timeout, t*1000);
1295
1296         if (print_notify_messages_pending())
1297                 select_timeout = MIN(select_timeout, 1000);
1298
1299         return select_timeout;
1300 }
1301
1302 /****************************************************************************
1303  Check if services need reloading.
1304 ****************************************************************************/
1305
1306 void check_reload(time_t t)
1307 {
1308         static pid_t mypid = 0;
1309         static time_t last_smb_conf_reload_time = 0;
1310         static time_t last_printer_reload_time = 0;
1311         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1312
1313         if(last_smb_conf_reload_time == 0) {
1314                 last_smb_conf_reload_time = t;
1315                 /* Our printing subsystem might not be ready at smbd start up.
1316                    Then no printer is available till the first printers check
1317                    is performed.  A lower initial interval circumvents this. */
1318                 if ( printcap_cache_time > 60 )
1319                         last_printer_reload_time = t - printcap_cache_time + 60;
1320                 else
1321                         last_printer_reload_time = t;
1322         }
1323
1324         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1325                 /* randomize over 60 second the printcap reload to avoid all
1326                  * process hitting cupsd at the same time */
1327                 int time_range = 60;
1328
1329                 last_printer_reload_time += random() % time_range;
1330                 mypid = getpid();
1331         }
1332
1333         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1334                 reload_services(True);
1335                 reload_after_sighup = False;
1336                 last_smb_conf_reload_time = t;
1337         }
1338
1339         /* 'printcap cache time = 0' disable the feature */
1340
1341         if ( printcap_cache_time != 0 )
1342         {
1343                 /* see if it's time to reload or if the clock has been set back */
1344
1345                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1346                         || (t-last_printer_reload_time  < 0) )
1347                 {
1348                         DEBUG( 3,( "Printcap cache time expired.\n"));
1349                         reload_printers();
1350                         last_printer_reload_time = t;
1351                 }
1352         }
1353 }
1354
1355 /****************************************************************************
1356  Process any timeout housekeeping. Return False if the caller should exit.
1357 ****************************************************************************/
1358
1359 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1360 {
1361         static time_t last_keepalive_sent_time = 0;
1362         static time_t last_idle_closed_check = 0;
1363         time_t t;
1364         BOOL allidle = True;
1365
1366         if (smb_read_error == READ_EOF) {
1367                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1368                 return False;
1369         }
1370
1371         if (smb_read_error == READ_ERROR) {
1372                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1373                         strerror(errno)));
1374                 return False;
1375         }
1376
1377         if (smb_read_error == READ_BAD_SIG) {
1378                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1379                 return False;
1380         }
1381
1382         *last_timeout_processing_time = t = time(NULL);
1383
1384         if(last_keepalive_sent_time == 0)
1385                 last_keepalive_sent_time = t;
1386
1387         if(last_idle_closed_check == 0)
1388                 last_idle_closed_check = t;
1389
1390         /* become root again if waiting */
1391         change_to_root_user();
1392
1393         /* run all registered idle events */
1394         smb_run_idle_events(t);
1395
1396         /* check if we need to reload services */
1397         check_reload(t);
1398
1399         /* automatic timeout if all connections are closed */
1400         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1401                 DEBUG( 2, ( "Closing idle connection\n" ) );
1402                 return False;
1403         } else {
1404                 last_idle_closed_check = t;
1405         }
1406
1407         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1408                 if (!send_keepalive(smbd_server_fd())) {
1409                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1410                         return False;
1411                 }
1412
1413                 /* send a keepalive for a password server or the like.
1414                         This is attached to the auth_info created in the
1415                 negprot */
1416                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1417                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1418
1419                         negprot_global_auth_context->challenge_set_method->send_keepalive
1420                         (&negprot_global_auth_context->challenge_set_method->private_data);
1421                 }
1422
1423                 last_keepalive_sent_time = t;
1424         }
1425
1426         /* check for connection timeouts */
1427         allidle = conn_idle_all(t, deadtime);
1428
1429         if (allidle && conn_num_open()>0) {
1430                 DEBUG(2,("Closing idle connection 2.\n"));
1431                 return False;
1432         }
1433
1434         if(global_machine_password_needs_changing &&
1435                         /* for ADS we need to do a regular ADS password change, not a domain
1436                                         password change */
1437                         lp_security() == SEC_DOMAIN) {
1438
1439                 unsigned char trust_passwd_hash[16];
1440                 time_t lct;
1441
1442                 /*
1443                  * We're in domain level security, and the code that
1444                  * read the machine password flagged that the machine
1445                  * password needs changing.
1446                  */
1447
1448                 /*
1449                  * First, open the machine password file with an exclusive lock.
1450                  */
1451
1452                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1453                         DEBUG(0,("process: unable to lock the machine account password for \
1454 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1455                         return True;
1456                 }
1457
1458                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1459                         DEBUG(0,("process: unable to read the machine account password for \
1460 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1461                         secrets_lock_trust_account_password(lp_workgroup(), False);
1462                         return True;
1463                 }
1464
1465                 /*
1466                  * Make sure someone else hasn't already done this.
1467                  */
1468
1469                 if(t < lct + lp_machine_password_timeout()) {
1470                         global_machine_password_needs_changing = False;
1471                         secrets_lock_trust_account_password(lp_workgroup(), False);
1472                         return True;
1473                 }
1474
1475                 /* always just contact the PDC here */
1476
1477                 change_trust_account_password( lp_workgroup(), NULL);
1478                 global_machine_password_needs_changing = False;
1479                 secrets_lock_trust_account_password(lp_workgroup(), False);
1480         }
1481
1482         /*
1483          * Check to see if we have any blocking locks
1484          * outstanding on the queue.
1485          */
1486         process_blocking_lock_queue(t);
1487
1488         /* update printer queue caches if necessary */
1489
1490         update_monitored_printq_cache();
1491
1492         /*
1493          * Check to see if we have any change notifies
1494          * outstanding on the queue.
1495          */
1496         process_pending_change_notify_queue(t);
1497
1498         /*
1499          * Now we are root, check if the log files need pruning.
1500          * Force a log file check.
1501          */
1502         force_check_log_size();
1503         check_log_size();
1504
1505         /* Send any queued printer notify message to interested smbd's. */
1506
1507         print_notify_send_messages(0);
1508
1509         /*
1510          * Modify the select timeout depending upon
1511          * what we have remaining in our queues.
1512          */
1513
1514         *select_timeout = setup_select_timeout();
1515
1516         return True;
1517 }
1518
1519 /****************************************************************************
1520  Accessor functions for InBuffer, OutBuffer.
1521 ****************************************************************************/
1522
1523 char *get_InBuffer(void)
1524 {
1525         return InBuffer;
1526 }
1527
1528 void set_InBuffer(char *new_inbuf)
1529 {
1530         InBuffer = new_inbuf;
1531         current_inbuf = InBuffer;
1532 }
1533
1534 char *get_OutBuffer(void)
1535 {
1536         return OutBuffer;
1537 }
1538
1539 void set_OutBuffer(char *new_outbuf)
1540 {
1541         OutBuffer = new_outbuf;
1542 }
1543
1544 /****************************************************************************
1545  Free an InBuffer. Checks if not in use by aio system.
1546  Must have been allocated by NewInBuffer.
1547 ****************************************************************************/
1548
1549 void free_InBuffer(char *inbuf)
1550 {
1551         if (!aio_inbuffer_in_use(inbuf)) {
1552                 if (current_inbuf == inbuf) {
1553                         current_inbuf = NULL;
1554                 }
1555                 SAFE_FREE(inbuf);
1556         }
1557 }
1558
1559 /****************************************************************************
1560  Free an OutBuffer. No outbuffers currently stolen by aio system.
1561  Must have been allocated by NewInBuffer.
1562 ****************************************************************************/
1563
1564 void free_OutBuffer(char *outbuf)
1565 {
1566         SAFE_FREE(outbuf);
1567 }
1568
1569 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1570
1571 /****************************************************************************
1572  Allocate a new InBuffer. Returns the new and old ones.
1573 ****************************************************************************/
1574
1575 char *NewInBuffer(char **old_inbuf)
1576 {
1577         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1578         if (!new_inbuf) {
1579                 return NULL;
1580         }
1581         if (old_inbuf) {
1582                 *old_inbuf = InBuffer;
1583         }
1584         InBuffer = new_inbuf;
1585 #if defined(DEVELOPER)
1586         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1587 #endif
1588         return InBuffer;
1589 }
1590
1591 /****************************************************************************
1592  Allocate a new OutBuffer. Returns the new and old ones.
1593 ****************************************************************************/
1594
1595 char *NewOutBuffer(char **old_outbuf)
1596 {
1597         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1598         if (!new_outbuf) {
1599                 return NULL;
1600         }
1601         if (old_outbuf) {
1602                 *old_outbuf = OutBuffer;
1603         }
1604         OutBuffer = new_outbuf;
1605 #if defined(DEVELOPER)
1606         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1607 #endif
1608         return OutBuffer;
1609 }
1610
1611 /****************************************************************************
1612  Process commands from the client
1613 ****************************************************************************/
1614
1615 void smbd_process(void)
1616 {
1617         time_t last_timeout_processing_time = time(NULL);
1618         unsigned int num_smbs = 0;
1619
1620         /* Allocate the primary Inbut/Output buffers. */
1621
1622         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1623                 return;
1624
1625         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1626
1627         while (True) {
1628                 int deadtime = lp_deadtime()*60;
1629                 int select_timeout = setup_select_timeout();
1630                 int num_echos;
1631
1632                 if (deadtime <= 0)
1633                         deadtime = DEFAULT_SMBD_TIMEOUT;
1634
1635                 errno = 0;
1636
1637                 /* free up temporary memory */
1638                 lp_TALLOC_FREE();
1639                 main_loop_TALLOC_FREE();
1640
1641                 /* Did someone ask for immediate checks on things like blocking locks ? */
1642                 if (select_timeout == 0) {
1643                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1644                                 return;
1645                         num_smbs = 0; /* Reset smb counter. */
1646                 }
1647
1648                 run_events();
1649
1650 #if defined(DEVELOPER)
1651                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1652 #endif
1653
1654                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1655                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1656                                 return;
1657                         num_smbs = 0; /* Reset smb counter. */
1658                 }
1659
1660                 /*
1661                  * Ensure we do timeout processing if the SMB we just got was
1662                  * only an echo request. This allows us to set the select
1663                  * timeout in 'receive_message_or_smb()' to any value we like
1664                  * without worrying that the client will send echo requests
1665                  * faster than the select timeout, thus starving out the
1666                  * essential processing (change notify, blocking locks) that
1667                  * the timeout code does. JRA.
1668                  */
1669                 num_echos = smb_echo_count;
1670
1671                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1672
1673                 process_smb(InBuffer, OutBuffer);
1674
1675                 if (smb_echo_count != num_echos) {
1676                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1677                                 return;
1678                         num_smbs = 0; /* Reset smb counter. */
1679                 }
1680
1681                 num_smbs++;
1682
1683                 /*
1684                  * If we are getting smb requests in a constant stream
1685                  * with no echos, make sure we attempt timeout processing
1686                  * every select_timeout milliseconds - but only check for this
1687                  * every 200 smb requests.
1688                  */
1689
1690                 if ((num_smbs % 200) == 0) {
1691                         time_t new_check_time = time(NULL);
1692                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1693                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1694                                         return;
1695                                 num_smbs = 0; /* Reset smb counter. */
1696                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1697                         }
1698                 }
1699
1700                 /* The timeout_processing function isn't run nearly
1701                    often enough to implement 'max log size' without
1702                    overrunning the size of the file by many megabytes.
1703                    This is especially true if we are running at debug
1704                    level 10.  Checking every 50 SMBs is a nice
1705                    tradeoff of performance vs log file size overrun. */
1706
1707                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1708                         change_to_root_user();
1709                         check_log_size();
1710                 }
1711         }
1712 }