source: branches/samba-3.3.x/source/smbd/process.c@ 338

Last change on this file since 338 was 338, checked in by Herwig Bauernfeind, 16 years ago

Update 3.3. to 3.3.8 (security update)
File size: 56.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22
23extern int smb_echo_count;
24
25/*
26 * Size of data we can send to client. Set
27 * by the client for all protocols above CORE.
28 * Set by us for CORE protocol.
29 */
30int max_send = BUFFER_SIZE;
31/*
32 * Size of the data we can receive. Set by us.
33 * Can be modified by the max xmit parameter.
34 */
35int max_recv = BUFFER_SIZE;
36
37SIG_ATOMIC_T reload_after_sighup = 0;
38SIG_ATOMIC_T got_sig_term = 0;
39extern bool global_machine_password_needs_changing;
40extern int max_send;
41
42/* Accessor function for smb_read_error for smbd functions. */
43
44/****************************************************************************
45 Send an smb to a fd.
46****************************************************************************/
47
48bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
49{
50 size_t len;
51 size_t nwritten=0;
52 ssize_t ret;
53 char *buf_out = buffer;
54
55 /* Sign the outgoing packet if required. */
56 srv_calculate_sign_mac(buf_out);
57
58 if (do_encrypt) {
59 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
60 if (!NT_STATUS_IS_OK(status)) {
61 DEBUG(0, ("send_smb: SMB encryption failed "
62 "on outgoing packet! Error %s\n",
63 nt_errstr(status) ));
64 return false;
65 }
66 }
67
68 len = smb_len(buf_out) + 4;
69
70 while (nwritten < len) {
71 ret = write_data(fd,buf_out+nwritten,len - nwritten);
72 if (ret <= 0) {
73 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
74 (int)len,(int)ret, strerror(errno) ));
75 srv_free_enc_buffer(buf_out);
76 return false;
77 }
78 nwritten += ret;
79 }
80
81 srv_free_enc_buffer(buf_out);
82 return true;
83}
84
85/*******************************************************************
86 Setup the word count and byte count for a smb message.
87********************************************************************/
88
89int srv_set_message(char *buf,
90 int num_words,
91 int num_bytes,
92 bool zero)
93{
94 if (zero && (num_words || num_bytes)) {
95 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
96 }
97 SCVAL(buf,smb_wct,num_words);
98 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
99 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
100 return (smb_size + num_words*2 + num_bytes);
101}
102
103static bool valid_smb_header(const uint8_t *inbuf)
104{
105 if (is_encrypted_packet(inbuf)) {
106 return true;
107 }
108 /*
109 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
110 * but it just looks weird to call strncmp for this one.
111 */
112 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
113}
114
115/* Socket functions for smbd packet processing. */
116
117static bool valid_packet_size(size_t len)
118{
119 /*
120 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
121 * of header. Don't print the error if this fits.... JRA.
122 */
123
124 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
125 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
126 (unsigned long)len));
127 return false;
128 }
129 return true;
130}
131
132static NTSTATUS read_packet_remainder(int fd, char *buffer,
133 unsigned int timeout, ssize_t len)
134{
135 if (len <= 0) {
136 return NT_STATUS_OK;
137 }
138
139 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
140}
141
142/****************************************************************************
143 Attempt a zerocopy writeX read. We know here that len > smb_size-4
144****************************************************************************/
145
146/*
147 * Unfortunately, earlier versions of smbclient/libsmbclient
148 * don't send this "standard" writeX header. I've fixed this
149 * for 3.2 but we'll use the old method with earlier versions.
150 * Windows and CIFSFS at least use this standard size. Not
151 * sure about MacOSX.
152 */
153
154#define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
155 (2*14) + /* word count (including bcc) */ \
156 1 /* pad byte */)
157
158static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
159 const char *lenbuf,
160 int fd, char **buffer,
161 unsigned int timeout,
162 size_t *p_unread,
163 size_t *len_ret)
164{
165 /* Size of a WRITEX call (+4 byte len). */
166 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
167 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
168 ssize_t toread;
169 NTSTATUS status;
170
171 memcpy(writeX_header, lenbuf, 4);
172
173 status = read_socket_with_timeout(
174 fd, writeX_header + 4,
175 STANDARD_WRITE_AND_X_HEADER_SIZE,
176 STANDARD_WRITE_AND_X_HEADER_SIZE,
177 timeout, NULL);
178
179 if (!NT_STATUS_IS_OK(status)) {
180 return status;
181 }
182
183 /*
184 * Ok - now try and see if this is a possible
185 * valid writeX call.
186 */
187
188 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
189 /*
190 * If the data offset is beyond what
191 * we've read, drain the extra bytes.
192 */
193 uint16_t doff = SVAL(writeX_header,smb_vwv11);
194 ssize_t newlen;
195
196 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
197 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
198 if (drain_socket(smbd_server_fd(), drain) != drain) {
199 smb_panic("receive_smb_raw_talloc_partial_read:"
200 " failed to drain pending bytes");
201 }
202 } else {
203 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
204 }
205
206 /* Spoof down the length and null out the bcc. */
207 set_message_bcc(writeX_header, 0);
208 newlen = smb_len(writeX_header);
209
210 /* Copy the header we've written. */
211
212 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
213 writeX_header,
214 sizeof(writeX_header));
215
216 if (*buffer == NULL) {
217 DEBUG(0, ("Could not allocate inbuf of length %d\n",
218 (int)sizeof(writeX_header)));
219 return NT_STATUS_NO_MEMORY;
220 }
221
222 /* Work out the remaining bytes. */
223 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
224 *len_ret = newlen + 4;
225 return NT_STATUS_OK;
226 }
227
228 if (!valid_packet_size(len)) {
229 return NT_STATUS_INVALID_PARAMETER;
230 }
231
232 /*
233 * Not a valid writeX call. Just do the standard
234 * talloc and return.
235 */
236
237 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
238
239 if (*buffer == NULL) {
240 DEBUG(0, ("Could not allocate inbuf of length %d\n",
241 (int)len+4));
242 return NT_STATUS_NO_MEMORY;
243 }
244
245 /* Copy in what we already read. */
246 memcpy(*buffer,
247 writeX_header,
248 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
249 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
250
251 if(toread > 0) {
252 status = read_packet_remainder(
253 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
254 timeout, toread);
255
256 if (!NT_STATUS_IS_OK(status)) {
257 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
258 nt_errstr(status)));
259 return status;
260 }
261 }
262
263 *len_ret = len + 4;
264 return NT_STATUS_OK;
265}
266
267static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
268 char **buffer, unsigned int timeout,
269 size_t *p_unread, size_t *plen)
270{
271 char lenbuf[4];
272 size_t len;
273 int min_recv_size = lp_min_receive_file_size();
274 NTSTATUS status;
275
276 *p_unread = 0;
277
278 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
279 if (!NT_STATUS_IS_OK(status)) {
280 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
281 return status;
282 }
283
284 if (CVAL(lenbuf,0) == 0 &&
285 min_recv_size &&
286 smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
287 !srv_is_signing_active()) {
288
289 return receive_smb_raw_talloc_partial_read(
290 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
291 }
292
293 if (!valid_packet_size(len)) {
294 return NT_STATUS_INVALID_PARAMETER;
295 }
296
297 /*
298 * The +4 here can't wrap, we've checked the length above already.
299 */
300
301 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
302
303 if (*buffer == NULL) {
304 DEBUG(0, ("Could not allocate inbuf of length %d\n",
305 (int)len+4));
306 return NT_STATUS_NO_MEMORY;
307 }
308
309 memcpy(*buffer, lenbuf, sizeof(lenbuf));
310
311 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
312 if (!NT_STATUS_IS_OK(status)) {
313 return status;
314 }
315
316 *plen = len + 4;
317 return NT_STATUS_OK;
318}
319
320static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
321 char **buffer, unsigned int timeout,
322 size_t *p_unread, bool *p_encrypted,
323 size_t *p_len)
324{
325 size_t len = 0;
326 NTSTATUS status;
327
328 *p_encrypted = false;
329
330 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
331 p_unread, &len);
332 if (!NT_STATUS_IS_OK(status)) {
333 return status;
334 }
335
336 if (is_encrypted_packet((uint8_t *)*buffer)) {
337 status = srv_decrypt_buffer(*buffer);
338 if (!NT_STATUS_IS_OK(status)) {
339 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
340 "incoming packet! Error %s\n",
341 nt_errstr(status) ));
342 return status;
343 }
344 *p_encrypted = true;
345 }
346
347 /* Check the incoming SMB signature. */
348 if (!srv_check_sign_mac(*buffer, true)) {
349 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
350 "incoming packet!\n"));
351 return NT_STATUS_INVALID_NETWORK_RESPONSE;
352 }
353
354 *p_len = len;
355 return NT_STATUS_OK;
356}
357
358/*
359 * Initialize a struct smb_request from an inbuf
360 */
361
362void init_smb_request(struct smb_request *req,
363 const uint8 *inbuf,
364 size_t unread_bytes,
365 bool encrypted)
366{
367 size_t req_size = smb_len(inbuf) + 4;
368 /* Ensure we have at least smb_size bytes. */
369 if (req_size < smb_size) {
370 DEBUG(0,("init_smb_request: invalid request size %u\n",
371 (unsigned int)req_size ));
372 exit_server_cleanly("Invalid SMB request");
373 }
374 req->flags2 = SVAL(inbuf, smb_flg2);
375 req->smbpid = SVAL(inbuf, smb_pid);
376 req->mid = SVAL(inbuf, smb_mid);
377 req->vuid = SVAL(inbuf, smb_uid);
378 req->tid = SVAL(inbuf, smb_tid);
379 req->wct = CVAL(inbuf, smb_wct);
380 req->unread_bytes = unread_bytes;
381 req->encrypted = encrypted;
382 req->conn = conn_find(req->tid);
383
384 /* Ensure we have at least wct words and 2 bytes of bcc. */
385 if (smb_size + req->wct*2 > req_size) {
386 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
387 (unsigned int)req->wct,
388 (unsigned int)req_size));
389 exit_server_cleanly("Invalid SMB request");
390 }
391 /* Ensure bcc is correct. */
392 if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
393 DEBUG(0,("init_smb_request: invalid bcc number %u "
394 "(wct = %u, size %u)\n",
395 (unsigned int)smb_buflen(inbuf),
396 (unsigned int)req->wct,
397 (unsigned int)req_size));
398 exit_server_cleanly("Invalid SMB request");
399 }
400 req->inbuf = inbuf;
401 req->outbuf = NULL;
402}
403
404/****************************************************************************
405 structure to hold a linked list of queued messages.
406 for processing.
407****************************************************************************/
408
409static struct pending_message_list *deferred_open_queue;
410
411/****************************************************************************
412 Function to push a message onto the tail of a linked list of smb messages ready
413 for processing.
414****************************************************************************/
415
416static bool push_queued_message(struct smb_request *req,
417 struct timeval request_time,
418 struct timeval end_time,
419 char *private_data, size_t private_len)
420{
421 int msg_len = smb_len(req->inbuf) + 4;
422 struct pending_message_list *msg;
423
424 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
425
426 if(msg == NULL) {
427 DEBUG(0,("push_message: malloc fail (1)\n"));
428 return False;
429 }
430
431 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
432 if(msg->buf.data == NULL) {
433 DEBUG(0,("push_message: malloc fail (2)\n"));
434 TALLOC_FREE(msg);
435 return False;
436 }
437
438 msg->request_time = request_time;
439 msg->end_time = end_time;
440 msg->encrypted = req->encrypted;
441 msg->processed = false;
442
443 if (private_data) {
444 msg->private_data = data_blob_talloc(msg, private_data,
445 private_len);
446 if (msg->private_data.data == NULL) {
447 DEBUG(0,("push_message: malloc fail (3)\n"));
448 TALLOC_FREE(msg);
449 return False;
450 }
451 }
452
453 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
454
455 DEBUG(10,("push_message: pushed message length %u on "
456 "deferred_open_queue\n", (unsigned int)msg_len));
457
458 return True;
459}
460
461/****************************************************************************
462 Function to delete a sharing violation open message by mid.
463****************************************************************************/
464
465void remove_deferred_open_smb_message(uint16 mid)
466{
467 struct pending_message_list *pml;
468
469 for (pml = deferred_open_queue; pml; pml = pml->next) {
470 if (mid == SVAL(pml->buf.data,smb_mid)) {
471 DEBUG(10,("remove_sharing_violation_open_smb_message: "
472 "deleting mid %u len %u\n",
473 (unsigned int)mid,
474 (unsigned int)pml->buf.length ));
475 DLIST_REMOVE(deferred_open_queue, pml);
476 TALLOC_FREE(pml);
477 return;
478 }
479 }
480}
481
482/****************************************************************************
483 Move a sharing violation open retry message to the front of the list and
484 schedule it for immediate processing.
485****************************************************************************/
486
487void schedule_deferred_open_smb_message(uint16 mid)
488{
489 struct pending_message_list *pml;
490 int i = 0;
491
492 for (pml = deferred_open_queue; pml; pml = pml->next) {
493 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
494 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
495 (unsigned int)msg_mid ));
496 if (mid == msg_mid) {
497
498 if (pml->processed) {
499 /* A processed message should not be
500 * rescheduled. */
501 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
502 "message mid %u was already processed\n",
503 (unsigned int)msg_mid ));
504 continue;
505 }
506
507 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
508 mid ));
509 pml->end_time.tv_sec = 0;
510 pml->end_time.tv_usec = 0;
511 DLIST_PROMOTE(deferred_open_queue, pml);
512 return;
513 }
514 }
515
516 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
517 mid ));
518}
519
520/****************************************************************************
521 Return true if this mid is on the deferred queue and was not yet processed.
522****************************************************************************/
523
524bool open_was_deferred(uint16 mid)
525{
526 struct pending_message_list *pml;
527
528 for (pml = deferred_open_queue; pml; pml = pml->next) {
529 if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) {
530 return True;
531 }
532 }
533 return False;
534}
535
536/****************************************************************************
537 Return the message queued by this mid.
538****************************************************************************/
539
540struct pending_message_list *get_open_deferred_message(uint16 mid)
541{
542 struct pending_message_list *pml;
543
544 for (pml = deferred_open_queue; pml; pml = pml->next) {
545 if (SVAL(pml->buf.data,smb_mid) == mid) {
546 return pml;
547 }
548 }
549 return NULL;
550}
551
552/****************************************************************************
553 Function to push a deferred open smb message onto a linked list of local smb
554 messages ready for processing.
555****************************************************************************/
556
557bool push_deferred_smb_message(struct smb_request *req,
558 struct timeval request_time,
559 struct timeval timeout,
560 char *private_data, size_t priv_len)
561{
562 struct timeval end_time;
563
564 if (req->unread_bytes) {
565 DEBUG(0,("push_deferred_smb_message: logic error ! "
566 "unread_bytes = %u\n",
567 (unsigned int)req->unread_bytes ));
568 smb_panic("push_deferred_smb_message: "
569 "logic error unread_bytes != 0" );
570 }
571
572 end_time = timeval_sum(&request_time, &timeout);
573
574 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
575 "timeout time [%u.%06u]\n",
576 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
577 (unsigned int)end_time.tv_sec,
578 (unsigned int)end_time.tv_usec));
579
580 return push_queued_message(req, request_time, end_time,
581 private_data, priv_len);
582}
583
584struct idle_event {
585 struct timed_event *te;
586 struct timeval interval;
587 char *name;
588 bool (*handler)(const struct timeval *now, void *private_data);
589 void *private_data;
590};
591
592static void smbd_idle_event_handler(struct event_context *ctx,
593 struct timed_event *te,
594 struct timeval now,
595 void *private_data)
596{
597 struct idle_event *event =
598 talloc_get_type_abort(private_data, struct idle_event);
599
600 TALLOC_FREE(event->te);
601
602 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
603 event->name, event->te));
604
605 if (!event->handler(&now, event->private_data)) {
606 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
607 event->name, event->te));
608 /* Don't repeat, delete ourselves */
609 TALLOC_FREE(event);
610 return;
611 }
612
613 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
614 event->name, event->te));
615
616 event->te = event_add_timed(ctx, event,
617 timeval_sum(&now, &event->interval),
618 smbd_idle_event_handler, event);
619
620 /* We can't do much but fail here. */
621 SMB_ASSERT(event->te != NULL);
622}
623
624struct idle_event *event_add_idle(struct event_context *event_ctx,
625 TALLOC_CTX *mem_ctx,
626 struct timeval interval,
627 const char *name,
628 bool (*handler)(const struct timeval *now,
629 void *private_data),
630 void *private_data)
631{
632 struct idle_event *result;
633 struct timeval now = timeval_current();
634
635 result = TALLOC_P(mem_ctx, struct idle_event);
636 if (result == NULL) {
637 DEBUG(0, ("talloc failed\n"));
638 return NULL;
639 }
640
641 result->interval = interval;
642 result->handler = handler;
643 result->private_data = private_data;
644
645 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
646 DEBUG(0, ("talloc failed\n"));
647 TALLOC_FREE(result);
648 return NULL;
649 }
650
651 result->te = event_add_timed(event_ctx, result,
652 timeval_sum(&now, &interval),
653 smbd_idle_event_handler, result);
654 if (result->te == NULL) {
655 DEBUG(0, ("event_add_timed failed\n"));
656 TALLOC_FREE(result);
657 return NULL;
658 }
659
660 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
661 return result;
662}
663
664/****************************************************************************
665 Do all async processing in here. This includes kernel oplock messages, change
666 notify events etc.
667****************************************************************************/
668
669static void async_processing(fd_set *pfds)
670{
671 DEBUG(10,("async_processing: Doing async processing.\n"));
672
673 process_aio_queue();
674
675 process_kernel_oplocks(smbd_messaging_context(), pfds);
676
677 /* Do the aio check again after receive_local_message as it does a
678 select and may have eaten our signal. */
679 /* Is this till true? -- vl */
680 process_aio_queue();
681
682 if (got_sig_term) {
683 exit_server_cleanly("termination signal");
684 }
685
686 /* check for sighup processing */
687 if (reload_after_sighup) {
688 change_to_root_user();
689 DEBUG(1,("Reloading services after SIGHUP\n"));
690 reload_services(False);
691 reload_after_sighup = 0;
692 }
693}
694
695/****************************************************************************
696 Add a fd to the set we will be select(2)ing on.
697****************************************************************************/
698
699static int select_on_fd(int fd, int maxfd, fd_set *fds)
700{
701 if (fd != -1) {
702 FD_SET(fd, fds);
703 maxfd = MAX(maxfd, fd);
704 }
705
706 return maxfd;
707}
708
709/****************************************************************************
710 Do a select on an two fd's - with timeout.
711
712 If a local udp message has been pushed onto the
713 queue (this can only happen during oplock break
714 processing) call async_processing()
715
716 If a pending smb message has been pushed onto the
717 queue (this can only happen during oplock break
718 processing) return this next.
719
720 If the first smbfd is ready then read an smb from it.
721 if the second (loopback UDP) fd is ready then read a message
722 from it and setup the buffer header to identify the length
723 and from address.
724 Returns False on timeout or error.
725 Else returns True.
726
727The timeout is in milliseconds
728****************************************************************************/
729
730static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
731 size_t *buffer_len,
732 size_t *p_unread, bool *p_encrypted)
733{
734 fd_set r_fds, w_fds;
735 int selrtn;
736 struct timeval to;
737 int maxfd = 0;
738 size_t len = 0;
739 NTSTATUS status;
740
741 *p_unread = 0;
742
743 again:
744
745 to.tv_sec = SMBD_SELECT_TIMEOUT;
746 to.tv_usec = 0;
747
748 /*
749 * Note that this call must be before processing any SMB
750 * messages as we need to synchronously process any messages
751 * we may have sent to ourselves from the previous SMB.
752 */
753 message_dispatch(smbd_messaging_context());
754
755 /*
756 * Check to see if we already have a message on the deferred open queue
757 * and it's time to schedule.
758 */
759 if(deferred_open_queue != NULL) {
760 bool pop_message = False;
761 struct pending_message_list *msg = deferred_open_queue;
762
763 if (timeval_is_zero(&msg->end_time)) {
764 pop_message = True;
765 } else {
766 struct timeval tv;
767 SMB_BIG_INT tdif;
768
769 GetTimeOfDay(&tv);
770 tdif = usec_time_diff(&msg->end_time, &tv);
771 if (tdif <= 0) {
772 /* Timed out. Schedule...*/
773 pop_message = True;
774 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
775 } else {
776 /* Make a more accurate select timeout. */
777 to.tv_sec = tdif / 1000000;
778 to.tv_usec = tdif % 1000000;
779 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
780 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
781 }
782 }
783
784 if (pop_message) {
785
786 *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
787 msg->buf.length);
788 if (*buffer == NULL) {
789 DEBUG(0, ("talloc failed\n"));
790 return NT_STATUS_NO_MEMORY;
791 }
792 *buffer_len = msg->buf.length;
793 *p_encrypted = msg->encrypted;
794
795 /* We leave this message on the queue so the open code can
796 know this is a retry. */
797 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
798
799 /* Mark the message as processed so this is not
800 * re-processed in error. */
801 msg->processed = true;
802 return NT_STATUS_OK;
803 }
804 }
805
806 /*
807 * Setup the select fd sets.
808 */
809
810 FD_ZERO(&r_fds);
811 FD_ZERO(&w_fds);
812
813 /*
814 * Ensure we process oplock break messages by preference.
815 * We have to do this before the select, after the select
816 * and if the select returns EINTR. This is due to the fact
817 * that the selects called from async_processing can eat an EINTR
818 * caused by a signal (we can't take the break message there).
819 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
820 */
821
822 if (oplock_message_waiting(&r_fds)) {
823 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
824 async_processing(&r_fds);
825 /*
826 * After async processing we must go and do the select again, as
827 * the state of the flag in fds for the server file descriptor is
828 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
829 */
830 goto again;
831 }
832
833 /*
834 * Are there any timed events waiting ? If so, ensure we don't
835 * select for longer than it would take to wait for them.
836 */
837
838 {
839 struct timeval now;
840 GetTimeOfDay(&now);
841
842 event_add_to_select_args(smbd_event_context(), &now,
843 &r_fds, &w_fds, &to, &maxfd);
844 }
845
846 if (timeval_is_zero(&to)) {
847 /* Process a timed event now... */
848 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
849 goto again;
850 }
851 }
852
853 {
854 int sav;
855 START_PROFILE(smbd_idle);
856
857 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
858 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
859
860 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
861 sav = errno;
862
863 END_PROFILE(smbd_idle);
864 errno = sav;
865 }
866
867 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
868 goto again;
869 }
870
871 /* if we get EINTR then maybe we have received an oplock
872 signal - treat this as select returning 1. This is ugly, but
873 is the best we can do until the oplock code knows more about
874 signals */
875 if (selrtn == -1 && errno == EINTR) {
876 async_processing(&r_fds);
877 /*
878 * After async processing we must go and do the select again, as
879 * the state of the flag in fds for the server file descriptor is
880 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
881 */
882 goto again;
883 }
884
885 /* Check if error */
886 if (selrtn == -1) {
887 /* something is wrong. Maybe the socket is dead? */
888 return map_nt_error_from_unix(errno);
889 }
890
891 /* Did we timeout ? */
892 if (selrtn == 0) {
893 goto again;
894 }
895
896 /*
897 * Ensure we process oplock break messages by preference.
898 * This is IMPORTANT ! Otherwise we can starve other processes
899 * sending us an oplock break message. JRA.
900 */
901
902 if (oplock_message_waiting(&r_fds)) {
903 async_processing(&r_fds);
904 /*
905 * After async processing we must go and do the select again, as
906 * the state of the flag in fds for the server file descriptor is
907 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
908 */
909 goto again;
910 }
911
912 /*
913 * We've just woken up from a protentially long select sleep.
914 * Ensure we process local messages as we need to synchronously
915 * process any messages from other smbd's to avoid file rename race
916 * conditions. This call is cheap if there are no messages waiting.
917 * JRA.
918 */
919 message_dispatch(smbd_messaging_context());
920
921 status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
922 p_unread, p_encrypted, &len);
923
924 if (!NT_STATUS_IS_OK(status)) {
925 return status;
926 }
927
928 *buffer_len = len;
929
930 return NT_STATUS_OK;
931}
932
933/*
934 * Only allow 5 outstanding trans requests. We're allocating memory, so
935 * prevent a DoS.
936 */
937
938NTSTATUS allow_new_trans(struct trans_state *list, int mid)
939{
940 int count = 0;
941 for (; list != NULL; list = list->next) {
942
943 if (list->mid == mid) {
944 return NT_STATUS_INVALID_PARAMETER;
945 }
946
947 count += 1;
948 }
949 if (count > 5) {
950 return NT_STATUS_INSUFFICIENT_RESOURCES;
951 }
952
953 return NT_STATUS_OK;
954}
955
956/****************************************************************************
957 We're terminating and have closed all our files/connections etc.
958 If there are any pending local messages we need to respond to them
959 before termination so that other smbds don't think we just died whilst
960 holding oplocks.
961****************************************************************************/
962
963void respond_to_all_remaining_local_messages(void)
964{
965 /*
966 * Assert we have no exclusive open oplocks.
967 */
968
969 if(get_number_of_exclusive_open_oplocks()) {
970 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
971 get_number_of_exclusive_open_oplocks() ));
972 return;
973 }
974
975 process_kernel_oplocks(smbd_messaging_context(), NULL);
976
977 return;
978}
979
980
981/*
982These flags determine some of the permissions required to do an operation
983
984Note that I don't set NEED_WRITE on some write operations because they
985are used by some brain-dead clients when printing, and I don't want to
986force write permissions on print services.
987*/
988#define AS_USER (1<<0)
989#define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
990#define TIME_INIT (1<<2)
991#define CAN_IPC (1<<3) /* Must be paired with AS_USER */
992#define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
993#define DO_CHDIR (1<<6)
994
995/*
996 define a list of possible SMB messages and their corresponding
997 functions. Any message that has a NULL function is unimplemented -
998 please feel free to contribute implementations!
999*/
1000static const struct smb_message_struct {
1001 const char *name;
1002 void (*fn)(struct smb_request *req);
1003 int flags;
1004} smb_messages[256] = {
1005
1006/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1007/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1008/* 0x02 */ { "SMBopen",reply_open,AS_USER },
1009/* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1010/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1011/* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1012/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1013/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1014/* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1015/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1016/* 0x0a */ { "SMBread",reply_read,AS_USER},
1017/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1018/* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1019/* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1020/* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1021/* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1022/* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1023/* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1024/* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1025/* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1026/* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1027/* 0x15 */ { NULL, NULL, 0 },
1028/* 0x16 */ { NULL, NULL, 0 },
1029/* 0x17 */ { NULL, NULL, 0 },
1030/* 0x18 */ { NULL, NULL, 0 },
1031/* 0x19 */ { NULL, NULL, 0 },
1032/* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1033/* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1034/* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1035/* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1036/* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1037/* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1038/* 0x20 */ { "SMBwritec", NULL,0},
1039/* 0x21 */ { NULL, NULL, 0 },
1040/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1041/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1042/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1043/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1044/* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1045/* 0x27 */ { "SMBioctl",reply_ioctl,0},
1046/* 0x28 */ { "SMBioctls", NULL,AS_USER},
1047/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1048/* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1049/* 0x2b */ { "SMBecho",reply_echo,0},
1050/* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1051/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1052/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1053/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1054/* 0x30 */ { NULL, NULL, 0 },
1055/* 0x31 */ { NULL, NULL, 0 },
1056/* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1057/* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC},
1058/* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1059/* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1060/* 0x36 */ { NULL, NULL, 0 },
1061/* 0x37 */ { NULL, NULL, 0 },
1062/* 0x38 */ { NULL, NULL, 0 },
1063/* 0x39 */ { NULL, NULL, 0 },
1064/* 0x3a */ { NULL, NULL, 0 },
1065/* 0x3b */ { NULL, NULL, 0 },
1066/* 0x3c */ { NULL, NULL, 0 },
1067/* 0x3d */ { NULL, NULL, 0 },
1068/* 0x3e */ { NULL, NULL, 0 },
1069/* 0x3f */ { NULL, NULL, 0 },
1070/* 0x40 */ { NULL, NULL, 0 },
1071/* 0x41 */ { NULL, NULL, 0 },
1072/* 0x42 */ { NULL, NULL, 0 },
1073/* 0x43 */ { NULL, NULL, 0 },
1074/* 0x44 */ { NULL, NULL, 0 },
1075/* 0x45 */ { NULL, NULL, 0 },
1076/* 0x46 */ { NULL, NULL, 0 },
1077/* 0x47 */ { NULL, NULL, 0 },
1078/* 0x48 */ { NULL, NULL, 0 },
1079/* 0x49 */ { NULL, NULL, 0 },
1080/* 0x4a */ { NULL, NULL, 0 },
1081/* 0x4b */ { NULL, NULL, 0 },
1082/* 0x4c */ { NULL, NULL, 0 },
1083/* 0x4d */ { NULL, NULL, 0 },
1084/* 0x4e */ { NULL, NULL, 0 },
1085/* 0x4f */ { NULL, NULL, 0 },
1086/* 0x50 */ { NULL, NULL, 0 },
1087/* 0x51 */ { NULL, NULL, 0 },
1088/* 0x52 */ { NULL, NULL, 0 },
1089/* 0x53 */ { NULL, NULL, 0 },
1090/* 0x54 */ { NULL, NULL, 0 },
1091/* 0x55 */ { NULL, NULL, 0 },
1092/* 0x56 */ { NULL, NULL, 0 },
1093/* 0x57 */ { NULL, NULL, 0 },
1094/* 0x58 */ { NULL, NULL, 0 },
1095/* 0x59 */ { NULL, NULL, 0 },
1096/* 0x5a */ { NULL, NULL, 0 },
1097/* 0x5b */ { NULL, NULL, 0 },
1098/* 0x5c */ { NULL, NULL, 0 },
1099/* 0x5d */ { NULL, NULL, 0 },
1100/* 0x5e */ { NULL, NULL, 0 },
1101/* 0x5f */ { NULL, NULL, 0 },
1102/* 0x60 */ { NULL, NULL, 0 },
1103/* 0x61 */ { NULL, NULL, 0 },
1104/* 0x62 */ { NULL, NULL, 0 },
1105/* 0x63 */ { NULL, NULL, 0 },
1106/* 0x64 */ { NULL, NULL, 0 },
1107/* 0x65 */ { NULL, NULL, 0 },
1108/* 0x66 */ { NULL, NULL, 0 },
1109/* 0x67 */ { NULL, NULL, 0 },
1110/* 0x68 */ { NULL, NULL, 0 },
1111/* 0x69 */ { NULL, NULL, 0 },
1112/* 0x6a */ { NULL, NULL, 0 },
1113/* 0x6b */ { NULL, NULL, 0 },
1114/* 0x6c */ { NULL, NULL, 0 },
1115/* 0x6d */ { NULL, NULL, 0 },
1116/* 0x6e */ { NULL, NULL, 0 },
1117/* 0x6f */ { NULL, NULL, 0 },
1118/* 0x70 */ { "SMBtcon",reply_tcon,0},
1119/* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1120/* 0x72 */ { "SMBnegprot",reply_negprot,0},
1121/* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1122/* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1123/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1124/* 0x76 */ { NULL, NULL, 0 },
1125/* 0x77 */ { NULL, NULL, 0 },
1126/* 0x78 */ { NULL, NULL, 0 },
1127/* 0x79 */ { NULL, NULL, 0 },
1128/* 0x7a */ { NULL, NULL, 0 },
1129/* 0x7b */ { NULL, NULL, 0 },
1130/* 0x7c */ { NULL, NULL, 0 },
1131/* 0x7d */ { NULL, NULL, 0 },
1132/* 0x7e */ { NULL, NULL, 0 },
1133/* 0x7f */ { NULL, NULL, 0 },
1134/* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1135/* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1136/* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1137/* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1138/* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1139/* 0x85 */ { NULL, NULL, 0 },
1140/* 0x86 */ { NULL, NULL, 0 },
1141/* 0x87 */ { NULL, NULL, 0 },
1142/* 0x88 */ { NULL, NULL, 0 },
1143/* 0x89 */ { NULL, NULL, 0 },
1144/* 0x8a */ { NULL, NULL, 0 },
1145/* 0x8b */ { NULL, NULL, 0 },
1146/* 0x8c */ { NULL, NULL, 0 },
1147/* 0x8d */ { NULL, NULL, 0 },
1148/* 0x8e */ { NULL, NULL, 0 },
1149/* 0x8f */ { NULL, NULL, 0 },
1150/* 0x90 */ { NULL, NULL, 0 },
1151/* 0x91 */ { NULL, NULL, 0 },
1152/* 0x92 */ { NULL, NULL, 0 },
1153/* 0x93 */ { NULL, NULL, 0 },
1154/* 0x94 */ { NULL, NULL, 0 },
1155/* 0x95 */ { NULL, NULL, 0 },
1156/* 0x96 */ { NULL, NULL, 0 },
1157/* 0x97 */ { NULL, NULL, 0 },
1158/* 0x98 */ { NULL, NULL, 0 },
1159/* 0x99 */ { NULL, NULL, 0 },
1160/* 0x9a */ { NULL, NULL, 0 },
1161/* 0x9b */ { NULL, NULL, 0 },
1162/* 0x9c */ { NULL, NULL, 0 },
1163/* 0x9d */ { NULL, NULL, 0 },
1164/* 0x9e */ { NULL, NULL, 0 },
1165/* 0x9f */ { NULL, NULL, 0 },
1166/* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1167/* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1168/* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1169/* 0xa3 */ { NULL, NULL, 0 },
1170/* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1171/* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1172/* 0xa6 */ { NULL, NULL, 0 },
1173/* 0xa7 */ { NULL, NULL, 0 },
1174/* 0xa8 */ { NULL, NULL, 0 },
1175/* 0xa9 */ { NULL, NULL, 0 },
1176/* 0xaa */ { NULL, NULL, 0 },
1177/* 0xab */ { NULL, NULL, 0 },
1178/* 0xac */ { NULL, NULL, 0 },
1179/* 0xad */ { NULL, NULL, 0 },
1180/* 0xae */ { NULL, NULL, 0 },
1181/* 0xaf */ { NULL, NULL, 0 },
1182/* 0xb0 */ { NULL, NULL, 0 },
1183/* 0xb1 */ { NULL, NULL, 0 },
1184/* 0xb2 */ { NULL, NULL, 0 },
1185/* 0xb3 */ { NULL, NULL, 0 },
1186/* 0xb4 */ { NULL, NULL, 0 },
1187/* 0xb5 */ { NULL, NULL, 0 },
1188/* 0xb6 */ { NULL, NULL, 0 },
1189/* 0xb7 */ { NULL, NULL, 0 },
1190/* 0xb8 */ { NULL, NULL, 0 },
1191/* 0xb9 */ { NULL, NULL, 0 },
1192/* 0xba */ { NULL, NULL, 0 },
1193/* 0xbb */ { NULL, NULL, 0 },
1194/* 0xbc */ { NULL, NULL, 0 },
1195/* 0xbd */ { NULL, NULL, 0 },
1196/* 0xbe */ { NULL, NULL, 0 },
1197/* 0xbf */ { NULL, NULL, 0 },
1198/* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1199/* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1200/* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1201/* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1202/* 0xc4 */ { NULL, NULL, 0 },
1203/* 0xc5 */ { NULL, NULL, 0 },
1204/* 0xc6 */ { NULL, NULL, 0 },
1205/* 0xc7 */ { NULL, NULL, 0 },
1206/* 0xc8 */ { NULL, NULL, 0 },
1207/* 0xc9 */ { NULL, NULL, 0 },
1208/* 0xca */ { NULL, NULL, 0 },
1209/* 0xcb */ { NULL, NULL, 0 },
1210/* 0xcc */ { NULL, NULL, 0 },
1211/* 0xcd */ { NULL, NULL, 0 },
1212/* 0xce */ { NULL, NULL, 0 },
1213/* 0xcf */ { NULL, NULL, 0 },
1214/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1215/* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1216/* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1217/* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1218/* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1219/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1220/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1221/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1222/* 0xd8 */ { NULL, NULL, 0 },
1223/* 0xd9 */ { NULL, NULL, 0 },
1224/* 0xda */ { NULL, NULL, 0 },
1225/* 0xdb */ { NULL, NULL, 0 },
1226/* 0xdc */ { NULL, NULL, 0 },
1227/* 0xdd */ { NULL, NULL, 0 },
1228/* 0xde */ { NULL, NULL, 0 },
1229/* 0xdf */ { NULL, NULL, 0 },
1230/* 0xe0 */ { NULL, NULL, 0 },
1231/* 0xe1 */ { NULL, NULL, 0 },
1232/* 0xe2 */ { NULL, NULL, 0 },
1233/* 0xe3 */ { NULL, NULL, 0 },
1234/* 0xe4 */ { NULL, NULL, 0 },
1235/* 0xe5 */ { NULL, NULL, 0 },
1236/* 0xe6 */ { NULL, NULL, 0 },
1237/* 0xe7 */ { NULL, NULL, 0 },
1238/* 0xe8 */ { NULL, NULL, 0 },
1239/* 0xe9 */ { NULL, NULL, 0 },
1240/* 0xea */ { NULL, NULL, 0 },
1241/* 0xeb */ { NULL, NULL, 0 },
1242/* 0xec */ { NULL, NULL, 0 },
1243/* 0xed */ { NULL, NULL, 0 },
1244/* 0xee */ { NULL, NULL, 0 },
1245/* 0xef */ { NULL, NULL, 0 },
1246/* 0xf0 */ { NULL, NULL, 0 },
1247/* 0xf1 */ { NULL, NULL, 0 },
1248/* 0xf2 */ { NULL, NULL, 0 },
1249/* 0xf3 */ { NULL, NULL, 0 },
1250/* 0xf4 */ { NULL, NULL, 0 },
1251/* 0xf5 */ { NULL, NULL, 0 },
1252/* 0xf6 */ { NULL, NULL, 0 },
1253/* 0xf7 */ { NULL, NULL, 0 },
1254/* 0xf8 */ { NULL, NULL, 0 },
1255/* 0xf9 */ { NULL, NULL, 0 },
1256/* 0xfa */ { NULL, NULL, 0 },
1257/* 0xfb */ { NULL, NULL, 0 },
1258/* 0xfc */ { NULL, NULL, 0 },
1259/* 0xfd */ { NULL, NULL, 0 },
1260/* 0xfe */ { NULL, NULL, 0 },
1261/* 0xff */ { NULL, NULL, 0 }
1262
1263};
1264
1265/*******************************************************************
1266 allocate and initialize a reply packet
1267********************************************************************/
1268
1269bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
1270 uint8_t num_words, uint32_t num_bytes)
1271{
1272 /*
1273 * Protect against integer wrap
1274 */
1275 if ((num_bytes > 0xffffff)
1276 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1277 char *msg;
1278 if (asprintf(&msg, "num_bytes too large: %u",
1279 (unsigned)num_bytes) == -1) {
1280 msg = CONST_DISCARD(char *, "num_bytes too large");
1281 }
1282 smb_panic(msg);
1283 }
1284
1285 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1286 smb_size + num_words*2 + num_bytes);
1287 if (*outbuf == NULL) {
1288 return false;
1289 }
1290
1291 construct_reply_common(inbuf, *outbuf);
1292 srv_set_message(*outbuf, num_words, num_bytes, false);
1293 /*
1294 * Zero out the word area, the caller has to take care of the bcc area
1295 * himself
1296 */
1297 if (num_words != 0) {
1298 memset(*outbuf + smb_vwv0, 0, num_words*2);
1299 }
1300
1301 return true;
1302}
1303
1304void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1305{
1306 char *outbuf;
1307 if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
1308 num_bytes)) {
1309 smb_panic("could not allocate output buffer\n");
1310 }
1311 req->outbuf = (uint8_t *)outbuf;
1312}
1313
1314
1315/*******************************************************************
1316 Dump a packet to a file.
1317********************************************************************/
1318
1319static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1320{
1321 int fd, i;
1322 char *fname = NULL;
1323 if (DEBUGLEVEL < 50) {
1324 return;
1325 }
1326
1327 if (len < 4) len = smb_len(data)+4;
1328 for (i=1;i<100;i++) {
1329 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1330 type ? "req" : "resp") == -1) {
1331 return;
1332 }
1333 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1334 if (fd != -1 || errno != EEXIST) break;
1335 }
1336 if (fd != -1) {
1337 ssize_t ret = write(fd, data, len);
1338 if (ret != len)
1339 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1340 close(fd);
1341 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1342 }
1343 SAFE_FREE(fname);
1344}
1345
1346/****************************************************************************
1347 Prepare everything for calling the actual request function, and potentially
1348 call the request function via the "new" interface.
1349
1350 Return False if the "legacy" function needs to be called, everything is
1351 prepared.
1352
1353 Return True if we're done.
1354
1355 I know this API sucks, but it is the one with the least code change I could
1356 find.
1357****************************************************************************/
1358
1359static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1360{
1361 int flags;
1362 uint16 session_tag;
1363 connection_struct *conn = NULL;
1364
1365 static uint16 last_session_tag = UID_FIELD_INVALID;
1366
1367 errno = 0;
1368
1369 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1370 * so subtract 4 from it. */
1371 if (!valid_smb_header(req->inbuf)
1372 || (size < (smb_size - 4))) {
1373 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1374 smb_len(req->inbuf)));
1375 exit_server_cleanly("Non-SMB packet");
1376 }
1377
1378 if (smb_messages[type].fn == NULL) {
1379 DEBUG(0,("Unknown message type %d!\n",type));
1380 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1381 reply_unknown_new(req, type);
1382 return NULL;
1383 }
1384
1385 flags = smb_messages[type].flags;
1386
1387 /* In share mode security we must ignore the vuid. */
1388 session_tag = (lp_security() == SEC_SHARE)
1389 ? UID_FIELD_INVALID : req->vuid;
1390 conn = req->conn;
1391
1392 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1393 (int)sys_getpid(), (unsigned long)conn));
1394
1395 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1396
1397 /* Ensure this value is replaced in the incoming packet. */
1398 SSVAL(req->inbuf,smb_uid,session_tag);
1399
1400 /*
1401 * Ensure the correct username is in current_user_info. This is a
1402 * really ugly bugfix for problems with multiple session_setup_and_X's
1403 * being done and allowing %U and %G substitutions to work correctly.
1404 * There is a reason this code is done here, don't move it unless you
1405 * know what you're doing... :-).
1406 * JRA.
1407 */
1408
1409 if (session_tag != last_session_tag) {
1410 user_struct *vuser = NULL;
1411
1412 last_session_tag = session_tag;
1413 if(session_tag != UID_FIELD_INVALID) {
1414 vuser = get_valid_user_struct(session_tag);
1415 if (vuser) {
1416 set_current_user_info(
1417 vuser->server_info->sanitized_username,
1418 vuser->server_info->unix_name,
1419 pdb_get_fullname(vuser->server_info
1420 ->sam_account),
1421 pdb_get_domain(vuser->server_info
1422 ->sam_account));
1423 }
1424 }
1425 }
1426
1427 /* Does this call need to be run as the connected user? */
1428 if (flags & AS_USER) {
1429
1430 /* Does this call need a valid tree connection? */
1431 if (!conn) {
1432 /*
1433 * Amazingly, the error code depends on the command
1434 * (from Samba4).
1435 */
1436 if (type == SMBntcreateX) {
1437 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1438 } else {
1439 reply_doserror(req, ERRSRV, ERRinvnid);
1440 }
1441 return NULL;
1442 }
1443
1444 if (!change_to_user(conn,session_tag)) {
1445 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1446 return conn;
1447 }
1448
1449 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1450
1451 /* Does it need write permission? */
1452 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1453 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1454 return conn;
1455 }
1456
1457 /* IPC services are limited */
1458 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1459 reply_doserror(req, ERRSRV,ERRaccess);
1460 return conn;
1461 }
1462 } else {
1463 /* This call needs to be run as root */
1464 change_to_root_user();
1465 }
1466
1467 /* load service specific parameters */
1468 if (conn) {
1469 if (req->encrypted) {
1470 conn->encrypted_tid = true;
1471 /* encrypted required from now on. */
1472 conn->encrypt_level = Required;
1473 } else if (ENCRYPTION_REQUIRED(conn)) {
1474 uint8 com = CVAL(req->inbuf,smb_com);
1475 if (com != SMBtrans2 && com != SMBtranss2) {
1476 exit_server_cleanly("encryption required "
1477 "on connection");
1478 return conn;
1479 }
1480 }
1481
1482 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1483 (flags & (AS_USER|DO_CHDIR)
1484 ?True:False))) {
1485 reply_doserror(req, ERRSRV, ERRaccess);
1486 return conn;
1487 }
1488 conn->num_smb_operations++;
1489 }
1490
1491 /* does this protocol need to be run as guest? */
1492 if ((flags & AS_GUEST)
1493 && (!change_to_guest() ||
1494 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1495 lp_hostsdeny(-1)))) {
1496 reply_doserror(req, ERRSRV, ERRaccess);
1497 return conn;
1498 }
1499
1500 smb_messages[type].fn(req);
1501 return req->conn;
1502}
1503
1504/****************************************************************************
1505 Construct a reply to the incoming packet.
1506****************************************************************************/
1507
1508static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1509{
1510 struct pending_message_list *pml = NULL;
1511 uint8 type = CVAL(inbuf,smb_com);
1512 connection_struct *conn;
1513 struct smb_request *req;
1514
1515 chain_size = 0;
1516 file_chain_reset();
1517 reset_chain_p();
1518
1519 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1520 smb_panic("could not allocate smb_request");
1521 }
1522 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1523
1524 conn = switch_message(type, req, size);
1525
1526 /* If this was a deferred message and it's still there and
1527 * was processed, remove it. */
1528 pml = get_open_deferred_message(req->mid);
1529 if (pml && pml->processed) {
1530 remove_deferred_open_smb_message(req->mid);
1531 }
1532
1533 if (req->unread_bytes) {
1534 /* writeX failed. drain socket. */
1535 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1536 req->unread_bytes) {
1537 smb_panic("failed to drain pending bytes");
1538 }
1539 req->unread_bytes = 0;
1540 }
1541
1542 if (req->outbuf == NULL) {
1543 return;
1544 }
1545
1546 if (CVAL(req->outbuf,0) == 0) {
1547 show_msg((char *)req->outbuf);
1548 }
1549
1550 if (!srv_send_smb(smbd_server_fd(),
1551 (char *)req->outbuf,
1552 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1553 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1554 }
1555
1556 TALLOC_FREE(req);
1557
1558 return;
1559}
1560
1561/****************************************************************************
1562 Process an smb from the client
1563****************************************************************************/
1564
1565static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1566{
1567 static int trans_num;
1568 int msg_type = CVAL(inbuf,0);
1569
1570 DO_PROFILE_INC(smb_count);
1571
1572 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1573 smb_len(inbuf) ) );
1574 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1575 (int)nread,
1576 (unsigned int)unread_bytes ));
1577
1578 if (msg_type != 0) {
1579 /*
1580 * NetBIOS session request, keepalive, etc.
1581 */
1582 reply_special(inbuf);
1583 return;
1584 }
1585
1586 show_msg(inbuf);
1587
1588 construct_reply(inbuf,nread,unread_bytes,encrypted);
1589
1590 trans_num++;
1591}
1592
1593/****************************************************************************
1594 Return a string containing the function name of a SMB command.
1595****************************************************************************/
1596
1597const char *smb_fn_name(int type)
1598{
1599 const char *unknown_name = "SMBunknown";
1600
1601 if (smb_messages[type].name == NULL)
1602 return(unknown_name);
1603
1604 return(smb_messages[type].name);
1605}
1606
1607/****************************************************************************
1608 Helper functions for contruct_reply.
1609****************************************************************************/
1610
1611static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1612
1613void add_to_common_flags2(uint32 v)
1614{
1615 common_flags2 |= v;
1616}
1617
1618void remove_from_common_flags2(uint32 v)
1619{
1620 common_flags2 &= ~v;
1621}
1622
1623void construct_reply_common(const char *inbuf, char *outbuf)
1624{
1625 srv_set_message(outbuf,0,0,false);
1626
1627 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1628 SIVAL(outbuf,smb_rcls,0);
1629 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1630 SSVAL(outbuf,smb_flg2,
1631 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1632 common_flags2);
1633 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1634
1635 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1636 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1637 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1638 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1639}
1640
1641/****************************************************************************
1642 Construct a chained reply and add it to the already made reply
1643****************************************************************************/
1644
1645void chain_reply(struct smb_request *req)
1646{
1647 static char *orig_inbuf;
1648
1649 /*
1650 * Dirty little const_discard: We mess with req->inbuf, which is
1651 * declared as const. If maybe at some point this routine gets
1652 * rewritten, this const_discard could go away.
1653 */
1654 char *inbuf = CONST_DISCARD(char *, req->inbuf);
1655 int size = smb_len(req->inbuf)+4;
1656
1657 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1658 unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1659 char *inbuf2;
1660 int outsize2;
1661 int new_size;
1662 char inbuf_saved[smb_wct];
1663 char *outbuf = (char *)req->outbuf;
1664 size_t outsize = smb_len(outbuf) + 4;
1665 size_t outsize_padded;
1666 size_t padding;
1667 size_t ofs, to_move;
1668
1669 struct smb_request *req2;
1670 size_t caller_outputlen;
1671 char *caller_output;
1672
1673 /* Maybe its not chained, or it's an error packet. */
1674 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1675 SCVAL(outbuf,smb_vwv0,0xFF);
1676 return;
1677 }
1678
1679 if (chain_size == 0) {
1680 /* this is the first part of the chain */
1681 orig_inbuf = inbuf;
1682 }
1683
1684 /*
1685 * We need to save the output the caller added to the chain so that we
1686 * can splice it into the final output buffer later.
1687 */
1688
1689 caller_outputlen = outsize - smb_wct;
1690
1691 caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1692
1693 if (caller_output == NULL) {
1694 /* TODO: NT_STATUS_NO_MEMORY */
1695 smb_panic("could not dup outbuf");
1696 }
1697
1698 /*
1699 * The original Win95 redirector dies on a reply to
1700 * a lockingX and read chain unless the chain reply is
1701 * 4 byte aligned. JRA.
1702 */
1703
1704 outsize_padded = (outsize + 3) & ~3;
1705 padding = outsize_padded - outsize;
1706
1707 /*
1708 * remember how much the caller added to the chain, only counting
1709 * stuff after the parameter words
1710 */
1711 chain_size += (outsize_padded - smb_wct);
1712
1713 /*
1714 * work out pointers into the original packets. The
1715 * headers on these need to be filled in
1716 */
1717 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1718
1719 /* remember the original command type */
1720 smb_com1 = CVAL(orig_inbuf,smb_com);
1721
1722 /* save the data which will be overwritten by the new headers */
1723 memcpy(inbuf_saved,inbuf2,smb_wct);
1724
1725 /* give the new packet the same header as the last part of the SMB */
1726 memmove(inbuf2,inbuf,smb_wct);
1727
1728 /* create the in buffer */
1729 SCVAL(inbuf2,smb_com,smb_com2);
1730
1731 /* work out the new size for the in buffer. */
1732 new_size = size - (inbuf2 - inbuf);
1733 if (new_size < 0) {
1734 DEBUG(0,("chain_reply: chain packet size incorrect "
1735 "(orig size = %d, offset = %d)\n",
1736 size, (int)(inbuf2 - inbuf) ));
1737 exit_server_cleanly("Bad chained packet");
1738 return;
1739 }
1740
1741 /* And set it in the header. */
1742 smb_setlen(inbuf2, new_size - 4);
1743
1744 DEBUG(3,("Chained message\n"));
1745 show_msg(inbuf2);
1746
1747 if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1748 smb_panic("could not allocate smb_request");
1749 }
1750 init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1751
1752 /* process the request */
1753 switch_message(smb_com2, req2, new_size);
1754
1755 /*
1756 * We don't accept deferred operations in chained requests.
1757 */
1758 SMB_ASSERT(req2->outbuf != NULL);
1759 outsize2 = smb_len(req2->outbuf)+4;
1760
1761 /*
1762 * Move away the new command output so that caller_output fits in,
1763 * copy in the caller_output saved above.
1764 */
1765
1766 SMB_ASSERT(outsize_padded >= smb_wct);
1767
1768 /*
1769 * "ofs" is the space we need for caller_output. Equal to
1770 * caller_outputlen plus the padding.
1771 */
1772
1773 ofs = outsize_padded - smb_wct;
1774
1775 /*
1776 * "to_move" is the amount of bytes the secondary routine gave us
1777 */
1778
1779 to_move = outsize2 - smb_wct;
1780
1781 if (to_move + ofs + smb_wct + chain_size > max_send) {
1782 smb_panic("replies too large -- would have to cut");
1783 }
1784
1785 /*
1786 * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1787 * the first request in the chain. So we have to re-allocate it. In
1788 * the "old" API the only outbuf ever used is the global OutBuffer
1789 * which is always large enough.
1790 */
1791
1792 outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1793 to_move + ofs + smb_wct);
1794 if (outbuf == NULL) {
1795 smb_panic("could not realloc outbuf");
1796 }
1797
1798 req->outbuf = (uint8 *)outbuf;
1799
1800 memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1801 memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1802
1803 /*
1804 * copy the new reply header over the old one but preserve the smb_com
1805 * field
1806 */
1807 memmove(outbuf, req2->outbuf, smb_wct);
1808 SCVAL(outbuf, smb_com, smb_com1);
1809
1810 /*
1811 * We've just copied in the whole "wct" area from the secondary
1812 * function. Fix up the chaining: com2 and the offset need to be
1813 * readjusted.
1814 */
1815
1816 SCVAL(outbuf, smb_vwv0, smb_com2);
1817 SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1818
1819 if (padding != 0) {
1820
1821 /*
1822 * Due to padding we have some uninitialized bytes after the
1823 * caller's output
1824 */
1825
1826 memset(outbuf + outsize, 0, padding);
1827 }
1828
1829 smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1830
1831 /*
1832 * restore the saved data, being careful not to overwrite any data
1833 * from the reply header
1834 */
1835 memcpy(inbuf2,inbuf_saved,smb_wct);
1836
1837 SAFE_FREE(caller_output);
1838 TALLOC_FREE(req2);
1839
1840 /*
1841 * Reset the chain_size for our caller's offset calculations
1842 */
1843
1844 chain_size -= (outsize_padded - smb_wct);
1845
1846 return;
1847}
1848
1849/****************************************************************************
1850 Check if services need reloading.
1851****************************************************************************/
1852
1853void check_reload(time_t t)
1854{
1855 static pid_t mypid = 0;
1856 static time_t last_smb_conf_reload_time = 0;
1857 static time_t last_printer_reload_time = 0;
1858 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1859
1860 if(last_smb_conf_reload_time == 0) {
1861 last_smb_conf_reload_time = t;
1862 /* Our printing subsystem might not be ready at smbd start up.
1863 Then no printer is available till the first printers check
1864 is performed. A lower initial interval circumvents this. */
1865 if ( printcap_cache_time > 60 )
1866 last_printer_reload_time = t - printcap_cache_time + 60;
1867 else
1868 last_printer_reload_time = t;
1869 }
1870
1871 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1872 /* randomize over 60 second the printcap reload to avoid all
1873 * process hitting cupsd at the same time */
1874 int time_range = 60;
1875
1876 last_printer_reload_time += random() % time_range;
1877 mypid = getpid();
1878 }
1879
1880 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1881 reload_services(True);
1882 reload_after_sighup = False;
1883 last_smb_conf_reload_time = t;
1884 }
1885
1886 /* 'printcap cache time = 0' disable the feature */
1887
1888 if ( printcap_cache_time != 0 )
1889 {
1890 /* see if it's time to reload or if the clock has been set back */
1891
1892 if ( (t >= last_printer_reload_time+printcap_cache_time)
1893 || (t-last_printer_reload_time < 0) )
1894 {
1895 DEBUG( 3,( "Printcap cache time expired.\n"));
1896 reload_printers();
1897 last_printer_reload_time = t;
1898 }
1899 }
1900}
1901
1902/****************************************************************************
1903 Process commands from the client
1904****************************************************************************/
1905
1906void smbd_process(void)
1907{
1908 unsigned int num_smbs = 0;
1909 size_t unread_bytes = 0;
1910
1911 char addr[INET6_ADDRSTRLEN];
1912
1913 /*
1914 * Before the first packet, check the global hosts allow/ hosts deny
1915 * parameters before doing any parsing of packets passed to us by the
1916 * client. This prevents attacks on our parsing code from hosts not in
1917 * the hosts allow list.
1918 */
1919
1920 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1921 lp_hostsdeny(-1))) {
1922 /*
1923 * send a negative session response "not listening on calling
1924 * name"
1925 */
1926 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1927 DEBUG( 1, ("Connection denied from %s\n",
1928 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1929 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1930 exit_server_cleanly("connection denied");
1931 }
1932
1933 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1934
1935 while (True) {
1936 NTSTATUS status;
1937 char *inbuf = NULL;
1938 size_t inbuf_len = 0;
1939 bool encrypted = false;
1940 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1941
1942 errno = 0;
1943
1944 run_events(smbd_event_context(), 0, NULL, NULL);
1945
1946 status = receive_message_or_smb(
1947 talloc_tos(), &inbuf, &inbuf_len,
1948 &unread_bytes, &encrypted);
1949
1950 if (!NT_STATUS_IS_OK(status)) {
1951 DEBUG(3, ("receive_message_or_smb failed: %s, "
1952 "exiting\n", nt_errstr(status)));
1953 return;
1954 }
1955
1956 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1957
1958 TALLOC_FREE(inbuf);
1959
1960 num_smbs++;
1961
1962 /* The timeout_processing function isn't run nearly
1963 often enough to implement 'max log size' without
1964 overrunning the size of the file by many megabytes.
1965 This is especially true if we are running at debug
1966 level 10. Checking every 50 SMBs is a nice
1967 tradeoff of performance vs log file size overrun. */
1968
1969 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1970 change_to_root_user();
1971 check_log_size();
1972 }
1973 TALLOC_FREE(frame);
1974 }
1975}
Note: See TracBrowser for help on using the repository browser.