source: trunk/samba/source/smbd/process.c @ 30

Last change on this file since 30 was 30, checked in by Paul Smedley, 14 years ago

Code updated to Samba 3.0.25rc2 level

File size: 49.3 KB
Line 
1/*
2   Unix SMB/CIFS implementation.
3   process incoming packets - main loop
4   Copyright (C) Andrew Tridgell 1992-1998
5   Copyright (C) Volker Lendecke 2005
6   
7   This program is free software; you can redistribute it and/or modify
8   it under the terms of the GNU General Public License as published by
9   the Free Software Foundation; either version 2 of the License, or
10   (at your option) any later version.
11   
12   This program is distributed in the hope that it will be useful,
13   but WITHOUT ANY WARRANTY; without even the implied warranty of
14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15   GNU General Public License for more details.
16   
17   You should have received a copy of the GNU General Public License
18   along with this program; if not, write to the Free Software
19   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20*/
21
22#include "includes.h"
23
24uint16 global_smbpid;
25extern int keepalive;
26extern struct auth_context *negprot_global_auth_context;
27extern int smb_echo_count;
28
29static char *InBuffer = NULL;
30static char *OutBuffer = NULL;
31static char *current_inbuf = NULL;
32
33/*
34 * Size of data we can send to client. Set
35 *  by the client for all protocols above CORE.
36 *  Set by us for CORE protocol.
37 */
38int max_send = BUFFER_SIZE;
39/*
40 * Size of the data we can receive. Set by us.
41 * Can be modified by the max xmit parameter.
42 */
43int max_recv = BUFFER_SIZE;
44
45extern int last_message;
46extern int smb_read_error;
47SIG_ATOMIC_T reload_after_sighup = 0;
48SIG_ATOMIC_T got_sig_term = 0;
49extern BOOL global_machine_password_needs_changing;
50extern int max_send;
51
52/****************************************************************************
53 Function to return the current request mid from Inbuffer.
54****************************************************************************/
55
56uint16 get_current_mid(void)
57{
58        return SVAL(InBuffer,smb_mid);
59}
60
61/****************************************************************************
62 structure to hold a linked list of queued messages.
63 for processing.
64****************************************************************************/
65
66static struct pending_message_list *deferred_open_queue;
67
68/****************************************************************************
69 Function to push a message onto the tail of a linked list of smb messages ready
70 for processing.
71****************************************************************************/
72
73static BOOL push_queued_message(char *buf, int msg_len,
74                                struct timeval request_time,
75                                struct timeval end_time,
76                                char *private_data, size_t private_len)
77{
78        struct pending_message_list *msg;
79
80        msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
81
82        if(msg == NULL) {
83                DEBUG(0,("push_message: malloc fail (1)\n"));
84                return False;
85        }
86
87        msg->buf = data_blob_talloc(msg, buf, msg_len);
88        if(msg->buf.data == NULL) {
89                DEBUG(0,("push_message: malloc fail (2)\n"));
90                TALLOC_FREE(msg);
91                return False;
92        }
93
94        msg->request_time = request_time;
95        msg->end_time = end_time;
96
97        if (private_data) {
98                msg->private_data = data_blob_talloc(msg, private_data,
99                                                     private_len);
100                if (msg->private_data.data == NULL) {
101                        DEBUG(0,("push_message: malloc fail (3)\n"));
102                        TALLOC_FREE(msg);
103                        return False;
104                }
105        }
106
107        DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
108
109        DEBUG(10,("push_message: pushed message length %u on "
110                  "deferred_open_queue\n", (unsigned int)msg_len));
111
112        return True;
113}
114
115/****************************************************************************
116 Function to delete a sharing violation open message by mid.
117****************************************************************************/
118
119void remove_deferred_open_smb_message(uint16 mid)
120{
121        struct pending_message_list *pml;
122
123        for (pml = deferred_open_queue; pml; pml = pml->next) {
124                if (mid == SVAL(pml->buf.data,smb_mid)) {
125                        DEBUG(10,("remove_sharing_violation_open_smb_message: "
126                                  "deleting mid %u len %u\n",
127                                  (unsigned int)mid,
128                                  (unsigned int)pml->buf.length ));
129                        DLIST_REMOVE(deferred_open_queue, pml);
130                        TALLOC_FREE(pml);
131                        return;
132                }
133        }
134}
135
136/****************************************************************************
137 Move a sharing violation open retry message to the front of the list and
138 schedule it for immediate processing.
139****************************************************************************/
140
141void schedule_deferred_open_smb_message(uint16 mid)
142{
143        struct pending_message_list *pml;
144        int i = 0;
145
146        for (pml = deferred_open_queue; pml; pml = pml->next) {
147                uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
148                DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
149                        (unsigned int)msg_mid ));
150                if (mid == msg_mid) {
151                        DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
152                                mid ));
153                        pml->end_time.tv_sec = 0;
154                        pml->end_time.tv_usec = 0;
155                        DLIST_PROMOTE(deferred_open_queue, pml);
156                        return;
157                }
158        }
159
160        DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
161                mid ));
162}
163
164/****************************************************************************
165 Return true if this mid is on the deferred queue.
166****************************************************************************/
167
168BOOL open_was_deferred(uint16 mid)
169{
170        struct pending_message_list *pml;
171
172        for (pml = deferred_open_queue; pml; pml = pml->next) {
173                if (SVAL(pml->buf.data,smb_mid) == mid) {
174                        return True;
175                }
176        }
177        return False;
178}
179
180/****************************************************************************
181 Return the message queued by this mid.
182****************************************************************************/
183
184struct pending_message_list *get_open_deferred_message(uint16 mid)
185{
186        struct pending_message_list *pml;
187
188        for (pml = deferred_open_queue; pml; pml = pml->next) {
189                if (SVAL(pml->buf.data,smb_mid) == mid) {
190                        return pml;
191                }
192        }
193        return NULL;
194}
195
196/****************************************************************************
197 Function to push a deferred open smb message onto a linked list of local smb
198 messages ready for processing.
199****************************************************************************/
200
201BOOL push_deferred_smb_message(uint16 mid,
202                               struct timeval request_time,
203                               struct timeval timeout,
204                               char *private_data, size_t priv_len)
205{
206        struct timeval end_time;
207
208        end_time = timeval_sum(&request_time, &timeout);
209
210        DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
211                  "timeout time [%u.%06u]\n",
212                  (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
213                  (unsigned int)end_time.tv_sec,
214                  (unsigned int)end_time.tv_usec));
215
216        return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
217                                   request_time, end_time,
218                                   private_data, priv_len);
219}
220
221struct idle_event {
222        struct timed_event *te;
223        struct timeval interval;
224        BOOL (*handler)(const struct timeval *now, void *private_data);
225        void *private_data;
226};
227
228static void idle_event_handler(struct event_context *ctx,
229                               struct timed_event *te,
230                               const struct timeval *now,
231                               void *private_data)
232{
233        struct idle_event *event =
234                talloc_get_type_abort(private_data, struct idle_event);
235
236        TALLOC_FREE(event->te);
237
238        if (!event->handler(now, event->private_data)) {
239                /* Don't repeat, delete ourselves */
240                TALLOC_FREE(event);
241                return;
242        }
243
244        event->te = event_add_timed(smbd_event_context(), event,
245                                    timeval_sum(now, &event->interval),
246                                    "idle_event_handler",
247                                    idle_event_handler, event);
248
249        /* We can't do much but fail here. */
250        SMB_ASSERT(event->te != NULL);
251}
252
253struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
254                                  struct timeval interval,
255                                  BOOL (*handler)(const struct timeval *now,
256                                                  void *private_data),
257                                  void *private_data)
258{
259        struct idle_event *result;
260        struct timeval now = timeval_current();
261
262        result = TALLOC_P(mem_ctx, struct idle_event);
263        if (result == NULL) {
264                DEBUG(0, ("talloc failed\n"));
265                return NULL;
266        }
267
268        result->interval = interval;
269        result->handler = handler;
270        result->private_data = private_data;
271
272        result->te = event_add_timed(smbd_event_context(), result,
273                                     timeval_sum(&now, &interval),
274                                     "idle_event_handler",
275                                     idle_event_handler, result);
276        if (result->te == NULL) {
277                DEBUG(0, ("event_add_timed failed\n"));
278                TALLOC_FREE(result);
279                return NULL;
280        }
281
282        return result;
283}
284
285/****************************************************************************
286 Do all async processing in here. This includes kernel oplock messages, change
287 notify events etc.
288****************************************************************************/
289
290static void async_processing(fd_set *pfds)
291{
292        DEBUG(10,("async_processing: Doing async processing.\n"));
293
294        process_aio_queue();
295
296        process_kernel_oplocks(pfds);
297
298        /* Do the aio check again after receive_local_message as it does a
299           select and may have eaten our signal. */
300        /* Is this till true? -- vl */
301        process_aio_queue();
302
303        if (got_sig_term) {
304                exit_server_cleanly("termination signal");
305        }
306
307        /* check for sighup processing */
308        if (reload_after_sighup) {
309                change_to_root_user();
310                DEBUG(1,("Reloading services after SIGHUP\n"));
311                reload_services(False);
312                reload_after_sighup = 0;
313        }
314}
315
316/****************************************************************************
317 Add a fd to the set we will be select(2)ing on.
318****************************************************************************/
319
320static int select_on_fd(int fd, int maxfd, fd_set *fds)
321{
322        if (fd != -1) {
323                FD_SET(fd, fds);
324                maxfd = MAX(maxfd, fd);
325        }
326
327        return maxfd;
328}
329
330/****************************************************************************
331  Do a select on an two fd's - with timeout.
332
333  If a local udp message has been pushed onto the
334  queue (this can only happen during oplock break
335  processing) call async_processing()
336
337  If a pending smb message has been pushed onto the
338  queue (this can only happen during oplock break
339  processing) return this next.
340
341  If the first smbfd is ready then read an smb from it.
342  if the second (loopback UDP) fd is ready then read a message
343  from it and setup the buffer header to identify the length
344  and from address.
345  Returns False on timeout or error.
346  Else returns True.
347
348The timeout is in milliseconds
349****************************************************************************/
350
351static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
352{
353        fd_set r_fds, w_fds;
354        int selrtn;
355        struct timeval to;
356        int maxfd = 0;
357
358        smb_read_error = 0;
359
360 again:
361
362        if (timeout >= 0) {
363                to.tv_sec = timeout / 1000;
364                to.tv_usec = (timeout % 1000) * 1000;
365        } else {
366                to.tv_sec = SMBD_SELECT_TIMEOUT;
367                to.tv_usec = 0;
368        }
369
370        /*
371         * Note that this call must be before processing any SMB
372         * messages as we need to synchronously process any messages
373         * we may have sent to ourselves from the previous SMB.
374         */
375        message_dispatch();
376
377        /*
378         * Check to see if we already have a message on the deferred open queue
379         * and it's time to schedule.
380         */
381        if(deferred_open_queue != NULL) {
382                BOOL pop_message = False;
383                struct pending_message_list *msg = deferred_open_queue;
384
385                if (timeval_is_zero(&msg->end_time)) {
386                        pop_message = True;
387                } else {
388                        struct timeval tv;
389                        SMB_BIG_INT tdif;
390
391                        GetTimeOfDay(&tv);
392                        tdif = usec_time_diff(&msg->end_time, &tv);
393                        if (tdif <= 0) {
394                                /* Timed out. Schedule...*/
395                                pop_message = True;
396                                DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
397                        } else {
398                                /* Make a more accurate select timeout. */
399                                to.tv_sec = tdif / 1000000;
400                                to.tv_usec = tdif % 1000000;
401                                DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
402                                        (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
403                        }
404                }
405
406                if (pop_message) {
407                        memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
408 
409                        /* We leave this message on the queue so the open code can
410                           know this is a retry. */
411                        DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
412                        return True;
413                }
414        }
415
416        /*
417         * Setup the select fd sets.
418         */
419
420        FD_ZERO(&r_fds);
421        FD_ZERO(&w_fds);
422
423        /*
424         * Ensure we process oplock break messages by preference.
425         * We have to do this before the select, after the select
426         * and if the select returns EINTR. This is due to the fact
427         * that the selects called from async_processing can eat an EINTR
428         * caused by a signal (we can't take the break message there).
429         * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
430         */
431
432        if (oplock_message_waiting(&r_fds)) {
433                DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
434                async_processing(&r_fds);
435                /*
436                 * After async processing we must go and do the select again, as
437                 * the state of the flag in fds for the server file descriptor is
438                 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
439                 */
440                goto again;
441        }
442
443        /*
444         * Are there any timed events waiting ? If so, ensure we don't
445         * select for longer than it would take to wait for them.
446         */
447
448        {
449                struct timeval now;
450                GetTimeOfDay(&now);
451
452                event_add_to_select_args(smbd_event_context(), &now,
453                                         &r_fds, &w_fds, &to, &maxfd);
454        }
455
456        if (timeval_is_zero(&to)) {
457                /* Process a timed event now... */
458                if (run_events(smbd_event_context(), 0, NULL, NULL)) {
459                        goto again;
460                }
461        }
462       
463        {
464                int sav;
465                START_PROFILE(smbd_idle);
466
467                maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
468                maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
469
470                selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
471                sav = errno;
472
473                END_PROFILE(smbd_idle);
474                errno = sav;
475        }
476
477        if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
478                goto again;
479        }
480
481        /* if we get EINTR then maybe we have received an oplock
482           signal - treat this as select returning 1. This is ugly, but
483           is the best we can do until the oplock code knows more about
484           signals */
485        if (selrtn == -1 && errno == EINTR) {
486                async_processing(&r_fds);
487                /*
488                 * After async processing we must go and do the select again, as
489                 * the state of the flag in fds for the server file descriptor is
490                 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
491                 */
492                goto again;
493        }
494
495        /* Check if error */
496        if (selrtn == -1) {
497                /* something is wrong. Maybe the socket is dead? */
498                smb_read_error = READ_ERROR;
499                return False;
500        } 
501   
502        /* Did we timeout ? */
503        if (selrtn == 0) {
504                smb_read_error = READ_TIMEOUT;
505                return False;
506        }
507
508        /*
509         * Ensure we process oplock break messages by preference.
510         * This is IMPORTANT ! Otherwise we can starve other processes
511         * sending us an oplock break message. JRA.
512         */
513
514        if (oplock_message_waiting(&r_fds)) {
515                async_processing(&r_fds);
516                /*
517                 * After async processing we must go and do the select again, as
518                 * the state of the flag in fds for the server file descriptor is
519                 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
520                 */
521                goto again;
522        }
523
524        return receive_smb(smbd_server_fd(), buffer, 0);
525}
526
527/*
528 * Only allow 5 outstanding trans requests. We're allocating memory, so
529 * prevent a DoS.
530 */
531
532NTSTATUS allow_new_trans(struct trans_state *list, int mid)
533{
534        int count = 0;
535        for (; list != NULL; list = list->next) {
536
537                if (list->mid == mid) {
538                        return NT_STATUS_INVALID_PARAMETER;
539                }
540
541                count += 1;
542        }
543        if (count > 5) {
544                return NT_STATUS_INSUFFICIENT_RESOURCES;
545        }
546
547        return NT_STATUS_OK;
548}
549
550/****************************************************************************
551 We're terminating and have closed all our files/connections etc.
552 If there are any pending local messages we need to respond to them
553 before termination so that other smbds don't think we just died whilst
554 holding oplocks.
555****************************************************************************/
556
557void respond_to_all_remaining_local_messages(void)
558{
559        /*
560         * Assert we have no exclusive open oplocks.
561         */
562
563        if(get_number_of_exclusive_open_oplocks()) {
564                DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
565                        get_number_of_exclusive_open_oplocks() ));
566                return;
567        }
568
569        process_kernel_oplocks(NULL);
570
571        return;
572}
573
574
575/*
576These flags determine some of the permissions required to do an operation
577
578Note that I don't set NEED_WRITE on some write operations because they
579are used by some brain-dead clients when printing, and I don't want to
580force write permissions on print services.
581*/
582#define AS_USER (1<<0)
583#define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
584#define TIME_INIT (1<<2)
585#define CAN_IPC (1<<3) /* Must be paired with AS_USER */
586#define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
587#define DO_CHDIR (1<<6)
588
589/*
590   define a list of possible SMB messages and their corresponding
591   functions. Any message that has a NULL function is unimplemented -
592   please feel free to contribute implementations!
593*/
594static const struct smb_message_struct {
595        const char *name;
596        int (*fn)(connection_struct *conn, char *, char *, int, int);
597        int flags;
598} smb_messages[256] = {
599
600/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
601/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
602/* 0x02 */ { "SMBopen",reply_open,AS_USER },
603/* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
604/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
605/* 0x05 */ { "SMBflush",reply_flush,AS_USER},
606/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE }, 
607/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
608/* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
609/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
610/* 0x0a */ { "SMBread",reply_read,AS_USER},
611/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
612/* 0x0c */ { "SMBlock",reply_lock,AS_USER},
613/* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
614/* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
615/* 0x0f */ { "SMBmknew",reply_mknew,AS_USER}, 
616/* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
617/* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
618/* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
619/* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
620/* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
621/* 0x15 */ { NULL, NULL, 0 },
622/* 0x16 */ { NULL, NULL, 0 },
623/* 0x17 */ { NULL, NULL, 0 },
624/* 0x18 */ { NULL, NULL, 0 },
625/* 0x19 */ { NULL, NULL, 0 },
626/* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
627/* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
628/* 0x1c */ { "SMBreadBs",NULL,0 },
629/* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
630/* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
631/* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
632/* 0x20 */ { "SMBwritec",NULL,0},
633/* 0x21 */ { NULL, NULL, 0 },
634/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
635/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
636/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
637/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
638/* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
639/* 0x27 */ { "SMBioctl",reply_ioctl,0},
640/* 0x28 */ { "SMBioctls",NULL,AS_USER},
641/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
642/* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
643/* 0x2b */ { "SMBecho",reply_echo,0},
644/* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
645/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
646/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
647/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
648/* 0x30 */ { NULL, NULL, 0 },
649/* 0x31 */ { NULL, NULL, 0 },
650/* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
651/* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
652/* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
653/* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
654/* 0x36 */ { NULL, NULL, 0 },
655/* 0x37 */ { NULL, NULL, 0 },
656/* 0x38 */ { NULL, NULL, 0 },
657/* 0x39 */ { NULL, NULL, 0 },
658/* 0x3a */ { NULL, NULL, 0 },
659/* 0x3b */ { NULL, NULL, 0 },
660/* 0x3c */ { NULL, NULL, 0 },
661/* 0x3d */ { NULL, NULL, 0 },
662/* 0x3e */ { NULL, NULL, 0 },
663/* 0x3f */ { NULL, NULL, 0 },
664/* 0x40 */ { NULL, NULL, 0 },
665/* 0x41 */ { NULL, NULL, 0 },
666/* 0x42 */ { NULL, NULL, 0 },
667/* 0x43 */ { NULL, NULL, 0 },
668/* 0x44 */ { NULL, NULL, 0 },
669/* 0x45 */ { NULL, NULL, 0 },
670/* 0x46 */ { NULL, NULL, 0 },
671/* 0x47 */ { NULL, NULL, 0 },
672/* 0x48 */ { NULL, NULL, 0 },
673/* 0x49 */ { NULL, NULL, 0 },
674/* 0x4a */ { NULL, NULL, 0 },
675/* 0x4b */ { NULL, NULL, 0 },
676/* 0x4c */ { NULL, NULL, 0 },
677/* 0x4d */ { NULL, NULL, 0 },
678/* 0x4e */ { NULL, NULL, 0 },
679/* 0x4f */ { NULL, NULL, 0 },
680/* 0x50 */ { NULL, NULL, 0 },
681/* 0x51 */ { NULL, NULL, 0 },
682/* 0x52 */ { NULL, NULL, 0 },
683/* 0x53 */ { NULL, NULL, 0 },
684/* 0x54 */ { NULL, NULL, 0 },
685/* 0x55 */ { NULL, NULL, 0 },
686/* 0x56 */ { NULL, NULL, 0 },
687/* 0x57 */ { NULL, NULL, 0 },
688/* 0x58 */ { NULL, NULL, 0 },
689/* 0x59 */ { NULL, NULL, 0 },
690/* 0x5a */ { NULL, NULL, 0 },
691/* 0x5b */ { NULL, NULL, 0 },
692/* 0x5c */ { NULL, NULL, 0 },
693/* 0x5d */ { NULL, NULL, 0 },
694/* 0x5e */ { NULL, NULL, 0 },
695/* 0x5f */ { NULL, NULL, 0 },
696/* 0x60 */ { NULL, NULL, 0 },
697/* 0x61 */ { NULL, NULL, 0 },
698/* 0x62 */ { NULL, NULL, 0 },
699/* 0x63 */ { NULL, NULL, 0 },
700/* 0x64 */ { NULL, NULL, 0 },
701/* 0x65 */ { NULL, NULL, 0 },
702/* 0x66 */ { NULL, NULL, 0 },
703/* 0x67 */ { NULL, NULL, 0 },
704/* 0x68 */ { NULL, NULL, 0 },
705/* 0x69 */ { NULL, NULL, 0 },
706/* 0x6a */ { NULL, NULL, 0 },
707/* 0x6b */ { NULL, NULL, 0 },
708/* 0x6c */ { NULL, NULL, 0 },
709/* 0x6d */ { NULL, NULL, 0 },
710/* 0x6e */ { NULL, NULL, 0 },
711/* 0x6f */ { NULL, NULL, 0 },
712/* 0x70 */ { "SMBtcon",reply_tcon,0},
713/* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
714/* 0x72 */ { "SMBnegprot",reply_negprot,0},
715/* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
716/* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
717/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
718/* 0x76 */ { NULL, NULL, 0 },
719/* 0x77 */ { NULL, NULL, 0 },
720/* 0x78 */ { NULL, NULL, 0 },
721/* 0x79 */ { NULL, NULL, 0 },
722/* 0x7a */ { NULL, NULL, 0 },
723/* 0x7b */ { NULL, NULL, 0 },
724/* 0x7c */ { NULL, NULL, 0 },
725/* 0x7d */ { NULL, NULL, 0 },
726/* 0x7e */ { NULL, NULL, 0 },
727/* 0x7f */ { NULL, NULL, 0 },
728/* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
729/* 0x81 */ { "SMBsearch",reply_search,AS_USER},
730/* 0x82 */ { "SMBffirst",reply_search,AS_USER},
731/* 0x83 */ { "SMBfunique",reply_search,AS_USER},
732/* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
733/* 0x85 */ { NULL, NULL, 0 },
734/* 0x86 */ { NULL, NULL, 0 },
735/* 0x87 */ { NULL, NULL, 0 },
736/* 0x88 */ { NULL, NULL, 0 },
737/* 0x89 */ { NULL, NULL, 0 },
738/* 0x8a */ { NULL, NULL, 0 },
739/* 0x8b */ { NULL, NULL, 0 },
740/* 0x8c */ { NULL, NULL, 0 },
741/* 0x8d */ { NULL, NULL, 0 },
742/* 0x8e */ { NULL, NULL, 0 },
743/* 0x8f */ { NULL, NULL, 0 },
744/* 0x90 */ { NULL, NULL, 0 },
745/* 0x91 */ { NULL, NULL, 0 },
746/* 0x92 */ { NULL, NULL, 0 },
747/* 0x93 */ { NULL, NULL, 0 },
748/* 0x94 */ { NULL, NULL, 0 },
749/* 0x95 */ { NULL, NULL, 0 },
750/* 0x96 */ { NULL, NULL, 0 },
751/* 0x97 */ { NULL, NULL, 0 },
752/* 0x98 */ { NULL, NULL, 0 },
753/* 0x99 */ { NULL, NULL, 0 },
754/* 0x9a */ { NULL, NULL, 0 },
755/* 0x9b */ { NULL, NULL, 0 },
756/* 0x9c */ { NULL, NULL, 0 },
757/* 0x9d */ { NULL, NULL, 0 },
758/* 0x9e */ { NULL, NULL, 0 },
759/* 0x9f */ { NULL, NULL, 0 },
760/* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
761/* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
762/* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
763/* 0xa3 */ { NULL, NULL, 0 },
764/* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
765/* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
766/* 0xa6 */ { NULL, NULL, 0 },
767/* 0xa7 */ { NULL, NULL, 0 },
768/* 0xa8 */ { NULL, NULL, 0 },
769/* 0xa9 */ { NULL, NULL, 0 },
770/* 0xaa */ { NULL, NULL, 0 },
771/* 0xab */ { NULL, NULL, 0 },
772/* 0xac */ { NULL, NULL, 0 },
773/* 0xad */ { NULL, NULL, 0 },
774/* 0xae */ { NULL, NULL, 0 },
775/* 0xaf */ { NULL, NULL, 0 },
776/* 0xb0 */ { NULL, NULL, 0 },
777/* 0xb1 */ { NULL, NULL, 0 },
778/* 0xb2 */ { NULL, NULL, 0 },
779/* 0xb3 */ { NULL, NULL, 0 },
780/* 0xb4 */ { NULL, NULL, 0 },
781/* 0xb5 */ { NULL, NULL, 0 },
782/* 0xb6 */ { NULL, NULL, 0 },
783/* 0xb7 */ { NULL, NULL, 0 },
784/* 0xb8 */ { NULL, NULL, 0 },
785/* 0xb9 */ { NULL, NULL, 0 },
786/* 0xba */ { NULL, NULL, 0 },
787/* 0xbb */ { NULL, NULL, 0 },
788/* 0xbc */ { NULL, NULL, 0 },
789/* 0xbd */ { NULL, NULL, 0 },
790/* 0xbe */ { NULL, NULL, 0 },
791/* 0xbf */ { NULL, NULL, 0 },
792/* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
793/* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
794/* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
795/* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
796/* 0xc4 */ { NULL, NULL, 0 },
797/* 0xc5 */ { NULL, NULL, 0 },
798/* 0xc6 */ { NULL, NULL, 0 },
799/* 0xc7 */ { NULL, NULL, 0 },
800/* 0xc8 */ { NULL, NULL, 0 },
801/* 0xc9 */ { NULL, NULL, 0 },
802/* 0xca */ { NULL, NULL, 0 },
803/* 0xcb */ { NULL, NULL, 0 },
804/* 0xcc */ { NULL, NULL, 0 },
805/* 0xcd */ { NULL, NULL, 0 },
806/* 0xce */ { NULL, NULL, 0 },
807/* 0xcf */ { NULL, NULL, 0 },
808/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
809/* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
810/* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
811/* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
812/* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
813/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
814/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
815/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
816/* 0xd8 */ { NULL, NULL, 0 },
817/* 0xd9 */ { NULL, NULL, 0 },
818/* 0xda */ { NULL, NULL, 0 },
819/* 0xdb */ { NULL, NULL, 0 },
820/* 0xdc */ { NULL, NULL, 0 },
821/* 0xdd */ { NULL, NULL, 0 },
822/* 0xde */ { NULL, NULL, 0 },
823/* 0xdf */ { NULL, NULL, 0 },
824/* 0xe0 */ { NULL, NULL, 0 },
825/* 0xe1 */ { NULL, NULL, 0 },
826/* 0xe2 */ { NULL, NULL, 0 },
827/* 0xe3 */ { NULL, NULL, 0 },
828/* 0xe4 */ { NULL, NULL, 0 },
829/* 0xe5 */ { NULL, NULL, 0 },
830/* 0xe6 */ { NULL, NULL, 0 },
831/* 0xe7 */ { NULL, NULL, 0 },
832/* 0xe8 */ { NULL, NULL, 0 },
833/* 0xe9 */ { NULL, NULL, 0 },
834/* 0xea */ { NULL, NULL, 0 },
835/* 0xeb */ { NULL, NULL, 0 },
836/* 0xec */ { NULL, NULL, 0 },
837/* 0xed */ { NULL, NULL, 0 },
838/* 0xee */ { NULL, NULL, 0 },
839/* 0xef */ { NULL, NULL, 0 },
840/* 0xf0 */ { NULL, NULL, 0 },
841/* 0xf1 */ { NULL, NULL, 0 },
842/* 0xf2 */ { NULL, NULL, 0 },
843/* 0xf3 */ { NULL, NULL, 0 },
844/* 0xf4 */ { NULL, NULL, 0 },
845/* 0xf5 */ { NULL, NULL, 0 },
846/* 0xf6 */ { NULL, NULL, 0 },
847/* 0xf7 */ { NULL, NULL, 0 },
848/* 0xf8 */ { NULL, NULL, 0 },
849/* 0xf9 */ { NULL, NULL, 0 },
850/* 0xfa */ { NULL, NULL, 0 },
851/* 0xfb */ { NULL, NULL, 0 },
852/* 0xfc */ { NULL, NULL, 0 },
853/* 0xfd */ { NULL, NULL, 0 },
854/* 0xfe */ { NULL, NULL, 0 },
855/* 0xff */ { NULL, NULL, 0 }
856
857};
858
859/*******************************************************************
860 Dump a packet to a file.
861********************************************************************/
862
863static void smb_dump(const char *name, int type, char *data, ssize_t len)
864{
865        int fd, i;
866        pstring fname;
867        if (DEBUGLEVEL < 50) return;
868
869        if (len < 4) len = smb_len(data)+4;
870        for (i=1;i<100;i++) {
871                slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
872                                type ? "req" : "resp");
873                fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
874                if (fd != -1 || errno != EEXIST) break;
875        }
876        if (fd != -1) {
877                ssize_t ret = write(fd, data, len);
878                if (ret != len)
879                        DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
880                close(fd);
881                DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
882        }
883}
884
885
886/****************************************************************************
887 Do a switch on the message type, and return the response size
888****************************************************************************/
889
890static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
891{
892        static pid_t pid= (pid_t)-1;
893        int outsize = 0;
894
895        type &= 0xff;
896
897        if (pid == (pid_t)-1)
898                pid = sys_getpid();
899
900        errno = 0;
901
902        last_message = type;
903
904        /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
905        if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
906                DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
907                exit_server_cleanly("Non-SMB packet");
908                return(-1);
909        }
910
911        /* yuck! this is an interim measure before we get rid of our
912                current inbuf/outbuf system */
913        global_smbpid = SVAL(inbuf,smb_pid);
914
915        if (smb_messages[type].fn == NULL) {
916                DEBUG(0,("Unknown message type %d!\n",type));
917                smb_dump("Unknown", 1, inbuf, size);
918                outsize = reply_unknown(inbuf,outbuf);
919        } else {
920                int flags = smb_messages[type].flags;
921                static uint16 last_session_tag = UID_FIELD_INVALID;
922                /* In share mode security we must ignore the vuid. */
923                uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
924                connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
925
926                DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
927
928                smb_dump(smb_fn_name(type), 1, inbuf, size);
929
930                /* Ensure this value is replaced in the incoming packet. */
931                SSVAL(inbuf,smb_uid,session_tag);
932
933                /*
934                 * Ensure the correct username is in current_user_info.
935                 * This is a really ugly bugfix for problems with
936                 * multiple session_setup_and_X's being done and
937                 * allowing %U and %G substitutions to work correctly.
938                 * There is a reason this code is done here, don't
939                 * move it unless you know what you're doing... :-).
940                 * JRA.
941                 */
942
943                if (session_tag != last_session_tag) {
944                        user_struct *vuser = NULL;
945
946                        last_session_tag = session_tag;
947                        if(session_tag != UID_FIELD_INVALID) {
948                                vuser = get_valid_user_struct(session_tag);           
949                                if (vuser) {
950                                        set_current_user_info(&vuser->user);
951                                }
952                        }
953                }
954
955                /* Does this call need to be run as the connected user? */
956                if (flags & AS_USER) {
957
958                        /* Does this call need a valid tree connection? */
959                        if (!conn) {
960                                /* Amazingly, the error code depends on the command (from Samba4). */
961                                if (type == SMBntcreateX) {
962                                        return ERROR_NT(NT_STATUS_INVALID_HANDLE);
963                                } else {
964                                        return ERROR_DOS(ERRSRV, ERRinvnid);
965                                }
966                        }
967
968                        if (!change_to_user(conn,session_tag)) {
969                                return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
970                        }
971
972                        /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
973
974                        /* Does it need write permission? */
975                        if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
976                                return ERROR_NT(NT_STATUS_MEDIA_WRITE_PROTECTED);
977                        }
978
979                        /* IPC services are limited */
980                        if (IS_IPC(conn) && !(flags & CAN_IPC)) {
981                                return(ERROR_DOS(ERRSRV,ERRaccess));
982                        }
983                } else {
984                        /* This call needs to be run as root */
985                        change_to_root_user();
986                }
987
988                /* load service specific parameters */
989                if (conn) {
990                        if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
991                                return(ERROR_DOS(ERRSRV,ERRaccess));
992                        }
993                        conn->num_smb_operations++;
994                }
995
996                /* does this protocol need to be run as guest? */
997                if ((flags & AS_GUEST) && (!change_to_guest() || 
998                                !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
999                        return(ERROR_DOS(ERRSRV,ERRaccess));
1000                }
1001
1002                current_inbuf = inbuf; /* In case we need to defer this message in open... */
1003                outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1004        }
1005
1006        smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1007
1008        return(outsize);
1009}
1010
1011/****************************************************************************
1012 Construct a reply to the incoming packet.
1013****************************************************************************/
1014
1015static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1016{
1017        int type = CVAL(inbuf,smb_com);
1018        int outsize = 0;
1019        int msg_type = CVAL(inbuf,0);
1020
1021        chain_size = 0;
1022        file_chain_reset();
1023        reset_chain_p();
1024
1025        if (msg_type != 0)
1026                return(reply_special(inbuf,outbuf)); 
1027
1028        construct_reply_common(inbuf, outbuf);
1029
1030        outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1031
1032        outsize += chain_size;
1033
1034        if(outsize > 4)
1035                smb_setlen(outbuf,outsize - 4);
1036        return(outsize);
1037}
1038
1039/****************************************************************************
1040 Process an smb from the client
1041****************************************************************************/
1042
1043static void process_smb(char *inbuf, char *outbuf)
1044{
1045        static int trans_num;
1046        int msg_type = CVAL(inbuf,0);
1047        int32 len = smb_len(inbuf);
1048        int nread = len + 4;
1049
1050        DO_PROFILE_INC(smb_count);
1051
1052        if (trans_num == 0) {
1053                /* on the first packet, check the global hosts allow/ hosts
1054                deny parameters before doing any parsing of the packet
1055                passed to us by the client.  This prevents attacks on our
1056                parsing code from hosts not in the hosts allow list */
1057                if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1058                                  lp_hostsdeny(-1))) {
1059                        /* send a negative session response "not listening on calling name" */
1060                        static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1061                        DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1062                        (void)send_smb(smbd_server_fd(),(char *)buf);
1063                        exit_server_cleanly("connection denied");
1064                }
1065        }
1066
1067        DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1068        DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1069
1070        if (msg_type == 0)
1071                show_msg(inbuf);
1072        else if(msg_type == SMBkeepalive)
1073                return; /* Keepalive packet. */
1074
1075        nread = construct_reply(inbuf,outbuf,nread,max_send);
1076     
1077        if(nread > 0) {
1078                if (CVAL(outbuf,0) == 0)
1079                        show_msg(outbuf);
1080       
1081                if (nread != smb_len(outbuf) + 4) {
1082                        DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1083                                nread, smb_len(outbuf)));
1084                } else if (!send_smb(smbd_server_fd(),outbuf)) {
1085                        exit_server_cleanly("process_smb: send_smb failed.");
1086                }
1087        }
1088        trans_num++;
1089}
1090
1091/****************************************************************************
1092 Return a string containing the function name of a SMB command.
1093****************************************************************************/
1094
1095const char *smb_fn_name(int type)
1096{
1097        const char *unknown_name = "SMBunknown";
1098
1099        if (smb_messages[type].name == NULL)
1100                return(unknown_name);
1101
1102        return(smb_messages[type].name);
1103}
1104
1105/****************************************************************************
1106 Helper functions for contruct_reply.
1107****************************************************************************/
1108
1109static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1110
1111void add_to_common_flags2(uint32 v)
1112{
1113        common_flags2 |= v;
1114}
1115
1116void remove_from_common_flags2(uint32 v)
1117{
1118        common_flags2 &= ~v;
1119}
1120
1121void construct_reply_common(const char *inbuf, char *outbuf)
1122{
1123        set_message(outbuf,0,0,False);
1124       
1125        SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1126        SIVAL(outbuf,smb_rcls,0);
1127        SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES)); 
1128        SSVAL(outbuf,smb_flg2,
1129                (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1130                common_flags2);
1131        memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1132
1133        SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1134        SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1135        SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1136        SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1137}
1138
1139/****************************************************************************
1140 Construct a chained reply and add it to the already made reply
1141****************************************************************************/
1142
1143int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1144{
1145        static char *orig_inbuf;
1146        static char *orig_outbuf;
1147        int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1148        unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1149        char *inbuf2, *outbuf2;
1150        int outsize2;
1151        int new_size;
1152        char inbuf_saved[smb_wct];
1153        char outbuf_saved[smb_wct];
1154        int outsize = smb_len(outbuf) + 4;
1155
1156        /* Maybe its not chained, or it's an error packet. */
1157        if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1158                SCVAL(outbuf,smb_vwv0,0xFF);
1159                return outsize;
1160        }
1161
1162        if (chain_size == 0) {
1163                /* this is the first part of the chain */
1164                orig_inbuf = inbuf;
1165                orig_outbuf = outbuf;
1166        }
1167
1168        /*
1169         * The original Win95 redirector dies on a reply to
1170         * a lockingX and read chain unless the chain reply is
1171         * 4 byte aligned. JRA.
1172         */
1173
1174        outsize = (outsize + 3) & ~3;
1175
1176        /* we need to tell the client where the next part of the reply will be */
1177        SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1178        SCVAL(outbuf,smb_vwv0,smb_com2);
1179
1180        /* remember how much the caller added to the chain, only counting stuff
1181                after the parameter words */
1182        chain_size += outsize - smb_wct;
1183
1184        /* work out pointers into the original packets. The
1185                headers on these need to be filled in */
1186        inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1187        outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1188
1189        /* remember the original command type */
1190        smb_com1 = CVAL(orig_inbuf,smb_com);
1191
1192        /* save the data which will be overwritten by the new headers */
1193        memcpy(inbuf_saved,inbuf2,smb_wct);
1194        memcpy(outbuf_saved,outbuf2,smb_wct);
1195
1196        /* give the new packet the same header as the last part of the SMB */
1197        memmove(inbuf2,inbuf,smb_wct);
1198
1199        /* create the in buffer */
1200        SCVAL(inbuf2,smb_com,smb_com2);
1201
1202        /* work out the new size for the in buffer. */
1203        new_size = size - (inbuf2 - inbuf);
1204        if (new_size < 0) {
1205                DEBUG(0,("chain_reply: chain packet size incorrect (orig size = %d, "
1206                        "offset = %d)\n",
1207                        size,
1208                        (inbuf2 - inbuf) ));
1209                exit_server_cleanly("Bad chained packet");
1210                return(-1);
1211        }
1212
1213        /* And set it in the header. */
1214        smb_setlen(inbuf2, new_size);
1215
1216        /* create the out buffer */
1217        construct_reply_common(inbuf2, outbuf2);
1218
1219        DEBUG(3,("Chained message\n"));
1220        show_msg(inbuf2);
1221
1222        /* process the request */
1223        outsize2 = switch_message(smb_com2,inbuf2,outbuf2,new_size,
1224                                bufsize-chain_size);
1225
1226        /* copy the new reply and request headers over the old ones, but
1227                preserve the smb_com field */
1228        memmove(orig_outbuf,outbuf2,smb_wct);
1229        SCVAL(orig_outbuf,smb_com,smb_com1);
1230
1231        /* restore the saved data, being careful not to overwrite any
1232                data from the reply header */
1233        memcpy(inbuf2,inbuf_saved,smb_wct);
1234
1235        {
1236                int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1237                if (ofs < 0) {
1238                        ofs = 0;
1239                }
1240                memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1241        }
1242
1243        return outsize2;
1244}
1245
1246/****************************************************************************
1247 Setup the needed select timeout in milliseconds.
1248****************************************************************************/
1249
1250static int setup_select_timeout(void)
1251{
1252        int select_timeout;
1253
1254        select_timeout = blocking_locks_timeout_ms(SMBD_SELECT_TIMEOUT*1000);
1255
1256        if (print_notify_messages_pending()) {
1257                select_timeout = MIN(select_timeout, 1000);
1258        }
1259
1260        return select_timeout;
1261}
1262
1263/****************************************************************************
1264 Check if services need reloading.
1265****************************************************************************/
1266
1267void check_reload(time_t t)
1268{
1269        static pid_t mypid = 0;
1270        static time_t last_smb_conf_reload_time = 0;
1271        static time_t last_printer_reload_time = 0;
1272        time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1273
1274        if(last_smb_conf_reload_time == 0) {
1275                last_smb_conf_reload_time = t;
1276                /* Our printing subsystem might not be ready at smbd start up.
1277                   Then no printer is available till the first printers check
1278                   is performed.  A lower initial interval circumvents this. */
1279                if ( printcap_cache_time > 60 )
1280                        last_printer_reload_time = t - printcap_cache_time + 60;
1281                else
1282                        last_printer_reload_time = t;
1283        }
1284
1285        if (mypid != getpid()) { /* First time or fork happened meanwhile */
1286                /* randomize over 60 second the printcap reload to avoid all
1287                 * process hitting cupsd at the same time */
1288                int time_range = 60;
1289
1290                last_printer_reload_time += random() % time_range;
1291                mypid = getpid();
1292        }
1293
1294        if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1295                reload_services(True);
1296                reload_after_sighup = False;
1297                last_smb_conf_reload_time = t;
1298        }
1299
1300        /* 'printcap cache time = 0' disable the feature */
1301       
1302        if ( printcap_cache_time != 0 )
1303        { 
1304                /* see if it's time to reload or if the clock has been set back */
1305               
1306                if ( (t >= last_printer_reload_time+printcap_cache_time) 
1307                        || (t-last_printer_reload_time  < 0) ) 
1308                {
1309                        DEBUG( 3,( "Printcap cache time expired.\n"));
1310                        reload_printers();
1311                        last_printer_reload_time = t;
1312                }
1313        }
1314}
1315
1316/****************************************************************************
1317 Process any timeout housekeeping. Return False if the caller should exit.
1318****************************************************************************/
1319
1320static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1321{
1322        static time_t last_keepalive_sent_time = 0;
1323        static time_t last_idle_closed_check = 0;
1324        time_t t;
1325        BOOL allidle = True;
1326
1327        if (smb_read_error == READ_EOF) {
1328                DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1329                return False;
1330        }
1331
1332        if (smb_read_error == READ_ERROR) {
1333                DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1334                        strerror(errno)));
1335                return False;
1336        }
1337
1338        if (smb_read_error == READ_BAD_SIG) {
1339                DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1340                return False;
1341        }
1342
1343        *last_timeout_processing_time = t = time(NULL);
1344
1345        if(last_keepalive_sent_time == 0)
1346                last_keepalive_sent_time = t;
1347
1348        if(last_idle_closed_check == 0)
1349                last_idle_closed_check = t;
1350
1351        /* become root again if waiting */
1352        change_to_root_user();
1353
1354        /* run all registered idle events */
1355        smb_run_idle_events(t);
1356
1357        /* check if we need to reload services */
1358        check_reload(t);
1359
1360        /* automatic timeout if all connections are closed */     
1361        if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1362                DEBUG( 2, ( "Closing idle connection\n" ) );
1363                return False;
1364        } else {
1365                last_idle_closed_check = t;
1366        }
1367
1368        if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1369                if (!send_keepalive(smbd_server_fd())) {
1370                        DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1371                        return False;
1372                }
1373
1374                /* send a keepalive for a password server or the like.
1375                        This is attached to the auth_info created in the
1376                negprot */
1377                if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1378                                && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1379
1380                        negprot_global_auth_context->challenge_set_method->send_keepalive
1381                        (&negprot_global_auth_context->challenge_set_method->private_data);
1382                }
1383
1384                last_keepalive_sent_time = t;
1385        }
1386
1387        /* check for connection timeouts */
1388        allidle = conn_idle_all(t, deadtime);
1389
1390        if (allidle && conn_num_open()>0) {
1391                DEBUG(2,("Closing idle connection 2.\n"));
1392                return False;
1393        }
1394
1395        if(global_machine_password_needs_changing && 
1396                        /* for ADS we need to do a regular ADS password change, not a domain
1397                                        password change */
1398                        lp_security() == SEC_DOMAIN) {
1399
1400                unsigned char trust_passwd_hash[16];
1401                time_t lct;
1402
1403                /*
1404                 * We're in domain level security, and the code that
1405                 * read the machine password flagged that the machine
1406                 * password needs changing.
1407                 */
1408
1409                /*
1410                 * First, open the machine password file with an exclusive lock.
1411                 */
1412
1413                if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1414                        DEBUG(0,("process: unable to lock the machine account password for \
1415machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1416                        return True;
1417                }
1418
1419                if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1420                        DEBUG(0,("process: unable to read the machine account password for \
1421machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1422                        secrets_lock_trust_account_password(lp_workgroup(), False);
1423                        return True;
1424                }
1425
1426                /*
1427                 * Make sure someone else hasn't already done this.
1428                 */
1429
1430                if(t < lct + lp_machine_password_timeout()) {
1431                        global_machine_password_needs_changing = False;
1432                        secrets_lock_trust_account_password(lp_workgroup(), False);
1433                        return True;
1434                }
1435
1436                /* always just contact the PDC here */
1437   
1438                change_trust_account_password( lp_workgroup(), NULL);
1439                global_machine_password_needs_changing = False;
1440                secrets_lock_trust_account_password(lp_workgroup(), False);
1441        }
1442
1443        /*
1444         * Check to see if we have any blocking locks
1445         * outstanding on the queue.
1446         */
1447        process_blocking_lock_queue();
1448
1449        /* update printer queue caches if necessary */
1450 
1451        update_monitored_printq_cache();
1452 
1453        /*
1454         * Now we are root, check if the log files need pruning.
1455         * Force a log file check.
1456         */
1457        force_check_log_size();
1458        check_log_size();
1459
1460        /* Send any queued printer notify message to interested smbd's. */
1461
1462        print_notify_send_messages(0);
1463
1464        /*
1465         * Modify the select timeout depending upon
1466         * what we have remaining in our queues.
1467         */
1468
1469        *select_timeout = setup_select_timeout();
1470
1471        return True;
1472}
1473
1474/****************************************************************************
1475 Accessor functions for InBuffer, OutBuffer.
1476****************************************************************************/
1477
1478char *get_InBuffer(void)
1479{
1480        return InBuffer;
1481}
1482
1483char *get_OutBuffer(void)
1484{
1485        return OutBuffer;
1486}
1487
1488const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1489
1490/****************************************************************************
1491 Allocate a new InBuffer. Returns the new and old ones.
1492****************************************************************************/
1493
1494static char *NewInBuffer(char **old_inbuf)
1495{
1496        char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1497        if (!new_inbuf) {
1498                return NULL;
1499        }
1500        if (old_inbuf) {
1501                *old_inbuf = InBuffer;
1502        }
1503        InBuffer = new_inbuf;
1504#if defined(DEVELOPER)
1505        clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1506#endif
1507        return InBuffer;
1508}
1509
1510/****************************************************************************
1511 Allocate a new OutBuffer. Returns the new and old ones.
1512****************************************************************************/
1513
1514static char *NewOutBuffer(char **old_outbuf)
1515{
1516        char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1517        if (!new_outbuf) {
1518                return NULL;
1519        }
1520        if (old_outbuf) {
1521                *old_outbuf = OutBuffer;
1522        }
1523        OutBuffer = new_outbuf;
1524#if defined(DEVELOPER)
1525        clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1526#endif
1527        return OutBuffer;
1528}
1529
1530/****************************************************************************
1531 Process commands from the client
1532****************************************************************************/
1533
1534void smbd_process(void)
1535{
1536        time_t last_timeout_processing_time = time(NULL);
1537        unsigned int num_smbs = 0;
1538
1539        /* Allocate the primary Inbut/Output buffers. */
1540
1541        if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL)) 
1542                return;
1543
1544        max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1545
1546        while (True) {
1547                int deadtime = lp_deadtime()*60;
1548                int select_timeout = setup_select_timeout();
1549                int num_echos;
1550
1551                if (deadtime <= 0)
1552                        deadtime = DEFAULT_SMBD_TIMEOUT;
1553
1554                errno = 0;     
1555               
1556                /* free up temporary memory */
1557                lp_TALLOC_FREE();
1558                main_loop_TALLOC_FREE();
1559
1560                /* Did someone ask for immediate checks on things like blocking locks ? */
1561                if (select_timeout == 0) {
1562                        if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1563                                return;
1564                        num_smbs = 0; /* Reset smb counter. */
1565                }
1566
1567                run_events(smbd_event_context(), 0, NULL, NULL);
1568
1569#if defined(DEVELOPER)
1570                clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1571#endif
1572
1573                while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1574                        if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1575                                return;
1576                        num_smbs = 0; /* Reset smb counter. */
1577                }
1578
1579                /*
1580                 * Ensure we do timeout processing if the SMB we just got was
1581                 * only an echo request. This allows us to set the select
1582                 * timeout in 'receive_message_or_smb()' to any value we like
1583                 * without worrying that the client will send echo requests
1584                 * faster than the select timeout, thus starving out the
1585                 * essential processing (change notify, blocking locks) that
1586                 * the timeout code does. JRA.
1587                 */ 
1588                num_echos = smb_echo_count;
1589
1590                clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1591
1592                process_smb(InBuffer, OutBuffer);
1593
1594                if (smb_echo_count != num_echos) {
1595                        if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1596                                return;
1597                        num_smbs = 0; /* Reset smb counter. */
1598                }
1599
1600                num_smbs++;
1601
1602                /*
1603                 * If we are getting smb requests in a constant stream
1604                 * with no echos, make sure we attempt timeout processing
1605                 * every select_timeout milliseconds - but only check for this
1606                 * every 200 smb requests.
1607                 */
1608               
1609                if ((num_smbs % 200) == 0) {
1610                        time_t new_check_time = time(NULL);
1611                        if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1612                                if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1613                                        return;
1614                                num_smbs = 0; /* Reset smb counter. */
1615                                last_timeout_processing_time = new_check_time; /* Reset time. */
1616                        }
1617                }
1618
1619                /* The timeout_processing function isn't run nearly
1620                   often enough to implement 'max log size' without
1621                   overrunning the size of the file by many megabytes.
1622                   This is especially true if we are running at debug
1623                   level 10.  Checking every 50 SMBs is a nice
1624                   tradeoff of performance vs log file size overrun. */
1625
1626                if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1627                        change_to_root_user();
1628                        check_log_size();
1629                }
1630        }
1631}
Note: See TracBrowser for help on using the repository browser.