source: branches/samba-3.3.x/source/smbd/process.c@ 491

Last change on this file since 491 was 467, checked in by Herwig Bauernfeind, 15 years ago

Update Samba 3.3 to 3.3.13 (security update)
File size: 57.2 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22
23extern int smb_echo_count;
24
25/*
26 * Size of data we can send to client. Set
27 * by the client for all protocols above CORE.
28 * Set by us for CORE protocol.
29 */
30int max_send = BUFFER_SIZE;
31/*
32 * Size of the data we can receive. Set by us.
33 * Can be modified by the max xmit parameter.
34 */
35int max_recv = BUFFER_SIZE;
36
37SIG_ATOMIC_T reload_after_sighup = 0;
38SIG_ATOMIC_T got_sig_term = 0;
39extern bool global_machine_password_needs_changing;
40extern int max_send;
41
42/* Accessor function for smb_read_error for smbd functions. */
43
44/****************************************************************************
45 Send an smb to a fd.
46****************************************************************************/
47
48bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
49{
50 size_t len;
51 size_t nwritten=0;
52 ssize_t ret;
53 char *buf_out = buffer;
54
55 /* Sign the outgoing packet if required. */
56 srv_calculate_sign_mac(buf_out);
57
58 if (do_encrypt) {
59 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
60 if (!NT_STATUS_IS_OK(status)) {
61 DEBUG(0, ("send_smb: SMB encryption failed "
62 "on outgoing packet! Error %s\n",
63 nt_errstr(status) ));
64 return false;
65 }
66 }
67
68 len = smb_len(buf_out) + 4;
69
70 while (nwritten < len) {
71 ret = write_data(fd,buf_out+nwritten,len - nwritten);
72 if (ret <= 0) {
73 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
74 (int)len,(int)ret, strerror(errno) ));
75 srv_free_enc_buffer(buf_out);
76 return false;
77 }
78 nwritten += ret;
79 }
80
81 srv_free_enc_buffer(buf_out);
82 return true;
83}
84
85/*******************************************************************
86 Setup the word count and byte count for a smb message.
87********************************************************************/
88
89int srv_set_message(char *buf,
90 int num_words,
91 int num_bytes,
92 bool zero)
93{
94 if (zero && (num_words || num_bytes)) {
95 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
96 }
97 SCVAL(buf,smb_wct,num_words);
98 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
99 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
100 return (smb_size + num_words*2 + num_bytes);
101}
102
103static bool valid_smb_header(const uint8_t *inbuf)
104{
105 if (is_encrypted_packet(inbuf)) {
106 return true;
107 }
108 /*
109 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
110 * but it just looks weird to call strncmp for this one.
111 */
112 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
113}
114
115/* Socket functions for smbd packet processing. */
116
117static bool valid_packet_size(size_t len)
118{
119 /*
120 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
121 * of header. Don't print the error if this fits.... JRA.
122 */
123
124 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
125 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
126 (unsigned long)len));
127 return false;
128 }
129 return true;
130}
131
132static NTSTATUS read_packet_remainder(int fd, char *buffer,
133 unsigned int timeout, ssize_t len)
134{
135 if (len <= 0) {
136 return NT_STATUS_OK;
137 }
138
139 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
140}
141
142/****************************************************************************
143 Attempt a zerocopy writeX read. We know here that len > smb_size-4
144****************************************************************************/
145
146/*
147 * Unfortunately, earlier versions of smbclient/libsmbclient
148 * don't send this "standard" writeX header. I've fixed this
149 * for 3.2 but we'll use the old method with earlier versions.
150 * Windows and CIFSFS at least use this standard size. Not
151 * sure about MacOSX.
152 */
153
154#define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
155 (2*14) + /* word count (including bcc) */ \
156 1 /* pad byte */)
157
158static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
159 const char *lenbuf,
160 int fd, char **buffer,
161 unsigned int timeout,
162 size_t *p_unread,
163 size_t *len_ret)
164{
165 /* Size of a WRITEX call (+4 byte len). */
166 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
167 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
168 ssize_t toread;
169 NTSTATUS status;
170
171 memcpy(writeX_header, lenbuf, 4);
172
173 status = read_socket_with_timeout(
174 fd, writeX_header + 4,
175 STANDARD_WRITE_AND_X_HEADER_SIZE,
176 STANDARD_WRITE_AND_X_HEADER_SIZE,
177 timeout, NULL);
178
179 if (!NT_STATUS_IS_OK(status)) {
180 return status;
181 }
182
183 /*
184 * Ok - now try and see if this is a possible
185 * valid writeX call.
186 */
187
188 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
189 /*
190 * If the data offset is beyond what
191 * we've read, drain the extra bytes.
192 */
193 uint16_t doff = SVAL(writeX_header,smb_vwv11);
194 ssize_t newlen;
195
196 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
197 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
198 if (drain_socket(smbd_server_fd(), drain) != drain) {
199 smb_panic("receive_smb_raw_talloc_partial_read:"
200 " failed to drain pending bytes");
201 }
202 } else {
203 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
204 }
205
206 /* Spoof down the length and null out the bcc. */
207 set_message_bcc(writeX_header, 0);
208 newlen = smb_len(writeX_header);
209
210 /* Copy the header we've written. */
211
212 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
213 writeX_header,
214 sizeof(writeX_header));
215
216 if (*buffer == NULL) {
217 DEBUG(0, ("Could not allocate inbuf of length %d\n",
218 (int)sizeof(writeX_header)));
219 return NT_STATUS_NO_MEMORY;
220 }
221
222 /* Work out the remaining bytes. */
223 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
224 *len_ret = newlen + 4;
225 return NT_STATUS_OK;
226 }
227
228 if (!valid_packet_size(len)) {
229 return NT_STATUS_INVALID_PARAMETER;
230 }
231
232 /*
233 * Not a valid writeX call. Just do the standard
234 * talloc and return.
235 */
236
237 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
238
239 if (*buffer == NULL) {
240 DEBUG(0, ("Could not allocate inbuf of length %d\n",
241 (int)len+4));
242 return NT_STATUS_NO_MEMORY;
243 }
244
245 /* Copy in what we already read. */
246 memcpy(*buffer,
247 writeX_header,
248 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
249 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
250
251 if(toread > 0) {
252 status = read_packet_remainder(
253 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
254 timeout, toread);
255
256 if (!NT_STATUS_IS_OK(status)) {
257 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
258 nt_errstr(status)));
259 return status;
260 }
261 }
262
263 *len_ret = len + 4;
264 return NT_STATUS_OK;
265}
266
267static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
268 char **buffer, unsigned int timeout,
269 size_t *p_unread, size_t *plen)
270{
271 char lenbuf[4];
272 size_t len;
273 int min_recv_size = lp_min_receive_file_size();
274 NTSTATUS status;
275
276 *p_unread = 0;
277
278 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
279 if (!NT_STATUS_IS_OK(status)) {
280 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
281 return status;
282 }
283
284 if (CVAL(lenbuf,0) == 0 &&
285 min_recv_size &&
286 smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
287 !srv_is_signing_active()) {
288
289 return receive_smb_raw_talloc_partial_read(
290 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
291 }
292
293 if (!valid_packet_size(len)) {
294 return NT_STATUS_INVALID_PARAMETER;
295 }
296
297 /*
298 * The +4 here can't wrap, we've checked the length above already.
299 */
300
301 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
302
303 if (*buffer == NULL) {
304 DEBUG(0, ("Could not allocate inbuf of length %d\n",
305 (int)len+4));
306 return NT_STATUS_NO_MEMORY;
307 }
308
309 memcpy(*buffer, lenbuf, sizeof(lenbuf));
310
311 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
312 if (!NT_STATUS_IS_OK(status)) {
313 return status;
314 }
315
316 *plen = len + 4;
317 return NT_STATUS_OK;
318}
319
320static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
321 char **buffer, unsigned int timeout,
322 size_t *p_unread, bool *p_encrypted,
323 size_t *p_len)
324{
325 size_t len = 0;
326 NTSTATUS status;
327
328 *p_encrypted = false;
329
330 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
331 p_unread, &len);
332 if (!NT_STATUS_IS_OK(status)) {
333 return status;
334 }
335
336 if (is_encrypted_packet((uint8_t *)*buffer)) {
337 status = srv_decrypt_buffer(*buffer);
338 if (!NT_STATUS_IS_OK(status)) {
339 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
340 "incoming packet! Error %s\n",
341 nt_errstr(status) ));
342 return status;
343 }
344 *p_encrypted = true;
345 }
346
347 /* Check the incoming SMB signature. */
348 if (!srv_check_sign_mac(*buffer, true)) {
349 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
350 "incoming packet!\n"));
351 return NT_STATUS_INVALID_NETWORK_RESPONSE;
352 }
353
354 *p_len = len;
355 return NT_STATUS_OK;
356}
357
358/*
359 * Initialize a struct smb_request from an inbuf
360 */
361
362void init_smb_request(struct smb_request *req,
363 const uint8 *inbuf,
364 size_t unread_bytes,
365 bool encrypted)
366{
367 size_t req_size = smb_len(inbuf) + 4;
368 /* Ensure we have at least smb_size bytes. */
369 if (req_size < smb_size) {
370 DEBUG(0,("init_smb_request: invalid request size %u\n",
371 (unsigned int)req_size ));
372 exit_server_cleanly("Invalid SMB request");
373 }
374 req->flags2 = SVAL(inbuf, smb_flg2);
375 req->smbpid = SVAL(inbuf, smb_pid);
376 req->mid = SVAL(inbuf, smb_mid);
377 req->vuid = SVAL(inbuf, smb_uid);
378 req->tid = SVAL(inbuf, smb_tid);
379 req->wct = CVAL(inbuf, smb_wct);
380 req->unread_bytes = unread_bytes;
381 req->encrypted = encrypted;
382 req->conn = conn_find(req->tid);
383
384 /* Ensure we have at least wct words and 2 bytes of bcc. */
385 if (smb_size + req->wct*2 > req_size) {
386 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
387 (unsigned int)req->wct,
388 (unsigned int)req_size));
389 exit_server_cleanly("Invalid SMB request");
390 }
391 /* Ensure bcc is correct. */
392 if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
393 DEBUG(0,("init_smb_request: invalid bcc number %u "
394 "(wct = %u, size %u)\n",
395 (unsigned int)smb_buflen(inbuf),
396 (unsigned int)req->wct,
397 (unsigned int)req_size));
398 exit_server_cleanly("Invalid SMB request");
399 }
400 req->inbuf = inbuf;
401 req->outbuf = NULL;
402}
403
404/****************************************************************************
405 structure to hold a linked list of queued messages.
406 for processing.
407****************************************************************************/
408
409static struct pending_message_list *deferred_open_queue;
410
411/****************************************************************************
412 Function to push a message onto the tail of a linked list of smb messages ready
413 for processing.
414****************************************************************************/
415
416static bool push_queued_message(struct smb_request *req,
417 struct timeval request_time,
418 struct timeval end_time,
419 char *private_data, size_t private_len)
420{
421 int msg_len = smb_len(req->inbuf) + 4;
422 struct pending_message_list *msg;
423
424 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
425
426 if(msg == NULL) {
427 DEBUG(0,("push_message: malloc fail (1)\n"));
428 return False;
429 }
430
431 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
432 if(msg->buf.data == NULL) {
433 DEBUG(0,("push_message: malloc fail (2)\n"));
434 TALLOC_FREE(msg);
435 return False;
436 }
437
438 msg->request_time = request_time;
439 msg->end_time = end_time;
440 msg->encrypted = req->encrypted;
441 msg->processed = false;
442
443 if (private_data) {
444 msg->private_data = data_blob_talloc(msg, private_data,
445 private_len);
446 if (msg->private_data.data == NULL) {
447 DEBUG(0,("push_message: malloc fail (3)\n"));
448 TALLOC_FREE(msg);
449 return False;
450 }
451 }
452
453 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
454
455 DEBUG(10,("push_message: pushed message length %u on "
456 "deferred_open_queue\n", (unsigned int)msg_len));
457
458 return True;
459}
460
461/****************************************************************************
462 Function to delete a sharing violation open message by mid.
463****************************************************************************/
464
465void remove_deferred_open_smb_message(uint16 mid)
466{
467 struct pending_message_list *pml;
468
469 for (pml = deferred_open_queue; pml; pml = pml->next) {
470 if (mid == SVAL(pml->buf.data,smb_mid)) {
471 DEBUG(10,("remove_sharing_violation_open_smb_message: "
472 "deleting mid %u len %u\n",
473 (unsigned int)mid,
474 (unsigned int)pml->buf.length ));
475 DLIST_REMOVE(deferred_open_queue, pml);
476 TALLOC_FREE(pml);
477 return;
478 }
479 }
480}
481
482/****************************************************************************
483 Move a sharing violation open retry message to the front of the list and
484 schedule it for immediate processing.
485****************************************************************************/
486
487void schedule_deferred_open_smb_message(uint16 mid)
488{
489 struct pending_message_list *pml;
490 int i = 0;
491
492 for (pml = deferred_open_queue; pml; pml = pml->next) {
493 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
494 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
495 (unsigned int)msg_mid ));
496 if (mid == msg_mid) {
497
498 if (pml->processed) {
499 /* A processed message should not be
500 * rescheduled. */
501 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
502 "message mid %u was already processed\n",
503 (unsigned int)msg_mid ));
504 continue;
505 }
506
507 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
508 mid ));
509 pml->end_time.tv_sec = 0;
510 pml->end_time.tv_usec = 0;
511 DLIST_PROMOTE(deferred_open_queue, pml);
512 return;
513 }
514 }
515
516 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
517 mid ));
518}
519
520/****************************************************************************
521 Return true if this mid is on the deferred queue and was not yet processed.
522****************************************************************************/
523
524bool open_was_deferred(uint16 mid)
525{
526 struct pending_message_list *pml;
527
528 for (pml = deferred_open_queue; pml; pml = pml->next) {
529 if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) {
530 return True;
531 }
532 }
533 return False;
534}
535
536/****************************************************************************
537 Return the message queued by this mid.
538****************************************************************************/
539
540struct pending_message_list *get_open_deferred_message(uint16 mid)
541{
542 struct pending_message_list *pml;
543
544 for (pml = deferred_open_queue; pml; pml = pml->next) {
545 if (SVAL(pml->buf.data,smb_mid) == mid) {
546 return pml;
547 }
548 }
549 return NULL;
550}
551
552/****************************************************************************
553 Function to push a deferred open smb message onto a linked list of local smb
554 messages ready for processing.
555****************************************************************************/
556
557bool push_deferred_smb_message(struct smb_request *req,
558 struct timeval request_time,
559 struct timeval timeout,
560 char *private_data, size_t priv_len)
561{
562 struct timeval end_time;
563
564 if (req->unread_bytes) {
565 DEBUG(0,("push_deferred_smb_message: logic error ! "
566 "unread_bytes = %u\n",
567 (unsigned int)req->unread_bytes ));
568 smb_panic("push_deferred_smb_message: "
569 "logic error unread_bytes != 0" );
570 }
571
572 end_time = timeval_sum(&request_time, &timeout);
573
574 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
575 "timeout time [%u.%06u]\n",
576 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
577 (unsigned int)end_time.tv_sec,
578 (unsigned int)end_time.tv_usec));
579
580 return push_queued_message(req, request_time, end_time,
581 private_data, priv_len);
582}
583
584struct idle_event {
585 struct timed_event *te;
586 struct timeval interval;
587 char *name;
588 bool (*handler)(const struct timeval *now, void *private_data);
589 void *private_data;
590};
591
592static void smbd_idle_event_handler(struct event_context *ctx,
593 struct timed_event *te,
594 struct timeval now,
595 void *private_data)
596{
597 struct idle_event *event =
598 talloc_get_type_abort(private_data, struct idle_event);
599
600 TALLOC_FREE(event->te);
601
602 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
603 event->name, event->te));
604
605 if (!event->handler(&now, event->private_data)) {
606 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
607 event->name, event->te));
608 /* Don't repeat, delete ourselves */
609 TALLOC_FREE(event);
610 return;
611 }
612
613 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
614 event->name, event->te));
615
616 event->te = event_add_timed(ctx, event,
617 timeval_sum(&now, &event->interval),
618 smbd_idle_event_handler, event);
619
620 /* We can't do much but fail here. */
621 SMB_ASSERT(event->te != NULL);
622}
623
624struct idle_event *event_add_idle(struct event_context *event_ctx,
625 TALLOC_CTX *mem_ctx,
626 struct timeval interval,
627 const char *name,
628 bool (*handler)(const struct timeval *now,
629 void *private_data),
630 void *private_data)
631{
632 struct idle_event *result;
633 struct timeval now = timeval_current();
634
635 result = TALLOC_P(mem_ctx, struct idle_event);
636 if (result == NULL) {
637 DEBUG(0, ("talloc failed\n"));
638 return NULL;
639 }
640
641 result->interval = interval;
642 result->handler = handler;
643 result->private_data = private_data;
644
645 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
646 DEBUG(0, ("talloc failed\n"));
647 TALLOC_FREE(result);
648 return NULL;
649 }
650
651 result->te = event_add_timed(event_ctx, result,
652 timeval_sum(&now, &interval),
653 smbd_idle_event_handler, result);
654 if (result->te == NULL) {
655 DEBUG(0, ("event_add_timed failed\n"));
656 TALLOC_FREE(result);
657 return NULL;
658 }
659
660 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
661 return result;
662}
663
664/****************************************************************************
665 Do all async processing in here. This includes kernel oplock messages, change
666 notify events etc.
667****************************************************************************/
668
669static void async_processing(fd_set *pfds)
670{
671 DEBUG(10,("async_processing: Doing async processing.\n"));
672
673 process_aio_queue();
674
675 process_kernel_oplocks(smbd_messaging_context(), pfds);
676
677 /* Do the aio check again after receive_local_message as it does a
678 select and may have eaten our signal. */
679 /* Is this till true? -- vl */
680 process_aio_queue();
681
682 if (got_sig_term) {
683 exit_server_cleanly("termination signal");
684 }
685
686 /* check for sighup processing */
687 if (reload_after_sighup) {
688 change_to_root_user();
689 DEBUG(1,("Reloading services after SIGHUP\n"));
690 reload_services(False);
691 reload_after_sighup = 0;
692 }
693}
694
695/****************************************************************************
696 Add a fd to the set we will be select(2)ing on.
697****************************************************************************/
698
699static int select_on_fd(int fd, int maxfd, fd_set *fds)
700{
701 if (fd != -1) {
702 FD_SET(fd, fds);
703 maxfd = MAX(maxfd, fd);
704 }
705
706 return maxfd;
707}
708
709/****************************************************************************
710 Do a select on an two fd's - with timeout.
711
712 If a local udp message has been pushed onto the
713 queue (this can only happen during oplock break
714 processing) call async_processing()
715
716 If a pending smb message has been pushed onto the
717 queue (this can only happen during oplock break
718 processing) return this next.
719
720 If the first smbfd is ready then read an smb from it.
721 if the second (loopback UDP) fd is ready then read a message
722 from it and setup the buffer header to identify the length
723 and from address.
724 Returns False on timeout or error.
725 Else returns True.
726
727The timeout is in milliseconds
728****************************************************************************/
729
730static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
731 size_t *buffer_len,
732 size_t *p_unread, bool *p_encrypted)
733{
734 fd_set r_fds, w_fds;
735 int selrtn;
736 struct timeval to;
737 int maxfd = 0;
738 size_t len = 0;
739 NTSTATUS status;
740
741 *p_unread = 0;
742
743 again:
744
745 to.tv_sec = SMBD_SELECT_TIMEOUT;
746 to.tv_usec = 0;
747
748 /*
749 * Note that this call must be before processing any SMB
750 * messages as we need to synchronously process any messages
751 * we may have sent to ourselves from the previous SMB.
752 */
753 message_dispatch(smbd_messaging_context());
754
755 /*
756 * Check to see if we already have a message on the deferred open queue
757 * and it's time to schedule.
758 */
759 if(deferred_open_queue != NULL) {
760 bool pop_message = False;
761 struct pending_message_list *msg = deferred_open_queue;
762
763 if (timeval_is_zero(&msg->end_time)) {
764 pop_message = True;
765 } else {
766 struct timeval tv;
767 SMB_BIG_INT tdif;
768
769 GetTimeOfDay(&tv);
770 tdif = usec_time_diff(&msg->end_time, &tv);
771 if (tdif <= 0) {
772 /* Timed out. Schedule...*/
773 pop_message = True;
774 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
775 } else {
776 /* Make a more accurate select timeout. */
777 to.tv_sec = tdif / 1000000;
778 to.tv_usec = tdif % 1000000;
779 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
780 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
781 }
782 }
783
784 if (pop_message) {
785
786 *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
787 msg->buf.length);
788 if (*buffer == NULL) {
789 DEBUG(0, ("talloc failed\n"));
790 return NT_STATUS_NO_MEMORY;
791 }
792 *buffer_len = msg->buf.length;
793 *p_encrypted = msg->encrypted;
794
795 /* We leave this message on the queue so the open code can
796 know this is a retry. */
797 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
798
799 /* Mark the message as processed so this is not
800 * re-processed in error. */
801 msg->processed = true;
802 return NT_STATUS_OK;
803 }
804 }
805
806 /*
807 * Setup the select fd sets.
808 */
809
810 FD_ZERO(&r_fds);
811 FD_ZERO(&w_fds);
812
813 /*
814 * Ensure we process oplock break messages by preference.
815 * We have to do this before the select, after the select
816 * and if the select returns EINTR. This is due to the fact
817 * that the selects called from async_processing can eat an EINTR
818 * caused by a signal (we can't take the break message there).
819 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
820 */
821
822 if (oplock_message_waiting(&r_fds)) {
823 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
824 async_processing(&r_fds);
825 /*
826 * After async processing we must go and do the select again, as
827 * the state of the flag in fds for the server file descriptor is
828 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
829 */
830 goto again;
831 }
832
833 /*
834 * Are there any timed events waiting ? If so, ensure we don't
835 * select for longer than it would take to wait for them.
836 */
837
838 {
839 struct timeval now;
840 GetTimeOfDay(&now);
841
842 event_add_to_select_args(smbd_event_context(), &now,
843 &r_fds, &w_fds, &to, &maxfd);
844 }
845
846 if (timeval_is_zero(&to)) {
847 /* Process a timed event now... */
848 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
849 goto again;
850 }
851 }
852
853 {
854 int sav;
855 START_PROFILE(smbd_idle);
856
857 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
858 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
859
860 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
861 sav = errno;
862
863 END_PROFILE(smbd_idle);
864 errno = sav;
865 }
866
867 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
868 goto again;
869 }
870
871 /* if we get EINTR then maybe we have received an oplock
872 signal - treat this as select returning 1. This is ugly, but
873 is the best we can do until the oplock code knows more about
874 signals */
875 if (selrtn == -1 && errno == EINTR) {
876 async_processing(&r_fds);
877 /*
878 * After async processing we must go and do the select again, as
879 * the state of the flag in fds for the server file descriptor is
880 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
881 */
882 goto again;
883 }
884
885 /* Check if error */
886 if (selrtn == -1) {
887 /* something is wrong. Maybe the socket is dead? */
888 return map_nt_error_from_unix(errno);
889 }
890
891 /* Did we timeout ? */
892 if (selrtn == 0) {
893 goto again;
894 }
895
896 /*
897 * Ensure we process oplock break messages by preference.
898 * This is IMPORTANT ! Otherwise we can starve other processes
899 * sending us an oplock break message. JRA.
900 */
901
902 if (oplock_message_waiting(&r_fds)) {
903 async_processing(&r_fds);
904 /*
905 * After async processing we must go and do the select again, as
906 * the state of the flag in fds for the server file descriptor is
907 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
908 */
909 goto again;
910 }
911
912 /*
913 * We've just woken up from a protentially long select sleep.
914 * Ensure we process local messages as we need to synchronously
915 * process any messages from other smbd's to avoid file rename race
916 * conditions. This call is cheap if there are no messages waiting.
917 * JRA.
918 */
919 message_dispatch(smbd_messaging_context());
920
921 status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
922 p_unread, p_encrypted, &len);
923
924 if (!NT_STATUS_IS_OK(status)) {
925 return status;
926 }
927
928 *buffer_len = len;
929
930 return NT_STATUS_OK;
931}
932
933/*
934 * Only allow 5 outstanding trans requests. We're allocating memory, so
935 * prevent a DoS.
936 */
937
938NTSTATUS allow_new_trans(struct trans_state *list, int mid)
939{
940 int count = 0;
941 for (; list != NULL; list = list->next) {
942
943 if (list->mid == mid) {
944 return NT_STATUS_INVALID_PARAMETER;
945 }
946
947 count += 1;
948 }
949 if (count > 5) {
950 return NT_STATUS_INSUFFICIENT_RESOURCES;
951 }
952
953 return NT_STATUS_OK;
954}
955
956/****************************************************************************
957 We're terminating and have closed all our files/connections etc.
958 If there are any pending local messages we need to respond to them
959 before termination so that other smbds don't think we just died whilst
960 holding oplocks.
961****************************************************************************/
962
963void respond_to_all_remaining_local_messages(void)
964{
965 /*
966 * Assert we have no exclusive open oplocks.
967 */
968
969 if(get_number_of_exclusive_open_oplocks()) {
970 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
971 get_number_of_exclusive_open_oplocks() ));
972 return;
973 }
974
975 process_kernel_oplocks(smbd_messaging_context(), NULL);
976
977 return;
978}
979
980
981/*
982These flags determine some of the permissions required to do an operation
983
984Note that I don't set NEED_WRITE on some write operations because they
985are used by some brain-dead clients when printing, and I don't want to
986force write permissions on print services.
987*/
988#define AS_USER (1<<0)
989#define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
990#define TIME_INIT (1<<2)
991#define CAN_IPC (1<<3) /* Must be paired with AS_USER */
992#define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
993#define DO_CHDIR (1<<6)
994
995/*
996 define a list of possible SMB messages and their corresponding
997 functions. Any message that has a NULL function is unimplemented -
998 please feel free to contribute implementations!
999*/
1000static const struct smb_message_struct {
1001 const char *name;
1002 void (*fn)(struct smb_request *req);
1003 int flags;
1004} smb_messages[256] = {
1005
1006/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1007/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1008/* 0x02 */ { "SMBopen",reply_open,AS_USER },
1009/* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1010/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1011/* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1012/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1013/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1014/* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1015/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1016/* 0x0a */ { "SMBread",reply_read,AS_USER},
1017/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1018/* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1019/* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1020/* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1021/* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1022/* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1023/* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1024/* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1025/* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1026/* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1027/* 0x15 */ { NULL, NULL, 0 },
1028/* 0x16 */ { NULL, NULL, 0 },
1029/* 0x17 */ { NULL, NULL, 0 },
1030/* 0x18 */ { NULL, NULL, 0 },
1031/* 0x19 */ { NULL, NULL, 0 },
1032/* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1033/* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1034/* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1035/* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1036/* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1037/* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1038/* 0x20 */ { "SMBwritec", NULL,0},
1039/* 0x21 */ { NULL, NULL, 0 },
1040/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1041/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1042/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1043/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1044/* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1045/* 0x27 */ { "SMBioctl",reply_ioctl,0},
1046/* 0x28 */ { "SMBioctls", NULL,AS_USER},
1047/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1048/* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1049/* 0x2b */ { "SMBecho",reply_echo,0},
1050/* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1051/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1052/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1053/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1054/* 0x30 */ { NULL, NULL, 0 },
1055/* 0x31 */ { NULL, NULL, 0 },
1056/* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1057/* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC},
1058/* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1059/* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1060/* 0x36 */ { NULL, NULL, 0 },
1061/* 0x37 */ { NULL, NULL, 0 },
1062/* 0x38 */ { NULL, NULL, 0 },
1063/* 0x39 */ { NULL, NULL, 0 },
1064/* 0x3a */ { NULL, NULL, 0 },
1065/* 0x3b */ { NULL, NULL, 0 },
1066/* 0x3c */ { NULL, NULL, 0 },
1067/* 0x3d */ { NULL, NULL, 0 },
1068/* 0x3e */ { NULL, NULL, 0 },
1069/* 0x3f */ { NULL, NULL, 0 },
1070/* 0x40 */ { NULL, NULL, 0 },
1071/* 0x41 */ { NULL, NULL, 0 },
1072/* 0x42 */ { NULL, NULL, 0 },
1073/* 0x43 */ { NULL, NULL, 0 },
1074/* 0x44 */ { NULL, NULL, 0 },
1075/* 0x45 */ { NULL, NULL, 0 },
1076/* 0x46 */ { NULL, NULL, 0 },
1077/* 0x47 */ { NULL, NULL, 0 },
1078/* 0x48 */ { NULL, NULL, 0 },
1079/* 0x49 */ { NULL, NULL, 0 },
1080/* 0x4a */ { NULL, NULL, 0 },
1081/* 0x4b */ { NULL, NULL, 0 },
1082/* 0x4c */ { NULL, NULL, 0 },
1083/* 0x4d */ { NULL, NULL, 0 },
1084/* 0x4e */ { NULL, NULL, 0 },
1085/* 0x4f */ { NULL, NULL, 0 },
1086/* 0x50 */ { NULL, NULL, 0 },
1087/* 0x51 */ { NULL, NULL, 0 },
1088/* 0x52 */ { NULL, NULL, 0 },
1089/* 0x53 */ { NULL, NULL, 0 },
1090/* 0x54 */ { NULL, NULL, 0 },
1091/* 0x55 */ { NULL, NULL, 0 },
1092/* 0x56 */ { NULL, NULL, 0 },
1093/* 0x57 */ { NULL, NULL, 0 },
1094/* 0x58 */ { NULL, NULL, 0 },
1095/* 0x59 */ { NULL, NULL, 0 },
1096/* 0x5a */ { NULL, NULL, 0 },
1097/* 0x5b */ { NULL, NULL, 0 },
1098/* 0x5c */ { NULL, NULL, 0 },
1099/* 0x5d */ { NULL, NULL, 0 },
1100/* 0x5e */ { NULL, NULL, 0 },
1101/* 0x5f */ { NULL, NULL, 0 },
1102/* 0x60 */ { NULL, NULL, 0 },
1103/* 0x61 */ { NULL, NULL, 0 },
1104/* 0x62 */ { NULL, NULL, 0 },
1105/* 0x63 */ { NULL, NULL, 0 },
1106/* 0x64 */ { NULL, NULL, 0 },
1107/* 0x65 */ { NULL, NULL, 0 },
1108/* 0x66 */ { NULL, NULL, 0 },
1109/* 0x67 */ { NULL, NULL, 0 },
1110/* 0x68 */ { NULL, NULL, 0 },
1111/* 0x69 */ { NULL, NULL, 0 },
1112/* 0x6a */ { NULL, NULL, 0 },
1113/* 0x6b */ { NULL, NULL, 0 },
1114/* 0x6c */ { NULL, NULL, 0 },
1115/* 0x6d */ { NULL, NULL, 0 },
1116/* 0x6e */ { NULL, NULL, 0 },
1117/* 0x6f */ { NULL, NULL, 0 },
1118/* 0x70 */ { "SMBtcon",reply_tcon,0},
1119/* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1120/* 0x72 */ { "SMBnegprot",reply_negprot,0},
1121/* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1122/* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1123/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1124/* 0x76 */ { NULL, NULL, 0 },
1125/* 0x77 */ { NULL, NULL, 0 },
1126/* 0x78 */ { NULL, NULL, 0 },
1127/* 0x79 */ { NULL, NULL, 0 },
1128/* 0x7a */ { NULL, NULL, 0 },
1129/* 0x7b */ { NULL, NULL, 0 },
1130/* 0x7c */ { NULL, NULL, 0 },
1131/* 0x7d */ { NULL, NULL, 0 },
1132/* 0x7e */ { NULL, NULL, 0 },
1133/* 0x7f */ { NULL, NULL, 0 },
1134/* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1135/* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1136/* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1137/* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1138/* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1139/* 0x85 */ { NULL, NULL, 0 },
1140/* 0x86 */ { NULL, NULL, 0 },
1141/* 0x87 */ { NULL, NULL, 0 },
1142/* 0x88 */ { NULL, NULL, 0 },
1143/* 0x89 */ { NULL, NULL, 0 },
1144/* 0x8a */ { NULL, NULL, 0 },
1145/* 0x8b */ { NULL, NULL, 0 },
1146/* 0x8c */ { NULL, NULL, 0 },
1147/* 0x8d */ { NULL, NULL, 0 },
1148/* 0x8e */ { NULL, NULL, 0 },
1149/* 0x8f */ { NULL, NULL, 0 },
1150/* 0x90 */ { NULL, NULL, 0 },
1151/* 0x91 */ { NULL, NULL, 0 },
1152/* 0x92 */ { NULL, NULL, 0 },
1153/* 0x93 */ { NULL, NULL, 0 },
1154/* 0x94 */ { NULL, NULL, 0 },
1155/* 0x95 */ { NULL, NULL, 0 },
1156/* 0x96 */ { NULL, NULL, 0 },
1157/* 0x97 */ { NULL, NULL, 0 },
1158/* 0x98 */ { NULL, NULL, 0 },
1159/* 0x99 */ { NULL, NULL, 0 },
1160/* 0x9a */ { NULL, NULL, 0 },
1161/* 0x9b */ { NULL, NULL, 0 },
1162/* 0x9c */ { NULL, NULL, 0 },
1163/* 0x9d */ { NULL, NULL, 0 },
1164/* 0x9e */ { NULL, NULL, 0 },
1165/* 0x9f */ { NULL, NULL, 0 },
1166/* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1167/* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1168/* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1169/* 0xa3 */ { NULL, NULL, 0 },
1170/* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1171/* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1172/* 0xa6 */ { NULL, NULL, 0 },
1173/* 0xa7 */ { NULL, NULL, 0 },
1174/* 0xa8 */ { NULL, NULL, 0 },
1175/* 0xa9 */ { NULL, NULL, 0 },
1176/* 0xaa */ { NULL, NULL, 0 },
1177/* 0xab */ { NULL, NULL, 0 },
1178/* 0xac */ { NULL, NULL, 0 },
1179/* 0xad */ { NULL, NULL, 0 },
1180/* 0xae */ { NULL, NULL, 0 },
1181/* 0xaf */ { NULL, NULL, 0 },
1182/* 0xb0 */ { NULL, NULL, 0 },
1183/* 0xb1 */ { NULL, NULL, 0 },
1184/* 0xb2 */ { NULL, NULL, 0 },
1185/* 0xb3 */ { NULL, NULL, 0 },
1186/* 0xb4 */ { NULL, NULL, 0 },
1187/* 0xb5 */ { NULL, NULL, 0 },
1188/* 0xb6 */ { NULL, NULL, 0 },
1189/* 0xb7 */ { NULL, NULL, 0 },
1190/* 0xb8 */ { NULL, NULL, 0 },
1191/* 0xb9 */ { NULL, NULL, 0 },
1192/* 0xba */ { NULL, NULL, 0 },
1193/* 0xbb */ { NULL, NULL, 0 },
1194/* 0xbc */ { NULL, NULL, 0 },
1195/* 0xbd */ { NULL, NULL, 0 },
1196/* 0xbe */ { NULL, NULL, 0 },
1197/* 0xbf */ { NULL, NULL, 0 },
1198/* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1199/* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1200/* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1201/* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1202/* 0xc4 */ { NULL, NULL, 0 },
1203/* 0xc5 */ { NULL, NULL, 0 },
1204/* 0xc6 */ { NULL, NULL, 0 },
1205/* 0xc7 */ { NULL, NULL, 0 },
1206/* 0xc8 */ { NULL, NULL, 0 },
1207/* 0xc9 */ { NULL, NULL, 0 },
1208/* 0xca */ { NULL, NULL, 0 },
1209/* 0xcb */ { NULL, NULL, 0 },
1210/* 0xcc */ { NULL, NULL, 0 },
1211/* 0xcd */ { NULL, NULL, 0 },
1212/* 0xce */ { NULL, NULL, 0 },
1213/* 0xcf */ { NULL, NULL, 0 },
1214/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1215/* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1216/* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1217/* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1218/* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1219/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1220/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1221/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1222/* 0xd8 */ { NULL, NULL, 0 },
1223/* 0xd9 */ { NULL, NULL, 0 },
1224/* 0xda */ { NULL, NULL, 0 },
1225/* 0xdb */ { NULL, NULL, 0 },
1226/* 0xdc */ { NULL, NULL, 0 },
1227/* 0xdd */ { NULL, NULL, 0 },
1228/* 0xde */ { NULL, NULL, 0 },
1229/* 0xdf */ { NULL, NULL, 0 },
1230/* 0xe0 */ { NULL, NULL, 0 },
1231/* 0xe1 */ { NULL, NULL, 0 },
1232/* 0xe2 */ { NULL, NULL, 0 },
1233/* 0xe3 */ { NULL, NULL, 0 },
1234/* 0xe4 */ { NULL, NULL, 0 },
1235/* 0xe5 */ { NULL, NULL, 0 },
1236/* 0xe6 */ { NULL, NULL, 0 },
1237/* 0xe7 */ { NULL, NULL, 0 },
1238/* 0xe8 */ { NULL, NULL, 0 },
1239/* 0xe9 */ { NULL, NULL, 0 },
1240/* 0xea */ { NULL, NULL, 0 },
1241/* 0xeb */ { NULL, NULL, 0 },
1242/* 0xec */ { NULL, NULL, 0 },
1243/* 0xed */ { NULL, NULL, 0 },
1244/* 0xee */ { NULL, NULL, 0 },
1245/* 0xef */ { NULL, NULL, 0 },
1246/* 0xf0 */ { NULL, NULL, 0 },
1247/* 0xf1 */ { NULL, NULL, 0 },
1248/* 0xf2 */ { NULL, NULL, 0 },
1249/* 0xf3 */ { NULL, NULL, 0 },
1250/* 0xf4 */ { NULL, NULL, 0 },
1251/* 0xf5 */ { NULL, NULL, 0 },
1252/* 0xf6 */ { NULL, NULL, 0 },
1253/* 0xf7 */ { NULL, NULL, 0 },
1254/* 0xf8 */ { NULL, NULL, 0 },
1255/* 0xf9 */ { NULL, NULL, 0 },
1256/* 0xfa */ { NULL, NULL, 0 },
1257/* 0xfb */ { NULL, NULL, 0 },
1258/* 0xfc */ { NULL, NULL, 0 },
1259/* 0xfd */ { NULL, NULL, 0 },
1260/* 0xfe */ { NULL, NULL, 0 },
1261/* 0xff */ { NULL, NULL, 0 }
1262
1263};
1264
1265/*******************************************************************
1266 allocate and initialize a reply packet
1267********************************************************************/
1268
1269bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
1270 uint8_t num_words, uint32_t num_bytes)
1271{
1272 /*
1273 * Protect against integer wrap
1274 */
1275 if ((num_bytes > 0xffffff)
1276 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1277 char *msg;
1278 if (asprintf(&msg, "num_bytes too large: %u",
1279 (unsigned)num_bytes) == -1) {
1280 msg = CONST_DISCARD(char *, "num_bytes too large");
1281 }
1282 smb_panic(msg);
1283 }
1284
1285 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1286 smb_size + num_words*2 + num_bytes);
1287 if (*outbuf == NULL) {
1288 return false;
1289 }
1290
1291 construct_reply_common(inbuf, *outbuf);
1292 srv_set_message(*outbuf, num_words, num_bytes, false);
1293 /*
1294 * Zero out the word area, the caller has to take care of the bcc area
1295 * himself
1296 */
1297 if (num_words != 0) {
1298 memset(*outbuf + smb_vwv0, 0, num_words*2);
1299 }
1300
1301 return true;
1302}
1303
1304void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1305{
1306 char *outbuf;
1307 if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
1308 num_bytes)) {
1309 smb_panic("could not allocate output buffer\n");
1310 }
1311 req->outbuf = (uint8_t *)outbuf;
1312}
1313
1314
1315/*******************************************************************
1316 Dump a packet to a file.
1317********************************************************************/
1318
1319static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1320{
1321 int fd, i;
1322 char *fname = NULL;
1323 if (DEBUGLEVEL < 50) {
1324 return;
1325 }
1326
1327 if (len < 4) len = smb_len(data)+4;
1328 for (i=1;i<100;i++) {
1329 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1330 type ? "req" : "resp") == -1) {
1331 return;
1332 }
1333 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1334 if (fd != -1 || errno != EEXIST) break;
1335 }
1336 if (fd != -1) {
1337 ssize_t ret = write(fd, data, len);
1338 if (ret != len)
1339 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1340 close(fd);
1341 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1342 }
1343 SAFE_FREE(fname);
1344}
1345
1346/****************************************************************************
1347 Prepare everything for calling the actual request function, and potentially
1348 call the request function via the "new" interface.
1349
1350 Return False if the "legacy" function needs to be called, everything is
1351 prepared.
1352
1353 Return True if we're done.
1354
1355 I know this API sucks, but it is the one with the least code change I could
1356 find.
1357****************************************************************************/
1358
1359static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1360{
1361 int flags;
1362 uint16 session_tag;
1363 connection_struct *conn = NULL;
1364
1365 static uint16 last_session_tag = UID_FIELD_INVALID;
1366
1367 errno = 0;
1368
1369 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1370 * so subtract 4 from it. */
1371 if (!valid_smb_header(req->inbuf)
1372 || (size < (smb_size - 4))) {
1373 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1374 smb_len(req->inbuf)));
1375 exit_server_cleanly("Non-SMB packet");
1376 }
1377
1378 if (smb_messages[type].fn == NULL) {
1379 DEBUG(0,("Unknown message type %d!\n",type));
1380 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1381 reply_unknown_new(req, type);
1382 return NULL;
1383 }
1384
1385 flags = smb_messages[type].flags;
1386
1387 /* In share mode security we must ignore the vuid. */
1388 session_tag = (lp_security() == SEC_SHARE)
1389 ? UID_FIELD_INVALID : req->vuid;
1390 conn = req->conn;
1391
1392 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1393 (int)sys_getpid(), (unsigned long)conn));
1394
1395 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1396
1397 /* Ensure this value is replaced in the incoming packet. */
1398 SSVAL(req->inbuf,smb_uid,session_tag);
1399
1400 /*
1401 * Ensure the correct username is in current_user_info. This is a
1402 * really ugly bugfix for problems with multiple session_setup_and_X's
1403 * being done and allowing %U and %G substitutions to work correctly.
1404 * There is a reason this code is done here, don't move it unless you
1405 * know what you're doing... :-).
1406 * JRA.
1407 */
1408
1409 if (session_tag != last_session_tag) {
1410 user_struct *vuser = NULL;
1411
1412 last_session_tag = session_tag;
1413 if(session_tag != UID_FIELD_INVALID) {
1414 vuser = get_valid_user_struct(session_tag);
1415 if (vuser) {
1416 set_current_user_info(
1417 vuser->server_info->sanitized_username,
1418 vuser->server_info->unix_name,
1419 pdb_get_fullname(vuser->server_info
1420 ->sam_account),
1421 pdb_get_domain(vuser->server_info
1422 ->sam_account));
1423 }
1424 }
1425 }
1426
1427 /* Does this call need to be run as the connected user? */
1428 if (flags & AS_USER) {
1429
1430 /* Does this call need a valid tree connection? */
1431 if (!conn) {
1432 /*
1433 * Amazingly, the error code depends on the command
1434 * (from Samba4).
1435 */
1436 if (type == SMBntcreateX) {
1437 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1438 } else {
1439 reply_doserror(req, ERRSRV, ERRinvnid);
1440 }
1441 return NULL;
1442 }
1443
1444 if (!change_to_user(conn,session_tag)) {
1445 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1446 return conn;
1447 }
1448
1449 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1450
1451 /* Does it need write permission? */
1452 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1453 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1454 return conn;
1455 }
1456
1457 /* IPC services are limited */
1458 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1459 reply_doserror(req, ERRSRV,ERRaccess);
1460 return conn;
1461 }
1462 } else {
1463 /* This call needs to be run as root */
1464 change_to_root_user();
1465 }
1466
1467 /* load service specific parameters */
1468 if (conn) {
1469 if (req->encrypted) {
1470 conn->encrypted_tid = true;
1471 /* encrypted required from now on. */
1472 conn->encrypt_level = Required;
1473 } else if (ENCRYPTION_REQUIRED(conn)) {
1474 uint8 com = CVAL(req->inbuf,smb_com);
1475 if (com != SMBtrans2 && com != SMBtranss2) {
1476 exit_server_cleanly("encryption required "
1477 "on connection");
1478 return conn;
1479 }
1480 }
1481
1482 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1483 (flags & (AS_USER|DO_CHDIR)
1484 ?True:False))) {
1485 reply_doserror(req, ERRSRV, ERRaccess);
1486 return conn;
1487 }
1488 conn->num_smb_operations++;
1489 }
1490
1491 /* does this protocol need to be run as guest? */
1492 if ((flags & AS_GUEST)
1493 && (!change_to_guest() ||
1494 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1495 lp_hostsdeny(-1)))) {
1496 reply_doserror(req, ERRSRV, ERRaccess);
1497 return conn;
1498 }
1499
1500 smb_messages[type].fn(req);
1501 return req->conn;
1502}
1503
1504/****************************************************************************
1505 Construct a reply to the incoming packet.
1506****************************************************************************/
1507
1508static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1509{
1510 struct pending_message_list *pml = NULL;
1511 uint8 type = CVAL(inbuf,smb_com);
1512 connection_struct *conn;
1513 struct smb_request *req;
1514
1515 chain_size = 0;
1516 file_chain_reset();
1517 reset_chain_p();
1518
1519 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1520 smb_panic("could not allocate smb_request");
1521 }
1522 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1523
1524 conn = switch_message(type, req, size);
1525
1526 /* If this was a deferred message and it's still there and
1527 * was processed, remove it. */
1528 pml = get_open_deferred_message(req->mid);
1529 if (pml && pml->processed) {
1530 remove_deferred_open_smb_message(req->mid);
1531 }
1532
1533 if (req->unread_bytes) {
1534 /* writeX failed. drain socket. */
1535 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1536 req->unread_bytes) {
1537 smb_panic("failed to drain pending bytes");
1538 }
1539 req->unread_bytes = 0;
1540 }
1541
1542 if (req->outbuf == NULL) {
1543 return;
1544 }
1545
1546 if (CVAL(req->outbuf,0) == 0) {
1547 show_msg((char *)req->outbuf);
1548 }
1549
1550 if (!srv_send_smb(smbd_server_fd(),
1551 (char *)req->outbuf,
1552 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1553 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1554 }
1555
1556 TALLOC_FREE(req);
1557
1558 return;
1559}
1560
1561/****************************************************************************
1562 Process an smb from the client
1563****************************************************************************/
1564
1565static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1566{
1567 static int trans_num;
1568 int msg_type = CVAL(inbuf,0);
1569
1570 DO_PROFILE_INC(smb_count);
1571
1572 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1573 smb_len(inbuf) ) );
1574 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1575 (int)nread,
1576 (unsigned int)unread_bytes ));
1577
1578 if (msg_type != 0) {
1579 /*
1580 * NetBIOS session request, keepalive, etc.
1581 */
1582 reply_special(inbuf);
1583 return;
1584 }
1585
1586 show_msg(inbuf);
1587
1588 construct_reply(inbuf,nread,unread_bytes,encrypted);
1589
1590 trans_num++;
1591}
1592
1593/****************************************************************************
1594 Return a string containing the function name of a SMB command.
1595****************************************************************************/
1596
1597const char *smb_fn_name(int type)
1598{
1599 const char *unknown_name = "SMBunknown";
1600
1601 if (smb_messages[type].name == NULL)
1602 return(unknown_name);
1603
1604 return(smb_messages[type].name);
1605}
1606
1607/****************************************************************************
1608 Helper functions for contruct_reply.
1609****************************************************************************/
1610
1611static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1612
1613void add_to_common_flags2(uint32 v)
1614{
1615 common_flags2 |= v;
1616}
1617
1618void remove_from_common_flags2(uint32 v)
1619{
1620 common_flags2 &= ~v;
1621}
1622
1623void construct_reply_common(const char *inbuf, char *outbuf)
1624{
1625 srv_set_message(outbuf,0,0,false);
1626
1627 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1628 SIVAL(outbuf,smb_rcls,0);
1629 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1630 SSVAL(outbuf,smb_flg2,
1631 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1632 common_flags2);
1633 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1634
1635 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1636 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1637 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1638 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1639}
1640
1641/****************************************************************************
1642 Construct a chained reply and add it to the already made reply
1643****************************************************************************/
1644
1645void chain_reply(struct smb_request *req)
1646{
1647 static char *orig_inbuf;
1648 static int orig_size;
1649
1650 /*
1651 * Dirty little const_discard: We mess with req->inbuf, which is
1652 * declared as const. If maybe at some point this routine gets
1653 * rewritten, this const_discard could go away.
1654 */
1655 char *inbuf = CONST_DISCARD(char *, req->inbuf);
1656 int size = smb_len(req->inbuf)+4;
1657
1658 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1659 unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1660 char *inbuf2;
1661 int outsize2;
1662 int new_size;
1663 char inbuf_saved[smb_wct];
1664 char *outbuf = (char *)req->outbuf;
1665 size_t outsize = smb_len(outbuf) + 4;
1666 size_t outsize_padded;
1667 size_t padding;
1668 size_t ofs, to_move;
1669
1670 struct smb_request *req2;
1671 size_t caller_outputlen;
1672 char *caller_output;
1673
1674 /* Maybe its not chained, or it's an error packet. */
1675 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1676 SCVAL(outbuf,smb_vwv0,0xFF);
1677 return;
1678 }
1679
1680 if (chain_size == 0) {
1681 /* this is the first part of the chain */
1682 orig_inbuf = inbuf;
1683 orig_size = size;
1684 }
1685
1686 /* Validate smb_off2 */
1687 if ((smb_off2 < smb_wct - 4) || orig_size < (smb_off2 + 4 - smb_wct)) {
1688 exit_server_cleanly("Bad chained packet");
1689 return;
1690 }
1691 /*
1692 * We need to save the output the caller added to the chain so that we
1693 * can splice it into the final output buffer later.
1694 */
1695
1696 if (outsize <= smb_wct) {
1697 exit_server_cleanly("Bad chained packet");
1698 return;
1699 }
1700
1701 caller_outputlen = outsize - smb_wct;
1702
1703 caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1704
1705 if (caller_output == NULL) {
1706 /* TODO: NT_STATUS_NO_MEMORY */
1707 smb_panic("could not dup outbuf");
1708 }
1709
1710 /*
1711 * The original Win95 redirector dies on a reply to
1712 * a lockingX and read chain unless the chain reply is
1713 * 4 byte aligned. JRA.
1714 */
1715
1716 outsize_padded = (outsize + 3) & ~3;
1717 padding = outsize_padded - outsize;
1718
1719 /*
1720 * remember how much the caller added to the chain, only counting
1721 * stuff after the parameter words
1722 */
1723 chain_size += (outsize_padded - smb_wct);
1724
1725 /*
1726 * work out pointers into the original packets. The
1727 * headers on these need to be filled in
1728 */
1729 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1730
1731 /* remember the original command type */
1732 smb_com1 = CVAL(orig_inbuf,smb_com);
1733
1734 /* save the data which will be overwritten by the new headers */
1735 memcpy(inbuf_saved,inbuf2,smb_wct);
1736
1737 /* give the new packet the same header as the last part of the SMB */
1738 memmove(inbuf2,inbuf,smb_wct);
1739
1740 /* create the in buffer */
1741 SCVAL(inbuf2,smb_com,smb_com2);
1742
1743 /* work out the new size for the in buffer. */
1744 new_size = size - (inbuf2 - inbuf);
1745 if (new_size < 0) {
1746 DEBUG(0,("chain_reply: chain packet size incorrect "
1747 "(orig size = %d, offset = %d)\n",
1748 size, (int)(inbuf2 - inbuf) ));
1749 exit_server_cleanly("Bad chained packet");
1750 return;
1751 }
1752
1753 /* And set it in the header. */
1754 smb_setlen(inbuf2, new_size - 4);
1755
1756 DEBUG(3,("Chained message\n"));
1757 show_msg(inbuf2);
1758
1759 if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1760 smb_panic("could not allocate smb_request");
1761 }
1762 init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1763
1764 /* process the request */
1765 switch_message(smb_com2, req2, new_size);
1766
1767 /*
1768 * We don't accept deferred operations in chained requests.
1769 */
1770 SMB_ASSERT(req2->outbuf != NULL);
1771 outsize2 = smb_len(req2->outbuf)+4;
1772
1773 /*
1774 * Move away the new command output so that caller_output fits in,
1775 * copy in the caller_output saved above.
1776 */
1777
1778 SMB_ASSERT(outsize_padded >= smb_wct);
1779
1780 /*
1781 * "ofs" is the space we need for caller_output. Equal to
1782 * caller_outputlen plus the padding.
1783 */
1784
1785 ofs = outsize_padded - smb_wct;
1786
1787 /*
1788 * "to_move" is the amount of bytes the secondary routine gave us
1789 */
1790
1791 to_move = outsize2 - smb_wct;
1792
1793 if (to_move + ofs + smb_wct + chain_size > max_send) {
1794 smb_panic("replies too large -- would have to cut");
1795 }
1796
1797 /*
1798 * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1799 * the first request in the chain. So we have to re-allocate it. In
1800 * the "old" API the only outbuf ever used is the global OutBuffer
1801 * which is always large enough.
1802 */
1803
1804 outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1805 to_move + ofs + smb_wct);
1806 if (outbuf == NULL) {
1807 smb_panic("could not realloc outbuf");
1808 }
1809
1810 req->outbuf = (uint8 *)outbuf;
1811
1812 memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1813 memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1814
1815 /*
1816 * copy the new reply header over the old one but preserve the smb_com
1817 * field
1818 */
1819 memmove(outbuf, req2->outbuf, smb_wct);
1820 SCVAL(outbuf, smb_com, smb_com1);
1821
1822 /*
1823 * We've just copied in the whole "wct" area from the secondary
1824 * function. Fix up the chaining: com2 and the offset need to be
1825 * readjusted.
1826 */
1827
1828 SCVAL(outbuf, smb_vwv0, smb_com2);
1829 SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1830
1831 if (padding != 0) {
1832
1833 /*
1834 * Due to padding we have some uninitialized bytes after the
1835 * caller's output
1836 */
1837
1838 memset(outbuf + outsize, 0, padding);
1839 }
1840
1841 smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1842
1843 /*
1844 * restore the saved data, being careful not to overwrite any data
1845 * from the reply header
1846 */
1847 memcpy(inbuf2,inbuf_saved,smb_wct);
1848
1849 SAFE_FREE(caller_output);
1850 TALLOC_FREE(req2);
1851
1852 /*
1853 * Reset the chain_size for our caller's offset calculations
1854 */
1855
1856 chain_size -= (outsize_padded - smb_wct);
1857
1858 return;
1859}
1860
1861/****************************************************************************
1862 Check if services need reloading.
1863****************************************************************************/
1864
1865void check_reload(time_t t)
1866{
1867 static pid_t mypid = 0;
1868 static time_t last_smb_conf_reload_time = 0;
1869 static time_t last_printer_reload_time = 0;
1870 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1871
1872 if(last_smb_conf_reload_time == 0) {
1873 last_smb_conf_reload_time = t;
1874 /* Our printing subsystem might not be ready at smbd start up.
1875 Then no printer is available till the first printers check
1876 is performed. A lower initial interval circumvents this. */
1877 if ( printcap_cache_time > 60 )
1878 last_printer_reload_time = t - printcap_cache_time + 60;
1879 else
1880 last_printer_reload_time = t;
1881 }
1882
1883 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1884 /* randomize over 60 second the printcap reload to avoid all
1885 * process hitting cupsd at the same time */
1886 int time_range = 60;
1887
1888 last_printer_reload_time += random() % time_range;
1889 mypid = getpid();
1890 }
1891
1892 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1893 reload_services(True);
1894 reload_after_sighup = False;
1895 last_smb_conf_reload_time = t;
1896 }
1897
1898 /* 'printcap cache time = 0' disable the feature */
1899
1900 if ( printcap_cache_time != 0 )
1901 {
1902 /* see if it's time to reload or if the clock has been set back */
1903
1904 if ( (t >= last_printer_reload_time+printcap_cache_time)
1905 || (t-last_printer_reload_time < 0) )
1906 {
1907 DEBUG( 3,( "Printcap cache time expired.\n"));
1908 reload_printers();
1909 last_printer_reload_time = t;
1910 }
1911 }
1912}
1913
1914/****************************************************************************
1915 Process commands from the client
1916****************************************************************************/
1917
1918void smbd_process(void)
1919{
1920 unsigned int num_smbs = 0;
1921 size_t unread_bytes = 0;
1922
1923 char addr[INET6_ADDRSTRLEN];
1924
1925 /*
1926 * Before the first packet, check the global hosts allow/ hosts deny
1927 * parameters before doing any parsing of packets passed to us by the
1928 * client. This prevents attacks on our parsing code from hosts not in
1929 * the hosts allow list.
1930 */
1931
1932 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1933 lp_hostsdeny(-1))) {
1934 /*
1935 * send a negative session response "not listening on calling
1936 * name"
1937 */
1938 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1939 DEBUG( 1, ("Connection denied from %s\n",
1940 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1941 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1942 exit_server_cleanly("connection denied");
1943 }
1944
1945 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1946
1947 while (True) {
1948 NTSTATUS status;
1949 char *inbuf = NULL;
1950 size_t inbuf_len = 0;
1951 bool encrypted = false;
1952 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1953
1954 errno = 0;
1955
1956 run_events(smbd_event_context(), 0, NULL, NULL);
1957
1958 status = receive_message_or_smb(
1959 talloc_tos(), &inbuf, &inbuf_len,
1960 &unread_bytes, &encrypted);
1961
1962 if (!NT_STATUS_IS_OK(status)) {
1963 DEBUG(3, ("receive_message_or_smb failed: %s, "
1964 "exiting\n", nt_errstr(status)));
1965 return;
1966 }
1967
1968 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1969
1970 TALLOC_FREE(inbuf);
1971
1972 num_smbs++;
1973
1974 /* The timeout_processing function isn't run nearly
1975 often enough to implement 'max log size' without
1976 overrunning the size of the file by many megabytes.
1977 This is especially true if we are running at debug
1978 level 10. Checking every 50 SMBs is a nice
1979 tradeoff of performance vs log file size overrun. */
1980
1981 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1982 change_to_root_user();
1983 check_log_size();
1984 }
1985 TALLOC_FREE(frame);
1986 }
1987}
Note: See TracBrowser for help on using the repository browser.