?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r6369: update release notes
[Samba.git] / source / smbd / nttrans.c
blobd747e84a3a5ee1162cbe6ad800f5a8dbe621ffae
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int max_send;
25 extern enum protocol_types Protocol;
26 extern int smb_read_error;
27 extern int global_oplock_break;
28 extern struct current_user current_user;
29
30 static const char *known_nt_pipes[] = {
31 "\\LANMAN",
32 "\\srvsvc",
33 "\\samr",
34 "\\wkssvc",
35 "\\NETLOGON",
36 "\\ntlsa",
37 "\\ntsvcs",
38 "\\lsass",
39 "\\lsarpc",
40 "\\winreg",
41 "\\spoolss",
42 "\\netdfs",
43 "\\rpcecho",
44 "\\svcctl",
45 "\\eventlog",
46 NULL
47 };
48
49 /* Map generic permissions to file object specific permissions */
50
51 struct generic_mapping file_generic_mapping = {
52 FILE_GENERIC_READ,
53 FILE_GENERIC_WRITE,
54 FILE_GENERIC_EXECUTE,
55 FILE_GENERIC_ALL
56 };
57
58 static char *nttrans_realloc(char **ptr, size_t size)
59 {
60 char *tptr = NULL;
61 if (ptr==NULL)
62 smb_panic("nttrans_realloc() called with NULL ptr\n");
63
64 tptr = SMB_REALLOC(*ptr, size);
65 if(tptr == NULL) {
66 *ptr = NULL;
67 return NULL;
68 }
69 memset(tptr,'\0',size);
70
71 *ptr = tptr;
72
73 return tptr;
74 }
75
76
77 /****************************************************************************
78 Send the required number of replies back.
79 We assume all fields other than the data fields are
80 set correctly for the type of call.
81 HACK ! Always assumes smb_setup field is zero.
82 ****************************************************************************/
83
84 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
85 int paramsize, char *pdata, int datasize)
86 {
87 int data_to_send = datasize;
88 int params_to_send = paramsize;
89 int useable_space;
90 char *pp = params;
91 char *pd = pdata;
92 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
93 int alignment_offset = 3;
94 int data_alignment_offset = 0;
95
96 /*
97 * Initially set the wcnt area to be 18 - this is true for all
98 * transNT replies.
99 */
100
101 set_message(outbuf,18,0,True);
102
103 if (NT_STATUS_V(nt_error))
104 ERROR_NT(nt_error);
105
106 /*
107 * If there genuinely are no parameters or data to send just send
108 * the empty packet.
109 */
110
111 if(params_to_send == 0 && data_to_send == 0) {
112 if (!send_smb(smbd_server_fd(),outbuf))
113 exit_server("send_nt_replies: send_smb failed.");
114 return 0;
115 }
116
117 /*
118 * When sending params and data ensure that both are nicely aligned.
119 * Only do this alignment when there is also data to send - else
120 * can cause NT redirector problems.
121 */
122
123 if (((params_to_send % 4) != 0) && (data_to_send != 0))
124 data_alignment_offset = 4 - (params_to_send % 4);
125
126 /*
127 * Space is bufsize minus Netbios over TCP header minus SMB header.
128 * The alignment_offset is to align the param bytes on a four byte
129 * boundary (2 bytes for data len, one byte pad).
130 * NT needs this to work correctly.
131 */
132
133 useable_space = bufsize - ((smb_buf(outbuf)+
134 alignment_offset+data_alignment_offset) -
135 outbuf);
136
137 /*
138 * useable_space can never be more than max_send minus the
139 * alignment offset.
140 */
141
142 useable_space = MIN(useable_space,
143 max_send - (alignment_offset+data_alignment_offset));
144
145
146 while (params_to_send || data_to_send) {
147
148 /*
149 * Calculate whether we will totally or partially fill this packet.
150 */
151
152 total_sent_thistime = params_to_send + data_to_send +
153 alignment_offset + data_alignment_offset;
154
155 /*
156 * We can never send more than useable_space.
157 */
158
159 total_sent_thistime = MIN(total_sent_thistime, useable_space);
160
161 set_message(outbuf, 18, total_sent_thistime, True);
162
163 /*
164 * Set total params and data to be sent.
165 */
166
167 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
168 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
169
170 /*
171 * Calculate how many parameters and data we can fit into
172 * this packet. Parameters get precedence.
173 */
174
175 params_sent_thistime = MIN(params_to_send,useable_space);
176 data_sent_thistime = useable_space - params_sent_thistime;
177 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
178
179 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
180
181 if(params_sent_thistime == 0) {
182 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
183 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
184 } else {
185 /*
186 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
187 * parameter bytes, however the first 4 bytes of outbuf are
188 * the Netbios over TCP header. Thus use smb_base() to subtract
189 * them from the calculation.
190 */
191
192 SIVAL(outbuf,smb_ntr_ParameterOffset,
193 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
194 /*
195 * Absolute displacement of param bytes sent in this packet.
196 */
197
198 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
199 }
200
201 /*
202 * Deal with the data portion.
203 */
204
205 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
206
207 if(data_sent_thistime == 0) {
208 SIVAL(outbuf,smb_ntr_DataOffset,0);
209 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
210 } else {
211 /*
212 * The offset of the data bytes is the offset of the
213 * parameter bytes plus the number of parameters being sent this time.
214 */
215
216 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
217 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
218 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
219 }
220
221 /*
222 * Copy the param bytes into the packet.
223 */
224
225 if(params_sent_thistime)
226 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
227
228 /*
229 * Copy in the data bytes
230 */
231
232 if(data_sent_thistime)
233 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
234 data_alignment_offset,pd,data_sent_thistime);
235
236 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
237 params_sent_thistime, data_sent_thistime, useable_space));
238 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
239 params_to_send, data_to_send, paramsize, datasize));
240
241 /* Send the packet */
242 if (!send_smb(smbd_server_fd(),outbuf))
243 exit_server("send_nt_replies: send_smb failed.");
244
245 pp += params_sent_thistime;
246 pd += data_sent_thistime;
247
248 params_to_send -= params_sent_thistime;
249 data_to_send -= data_sent_thistime;
250
251 /*
252 * Sanity check
253 */
254
255 if(params_to_send < 0 || data_to_send < 0) {
256 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
257 params_to_send, data_to_send));
258 return -1;
259 }
260 }
261
262 return 0;
263 }
264
265 /****************************************************************************
266 Save case statics.
267 ****************************************************************************/
268
269 static BOOL saved_case_sensitive;
270 static BOOL saved_case_preserve;
271 static BOOL saved_short_case_preserve;
272
273 /****************************************************************************
274 Save case semantics.
275 ****************************************************************************/
276
277 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
278 {
279 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
280 return;
281
282 saved_case_sensitive = conn->case_sensitive;
283 saved_case_preserve = conn->case_preserve;
284 saved_short_case_preserve = conn->short_case_preserve;
285
286 /* Set to POSIX. */
287 conn->case_sensitive = True;
288 conn->case_preserve = True;
289 conn->short_case_preserve = True;
290 }
291
292 /****************************************************************************
293 Restore case semantics.
294 ****************************************************************************/
295
296 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
297 {
298 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
299 return;
300
301 conn->case_sensitive = saved_case_sensitive;
302 conn->case_preserve = saved_case_preserve;
303 conn->short_case_preserve = saved_short_case_preserve;
304 }
305
306 /****************************************************************************
307 Utility function to map create disposition.
308 ****************************************************************************/
309
310 static int map_create_disposition( uint32 create_disposition)
311 {
312 int ret;
313
314 switch( create_disposition ) {
315 case FILE_CREATE:
316 /* create if not exist, fail if exist */
317 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL);
318 break;
319 case FILE_SUPERSEDE:
320 case FILE_OVERWRITE_IF:
321 /* create if not exist, trunc if exist */
322 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
323 break;
324 case FILE_OPEN:
325 /* fail if not exist, open if exists */
326 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN);
327 break;
328 case FILE_OPEN_IF:
329 /* create if not exist, open if exists */
330 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_OPEN);
331 break;
332 case FILE_OVERWRITE:
333 /* fail if not exist, truncate if exists */
334 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
335 break;
336 default:
337 DEBUG(0,("map_create_disposition: Incorrect value for create_disposition = %d\n",
338 create_disposition ));
339 return -1;
340 }
341
342 DEBUG(10,("map_create_disposition: Mapped create_disposition 0x%lx to 0x%x\n",
343 (unsigned long)create_disposition, ret ));
344
345 return ret;
346 }
347
348 /****************************************************************************
349 Utility function to map share modes.
350 ****************************************************************************/
351
352 static int map_share_mode( char *fname, uint32 create_options,
353 uint32 *desired_access, uint32 share_access, uint32 file_attributes)
354 {
355 int smb_open_mode = -1;
356 uint32 original_desired_access = *desired_access;
357
358 /* This is a nasty hack - must fix... JRA. */
359 if (*desired_access == MAXIMUM_ALLOWED_ACCESS) {
360 *desired_access = FILE_GENERIC_ALL;
361 }
362
363 /*
364 * Convert GENERIC bits to specific bits.
365 */
366
367 se_map_generic(desired_access, &file_generic_mapping);
368
369 switch( *desired_access & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA) ) {
370 case FILE_READ_DATA:
371 smb_open_mode = DOS_OPEN_RDONLY;
372 break;
373 case FILE_WRITE_DATA:
374 case FILE_APPEND_DATA:
375 case FILE_WRITE_DATA|FILE_APPEND_DATA:
376 smb_open_mode = DOS_OPEN_WRONLY;
377 break;
378 case FILE_READ_DATA|FILE_WRITE_DATA:
379 case FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA:
380 case FILE_READ_DATA|FILE_APPEND_DATA:
381 smb_open_mode = DOS_OPEN_RDWR;
382 break;
383 }
384
385 /*
386 * NB. For DELETE_ACCESS we should really check the
387 * directory permissions, as that is what controls
388 * delete, and for WRITE_DAC_ACCESS we should really
389 * check the ownership, as that is what controls the
390 * chmod. Note that this is *NOT* a security hole (this
391 * note is for you, Andrew) as we are not *allowing*
392 * the access at this point, the actual unlink or
393 * chown or chmod call would do this. We are just helping
394 * clients out by telling them if they have a hope
395 * of any of this succeeding. POSIX acls may still
396 * deny the real call. JRA.
397 */
398
399 if (smb_open_mode == -1) {
400
401 if(*desired_access & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS|
402 FILE_EXECUTE|FILE_READ_ATTRIBUTES|
403 FILE_READ_EA|FILE_WRITE_EA|SYSTEM_SECURITY_ACCESS|
404 FILE_WRITE_ATTRIBUTES|READ_CONTROL_ACCESS)) {
405 smb_open_mode = DOS_OPEN_RDONLY;
406 } else if(*desired_access == 0) {
407
408 /*
409 * JRA - NT seems to sometimes send desired_access as zero. play it safe
410 * and map to a stat open.
411 */
412
413 smb_open_mode = DOS_OPEN_RDONLY;
414
415 } else {
416 DEBUG(0,("map_share_mode: Incorrect value 0x%lx for desired_access to file %s\n",
417 (unsigned long)*desired_access, fname));
418 return -1;
419 }
420 }
421
422 /*
423 * Set the special bit that means allow share delete.
424 * This is held outside the normal share mode bits at 1<<15.
425 * JRA.
426 */
427
428 if(share_access & FILE_SHARE_DELETE) {
429 smb_open_mode |= ALLOW_SHARE_DELETE;
430 DEBUG(10,("map_share_mode: FILE_SHARE_DELETE requested. open_mode = 0x%x\n", smb_open_mode));
431 }
432
433 if(*desired_access & DELETE_ACCESS) {
434 DEBUG(10,("map_share_mode: DELETE_ACCESS requested. open_mode = 0x%x\n", smb_open_mode));
435 }
436
437 /*
438 * We need to store the intent to open for Delete. This
439 * is what determines if a delete on close flag can be set.
440 * This is the wrong way (and place) to store this, but for 2.2 this
441 * is the only practical way. JRA.
442 */
443
444 if (create_options & FILE_DELETE_ON_CLOSE) {
445 /*
446 * W2K3 bug compatibility mode... To set delete on close
447 * the redirector must have *specifically* set DELETE_ACCESS
448 * in the desired_access field. Just asking for GENERIC_ALL won't do. JRA.
449 */
450
451 if (!(original_desired_access & DELETE_ACCESS)) {
452 DEBUG(5,("map_share_mode: FILE_DELETE_ON_CLOSE requested without \
453 DELETE_ACCESS for file %s. (desired_access = 0x%lx)\n",
454 fname, (unsigned long)*desired_access));
455 return -1;
456 }
457 /* Implicit delete access is *NOT* requested... */
458 smb_open_mode |= DELETE_ON_CLOSE_FLAG;
459 DEBUG(10,("map_share_mode: FILE_DELETE_ON_CLOSE requested. open_mode = 0x%x\n", smb_open_mode));
460 }
461
462 /* Add in the requested share mode. */
463 switch( share_access & (FILE_SHARE_READ|FILE_SHARE_WRITE)) {
464 case FILE_SHARE_READ:
465 smb_open_mode |= SET_DENY_MODE(DENY_WRITE);
466 break;
467 case FILE_SHARE_WRITE:
468 smb_open_mode |= SET_DENY_MODE(DENY_READ);
469 break;
470 case (FILE_SHARE_READ|FILE_SHARE_WRITE):
471 smb_open_mode |= SET_DENY_MODE(DENY_NONE);
472 break;
473 case FILE_SHARE_NONE:
474 smb_open_mode |= SET_DENY_MODE(DENY_ALL);
475 break;
476 }
477
478 /*
479 * Handle an O_SYNC request.
480 */
481
482 if(file_attributes & FILE_FLAG_WRITE_THROUGH)
483 smb_open_mode |= FILE_SYNC_OPENMODE;
484
485 DEBUG(10,("map_share_mode: Mapped desired access 0x%lx, share access 0x%lx, file attributes 0x%lx \
486 to open_mode 0x%x\n", (unsigned long)*desired_access, (unsigned long)share_access,
487 (unsigned long)file_attributes, smb_open_mode ));
488
489 return smb_open_mode;
490 }
491
492 /****************************************************************************
493 Reply to an NT create and X call on a pipe.
494 ****************************************************************************/
495
496 static int nt_open_pipe(char *fname, connection_struct *conn,
497 char *inbuf, char *outbuf, int *ppnum)
498 {
499 smb_np_struct *p = NULL;
500
501 uint16 vuid = SVAL(inbuf, smb_uid);
502 int i;
503
504 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
505
506 /* See if it is one we want to handle. */
507
508 if (lp_disable_spoolss() && strequal(fname, "\\spoolss"))
509 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
510
511 for( i = 0; known_nt_pipes[i]; i++ )
512 if( strequal(fname,known_nt_pipes[i]))
513 break;
514
515 if ( known_nt_pipes[i] == NULL )
516 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
517
518 /* Strip \\ off the name. */
519 fname++;
520
521 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
522
523 p = open_rpc_pipe_p(fname, conn, vuid);
524 if (!p)
525 return(ERROR_DOS(ERRSRV,ERRnofids));
526
527 *ppnum = p->pnum;
528
529 return 0;
530 }
531
532 /****************************************************************************
533 Reply to an NT create and X call for pipes.
534 ****************************************************************************/
535
536 static int do_ntcreate_pipe_open(connection_struct *conn,
537 char *inbuf,char *outbuf,int length,int bufsize)
538 {
539 pstring fname;
540 int ret;
541 int pnum = -1;
542 char *p = NULL;
543
544 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
545
546 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
547 return ret;
548
549 /*
550 * Deal with pipe return.
551 */
552
553 set_message(outbuf,34,0,True);
554
555 p = outbuf + smb_vwv2;
556 p++;
557 SSVAL(p,0,pnum);
558 p += 2;
559 SIVAL(p,0,FILE_WAS_OPENED);
560 p += 4;
561 p += 32;
562 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
563 p += 20;
564 /* File type. */
565 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
566 /* Device state. */
567 SSVAL(p,2, 0x5FF); /* ? */
568
569 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
570
571 return chain_reply(inbuf,outbuf,length,bufsize);
572 }
573
574 /****************************************************************************
575 Reply to an NT create and X call.
576 ****************************************************************************/
577
578 int reply_ntcreate_and_X(connection_struct *conn,
579 char *inbuf,char *outbuf,int length,int bufsize)
580 {
581 int result;
582 pstring fname;
583 enum FAKE_FILE_TYPE fake_file_type = FAKE_FILE_TYPE_NONE;
584 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
585 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
586 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
587 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
588 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
589 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
590 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
591 int smb_ofun;
592 int smb_open_mode;
593 /* Breakout the oplock request bits so we can set the
594 reply bits separately. */
595 int oplock_request = 0;
596 int fmode=0,rmode=0;
597 SMB_OFF_T file_len = 0;
598 SMB_STRUCT_STAT sbuf;
599 int smb_action = 0;
600 BOOL bad_path = False;
601 files_struct *fsp=NULL;
602 char *p = NULL;
603 time_t c_time;
604 BOOL extended_oplock_granted = False;
605 NTSTATUS status;
606
607 START_PROFILE(SMBntcreateX);
608
609 DEBUG(10,("reply_ntcreateX: flags = 0x%x, desired_access = 0x%x \
610 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
611 create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attributes,
612 share_access, create_disposition,
613 create_options, root_dir_fid ));
614
615 /* If it's an IPC, use the pipe handler. */
616
617 if (IS_IPC(conn)) {
618 if (lp_nt_pipe_support()) {
619 END_PROFILE(SMBntcreateX);
620 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
621 } else {
622 END_PROFILE(SMBntcreateX);
623 return(ERROR_DOS(ERRDOS,ERRnoaccess));
624 }
625 }
626
627 if (create_options & FILE_OPEN_BY_FILE_ID) {
628 END_PROFILE(SMBntcreateX);
629 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
630 }
631
632 /*
633 * We need to construct the open_and_X ofun value from the
634 * NT values, as that's what our code is structured to accept.
635 */
636
637 if((smb_ofun = map_create_disposition( create_disposition )) == -1) {
638 END_PROFILE(SMBntcreateX);
639 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
640 }
641
642 /*
643 * Get the file name.
644 */
645
646 if(root_dir_fid != 0) {
647 /*
648 * This filename is relative to a directory fid.
649 */
650 pstring rel_fname;
651 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
652 size_t dir_name_len;
653
654 if(!dir_fsp) {
655 END_PROFILE(SMBntcreateX);
656 return(ERROR_DOS(ERRDOS,ERRbadfid));
657 }
658
659 if(!dir_fsp->is_directory) {
660
661 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
662 if (!NT_STATUS_IS_OK(status)) {
663 END_PROFILE(SMBntcreateX);
664 return ERROR_NT(status);
665 }
666
667 /*
668 * Check to see if this is a mac fork of some kind.
669 */
670
671 if( strchr_m(fname, ':')) {
672 END_PROFILE(SMBntcreateX);
673 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
674 }
675
676 /*
677 we need to handle the case when we get a
678 relative open relative to a file and the
679 pathname is blank - this is a reopen!
680 (hint from demyn plantenberg)
681 */
682
683 END_PROFILE(SMBntcreateX);
684 return(ERROR_DOS(ERRDOS,ERRbadfid));
685 }
686
687 /*
688 * Copy in the base directory name.
689 */
690
691 pstrcpy( fname, dir_fsp->fsp_name );
692 dir_name_len = strlen(fname);
693
694 /*
695 * Ensure it ends in a '\'.
696 */
697
698 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
699 pstrcat(fname, "/");
700 dir_name_len++;
701 }
702
703 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status,False);
704 if (!NT_STATUS_IS_OK(status)) {
705 END_PROFILE(SMBntcreateX);
706 return ERROR_NT(status);
707 }
708 pstrcat(fname, rel_fname);
709 } else {
710 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
711 if (!NT_STATUS_IS_OK(status)) {
712 END_PROFILE(SMBntcreateX);
713 return ERROR_NT(status);
714 }
715
716 /*
717 * Check to see if this is a mac fork of some kind.
718 */
719
720 if( strchr_m(fname, ':')) {
721
722 #ifdef HAVE_SYS_QUOTAS
723 if ((fake_file_type=is_fake_file(fname))!=FAKE_FILE_TYPE_NONE) {
724 /*
725 * here we go! support for changing the disk quotas --metze
726 *
727 * we need to fake up to open this MAGIC QUOTA file
728 * and return a valid FID
729 *
730 * w2k close this file directly after openening
731 * xp also tries a QUERY_FILE_INFO on the file and then close it
732 */
733 } else {
734 #endif
735 END_PROFILE(SMBntcreateX);
736 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
737 #ifdef HAVE_SYS_QUOTAS
738 }
739 #endif
740 }
741 }
742
743 /*
744 * Now contruct the smb_open_mode value from the filename,
745 * desired access and the share access.
746 */
747 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
748
749 if((smb_open_mode = map_share_mode(fname, create_options, &desired_access,
750 share_access,
751 file_attributes)) == -1) {
752 END_PROFILE(SMBntcreateX);
753 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
754 }
755
756 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
757 if (oplock_request) {
758 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
759 }
760
761 /*
762 * Ordinary file or directory.
763 */
764
765 /*
766 * Check if POSIX semantics are wanted.
767 */
768
769 set_posix_case_semantics(conn, file_attributes);
770
771 unix_convert(fname,conn,0,&bad_path,&sbuf);
772
773 /* FAKE_FILE is a special case */
774 if (fake_file_type == FAKE_FILE_TYPE_NONE) {
775 /* Normal file. */
776 if (bad_path) {
777 restore_case_semantics(conn, file_attributes);
778 END_PROFILE(SMBntcreateX);
779 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
780 }
781 /* All file access must go through check_name() */
782 if (!check_name(fname,conn)) {
783 restore_case_semantics(conn, file_attributes);
784 END_PROFILE(SMBntcreateX);
785 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
786 }
787 }
788
789 #if 0
790 /* This is the correct thing to do (check every time) but can_delete is
791 expensive (it may have to read the parent directory permissions). So
792 for now we're not doing it unless we have a strong hint the client
793 is really going to delete this file. */
794 if (desired_access & DELETE_ACCESS) {
795 #else
796 /* Setting FILE_SHARE_DELETE is the hint. */
797 if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
798 #endif
799 status = can_delete(conn, fname, file_attributes, bad_path, True);
800 /* We're only going to fail here if it's access denied, as that's the
801 only error we care about for "can we delete this ?" questions. */
802 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
803 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
804 restore_case_semantics(conn, file_attributes);
805 END_PROFILE(SMBntcreateX);
806 return ERROR_NT(status);
807 }
808 }
809
810 /*
811 * If it's a request for a directory open, deal with it separately.
812 */
813
814 if(create_options & FILE_DIRECTORY_FILE) {
815 oplock_request = 0;
816
817 /* Can't open a temp directory. IFS kit test. */
818 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
819 END_PROFILE(SMBntcreateX);
820 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
821 }
822
823 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
824
825 restore_case_semantics(conn, file_attributes);
826
827 if(!fsp) {
828 END_PROFILE(SMBntcreateX);
829 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
830 }
831 } else {
832 /*
833 * Ordinary file case.
834 */
835
836 /* NB. We have a potential bug here. If we
837 * cause an oplock break to ourselves, then we
838 * could end up processing filename related
839 * SMB requests whilst we await the oplock
840 * break response. As we may have changed the
841 * filename case semantics to be POSIX-like,
842 * this could mean a filename request could
843 * fail when it should succeed. This is a rare
844 * condition, but eventually we must arrange
845 * to restore the correct case semantics
846 * before issuing an oplock break request to
847 * our client. JRA. */
848
849 if (fake_file_type==FAKE_FILE_TYPE_NONE) {
850 fsp = open_file_shared1(conn,fname,&sbuf,
851 desired_access,
852 smb_open_mode,
853 smb_ofun,file_attributes,oplock_request,
854 &rmode,&smb_action);
855 } else {
856 /* to open a fake_file --metze */
857 fsp = open_fake_file_shared1(fake_file_type,conn,fname,&sbuf,
858 desired_access,
859 smb_open_mode,
860 smb_ofun,file_attributes, oplock_request,
861 &rmode,&smb_action);
862 }
863
864 if (!fsp) {
865 /* We cheat here. There are two cases we
866 * care about. One is a directory rename,
867 * where the NT client will attempt to
868 * open the source directory for
869 * DELETE access. Note that when the
870 * NT client does this it does *not*
871 * set the directory bit in the
872 * request packet. This is translated
873 * into a read/write open
874 * request. POSIX states that any open
875 * for write request on a directory
876 * will generate an EISDIR error, so
877 * we can catch this here and open a
878 * pseudo handle that is flagged as a
879 * directory. The second is an open
880 * for a permissions read only, which
881 * we handle in the open_file_stat case. JRA.
882 */
883
884 if(errno == EISDIR) {
885
886 /*
887 * Fail the open if it was explicitly a non-directory file.
888 */
889
890 if (create_options & FILE_NON_DIRECTORY_FILE) {
891 restore_case_semantics(conn, file_attributes);
892 END_PROFILE(SMBntcreateX);
893 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
894 }
895
896 oplock_request = 0;
897 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
898
899 if(!fsp) {
900 restore_case_semantics(conn, file_attributes);
901 END_PROFILE(SMBntcreateX);
902 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
903 }
904 } else {
905
906 restore_case_semantics(conn, file_attributes);
907 END_PROFILE(SMBntcreateX);
908 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
909 /* We have re-scheduled this call. */
910 return -1;
911 }
912 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
913 }
914 }
915 }
916
917 restore_case_semantics(conn, file_attributes);
918
919 file_len = sbuf.st_size;
920 fmode = dos_mode(conn,fname,&sbuf);
921 if(fmode == 0) {
922 fmode = FILE_ATTRIBUTE_NORMAL;
923 }
924 if (!fsp->is_directory && (fmode & aDIR)) {
925 close_file(fsp,False);
926 END_PROFILE(SMBntcreateX);
927 return ERROR_DOS(ERRDOS,ERRnoaccess);
928 }
929
930 /* Save the requested allocation size. */
931 if ((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) {
932 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
933 #ifdef LARGE_SMB_OFF_T
934 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
935 #endif
936 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
937 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
938 if (fsp->is_directory) {
939 close_file(fsp,False);
940 END_PROFILE(SMBntcreateX);
941 /* Can't set allocation size on a directory. */
942 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
943 }
944 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
945 close_file(fsp,False);
946 END_PROFILE(SMBntcreateX);
947 return ERROR_NT(NT_STATUS_DISK_FULL);
948 }
949 } else {
950 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
951 }
952 }
953
954 /*
955 * If the caller set the extended oplock request bit
956 * and we granted one (by whatever means) - set the
957 * correct bit for extended oplock reply.
958 */
959
960 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
961 extended_oplock_granted = True;
962 }
963
964 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
965 extended_oplock_granted = True;
966 }
967
968 #if 0
969 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
970 set_message(outbuf,42,0,True);
971 #else
972 set_message(outbuf,34,0,True);
973 #endif
974
975 p = outbuf + smb_vwv2;
976
977 /*
978 * Currently as we don't support level II oplocks we just report
979 * exclusive & batch here.
980 */
981
982 if (extended_oplock_granted) {
983 if (flags & REQUEST_BATCH_OPLOCK) {
984 SCVAL(p,0, BATCH_OPLOCK_RETURN);
985 } else {
986 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
987 }
988 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
989 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
990 } else {
991 SCVAL(p,0,NO_OPLOCK_RETURN);
992 }
993
994 p++;
995 SSVAL(p,0,fsp->fnum);
996 p += 2;
997 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
998 SIVAL(p,0,FILE_WAS_SUPERSEDED);
999 else
1000 SIVAL(p,0,smb_action);
1001 p += 4;
1002
1003 /* Create time. */
1004 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1005
1006 if (lp_dos_filetime_resolution(SNUM(conn))) {
1007 c_time &= ~1;
1008 sbuf.st_atime &= ~1;
1009 sbuf.st_mtime &= ~1;
1010 sbuf.st_mtime &= ~1;
1011 }
1012
1013 put_long_date(p,c_time);
1014 p += 8;
1015 put_long_date(p,sbuf.st_atime); /* access time */
1016 p += 8;
1017 put_long_date(p,sbuf.st_mtime); /* write time */
1018 p += 8;
1019 put_long_date(p,sbuf.st_mtime); /* change time */
1020 p += 8;
1021 SIVAL(p,0,fmode); /* File Attributes. */
1022 p += 4;
1023 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1024 p += 8;
1025 SOFF_T(p,0,file_len);
1026 p += 8;
1027 if (flags & EXTENDED_RESPONSE_REQUIRED)
1028 SSVAL(p,2,0x7);
1029 p += 4;
1030 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1031
1032 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
1033
1034 result = chain_reply(inbuf,outbuf,length,bufsize);
1035 END_PROFILE(SMBntcreateX);
1036 return result;
1037 }
1038
1039 /****************************************************************************
1040 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1041 ****************************************************************************/
1042
1043 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1044 char **ppsetup, uint32 setup_count,
1045 char **ppparams, uint32 parameter_count,
1046 char **ppdata, uint32 data_count)
1047 {
1048 pstring fname;
1049 char *params = *ppparams;
1050 int ret;
1051 int pnum = -1;
1052 char *p = NULL;
1053 NTSTATUS status;
1054
1055 /*
1056 * Ensure minimum number of parameters sent.
1057 */
1058
1059 if(parameter_count < 54) {
1060 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1061 return ERROR_DOS(ERRDOS,ERRnoaccess);
1062 }
1063
1064 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1065 if (!NT_STATUS_IS_OK(status)) {
1066 return ERROR_NT(status);
1067 }
1068
1069 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
1070 return ret;
1071
1072 /* Realloc the size of parameters and data we will return */
1073 params = nttrans_realloc(ppparams, 69);
1074 if(params == NULL)
1075 return ERROR_DOS(ERRDOS,ERRnomem);
1076
1077 p = params;
1078 SCVAL(p,0,NO_OPLOCK_RETURN);
1079
1080 p += 2;
1081 SSVAL(p,0,pnum);
1082 p += 2;
1083 SIVAL(p,0,FILE_WAS_OPENED);
1084 p += 8;
1085
1086 p += 32;
1087 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1088 p += 20;
1089 /* File type. */
1090 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1091 /* Device state. */
1092 SSVAL(p,2, 0x5FF); /* ? */
1093
1094 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1095
1096 /* Send the required number of replies */
1097 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1098
1099 return -1;
1100 }
1101
1102 /****************************************************************************
1103 Internal fn to set security descriptors.
1104 ****************************************************************************/
1105
1106 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1107 {
1108 prs_struct pd;
1109 SEC_DESC *psd = NULL;
1110 TALLOC_CTX *mem_ctx;
1111 BOOL ret;
1112
1113 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
1114 return NT_STATUS_OK;
1115 }
1116
1117 /*
1118 * Init the parse struct we will unmarshall from.
1119 */
1120
1121 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1122 DEBUG(0,("set_sd: talloc_init failed.\n"));
1123 return NT_STATUS_NO_MEMORY;
1124 }
1125
1126 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1127
1128 /*
1129 * Setup the prs_struct to point at the memory we just
1130 * allocated.
1131 */
1132
1133 prs_give_memory( &pd, data, sd_len, False);
1134
1135 /*
1136 * Finally, unmarshall from the data buffer.
1137 */
1138
1139 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1140 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1141 /*
1142 * Return access denied for want of a better error message..
1143 */
1144 talloc_destroy(mem_ctx);
1145 return NT_STATUS_NO_MEMORY;
1146 }
1147
1148 if (psd->off_owner_sid==0)
1149 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1150 if (psd->off_grp_sid==0)
1151 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1152 if (psd->off_sacl==0)
1153 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1154 if (psd->off_dacl==0)
1155 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1156
1157 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fd, security_info_sent, psd);
1158
1159 if (!ret) {
1160 talloc_destroy(mem_ctx);
1161 return NT_STATUS_ACCESS_DENIED;
1162 }
1163
1164 talloc_destroy(mem_ctx);
1165
1166 return NT_STATUS_OK;
1167 }
1168
1169 /****************************************************************************
1170 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1171 ****************************************************************************/
1172
1173 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1174 {
1175 struct ea_list *ea_list_head = NULL;
1176 size_t offset = 0;
1177
1178 if (data_size < 4) {
1179 return NULL;
1180 }
1181
1182 while (offset + 4 <= data_size) {
1183 size_t next_offset = IVAL(pdata,offset);
1184 struct ea_list *tmp;
1185 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1186
1187 DLIST_ADD_END(ea_list_head, eal, tmp);
1188 if (next_offset == 0) {
1189 break;
1190 }
1191 offset += next_offset;
1192 }
1193
1194 return ea_list_head;
1195 }
1196
1197 /****************************************************************************
1198 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1199 ****************************************************************************/
1200
1201 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1202 char **ppsetup, uint32 setup_count,
1203 char **ppparams, uint32 parameter_count,
1204 char **ppdata, uint32 data_count, uint32 max_data_count)
1205 {
1206 pstring fname;
1207 char *params = *ppparams;
1208 char *data = *ppdata;
1209 /* Breakout the oplock request bits so we can set the reply bits separately. */
1210 int oplock_request = 0;
1211 int fmode=0,rmode=0;
1212 SMB_OFF_T file_len = 0;
1213 SMB_STRUCT_STAT sbuf;
1214 int smb_action = 0;
1215 BOOL bad_path = False;
1216 files_struct *fsp = NULL;
1217 char *p = NULL;
1218 BOOL extended_oplock_granted = False;
1219 uint32 flags;
1220 uint32 desired_access;
1221 uint32 file_attributes;
1222 uint32 share_access;
1223 uint32 create_disposition;
1224 uint32 create_options;
1225 uint32 sd_len;
1226 uint32 ea_len;
1227 uint16 root_dir_fid;
1228 int smb_ofun;
1229 int smb_open_mode;
1230 time_t c_time;
1231 struct ea_list *ea_list = NULL;
1232 TALLOC_CTX *ctx = NULL;
1233 char *pdata = NULL;
1234 NTSTATUS status;
1235
1236 DEBUG(5,("call_nt_transact_create\n"));
1237
1238 /*
1239 * If it's an IPC, use the pipe handler.
1240 */
1241
1242 if (IS_IPC(conn)) {
1243 if (lp_nt_pipe_support())
1244 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1245 bufsize,
1246 ppsetup, setup_count,
1247 ppparams, parameter_count,
1248 ppdata, data_count);
1249 else
1250 return ERROR_DOS(ERRDOS,ERRnoaccess);
1251 }
1252
1253 /*
1254 * Ensure minimum number of parameters sent.
1255 */
1256
1257 if(parameter_count < 54) {
1258 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1259 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1260 }
1261
1262 flags = IVAL(params,0);
1263 desired_access = IVAL(params,8);
1264 file_attributes = IVAL(params,20);
1265 share_access = IVAL(params,24);
1266 create_disposition = IVAL(params,28);
1267 create_options = IVAL(params,32);
1268 sd_len = IVAL(params,36);
1269 ea_len = IVAL(params,40);
1270 root_dir_fid = (uint16)IVAL(params,4);
1271
1272 /* Ensure the data_len is correct for the sd and ea values given. */
1273 if ((ea_len + sd_len > data_count) ||
1274 (ea_len > data_count) || (sd_len > data_count) ||
1275 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1276 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1277 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1278 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1279 }
1280
1281 if (ea_len) {
1282 if (!lp_ea_support(SNUM(conn))) {
1283 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1284 (unsigned int)ea_len ));
1285 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1286 }
1287
1288 if (ea_len < 10) {
1289 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1290 (unsigned int)ea_len ));
1291 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1292 }
1293 }
1294
1295 if (create_options & FILE_OPEN_BY_FILE_ID) {
1296 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1297 }
1298
1299 /*
1300 * We need to construct the open_and_X ofun value from the
1301 * NT values, as that's what our code is structured to accept.
1302 */
1303
1304 if((smb_ofun = map_create_disposition( create_disposition )) == -1) {
1305 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1306 }
1307
1308 /*
1309 * Get the file name.
1310 */
1311
1312 if(root_dir_fid != 0) {
1313 /*
1314 * This filename is relative to a directory fid.
1315 */
1316 files_struct *dir_fsp = file_fsp(params,4);
1317 size_t dir_name_len;
1318
1319 if(!dir_fsp)
1320 return ERROR_DOS(ERRDOS,ERRbadfid);
1321
1322 if(!dir_fsp->is_directory) {
1323 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1324 if (!NT_STATUS_IS_OK(status)) {
1325 return ERROR_NT(status);
1326 }
1327
1328 /*
1329 * Check to see if this is a mac fork of some kind.
1330 */
1331
1332 if( strchr_m(fname, ':'))
1333 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1334
1335 return ERROR_DOS(ERRDOS,ERRbadfid);
1336 }
1337
1338 /*
1339 * Copy in the base directory name.
1340 */
1341
1342 pstrcpy( fname, dir_fsp->fsp_name );
1343 dir_name_len = strlen(fname);
1344
1345 /*
1346 * Ensure it ends in a '\'.
1347 */
1348
1349 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1350 pstrcat(fname, "/");
1351 dir_name_len++;
1352 }
1353
1354 {
1355 pstring tmpname;
1356 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status, False);
1357 if (!NT_STATUS_IS_OK(status)) {
1358 return ERROR_NT(status);
1359 }
1360 pstrcat(fname, tmpname);
1361 }
1362 } else {
1363 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 return ERROR_NT(status);
1366 }
1367
1368 /*
1369 * Check to see if this is a mac fork of some kind.
1370 */
1371
1372 if( strchr_m(fname, ':'))
1373 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1374 }
1375
1376 /*
1377 * Now contruct the smb_open_mode value from the desired access
1378 * and the share access.
1379 */
1380
1381 if((smb_open_mode = map_share_mode( fname, create_options, &desired_access,
1382 share_access, file_attributes)) == -1)
1383 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1384
1385 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1386 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1387
1388 /*
1389 * Check if POSIX semantics are wanted.
1390 */
1391
1392 set_posix_case_semantics(conn, file_attributes);
1393
1394 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1395
1396 unix_convert(fname,conn,0,&bad_path,&sbuf);
1397 if (bad_path) {
1398 restore_case_semantics(conn, file_attributes);
1399 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1400 }
1401 /* All file access must go through check_name() */
1402 if (!check_name(fname,conn)) {
1403 restore_case_semantics(conn, file_attributes);
1404 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
1405 }
1406
1407 #if 0
1408 /* This is the correct thing to do (check every time) but can_delete is
1409 expensive (it may have to read the parent directory permissions). So
1410 for now we're not doing it unless we have a strong hint the client
1411 is really going to delete this file. */
1412 if (desired_access & DELETE_ACCESS) {
1413 #else
1414 /* Setting FILE_SHARE_DELETE is the hint. */
1415 if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
1416 #endif
1417 status = can_delete(conn, fname, file_attributes, bad_path, True);
1418 /* We're only going to fail here if it's access denied, as that's the
1419 only error we care about for "can we delete this ?" questions. */
1420 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
1421 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
1422 restore_case_semantics(conn, file_attributes);
1423 END_PROFILE(SMBntcreateX);
1424 return ERROR_NT(status);
1425 }
1426 }
1427
1428 if (ea_len) {
1429 ctx = talloc_init("NTTRANS_CREATE_EA");
1430 if (!ctx) {
1431 talloc_destroy(ctx);
1432 restore_case_semantics(conn, file_attributes);
1433 return ERROR_NT(NT_STATUS_NO_MEMORY);
1434 }
1435
1436 pdata = data + sd_len;
1437
1438 /* We have already checked that ea_len <= data_count here. */
1439 ea_list = read_nttrans_ea_list(ctx, pdata, ea_len);
1440 if (!ea_list ) {
1441 talloc_destroy(ctx);
1442 restore_case_semantics(conn, file_attributes);
1443 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1444 }
1445 }
1446
1447 /*
1448 * If it's a request for a directory open, deal with it separately.
1449 */
1450
1451 if(create_options & FILE_DIRECTORY_FILE) {
1452
1453 /* Can't open a temp directory. IFS kit test. */
1454 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1455 talloc_destroy(ctx);
1456 restore_case_semantics(conn, file_attributes);
1457 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1458 }
1459
1460 oplock_request = 0;
1461
1462 /*
1463 * We will get a create directory here if the Win32
1464 * app specified a security descriptor in the
1465 * CreateDirectory() call.
1466 */
1467
1468 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1469
1470 if(!fsp) {
1471 talloc_destroy(ctx);
1472 restore_case_semantics(conn, file_attributes);
1473 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1474 }
1475
1476 } else {
1477
1478 /*
1479 * Ordinary file case.
1480 */
1481
1482 fsp = open_file_shared1(conn,fname,&sbuf,desired_access,
1483 smb_open_mode,smb_ofun,file_attributes,
1484 oplock_request,&rmode,&smb_action);
1485
1486 if (!fsp) {
1487 if(errno == EISDIR) {
1488
1489 /*
1490 * Fail the open if it was explicitly a non-directory file.
1491 */
1492
1493 if (create_options & FILE_NON_DIRECTORY_FILE) {
1494 restore_case_semantics(conn, file_attributes);
1495 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1496 }
1497
1498 oplock_request = 0;
1499 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1500
1501 if(!fsp) {
1502 talloc_destroy(ctx);
1503 restore_case_semantics(conn, file_attributes);
1504 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1505 }
1506 } else {
1507 talloc_destroy(ctx);
1508 restore_case_semantics(conn, file_attributes);
1509 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1510 /* We have re-scheduled this call. */
1511 return -1;
1512 }
1513 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1514 }
1515 }
1516 }
1517
1518 /*
1519 * According to the MS documentation, the only time the security
1520 * descriptor is applied to the opened file is iff we *created* the
1521 * file; an existing file stays the same.
1522 *
1523 * Also, it seems (from observation) that you can open the file with
1524 * any access mask but you can still write the sd. We need to override
1525 * the granted access before we call set_sd
1526 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1527 */
1528
1529 if (lp_nt_acl_support(SNUM(conn)) && sd_len && smb_action == FILE_WAS_CREATED) {
1530 uint32 saved_access = fsp->desired_access;
1531
1532 /* We have already checked that sd_len <= data_count here. */
1533
1534 fsp->desired_access = FILE_GENERIC_ALL;
1535
1536 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1537 if (!NT_STATUS_IS_OK(status)) {
1538 talloc_destroy(ctx);
1539 close_file(fsp,False);
1540 restore_case_semantics(conn, file_attributes);
1541 return ERROR_NT(status);
1542 }
1543 fsp->desired_access = saved_access;
1544 }
1545
1546 if (ea_len && (smb_action == FILE_WAS_CREATED)) {
1547 status = set_ea(conn, fsp, fname, ea_list);
1548 talloc_destroy(ctx);
1549 if (!NT_STATUS_IS_OK(status)) {
1550 close_file(fsp,False);
1551 restore_case_semantics(conn, file_attributes);
1552 return ERROR_NT(status);
1553 }
1554 }
1555
1556 restore_case_semantics(conn, file_attributes);
1557
1558 file_len = sbuf.st_size;
1559 fmode = dos_mode(conn,fname,&sbuf);
1560 if(fmode == 0) {
1561 fmode = FILE_ATTRIBUTE_NORMAL;
1562 }
1563 if (!fsp->is_directory && (fmode & aDIR)) {
1564 close_file(fsp,False);
1565 return ERROR_DOS(ERRDOS,ERRnoaccess);
1566 }
1567
1568 /* Save the requested allocation size. */
1569 if ((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) {
1570 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1571 #ifdef LARGE_SMB_OFF_T
1572 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1573 #endif
1574 if (allocation_size && (allocation_size > file_len)) {
1575 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1576 if (fsp->is_directory) {
1577 close_file(fsp,False);
1578 /* Can't set allocation size on a directory. */
1579 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1580 }
1581 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1582 close_file(fsp,False);
1583 return ERROR_NT(NT_STATUS_DISK_FULL);
1584 }
1585 } else {
1586 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1587 }
1588 }
1589
1590 /*
1591 * If the caller set the extended oplock request bit
1592 * and we granted one (by whatever means) - set the
1593 * correct bit for extended oplock reply.
1594 */
1595
1596 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1597 extended_oplock_granted = True;
1598 }
1599
1600 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1601 extended_oplock_granted = True;
1602 }
1603
1604 /* Realloc the size of parameters and data we will return */
1605 params = nttrans_realloc(ppparams, 69);
1606 if(params == NULL)
1607 return ERROR_DOS(ERRDOS,ERRnomem);
1608
1609 p = params;
1610 if (extended_oplock_granted)
1611 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1612 else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type))
1613 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1614 else
1615 SCVAL(p,0,NO_OPLOCK_RETURN);
1616
1617 p += 2;
1618 SSVAL(p,0,fsp->fnum);
1619 p += 2;
1620 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
1621 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1622 else
1623 SIVAL(p,0,smb_action);
1624 p += 8;
1625
1626 /* Create time. */
1627 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1628
1629 if (lp_dos_filetime_resolution(SNUM(conn))) {
1630 c_time &= ~1;
1631 sbuf.st_atime &= ~1;
1632 sbuf.st_mtime &= ~1;
1633 sbuf.st_mtime &= ~1;
1634 }
1635
1636 put_long_date(p,c_time);
1637 p += 8;
1638 put_long_date(p,sbuf.st_atime); /* access time */
1639 p += 8;
1640 put_long_date(p,sbuf.st_mtime); /* write time */
1641 p += 8;
1642 put_long_date(p,sbuf.st_mtime); /* change time */
1643 p += 8;
1644 SIVAL(p,0,fmode); /* File Attributes. */
1645 p += 4;
1646 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1647 p += 8;
1648 SOFF_T(p,0,file_len);
1649 p += 8;
1650 if (flags & EXTENDED_RESPONSE_REQUIRED)
1651 SSVAL(p,2,0x7);
1652 p += 4;
1653 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1654
1655 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1656
1657 /* Send the required number of replies */
1658 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1659
1660 return -1;
1661 }
1662
1663 /****************************************************************************
1664 Reply to a NT CANCEL request.
1665 ****************************************************************************/
1666
1667 int reply_ntcancel(connection_struct *conn,
1668 char *inbuf,char *outbuf,int length,int bufsize)
1669 {
1670 /*
1671 * Go through and cancel any pending change notifies.
1672 */
1673
1674 int mid = SVAL(inbuf,smb_mid);
1675 START_PROFILE(SMBntcancel);
1676 remove_pending_change_notify_requests_by_mid(mid);
1677 remove_pending_lock_requests_by_mid(mid);
1678 srv_cancel_sign_response(mid);
1679
1680 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1681
1682 END_PROFILE(SMBntcancel);
1683 return(-1);
1684 }
1685
1686 /****************************************************************************
1687 Copy a file.
1688 ****************************************************************************/
1689
1690 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint16 attrs)
1691 {
1692 BOOL bad_path_oldname = False;
1693 BOOL bad_path_newname = False;
1694 SMB_STRUCT_STAT sbuf1, sbuf2;
1695 pstring last_component_oldname;
1696 pstring last_component_newname;
1697 files_struct *fsp1,*fsp2;
1698 uint16 fmode;
1699 int access_mode;
1700 int smb_action;
1701 SMB_OFF_T ret=-1;
1702 int close_ret;
1703 NTSTATUS status = NT_STATUS_OK;
1704
1705 ZERO_STRUCT(sbuf1);
1706 ZERO_STRUCT(sbuf2);
1707
1708 /* No wildcards. */
1709 if (ms_has_wild(newname) || ms_has_wild(oldname)) {
1710 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1711 }
1712
1713 if (!CAN_WRITE(conn))
1714 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1715
1716 unix_convert(oldname,conn,last_component_oldname,&bad_path_oldname,&sbuf1);
1717 if (bad_path_oldname) {
1718 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1719 }
1720
1721 /* Quick check for "." and ".." */
1722 if (last_component_oldname[0] == '.') {
1723 if (!last_component_oldname[1] || (last_component_oldname[1] == '.' && !last_component_oldname[2])) {
1724 return NT_STATUS_OBJECT_NAME_INVALID;
1725 }
1726 }
1727
1728 /* Source must already exist. */
1729 if (!VALID_STAT(sbuf1)) {
1730 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1731 }
1732 if (!check_name(oldname,conn)) {
1733 return NT_STATUS_ACCESS_DENIED;
1734 }
1735
1736 /* Ensure attributes match. */
1737 fmode = dos_mode(conn,oldname,&sbuf1);
1738 if ((fmode & ~attrs) & (aHIDDEN | aSYSTEM))
1739 return NT_STATUS_NO_SUCH_FILE;
1740
1741 unix_convert(newname,conn,last_component_newname,&bad_path_newname,&sbuf2);
1742 if (bad_path_newname) {
1743 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1744 }
1745
1746 /* Quick check for "." and ".." */
1747 if (last_component_newname[0] == '.') {
1748 if (!last_component_newname[1] || (last_component_newname[1] == '.' && !last_component_newname[2])) {
1749 return NT_STATUS_OBJECT_NAME_INVALID;
1750 }
1751 }
1752
1753 /* Disallow if newname already exists. */
1754 if (VALID_STAT(sbuf2)) {
1755 return NT_STATUS_OBJECT_NAME_COLLISION;
1756 }
1757
1758 if (!check_name(newname,conn)) {
1759 return NT_STATUS_ACCESS_DENIED;
1760 }
1761
1762 /* No links from a directory. */
1763 if (S_ISDIR(sbuf1.st_mode)) {
1764 return NT_STATUS_FILE_IS_A_DIRECTORY;
1765 }
1766
1767 /* Ensure this is within the share. */
1768 if (!reduce_name(conn, oldname) != 0) {
1769 return NT_STATUS_ACCESS_DENIED;
1770 }
1771
1772 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1773
1774 fsp1 = open_file_shared1(conn,oldname,&sbuf1,FILE_READ_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
1775 (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,0,
1776 &access_mode,&smb_action);
1777
1778 if (!fsp1) {
1779 get_saved_error_triple(NULL, NULL, &status);
1780 if (NT_STATUS_IS_OK(status)) {
1781 status = NT_STATUS_ACCESS_DENIED;
1782 }
1783 set_saved_error_triple(0, 0, NT_STATUS_OK);
1784 return status;
1785 }
1786
1787 fsp2 = open_file_shared1(conn,newname,&sbuf2,FILE_WRITE_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
1788 (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL),fmode,INTERNAL_OPEN_ONLY,
1789 &access_mode,&smb_action);
1790
1791 if (!fsp2) {
1792 get_saved_error_triple(NULL, NULL, &status);
1793 if (NT_STATUS_IS_OK(status)) {
1794 status = NT_STATUS_ACCESS_DENIED;
1795 }
1796 set_saved_error_triple(0, 0, NT_STATUS_OK);
1797 close_file(fsp1,False);
1798 return status;
1799 }
1800
1801 if (sbuf1.st_size)
1802 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1803
1804 /*
1805 * As we are opening fsp1 read-only we only expect
1806 * an error on close on fsp2 if we are out of space.
1807 * Thus we don't look at the error return from the
1808 * close of fsp1.
1809 */
1810 close_file(fsp1,False);
1811
1812 /* Ensure the modtime is set correctly on the destination file. */
1813 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1814
1815 close_ret = close_file(fsp2,False);
1816
1817 /* Grrr. We have to do this as open_file_shared1 adds aARCH when it
1818 creates the file. This isn't the correct thing to do in the copy case. JRA */
1819 file_set_dosmode(conn, newname, fmode, &sbuf2, True);
1820
1821 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1822 return NT_STATUS_DISK_FULL;
1823 }
1824
1825 if (close_ret != 0) {
1826 status = map_nt_error_from_unix(close_ret);
1827 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1828 nt_errstr(status), oldname, newname));
1829 }
1830 return status;
1831 }
1832
1833 /****************************************************************************
1834 Reply to a NT rename request.
1835 ****************************************************************************/
1836
1837 int reply_ntrename(connection_struct *conn,
1838 char *inbuf,char *outbuf,int length,int bufsize)
1839 {
1840 int outsize = 0;
1841 pstring oldname;
1842 pstring newname;
1843 char *p;
1844 NTSTATUS status;
1845 uint16 attrs = SVAL(inbuf,smb_vwv0);
1846 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1847
1848 START_PROFILE(SMBntrename);
1849
1850 p = smb_buf(inbuf) + 1;
1851 p += srvstr_get_path(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, True);
1852 if (!NT_STATUS_IS_OK(status)) {
1853 END_PROFILE(SMBntrename);
1854 return ERROR_NT(status);
1855 }
1856
1857 if( strchr_m(oldname, ':')) {
1858 /* Can't rename a stream. */
1859 END_PROFILE(SMBntrename);
1860 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1861 }
1862
1863 if (ms_has_wild(oldname)) {
1864 END_PROFILE(SMBntrename);
1865 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1866 }
1867
1868 p++;
1869 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, False);
1870 if (!NT_STATUS_IS_OK(status)) {
1871 END_PROFILE(SMBntrename);
1872 return ERROR_NT(status);
1873 }
1874
1875 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1876 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1877
1878 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1879
1880 switch(rename_type) {
1881 case RENAME_FLAG_RENAME:
1882 status = rename_internals(conn, oldname, newname, attrs, False);
1883 break;
1884 case RENAME_FLAG_HARD_LINK:
1885 status = hardlink_internals(conn, oldname, newname);
1886 break;
1887 case RENAME_FLAG_COPY:
1888 status = copy_internals(conn, oldname, newname, attrs);
1889 break;
1890 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1891 status = NT_STATUS_INVALID_PARAMETER;
1892 break;
1893 default:
1894 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1895 break;
1896 }
1897
1898 if (!NT_STATUS_IS_OK(status)) {
1899 END_PROFILE(SMBntrename);
1900 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1901 /* We have re-scheduled this call. */
1902 return -1;
1903 }
1904 return ERROR_NT(status);
1905 }
1906
1907 /*
1908 * Win2k needs a changenotify request response before it will
1909 * update after a rename..
1910 */
1911 process_pending_change_notify_queue((time_t)0);
1912 outsize = set_message(outbuf,0,0,True);
1913
1914 END_PROFILE(SMBntrename);
1915 return(outsize);
1916 }
1917
1918 /****************************************************************************
1919 Reply to an unsolicited SMBNTtranss - just ignore it!
1920 ****************************************************************************/
1921
1922 int reply_nttranss(connection_struct *conn,
1923 char *inbuf,char *outbuf,int length,int bufsize)
1924 {
1925 START_PROFILE(SMBnttranss);
1926 DEBUG(4,("Ignoring nttranss of length %d\n",length));
1927 END_PROFILE(SMBnttranss);
1928 return(-1);
1929 }
1930
1931 /****************************************************************************
1932 Reply to a notify change - queue the request and
1933 don't allow a directory to be opened.
1934 ****************************************************************************/
1935
1936 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1937 char **ppsetup, uint32 setup_count,
1938 char **ppparams, uint32 parameter_count,
1939 char **ppdata, uint32 data_count, uint32 max_data_count)
1940 {
1941 char *setup = *ppsetup;
1942 files_struct *fsp;
1943 uint32 flags;
1944
1945 if(setup_count < 6)
1946 return ERROR_DOS(ERRDOS,ERRbadfunc);
1947
1948 fsp = file_fsp(setup,4);
1949 flags = IVAL(setup, 0);
1950
1951 DEBUG(3,("call_nt_transact_notify_change\n"));
1952
1953 if(!fsp)
1954 return ERROR_DOS(ERRDOS,ERRbadfid);
1955
1956 if((!fsp->is_directory) || (conn != fsp->conn))
1957 return ERROR_DOS(ERRDOS,ERRbadfid);
1958
1959 if (!change_notify_set(inbuf, fsp, conn, flags))
1960 return(UNIXERROR(ERRDOS,ERRbadfid));
1961
1962 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1963 name = %s\n", fsp->fsp_name ));
1964
1965 return -1;
1966 }
1967
1968 /****************************************************************************
1969 Reply to an NT transact rename command.
1970 ****************************************************************************/
1971
1972 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1973 char **ppsetup, uint32 setup_count,
1974 char **ppparams, uint32 parameter_count,
1975 char **ppdata, uint32 data_count, uint32 max_data_count)
1976 {
1977 char *params = *ppparams;
1978 pstring new_name;
1979 files_struct *fsp = NULL;
1980 BOOL replace_if_exists = False;
1981 NTSTATUS status;
1982
1983 if(parameter_count < 4)
1984 return ERROR_DOS(ERRDOS,ERRbadfunc);
1985
1986 fsp = file_fsp(params, 0);
1987 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1988 CHECK_FSP(fsp, conn);
1989 srvstr_get_path(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status, True);
1990 if (!NT_STATUS_IS_OK(status)) {
1991 return ERROR_NT(status);
1992 }
1993
1994 status = rename_internals(conn, fsp->fsp_name,
1995 new_name, 0, replace_if_exists);
1996 if (!NT_STATUS_IS_OK(status))
1997 return ERROR_NT(status);
1998
1999 /*
2000 * Rename was successful.
2001 */
2002 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2003
2004 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2005 fsp->fsp_name, new_name));
2006
2007 /*
2008 * Win2k needs a changenotify request response before it will
2009 * update after a rename..
2010 */
2011
2012 process_pending_change_notify_queue((time_t)0);
2013
2014 return -1;
2015 }
2016
2017 /******************************************************************************
2018 Fake up a completely empty SD.
2019 *******************************************************************************/
2020
2021 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
2022 {
2023 size_t sd_size;
2024
2025 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2026 if(!*ppsd) {
2027 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2028 sd_size = 0;
2029 }
2030
2031 return sd_size;
2032 }
2033
2034 /****************************************************************************
2035 Reply to query a security descriptor.
2036 ****************************************************************************/
2037
2038 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2039 char **ppsetup, uint32 setup_count,
2040 char **ppparams, uint32 parameter_count,
2041 char **ppdata, uint32 data_count, uint32 max_data_count)
2042 {
2043 char *params = *ppparams;
2044 char *data = *ppdata;
2045 prs_struct pd;
2046 SEC_DESC *psd = NULL;
2047 size_t sd_size;
2048 uint32 security_info_wanted;
2049 TALLOC_CTX *mem_ctx;
2050 files_struct *fsp = NULL;
2051
2052 if(parameter_count < 8)
2053 return ERROR_DOS(ERRDOS,ERRbadfunc);
2054
2055 fsp = file_fsp(params,0);
2056 if(!fsp)
2057 return ERROR_DOS(ERRDOS,ERRbadfid);
2058
2059 security_info_wanted = IVAL(params,4);
2060
2061 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2062 (unsigned int)security_info_wanted ));
2063
2064 params = nttrans_realloc(ppparams, 4);
2065 if(params == NULL)
2066 return ERROR_DOS(ERRDOS,ERRnomem);
2067
2068 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2069 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2070 return ERROR_DOS(ERRDOS,ERRnomem);
2071 }
2072
2073 /*
2074 * Get the permissions to return.
2075 */
2076
2077 if (!lp_nt_acl_support(SNUM(conn)))
2078 sd_size = get_null_nt_acl(mem_ctx, &psd);
2079 else
2080 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, security_info_wanted, &psd);
2081
2082 if (sd_size == 0) {
2083 talloc_destroy(mem_ctx);
2084 return(UNIXERROR(ERRDOS,ERRnoaccess));
2085 }
2086
2087 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %d.\n",(int)sd_size));
2088
2089 SIVAL(params,0,(uint32)sd_size);
2090
2091 if(max_data_count < sd_size) {
2092
2093 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2094 params, 4, *ppdata, 0);
2095 talloc_destroy(mem_ctx);
2096 return -1;
2097 }
2098
2099 /*
2100 * Allocate the data we will point this at.
2101 */
2102
2103 data = nttrans_realloc(ppdata, sd_size);
2104 if(data == NULL) {
2105 talloc_destroy(mem_ctx);
2106 return ERROR_DOS(ERRDOS,ERRnomem);
2107 }
2108
2109 /*
2110 * Init the parse struct we will marshall into.
2111 */
2112
2113 prs_init(&pd, 0, mem_ctx, MARSHALL);
2114
2115 /*
2116 * Setup the prs_struct to point at the memory we just
2117 * allocated.
2118 */
2119
2120 prs_give_memory( &pd, data, (uint32)sd_size, False);
2121
2122 /*
2123 * Finally, linearize into the outgoing buffer.
2124 */
2125
2126 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2127 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2128 security descriptor.\n"));
2129 /*
2130 * Return access denied for want of a better error message..
2131 */
2132 talloc_destroy(mem_ctx);
2133 return(UNIXERROR(ERRDOS,ERRnoaccess));
2134 }
2135
2136 /*
2137 * Now we can delete the security descriptor.
2138 */
2139
2140 talloc_destroy(mem_ctx);
2141
2142 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
2143 return -1;
2144 }
2145
2146 /****************************************************************************
2147 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2148 ****************************************************************************/
2149
2150 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2151 char **ppsetup, uint32 setup_count,
2152 char **ppparams, uint32 parameter_count,
2153 char **ppdata, uint32 data_count, uint32 max_data_count)
2154 {
2155 char *params= *ppparams;
2156 char *data = *ppdata;
2157 files_struct *fsp = NULL;
2158 uint32 security_info_sent = 0;
2159 NTSTATUS nt_status;
2160
2161 if(parameter_count < 8)
2162 return ERROR_DOS(ERRDOS,ERRbadfunc);
2163
2164 if((fsp = file_fsp(params,0)) == NULL)
2165 return ERROR_DOS(ERRDOS,ERRbadfid);
2166
2167 if(!lp_nt_acl_support(SNUM(conn)))
2168 goto done;
2169
2170 security_info_sent = IVAL(params,4);
2171
2172 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2173 (unsigned int)security_info_sent ));
2174
2175 if (data_count == 0)
2176 return ERROR_DOS(ERRDOS, ERRnoaccess);
2177
2178 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent)))
2179 return ERROR_NT(nt_status);
2180
2181 done:
2182
2183 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2184 return -1;
2185 }
2186
2187 /****************************************************************************
2188 Reply to NT IOCTL
2189 ****************************************************************************/
2190
2191 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2192 char **ppsetup, uint32 setup_count,
2193 char **ppparams, uint32 parameter_count,
2194 char **ppdata, uint32 data_count, uint32 max_data_count)
2195 {
2196 uint32 function;
2197 uint16 fidnum;
2198 files_struct *fsp;
2199 uint8 isFSctl;
2200 uint8 compfilter;
2201 static BOOL logged_message;
2202 char *pdata = *ppdata;
2203
2204 if (setup_count != 8) {
2205 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2206 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2207 }
2208
2209 function = IVAL(*ppsetup, 0);
2210 fidnum = SVAL(*ppsetup, 4);
2211 isFSctl = CVAL(*ppsetup, 6);
2212 compfilter = CVAL(*ppsetup, 7);
2213
2214 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2215 function, fidnum, isFSctl, compfilter));
2216
2217 fsp=file_fsp(*ppsetup, 4);
2218 /* this check is done in each implemented function case for now
2219 because I don't want to break anything... --metze
2220 FSP_BELONGS_CONN(fsp,conn);*/
2221
2222 switch (function) {
2223 case FSCTL_SET_SPARSE:
2224 /* pretend this succeeded - tho strictly we should
2225 mark the file sparse (if the local fs supports it)
2226 so we can know if we need to pre-allocate or not */
2227
2228 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2229 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2230 return -1;
2231
2232 case FSCTL_0x000900C0:
2233 /* pretend this succeeded - don't know what this really is
2234 but works ok like this --metze
2235 */
2236
2237 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2238 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2239 return -1;
2240
2241 case FSCTL_GET_REPARSE_POINT:
2242 /* pretend this fail - my winXP does it like this
2243 * --metze
2244 */
2245
2246 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2247 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2248 return -1;
2249
2250 case FSCTL_SET_REPARSE_POINT:
2251 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2252 * --metze
2253 */
2254
2255 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2256 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2257 return -1;
2258
2259 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2260 {
2261 /*
2262 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2263 * and return their volume names. If max_data_count is 16, then it is just
2264 * asking for the number of volumes and length of the combined names.
2265 *
2266 * pdata is the data allocated by our caller, but that uses
2267 * total_data_count (which is 0 in our case) rather than max_data_count.
2268 * Allocate the correct amount and return the pointer to let
2269 * it be deallocated when we return.
2270 */
2271 SHADOW_COPY_DATA *shadow_data = NULL;
2272 TALLOC_CTX *shadow_mem_ctx = NULL;
2273 BOOL labels = False;
2274 uint32 labels_data_count = 0;
2275 uint32 i;
2276 char *cur_pdata;
2277
2278 FSP_BELONGS_CONN(fsp,conn);
2279
2280 if (max_data_count < 16) {
2281 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2282 max_data_count));
2283 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2284 }
2285
2286 if (max_data_count > 16) {
2287 labels = True;
2288 }
2289
2290 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2291 if (shadow_mem_ctx == NULL) {
2292 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2293 return ERROR_NT(NT_STATUS_NO_MEMORY);
2294 }
2295
2296 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2297 if (shadow_data == NULL) {
2298 DEBUG(0,("talloc_zero() failed!\n"));
2299 talloc_destroy(shadow_mem_ctx);
2300 return ERROR_NT(NT_STATUS_NO_MEMORY);
2301 }
2302
2303 shadow_data->mem_ctx = shadow_mem_ctx;
2304
2305 /*
2306 * Call the VFS routine to actually do the work.
2307 */
2308 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2309 talloc_destroy(shadow_data->mem_ctx);
2310 if (errno == ENOSYS) {
2311 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2312 conn->connectpath));
2313 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2314 } else {
2315 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2316 conn->connectpath));
2317 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2318 }
2319 }
2320
2321 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2322
2323 if (!labels) {
2324 data_count = 16;
2325 } else {
2326 data_count = 12+labels_data_count+4;
2327 }
2328
2329 if (max_data_count<data_count) {
2330 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2331 max_data_count,data_count));
2332 talloc_destroy(shadow_data->mem_ctx);
2333 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2334 }
2335
2336 pdata = nttrans_realloc(ppdata, data_count);
2337 if (pdata == NULL) {
2338 talloc_destroy(shadow_data->mem_ctx);
2339 return ERROR_NT(NT_STATUS_NO_MEMORY);
2340 }
2341
2342 cur_pdata = pdata;
2343
2344 /* num_volumes 4 bytes */
2345 SIVAL(pdata,0,shadow_data->num_volumes);
2346
2347 if (labels) {
2348 /* num_labels 4 bytes */
2349 SIVAL(pdata,4,shadow_data->num_volumes);
2350 }
2351
2352 /* needed_data_count 4 bytes */
2353 SIVAL(pdata,8,labels_data_count);
2354
2355 cur_pdata+=12;
2356
2357 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2358 shadow_data->num_volumes,fsp->fsp_name));
2359 if (labels && shadow_data->labels) {
2360 for (i=0;i<shadow_data->num_volumes;i++) {
2361 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2362 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2363 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2364 }
2365 }
2366
2367 talloc_destroy(shadow_data->mem_ctx);
2368
2369 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2370
2371 return -1;
2372 }
2373
2374 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2375 {
2376 /* pretend this succeeded -
2377 *
2378 * we have to send back a list with all files owned by this SID
2379 *
2380 * but I have to check that --metze
2381 */
2382 DOM_SID sid;
2383 uid_t uid;
2384 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2385
2386 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2387
2388 FSP_BELONGS_CONN(fsp,conn);
2389
2390 /* unknown 4 bytes: this is not the length of the sid :-( */
2391 /*unknown = IVAL(pdata,0);*/
2392
2393 sid_parse(pdata+4,sid_len,&sid);
2394 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2395
2396 if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) {
2397 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2398 sid_string_static(&sid),(unsigned long)sid_len));
2399 uid = (-1);
2400 }
2401
2402 /* we can take a look at the find source :-)
2403 *
2404 * find ./ -uid $uid -name '*' is what we need here
2405 *
2406 *
2407 * and send 4bytes len and then NULL terminated unicode strings
2408 * for each file
2409 *
2410 * but I don't know how to deal with the paged results
2411 * (maybe we can hang the result anywhere in the fsp struct)
2412 *
2413 * we don't send all files at once
2414 * and at the next we should *not* start from the beginning,
2415 * so we have to cache the result
2416 *
2417 * --metze
2418 */
2419
2420 /* this works for now... */
2421 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2422 return -1;
2423 }
2424 default:
2425 if (!logged_message) {
2426 logged_message = True; /* Only print this once... */
2427 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2428 function));
2429 }
2430 }
2431
2432 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2433 }
2434
2435
2436 #ifdef HAVE_SYS_QUOTAS
2437 /****************************************************************************
2438 Reply to get user quota
2439 ****************************************************************************/
2440
2441 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2442 char **ppsetup, uint32 setup_count,
2443 char **ppparams, uint32 parameter_count,
2444 char **ppdata, uint32 data_count, uint32 max_data_count)
2445 {
2446 NTSTATUS nt_status = NT_STATUS_OK;
2447 char *params = *ppparams;
2448 char *pdata = *ppdata;
2449 char *entry;
2450 int data_len=0,param_len=0;
2451 int qt_len=0;
2452 int entry_len = 0;
2453 files_struct *fsp = NULL;
2454 uint16 level = 0;
2455 size_t sid_len;
2456 DOM_SID sid;
2457 BOOL start_enum = True;
2458 SMB_NTQUOTA_STRUCT qt;
2459 SMB_NTQUOTA_LIST *tmp_list;
2460 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2461 extern struct current_user current_user;
2462
2463 ZERO_STRUCT(qt);
2464
2465 /* access check */
2466 if (current_user.uid != 0) {
2467 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2468 lp_servicename(SNUM(conn)),conn->user));
2469 return ERROR_DOS(ERRDOS,ERRnoaccess);
2470 }
2471
2472 /*
2473 * Ensure minimum number of parameters sent.
2474 */
2475
2476 if (parameter_count < 4) {
2477 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2478 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2479 }
2480
2481 /* maybe we can check the quota_fnum */
2482 fsp = file_fsp(params,0);
2483 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2484 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2485 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2486 }
2487
2488 /* the NULL pointer cheking for fsp->fake_file_handle->pd
2489 * is done by CHECK_NTQUOTA_HANDLE_OK()
2490 */
2491 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2492
2493 level = SVAL(params,2);
2494
2495 /* unknown 12 bytes leading in params */
2496
2497 switch (level) {
2498 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2499 /* seems that we should continue with the enum here --metze */
2500
2501 if (qt_handle->quota_list!=NULL &&
2502 qt_handle->tmp_list==NULL) {
2503
2504 /* free the list */
2505 free_ntquota_list(&(qt_handle->quota_list));
2506
2507 /* Realloc the size of parameters and data we will return */
2508 param_len = 4;
2509 params = nttrans_realloc(ppparams, param_len);
2510 if(params == NULL)
2511 return ERROR_DOS(ERRDOS,ERRnomem);
2512
2513 data_len = 0;
2514 SIVAL(params,0,data_len);
2515
2516 break;
2517 }
2518
2519 start_enum = False;
2520
2521 case TRANSACT_GET_USER_QUOTA_LIST_START:
2522
2523 if (qt_handle->quota_list==NULL &&
2524 qt_handle->tmp_list==NULL) {
2525 start_enum = True;
2526 }
2527
2528 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2529 return ERROR_DOS(ERRSRV,ERRerror);
2530
2531 /* Realloc the size of parameters and data we will return */
2532 param_len = 4;
2533 params = nttrans_realloc(ppparams, param_len);
2534 if(params == NULL)
2535 return ERROR_DOS(ERRDOS,ERRnomem);
2536
2537 /* we should not trust the value in max_data_count*/
2538 max_data_count = MIN(max_data_count,2048);
2539
2540 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2541 if(pdata == NULL)
2542 return ERROR_DOS(ERRDOS,ERRnomem);
2543
2544 entry = pdata;
2545
2546
2547 /* set params Size of returned Quota Data 4 bytes*/
2548 /* but set it later when we know it */
2549
2550 /* for each entry push the data */
2551
2552 if (start_enum) {
2553 qt_handle->tmp_list = qt_handle->quota_list;
2554 }
2555
2556 tmp_list = qt_handle->tmp_list;
2557
2558 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2559 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2560
2561 sid_len = sid_size(&tmp_list->quotas->sid);
2562 entry_len = 40 + sid_len;
2563
2564 /* nextoffset entry 4 bytes */
2565 SIVAL(entry,0,entry_len);
2566
2567 /* then the len of the SID 4 bytes */
2568 SIVAL(entry,4,sid_len);
2569
2570 /* unknown data 8 bytes SMB_BIG_UINT */
2571 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2572
2573 /* the used disk space 8 bytes SMB_BIG_UINT */
2574 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2575
2576 /* the soft quotas 8 bytes SMB_BIG_UINT */
2577 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2578
2579 /* the hard quotas 8 bytes SMB_BIG_UINT */
2580 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2581
2582 /* and now the SID */
2583 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2584 }
2585
2586 qt_handle->tmp_list = tmp_list;
2587
2588 /* overwrite the offset of the last entry */
2589 SIVAL(entry-entry_len,0,0);
2590
2591 data_len = 4+qt_len;
2592 /* overwrite the params quota_data_len */
2593 SIVAL(params,0,data_len);
2594
2595 break;
2596
2597 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2598
2599 /* unknown 4 bytes IVAL(pdata,0) */
2600
2601 if (data_count < 8) {
2602 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2603 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2604 }
2605
2606 sid_len = IVAL(pdata,4);
2607 /* Ensure this is less than 1mb. */
2608 if (sid_len > (1024*1024)) {
2609 return ERROR_DOS(ERRDOS,ERRnomem);
2610 }
2611
2612 if (data_count < 8+sid_len) {
2613 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2614 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2615 }
2616
2617 data_len = 4+40+sid_len;
2618
2619 if (max_data_count < data_len) {
2620 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2621 max_data_count, data_len));
2622 param_len = 4;
2623 SIVAL(params,0,data_len);
2624 data_len = 0;
2625 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2626 break;
2627 }
2628
2629 sid_parse(pdata+8,sid_len,&sid);
2630
2631
2632 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2633 ZERO_STRUCT(qt);
2634 /*
2635 * we have to return zero's in all fields
2636 * instead of returning an error here
2637 * --metze
2638 */
2639 }
2640
2641 /* Realloc the size of parameters and data we will return */
2642 param_len = 4;
2643 params = nttrans_realloc(ppparams, param_len);
2644 if(params == NULL)
2645 return ERROR_DOS(ERRDOS,ERRnomem);
2646
2647 pdata = nttrans_realloc(ppdata, data_len);
2648 if(pdata == NULL)
2649 return ERROR_DOS(ERRDOS,ERRnomem);
2650
2651 entry = pdata;
2652
2653 /* set params Size of returned Quota Data 4 bytes*/
2654 SIVAL(params,0,data_len);
2655
2656 /* nextoffset entry 4 bytes */
2657 SIVAL(entry,0,0);
2658
2659 /* then the len of the SID 4 bytes */
2660 SIVAL(entry,4,sid_len);
2661
2662 /* unknown data 8 bytes SMB_BIG_UINT */
2663 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2664
2665 /* the used disk space 8 bytes SMB_BIG_UINT */
2666 SBIG_UINT(entry,16,qt.usedspace);
2667
2668 /* the soft quotas 8 bytes SMB_BIG_UINT */
2669 SBIG_UINT(entry,24,qt.softlim);
2670
2671 /* the hard quotas 8 bytes SMB_BIG_UINT */
2672 SBIG_UINT(entry,32,qt.hardlim);
2673
2674 /* and now the SID */
2675 sid_linearize(entry+40, sid_len, &sid);
2676
2677 break;
2678
2679 default:
2680 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2681 return ERROR_DOS(ERRSRV,ERRerror);
2682 break;
2683 }
2684
2685 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2686
2687 return -1;
2688 }
2689
2690 /****************************************************************************
2691 Reply to set user quota
2692 ****************************************************************************/
2693
2694 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2695 char **ppsetup, uint32 setup_count,
2696 char **ppparams, uint32 parameter_count,
2697 char **ppdata, uint32 data_count, uint32 max_data_count)
2698 {
2699 char *params = *ppparams;
2700 char *pdata = *ppdata;
2701 int data_len=0,param_len=0;
2702 SMB_NTQUOTA_STRUCT qt;
2703 size_t sid_len;
2704 DOM_SID sid;
2705 files_struct *fsp = NULL;
2706
2707 ZERO_STRUCT(qt);
2708
2709 /* access check */
2710 if (current_user.uid != 0) {
2711 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2712 lp_servicename(SNUM(conn)),conn->user));
2713 return ERROR_DOS(ERRDOS,ERRnoaccess);
2714 }
2715
2716 /*
2717 * Ensure minimum number of parameters sent.
2718 */
2719
2720 if (parameter_count < 2) {
2721 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2722 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2723 }
2724
2725 /* maybe we can check the quota_fnum */
2726 fsp = file_fsp(params,0);
2727 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2728 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2729 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2730 }
2731
2732 if (data_count < 40) {
2733 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2734 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2735 }
2736
2737 /* offset to next quota record.
2738 * 4 bytes IVAL(pdata,0)
2739 * unused here...
2740 */
2741
2742 /* sid len */
2743 sid_len = IVAL(pdata,4);
2744
2745 if (data_count < 40+sid_len) {
2746 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2747 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2748 }
2749
2750 /* unknown 8 bytes in pdata
2751 * maybe its the change time in NTTIME
2752 */
2753
2754 /* the used space 8 bytes (SMB_BIG_UINT)*/
2755 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2756 #ifdef LARGE_SMB_OFF_T
2757 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2758 #else /* LARGE_SMB_OFF_T */
2759 if ((IVAL(pdata,20) != 0)&&
2760 ((qt.usedspace != 0xFFFFFFFF)||
2761 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2762 /* more than 32 bits? */
2763 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2764 }
2765 #endif /* LARGE_SMB_OFF_T */
2766
2767 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2768 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2769 #ifdef LARGE_SMB_OFF_T
2770 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2771 #else /* LARGE_SMB_OFF_T */
2772 if ((IVAL(pdata,28) != 0)&&
2773 ((qt.softlim != 0xFFFFFFFF)||
2774 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2775 /* more than 32 bits? */
2776 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2777 }
2778 #endif /* LARGE_SMB_OFF_T */
2779
2780 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2781 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2782 #ifdef LARGE_SMB_OFF_T
2783 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2784 #else /* LARGE_SMB_OFF_T */
2785 if ((IVAL(pdata,36) != 0)&&
2786 ((qt.hardlim != 0xFFFFFFFF)||
2787 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2788 /* more than 32 bits? */
2789 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2790 }
2791 #endif /* LARGE_SMB_OFF_T */
2792
2793 sid_parse(pdata+40,sid_len,&sid);
2794 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2795
2796 /* 44 unknown bytes left... */
2797
2798 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2799 return ERROR_DOS(ERRSRV,ERRerror);
2800 }
2801
2802 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2803
2804 return -1;
2805 }
2806 #endif /* HAVE_SYS_QUOTAS */
2807
2808 /****************************************************************************
2809 Reply to a SMBNTtrans.
2810 ****************************************************************************/
2811
2812 int reply_nttrans(connection_struct *conn,
2813 char *inbuf,char *outbuf,int length,int bufsize)
2814 {
2815 int outsize = 0;
2816 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2817 #if 0 /* Not used. */
2818 uint16 max_setup_count = CVAL(inbuf, smb_nt_MaxSetupCount);
2819 uint32 max_parameter_count = IVAL(inbuf, smb_nt_MaxParameterCount);
2820 #endif /* Not used. */
2821 uint32 total_parameter_count = IVAL(inbuf, smb_nt_TotalParameterCount);
2822 uint32 total_data_count = IVAL(inbuf, smb_nt_TotalDataCount);
2823 uint32 parameter_count = IVAL(inbuf,smb_nt_ParameterCount);
2824 uint32 parameter_offset = IVAL(inbuf,smb_nt_ParameterOffset);
2825 uint32 data_count = IVAL(inbuf,smb_nt_DataCount);
2826 uint32 data_offset = IVAL(inbuf,smb_nt_DataOffset);
2827 uint16 setup_count = 2*CVAL(inbuf,smb_nt_SetupCount); /* setup count is in *words* */
2828 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2829 char *params = NULL, *data = NULL, *setup = NULL;
2830 uint32 num_params_sofar, num_data_sofar;
2831 START_PROFILE(SMBnttrans);
2832
2833 if(global_oplock_break &&
2834 ((function_code == NT_TRANSACT_CREATE) ||
2835 (function_code == NT_TRANSACT_RENAME))) {
2836 /*
2837 * Queue this open message as we are the process of an oplock break.
2838 */
2839
2840 DEBUG(2,("reply_nttrans: queueing message code 0x%x \
2841 due to being in oplock break state.\n", (unsigned int)function_code ));
2842
2843 push_oplock_pending_smb_message( inbuf, length);
2844 END_PROFILE(SMBnttrans);
2845 return -1;
2846 }
2847
2848 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2849 END_PROFILE(SMBnttrans);
2850 return ERROR_DOS(ERRSRV,ERRaccess);
2851 }
2852
2853 outsize = set_message(outbuf,0,0,True);
2854
2855 /*
2856 * All nttrans messages we handle have smb_wct == 19 + setup_count.
2857 * Ensure this is so as a sanity check.
2858 */
2859
2860 if(CVAL(inbuf, smb_wct) != 19 + (setup_count/2)) {
2861 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2862 CVAL(inbuf, smb_wct), 19 + (setup_count/2)));
2863 goto bad_param;
2864 }
2865
2866 /* Don't allow more than 128mb for each value. */
2867 if ((total_parameter_count > (1024*1024*128)) || (total_data_count > (1024*1024*128))) {
2868 END_PROFILE(SMBnttrans);
2869 return ERROR_DOS(ERRDOS,ERRnomem);
2870 }
2871
2872 /* Allocate the space for the setup, the maximum needed parameters and data */
2873
2874 if(setup_count > 0)
2875 setup = (char *)SMB_MALLOC(setup_count);
2876 if (total_parameter_count > 0)
2877 params = (char *)SMB_MALLOC(total_parameter_count);
2878 if (total_data_count > 0)
2879 data = (char *)SMB_MALLOC(total_data_count);
2880
2881 if ((total_parameter_count && !params) || (total_data_count && !data) ||
2882 (setup_count && !setup)) {
2883 SAFE_FREE(setup);
2884 SAFE_FREE(params);
2885 SAFE_FREE(data);
2886 DEBUG(0,("reply_nttrans : Out of memory\n"));
2887 END_PROFILE(SMBnttrans);
2888 return ERROR_DOS(ERRDOS,ERRnomem);
2889 }
2890
2891 /* Copy the param and data bytes sent with this request into the params buffer */
2892 num_params_sofar = parameter_count;
2893 num_data_sofar = data_count;
2894
2895 if (parameter_count > total_parameter_count || data_count > total_data_count)
2896 goto bad_param;
2897
2898 if(setup) {
2899 DEBUG(10,("reply_nttrans: setup_count = %d\n", setup_count));
2900 if ((smb_nt_SetupStart + setup_count < smb_nt_SetupStart) ||
2901 (smb_nt_SetupStart + setup_count < setup_count))
2902 goto bad_param;
2903 if (smb_nt_SetupStart + setup_count > length)
2904 goto bad_param;
2905
2906 memcpy( setup, &inbuf[smb_nt_SetupStart], setup_count);
2907 dump_data(10, setup, setup_count);
2908 }
2909 if(params) {
2910 DEBUG(10,("reply_nttrans: parameter_count = %d\n", parameter_count));
2911 if ((parameter_offset + parameter_count < parameter_offset) ||
2912 (parameter_offset + parameter_count < parameter_count))
2913 goto bad_param;
2914 if ((smb_base(inbuf) + parameter_offset + parameter_count > inbuf + length)||
2915 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2916 goto bad_param;
2917
2918 memcpy( params, smb_base(inbuf) + parameter_offset, parameter_count);
2919 dump_data(10, params, parameter_count);
2920 }
2921 if(data) {
2922 DEBUG(10,("reply_nttrans: data_count = %d\n",data_count));
2923 if ((data_offset + data_count < data_offset) || (data_offset + data_count < data_count))
2924 goto bad_param;
2925 if ((smb_base(inbuf) + data_offset + data_count > inbuf + length) ||
2926 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2927 goto bad_param;
2928
2929 memcpy( data, smb_base(inbuf) + data_offset, data_count);
2930 dump_data(10, data, data_count);
2931 }
2932
2933 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2934
2935 if(num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2936 /* We need to send an interim response then receive the rest
2937 of the parameter/data bytes */
2938 outsize = set_message(outbuf,0,0,True);
2939 srv_signing_trans_stop();
2940 if (!send_smb(smbd_server_fd(),outbuf))
2941 exit_server("reply_nttrans: send_smb failed.");
2942
2943 while( num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2944 BOOL ret;
2945 uint32 parameter_displacement;
2946 uint32 data_displacement;
2947
2948 ret = receive_next_smb(inbuf,bufsize,SMB_SECONDARY_WAIT);
2949
2950 /* We need to re-calcuate the new length after we've read the secondary packet. */
2951 length = smb_len(inbuf) + 4;
2952
2953 /*
2954 * The sequence number for the trans reply is always
2955 * based on the last secondary received.
2956 */
2957
2958 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2959
2960 if((ret && (CVAL(inbuf, smb_com) != SMBnttranss)) || !ret) {
2961 outsize = set_message(outbuf,0,0,True);
2962 if(ret) {
2963 DEBUG(0,("reply_nttrans: Invalid secondary nttrans packet\n"));
2964 } else {
2965 DEBUG(0,("reply_nttrans: %s in getting secondary nttrans response.\n",
2966 (smb_read_error == READ_ERROR) ? "error" : "timeout" ));
2967 }
2968 goto bad_param;
2969 }
2970
2971 /* Revise total_params and total_data in case they have changed downwards */
2972 if (IVAL(inbuf, smb_nts_TotalParameterCount) < total_parameter_count)
2973 total_parameter_count = IVAL(inbuf, smb_nts_TotalParameterCount);
2974 if (IVAL(inbuf, smb_nts_TotalDataCount) < total_data_count)
2975 total_data_count = IVAL(inbuf, smb_nts_TotalDataCount);
2976
2977 parameter_count = IVAL(inbuf,smb_nts_ParameterCount);
2978 parameter_offset = IVAL(inbuf, smb_nts_ParameterOffset);
2979 parameter_displacement = IVAL(inbuf, smb_nts_ParameterDisplacement);
2980 num_params_sofar += parameter_count;
2981
2982 data_count = IVAL(inbuf, smb_nts_DataCount);
2983 data_displacement = IVAL(inbuf, smb_nts_DataDisplacement);
2984 data_offset = IVAL(inbuf, smb_nts_DataOffset);
2985 num_data_sofar += data_count;
2986
2987 if (num_params_sofar > total_parameter_count || num_data_sofar > total_data_count) {
2988 DEBUG(0,("reply_nttrans2: data overflow in secondary nttrans packet"));
2989 goto bad_param;
2990 }
2991
2992 if (parameter_count) {
2993 if (parameter_displacement + parameter_count > total_parameter_count)
2994 goto bad_param;
2995 if ((parameter_displacement + parameter_count < parameter_displacement) ||
2996 (parameter_displacement + parameter_count < parameter_count))
2997 goto bad_param;
2998 if (parameter_displacement > total_parameter_count)
2999 goto bad_param;
3000 if ((smb_base(inbuf) + parameter_offset + parameter_count > inbuf + length) ||
3001 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
3002 goto bad_param;
3003 if (parameter_displacement + params < params)
3004 goto bad_param;
3005
3006 memcpy( &params[parameter_displacement], smb_base(inbuf) + parameter_offset, parameter_count);
3007 }
3008
3009 if (data_count) {
3010 if (data_displacement + data_count > total_data_count)
3011 goto bad_param;
3012 if ((data_displacement + data_count < data_displacement) ||
3013 (data_displacement + data_count < data_count))
3014 goto bad_param;
3015 if (data_displacement > total_data_count)
3016 goto bad_param;
3017 if ((smb_base(inbuf) + data_offset + data_count > inbuf + length) ||
3018 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
3019 goto bad_param;
3020 if (data_displacement + data < data)
3021 goto bad_param;
3022
3023 memcpy( &data[data_displacement], smb_base(inbuf)+ data_offset, data_count);
3024 }
3025 }
3026 }
3027
3028 if (Protocol >= PROTOCOL_NT1)
3029 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | FLAGS2_IS_LONG_NAME);
3030
3031 /* Now we must call the relevant NT_TRANS function */
3032 switch(function_code) {
3033 case NT_TRANSACT_CREATE:
3034 START_PROFILE_NESTED(NT_transact_create);
3035 outsize = call_nt_transact_create(conn, inbuf, outbuf,
3036 length, bufsize,
3037 &setup, setup_count,
3038 &params, total_parameter_count,
3039 &data, total_data_count, max_data_count);
3040 END_PROFILE_NESTED(NT_transact_create);
3041 break;
3042 case NT_TRANSACT_IOCTL:
3043 START_PROFILE_NESTED(NT_transact_ioctl);
3044 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
3045 length, bufsize,
3046 &setup, setup_count,
3047 &params, total_parameter_count,
3048 &data, total_data_count, max_data_count);
3049 END_PROFILE_NESTED(NT_transact_ioctl);
3050 break;
3051 case NT_TRANSACT_SET_SECURITY_DESC:
3052 START_PROFILE_NESTED(NT_transact_set_security_desc);
3053 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
3054 length, bufsize,
3055 &setup, setup_count,
3056 &params, total_parameter_count,
3057 &data, total_data_count, max_data_count);
3058 END_PROFILE_NESTED(NT_transact_set_security_desc);
3059 break;
3060 case NT_TRANSACT_NOTIFY_CHANGE:
3061 START_PROFILE_NESTED(NT_transact_notify_change);
3062 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
3063 length, bufsize,
3064 &setup, setup_count,
3065 &params, total_parameter_count,
3066 &data, total_data_count, max_data_count);
3067 END_PROFILE_NESTED(NT_transact_notify_change);
3068 break;
3069 case NT_TRANSACT_RENAME:
3070 START_PROFILE_NESTED(NT_transact_rename);
3071 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
3072 length, bufsize,
3073 &setup, setup_count,
3074 &params, total_parameter_count,
3075 &data, total_data_count, max_data_count);
3076 END_PROFILE_NESTED(NT_transact_rename);
3077 break;
3078
3079 case NT_TRANSACT_QUERY_SECURITY_DESC:
3080 START_PROFILE_NESTED(NT_transact_query_security_desc);
3081 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
3082 length, bufsize,
3083 &setup, setup_count,
3084 &params, total_parameter_count,
3085 &data, total_data_count, max_data_count);
3086 END_PROFILE_NESTED(NT_transact_query_security_desc);
3087 break;
3088 #ifdef HAVE_SYS_QUOTAS
3089 case NT_TRANSACT_GET_USER_QUOTA:
3090 START_PROFILE_NESTED(NT_transact_get_user_quota);
3091 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
3092 length, bufsize,
3093 &setup, setup_count,
3094 &params, total_parameter_count,
3095 &data, total_data_count, max_data_count);
3096 END_PROFILE_NESTED(NT_transact_get_user_quota);
3097 break;
3098 case NT_TRANSACT_SET_USER_QUOTA:
3099 START_PROFILE_NESTED(NT_transact_set_user_quota);
3100 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
3101 length, bufsize,
3102 &setup, setup_count,
3103 &params, total_parameter_count,
3104 &data, total_data_count, max_data_count);
3105 END_PROFILE_NESTED(NT_transact_set_user_quota);
3106 break;
3107 #endif /* HAVE_SYS_QUOTAS */
3108 default:
3109 /* Error in request */
3110 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code));
3111 SAFE_FREE(setup);
3112 SAFE_FREE(params);
3113 SAFE_FREE(data);
3114 END_PROFILE(SMBnttrans);
3115 srv_signing_trans_stop();
3116 return ERROR_DOS(ERRSRV,ERRerror);
3117 }
3118
3119 /* As we do not know how many data packets will need to be
3120 returned here the various call_nt_transact_xxxx calls
3121 must send their own. Thus a call_nt_transact_xxxx routine only
3122 returns a value other than -1 when it wants to send
3123 an error packet.
3124 */
3125
3126 srv_signing_trans_stop();
3127
3128 SAFE_FREE(setup);
3129 SAFE_FREE(params);
3130 SAFE_FREE(data);
3131 END_PROFILE(SMBnttrans);
3132 return outsize; /* If a correct response was needed the call_nt_transact_xxxx
3133 calls have already sent it. If outsize != -1 then it is
3134 returning an error packet. */
3135
3136 bad_param:
3137
3138 srv_signing_trans_stop();
3139 SAFE_FREE(params);
3140 SAFE_FREE(data);
3141 SAFE_FREE(setup);
3142 END_PROFILE(SMBnttrans);
3143 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3144 }
Samba GIT mirror