?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Add an async smbsock_connect
[Samba.git] / source3 / smbd / nttrans.c
blob2834f080a76077956bf05994f81cee45b5a5a3fc
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23
24 extern enum protocol_types Protocol;
25 extern const struct generic_mapping file_generic_mapping;
26
27 static char *nttrans_realloc(char **ptr, size_t size)
28 {
29 if (ptr==NULL) {
30 smb_panic("nttrans_realloc() called with NULL ptr");
31 }
32
33 *ptr = (char *)SMB_REALLOC(*ptr, size);
34 if(*ptr == NULL) {
35 return NULL;
36 }
37 memset(*ptr,'\0',size);
38 return *ptr;
39 }
40
41 /****************************************************************************
42 Send the required number of replies back.
43 We assume all fields other than the data fields are
44 set correctly for the type of call.
45 HACK ! Always assumes smb_setup field is zero.
46 ****************************************************************************/
47
48 void send_nt_replies(connection_struct *conn,
49 struct smb_request *req, NTSTATUS nt_error,
50 char *params, int paramsize,
51 char *pdata, int datasize)
52 {
53 int data_to_send = datasize;
54 int params_to_send = paramsize;
55 int useable_space;
56 char *pp = params;
57 char *pd = pdata;
58 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59 int alignment_offset = 3;
60 int data_alignment_offset = 0;
61
62 /*
63 * If there genuinely are no parameters or data to send just send
64 * the empty packet.
65 */
66
67 if(params_to_send == 0 && data_to_send == 0) {
68 reply_outbuf(req, 18, 0);
69 show_msg((char *)req->outbuf);
70 return;
71 }
72
73 /*
74 * When sending params and data ensure that both are nicely aligned.
75 * Only do this alignment when there is also data to send - else
76 * can cause NT redirector problems.
77 */
78
79 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
80 data_alignment_offset = 4 - (params_to_send % 4);
81 }
82
83 /*
84 * Space is bufsize minus Netbios over TCP header minus SMB header.
85 * The alignment_offset is to align the param bytes on a four byte
86 * boundary (2 bytes for data len, one byte pad).
87 * NT needs this to work correctly.
88 */
89
90 useable_space = max_send - (smb_size
91 + 2 * 18 /* wct */
92 + alignment_offset
93 + data_alignment_offset);
94
95 if (useable_space < 0) {
96 char *msg = talloc_asprintf(
97 talloc_tos(),
98 "send_nt_replies failed sanity useable_space = %d!!!",
99 useable_space);
100 DEBUG(0, ("%s\n", msg));
101 exit_server_cleanly(msg);
102 }
103
104 while (params_to_send || data_to_send) {
105
106 /*
107 * Calculate whether we will totally or partially fill this packet.
108 */
109
110 total_sent_thistime = params_to_send + data_to_send;
111
112 /*
113 * We can never send more than useable_space.
114 */
115
116 total_sent_thistime = MIN(total_sent_thistime, useable_space);
117
118 reply_outbuf(req, 18,
119 total_sent_thistime + alignment_offset
120 + data_alignment_offset);
121
122 /*
123 * We might have had SMBnttranss in req->inbuf, fix that.
124 */
125 SCVAL(req->outbuf, smb_com, SMBnttrans);
126
127 /*
128 * Set total params and data to be sent.
129 */
130
131 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
132 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
133
134 /*
135 * Calculate how many parameters and data we can fit into
136 * this packet. Parameters get precedence.
137 */
138
139 params_sent_thistime = MIN(params_to_send,useable_space);
140 data_sent_thistime = useable_space - params_sent_thistime;
141 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
142
143 SIVAL(req->outbuf, smb_ntr_ParameterCount,
144 params_sent_thistime);
145
146 if(params_sent_thistime == 0) {
147 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
148 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
149 } else {
150 /*
151 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
152 * parameter bytes, however the first 4 bytes of outbuf are
153 * the Netbios over TCP header. Thus use smb_base() to subtract
154 * them from the calculation.
155 */
156
157 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
158 ((smb_buf(req->outbuf)+alignment_offset)
159 - smb_base(req->outbuf)));
160 /*
161 * Absolute displacement of param bytes sent in this packet.
162 */
163
164 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
165 pp - params);
166 }
167
168 /*
169 * Deal with the data portion.
170 */
171
172 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
173
174 if(data_sent_thistime == 0) {
175 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
176 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
177 } else {
178 /*
179 * The offset of the data bytes is the offset of the
180 * parameter bytes plus the number of parameters being sent this time.
181 */
182
183 SIVAL(req->outbuf, smb_ntr_DataOffset,
184 ((smb_buf(req->outbuf)+alignment_offset) -
185 smb_base(req->outbuf))
186 + params_sent_thistime + data_alignment_offset);
187 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
188 }
189
190 /*
191 * Copy the param bytes into the packet.
192 */
193
194 if(params_sent_thistime) {
195 if (alignment_offset != 0) {
196 memset(smb_buf(req->outbuf), 0,
197 alignment_offset);
198 }
199 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
200 params_sent_thistime);
201 }
202
203 /*
204 * Copy in the data bytes
205 */
206
207 if(data_sent_thistime) {
208 if (data_alignment_offset != 0) {
209 memset((smb_buf(req->outbuf)+alignment_offset+
210 params_sent_thistime), 0,
211 data_alignment_offset);
212 }
213 memcpy(smb_buf(req->outbuf)+alignment_offset
214 +params_sent_thistime+data_alignment_offset,
215 pd,data_sent_thistime);
216 }
217
218 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
219 params_sent_thistime, data_sent_thistime, useable_space));
220 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
221 params_to_send, data_to_send, paramsize, datasize));
222
223 if (NT_STATUS_V(nt_error)) {
224 error_packet_set((char *)req->outbuf,
225 0, 0, nt_error,
226 __LINE__,__FILE__);
227 }
228
229 /* Send the packet */
230 show_msg((char *)req->outbuf);
231 if (!srv_send_smb(smbd_server_fd(),
232 (char *)req->outbuf,
233 IS_CONN_ENCRYPTED(conn),
234 &req->pcd)) {
235 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
236 }
237
238 TALLOC_FREE(req->outbuf);
239
240 pp += params_sent_thistime;
241 pd += data_sent_thistime;
242
243 params_to_send -= params_sent_thistime;
244 data_to_send -= data_sent_thistime;
245
246 /*
247 * Sanity check
248 */
249
250 if(params_to_send < 0 || data_to_send < 0) {
251 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252 params_to_send, data_to_send));
253 exit_server_cleanly("send_nt_replies: internal error");
254 }
255 }
256 }
257
258 /****************************************************************************
259 Is it an NTFS stream name ?
260 An NTFS file name is <path>.<extention>:<stream name>:<stream type>
261 $DATA can be used as both a stream name and a stream type. A missing stream
262 name or type implies $DATA.
263
264 Both Windows stream names and POSIX files can contain the ':' character.
265 This function first checks for the existence of a colon in the last component
266 of the given name. If the name contains a colon we differentiate between a
267 stream and POSIX file by checking if the latter exists through a POSIX stat.
268
269 Function assumes we've already chdir() to the "root" directory of fname.
270 ****************************************************************************/
271
272 bool is_ntfs_stream_name(const char *fname)
273 {
274 const char *lastcomp;
275 SMB_STRUCT_STAT sbuf;
276
277 /* If all pathnames are treated as POSIX we ignore streams. */
278 if (lp_posix_pathnames()) {
279 return false;
280 }
281
282 /* Find the last component of the name. */
283 if ((lastcomp = strrchr_m(fname, '/')) != NULL)
284 ++lastcomp;
285 else
286 lastcomp = fname;
287
288 /* If there is no colon in the last component, it's not a stream. */
289 if (strchr_m(lastcomp, ':') == NULL)
290 return false;
291
292 /*
293 * If file already exists on disk, it's not a stream. The stat must
294 * bypass the vfs layer so streams modules don't intefere.
295 */
296 if (sys_stat(fname, &sbuf) == 0) {
297 DEBUG(5, ("is_ntfs_stream_name: file %s contains a ':' but is "
298 "not a stream\n", fname));
299 return false;
300 }
301
302 return true;
303 }
304
305 /****************************************************************************
306 Reply to an NT create and X call on a pipe
307 ****************************************************************************/
308
309 static void nt_open_pipe(char *fname, connection_struct *conn,
310 struct smb_request *req, int *ppnum)
311 {
312 files_struct *fsp;
313 NTSTATUS status;
314
315 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
316
317 /* Strip \\ off the name. */
318 fname++;
319
320 status = open_np_file(req, fname, &fsp);
321 if (!NT_STATUS_IS_OK(status)) {
322 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
323 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
324 ERRDOS, ERRbadpipe);
325 return;
326 }
327 reply_nterror(req, status);
328 return;
329 }
330
331 *ppnum = fsp->fnum;
332 return;
333 }
334
335 /****************************************************************************
336 Reply to an NT create and X call for pipes.
337 ****************************************************************************/
338
339 static void do_ntcreate_pipe_open(connection_struct *conn,
340 struct smb_request *req)
341 {
342 char *fname = NULL;
343 int pnum = -1;
344 char *p = NULL;
345 uint32 flags = IVAL(req->vwv+3, 1);
346 TALLOC_CTX *ctx = talloc_tos();
347
348 srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
349
350 if (!fname) {
351 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
352 ERRDOS, ERRbadpipe);
353 return;
354 }
355 nt_open_pipe(fname, conn, req, &pnum);
356
357 if (req->outbuf) {
358 /* error reply */
359 return;
360 }
361
362 /*
363 * Deal with pipe return.
364 */
365
366 if (flags & EXTENDED_RESPONSE_REQUIRED) {
367 /* This is very strange. We
368 * return 50 words, but only set
369 * the wcnt to 42 ? It's definately
370 * what happens on the wire....
371 */
372 reply_outbuf(req, 50, 0);
373 SCVAL(req->outbuf,smb_wct,42);
374 } else {
375 reply_outbuf(req, 34, 0);
376 }
377
378 p = (char *)req->outbuf + smb_vwv2;
379 p++;
380 SSVAL(p,0,pnum);
381 p += 2;
382 SIVAL(p,0,FILE_WAS_OPENED);
383 p += 4;
384 p += 32;
385 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
386 p += 20;
387 /* File type. */
388 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
389 /* Device state. */
390 SSVAL(p,2, 0x5FF); /* ? */
391 p += 4;
392
393 if (flags & EXTENDED_RESPONSE_REQUIRED) {
394 p += 25;
395 SIVAL(p,0,FILE_GENERIC_ALL);
396 /*
397 * For pipes W2K3 seems to return
398 * 0x12019B next.
399 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
400 */
401 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
402 }
403
404 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
405
406 chain_reply(req);
407 }
408
409 /****************************************************************************
410 Reply to an NT create and X call.
411 ****************************************************************************/
412
413 void reply_ntcreate_and_X(struct smb_request *req)
414 {
415 connection_struct *conn = req->conn;
416 char *fname = NULL;
417 uint32 flags;
418 uint32 access_mask;
419 uint32 file_attributes;
420 uint32 share_access;
421 uint32 create_disposition;
422 uint32 create_options;
423 uint16 root_dir_fid;
424 uint64_t allocation_size;
425 /* Breakout the oplock request bits so we can set the
426 reply bits separately. */
427 uint32 fattr=0;
428 SMB_OFF_T file_len = 0;
429 SMB_STRUCT_STAT sbuf;
430 int info = 0;
431 files_struct *fsp = NULL;
432 char *p = NULL;
433 struct timespec c_timespec;
434 struct timespec a_timespec;
435 struct timespec m_timespec;
436 NTSTATUS status;
437 int oplock_request;
438 uint8_t oplock_granted = NO_OPLOCK_RETURN;
439 struct case_semantics_state *case_state = NULL;
440 TALLOC_CTX *ctx = talloc_tos();
441
442 START_PROFILE(SMBntcreateX);
443
444 SET_STAT_INVALID(sbuf);
445
446 if (req->wct < 24) {
447 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
448 return;
449 }
450
451 flags = IVAL(req->vwv+3, 1);
452 access_mask = IVAL(req->vwv+7, 1);
453 file_attributes = IVAL(req->vwv+13, 1);
454 share_access = IVAL(req->vwv+15, 1);
455 create_disposition = IVAL(req->vwv+17, 1);
456 create_options = IVAL(req->vwv+19, 1);
457 root_dir_fid = (uint16)IVAL(req->vwv+5, 1);
458
459 allocation_size = (uint64_t)IVAL(req->vwv+9, 1);
460 #ifdef LARGE_SMB_OFF_T
461 allocation_size |= (((uint64_t)IVAL(req->vwv+11, 1)) << 32);
462 #endif
463
464 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
465 STR_TERMINATE, &status);
466
467 if (!NT_STATUS_IS_OK(status)) {
468 reply_nterror(req, status);
469 END_PROFILE(SMBntcreateX);
470 return;
471 }
472
473 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
474 "file_attributes = 0x%x, share_access = 0x%x, "
475 "create_disposition = 0x%x create_options = 0x%x "
476 "root_dir_fid = 0x%x, fname = %s\n",
477 (unsigned int)flags,
478 (unsigned int)access_mask,
479 (unsigned int)file_attributes,
480 (unsigned int)share_access,
481 (unsigned int)create_disposition,
482 (unsigned int)create_options,
483 (unsigned int)root_dir_fid,
484 fname));
485
486 /*
487 * we need to remove ignored bits when they come directly from the client
488 * because we reuse some of them for internal stuff
489 */
490 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
491
492 /*
493 * If it's an IPC, use the pipe handler.
494 */
495
496 if (IS_IPC(conn)) {
497 if (lp_nt_pipe_support()) {
498 do_ntcreate_pipe_open(conn, req);
499 END_PROFILE(SMBntcreateX);
500 return;
501 }
502 reply_doserror(req, ERRDOS, ERRnoaccess);
503 END_PROFILE(SMBntcreateX);
504 return;
505 }
506
507 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
508 if (oplock_request) {
509 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
510 ? BATCH_OPLOCK : 0;
511 }
512
513 /*
514 * Check if POSIX semantics are wanted.
515 */
516
517 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
518 case_state = set_posix_case_semantics(ctx, conn);
519 if (!case_state) {
520 reply_nterror(req, NT_STATUS_NO_MEMORY);
521 END_PROFILE(SMBntcreateX);
522 return;
523 }
524 /*
525 * Bug #6898 - clients using Windows opens should
526 * never be able to set this attribute into the
527 * VFS.
528 */
529 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
530 }
531
532 status = SMB_VFS_CREATE_FILE(
533 conn, /* conn */
534 req, /* req */
535 root_dir_fid, /* root_dir_fid */
536 fname, /* fname */
537 CFF_DOS_PATH, /* create_file_flags */
538 access_mask, /* access_mask */
539 share_access, /* share_access */
540 create_disposition, /* create_disposition*/
541 create_options, /* create_options */
542 file_attributes, /* file_attributes */
543 oplock_request, /* oplock_request */
544 allocation_size, /* allocation_size */
545 NULL, /* sd */
546 NULL, /* ea_list */
547 &fsp, /* result */
548 &info, /* pinfo */
549 &sbuf); /* psbuf */
550
551 TALLOC_FREE(case_state);
552
553 if (!NT_STATUS_IS_OK(status)) {
554 if (open_was_deferred(req->mid)) {
555 /* We have re-scheduled this call, no error. */
556 END_PROFILE(SMBntcreateX);
557 return;
558 }
559 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
560 reply_botherror(req, status, ERRDOS, ERRfilexists);
561 }
562 else {
563 reply_nterror(req, status);
564 }
565 END_PROFILE(SMBntcreateX);
566 return;
567 }
568
569 /*
570 * If the caller set the extended oplock request bit
571 * and we granted one (by whatever means) - set the
572 * correct bit for extended oplock reply.
573 */
574
575 if (oplock_request &&
576 (lp_fake_oplocks(SNUM(conn))
577 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
578
579 /*
580 * Exclusive oplock granted
581 */
582
583 if (flags & REQUEST_BATCH_OPLOCK) {
584 oplock_granted = BATCH_OPLOCK_RETURN;
585 } else {
586 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
587 }
588 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
589 oplock_granted = LEVEL_II_OPLOCK_RETURN;
590 } else {
591 oplock_granted = NO_OPLOCK_RETURN;
592 }
593
594 file_len = sbuf.st_size;
595 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
596 if (fattr == 0) {
597 fattr = FILE_ATTRIBUTE_NORMAL;
598 }
599
600 if (flags & EXTENDED_RESPONSE_REQUIRED) {
601 /* This is very strange. We
602 * return 50 words, but only set
603 * the wcnt to 42 ? It's definately
604 * what happens on the wire....
605 */
606 reply_outbuf(req, 50, 0);
607 SCVAL(req->outbuf,smb_wct,42);
608 } else {
609 reply_outbuf(req, 34, 0);
610 }
611
612 p = (char *)req->outbuf + smb_vwv2;
613
614 SCVAL(p, 0, oplock_granted);
615
616 p++;
617 SSVAL(p,0,fsp->fnum);
618 p += 2;
619 if ((create_disposition == FILE_SUPERSEDE)
620 && (info == FILE_WAS_OVERWRITTEN)) {
621 SIVAL(p,0,FILE_WAS_SUPERSEDED);
622 } else {
623 SIVAL(p,0,info);
624 }
625 p += 4;
626
627 /* Create time. */
628 c_timespec = get_create_timespec(
629 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
630 a_timespec = get_atimespec(&sbuf);
631 m_timespec = get_mtimespec(&sbuf);
632
633 if (lp_dos_filetime_resolution(SNUM(conn))) {
634 dos_filetime_timespec(&c_timespec);
635 dos_filetime_timespec(&a_timespec);
636 dos_filetime_timespec(&m_timespec);
637 }
638
639 put_long_date_timespec(conn->ts_res, p, c_timespec); /* create time. */
640 p += 8;
641 put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
642 p += 8;
643 put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
644 p += 8;
645 put_long_date_timespec(conn->ts_res, p, m_timespec); /* change time */
646 p += 8;
647 SIVAL(p,0,fattr); /* File Attributes. */
648 p += 4;
649 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf));
650 p += 8;
651 SOFF_T(p,0,file_len);
652 p += 8;
653 if (flags & EXTENDED_RESPONSE_REQUIRED) {
654 SSVAL(p,2,0x7);
655 }
656 p += 4;
657 SCVAL(p,0,fsp->is_directory ? 1 : 0);
658
659 if (flags & EXTENDED_RESPONSE_REQUIRED) {
660 uint32 perms = 0;
661 p += 25;
662 if (fsp->is_directory
663 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
664 perms = FILE_GENERIC_ALL;
665 } else {
666 perms = FILE_GENERIC_READ|FILE_EXECUTE;
667 }
668 SIVAL(p,0,perms);
669 }
670
671 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
672 fsp->fnum, fsp->fsp_name));
673
674 chain_reply(req);
675 END_PROFILE(SMBntcreateX);
676 return;
677 }
678
679 /****************************************************************************
680 Reply to a NT_TRANSACT_CREATE call to open a pipe.
681 ****************************************************************************/
682
683 static void do_nt_transact_create_pipe(connection_struct *conn,
684 struct smb_request *req,
685 uint16 **ppsetup, uint32 setup_count,
686 char **ppparams, uint32 parameter_count,
687 char **ppdata, uint32 data_count)
688 {
689 char *fname = NULL;
690 char *params = *ppparams;
691 int pnum = -1;
692 char *p = NULL;
693 NTSTATUS status;
694 size_t param_len;
695 uint32 flags;
696 TALLOC_CTX *ctx = talloc_tos();
697
698 /*
699 * Ensure minimum number of parameters sent.
700 */
701
702 if(parameter_count < 54) {
703 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
704 reply_doserror(req, ERRDOS, ERRnoaccess);
705 return;
706 }
707
708 flags = IVAL(params,0);
709
710 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
711 parameter_count-53, STR_TERMINATE,
712 &status);
713 if (!NT_STATUS_IS_OK(status)) {
714 reply_nterror(req, status);
715 return;
716 }
717
718 nt_open_pipe(fname, conn, req, &pnum);
719
720 if (req->outbuf) {
721 /* Error return */
722 return;
723 }
724
725 /* Realloc the size of parameters and data we will return */
726 if (flags & EXTENDED_RESPONSE_REQUIRED) {
727 /* Extended response is 32 more byyes. */
728 param_len = 101;
729 } else {
730 param_len = 69;
731 }
732 params = nttrans_realloc(ppparams, param_len);
733 if(params == NULL) {
734 reply_doserror(req, ERRDOS, ERRnomem);
735 return;
736 }
737
738 p = params;
739 SCVAL(p,0,NO_OPLOCK_RETURN);
740
741 p += 2;
742 SSVAL(p,0,pnum);
743 p += 2;
744 SIVAL(p,0,FILE_WAS_OPENED);
745 p += 8;
746
747 p += 32;
748 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
749 p += 20;
750 /* File type. */
751 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
752 /* Device state. */
753 SSVAL(p,2, 0x5FF); /* ? */
754 p += 4;
755
756 if (flags & EXTENDED_RESPONSE_REQUIRED) {
757 p += 25;
758 SIVAL(p,0,FILE_GENERIC_ALL);
759 /*
760 * For pipes W2K3 seems to return
761 * 0x12019B next.
762 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
763 */
764 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
765 }
766
767 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
768
769 /* Send the required number of replies */
770 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
771
772 return;
773 }
774
775 /****************************************************************************
776 Internal fn to set security descriptors.
777 ****************************************************************************/
778
779 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
780 uint32 security_info_sent)
781 {
782 SEC_DESC *psd = NULL;
783 NTSTATUS status;
784
785 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
786 return NT_STATUS_OK;
787 }
788
789 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
790
791 if (!NT_STATUS_IS_OK(status)) {
792 return status;
793 }
794
795 if (psd->owner_sid == NULL) {
796 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
797 }
798 if (psd->group_sid == NULL) {
799 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
800 }
801
802 /* Convert all the generic bits. */
803 security_acl_map_generic(psd->dacl, &file_generic_mapping);
804 security_acl_map_generic(psd->sacl, &file_generic_mapping);
805
806 if (DEBUGLEVEL >= 10) {
807 DEBUG(10,("set_sd for file %s\n", fsp->fsp_name ));
808 NDR_PRINT_DEBUG(security_descriptor, psd);
809 }
810
811 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
812
813 TALLOC_FREE(psd);
814
815 return status;
816 }
817
818 /****************************************************************************
819 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
820 ****************************************************************************/
821
822 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
823 {
824 struct ea_list *ea_list_head = NULL;
825 size_t offset = 0;
826
827 if (data_size < 4) {
828 return NULL;
829 }
830
831 while (offset + 4 <= data_size) {
832 size_t next_offset = IVAL(pdata,offset);
833 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
834
835 if (!eal) {
836 return NULL;
837 }
838
839 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
840 if (next_offset == 0) {
841 break;
842 }
843 offset += next_offset;
844 }
845
846 return ea_list_head;
847 }
848
849 /****************************************************************************
850 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
851 ****************************************************************************/
852
853 static void call_nt_transact_create(connection_struct *conn,
854 struct smb_request *req,
855 uint16 **ppsetup, uint32 setup_count,
856 char **ppparams, uint32 parameter_count,
857 char **ppdata, uint32 data_count,
858 uint32 max_data_count)
859 {
860 char *fname = NULL;
861 char *params = *ppparams;
862 char *data = *ppdata;
863 /* Breakout the oplock request bits so we can set the reply bits separately. */
864 uint32 fattr=0;
865 SMB_OFF_T file_len = 0;
866 SMB_STRUCT_STAT sbuf;
867 int info = 0;
868 files_struct *fsp = NULL;
869 char *p = NULL;
870 uint32 flags;
871 uint32 access_mask;
872 uint32 file_attributes;
873 uint32 share_access;
874 uint32 create_disposition;
875 uint32 create_options;
876 uint32 sd_len;
877 struct security_descriptor *sd = NULL;
878 uint32 ea_len;
879 uint16 root_dir_fid;
880 struct timespec c_timespec;
881 struct timespec a_timespec;
882 struct timespec m_timespec;
883 struct ea_list *ea_list = NULL;
884 NTSTATUS status;
885 size_t param_len;
886 uint64_t allocation_size;
887 int oplock_request;
888 uint8_t oplock_granted;
889 struct case_semantics_state *case_state = NULL;
890 TALLOC_CTX *ctx = talloc_tos();
891
892 SET_STAT_INVALID(sbuf);
893
894 DEBUG(5,("call_nt_transact_create\n"));
895
896 /*
897 * If it's an IPC, use the pipe handler.
898 */
899
900 if (IS_IPC(conn)) {
901 if (lp_nt_pipe_support()) {
902 do_nt_transact_create_pipe(
903 conn, req,
904 ppsetup, setup_count,
905 ppparams, parameter_count,
906 ppdata, data_count);
907 return;
908 }
909 reply_doserror(req, ERRDOS, ERRnoaccess);
910 return;
911 }
912
913 /*
914 * Ensure minimum number of parameters sent.
915 */
916
917 if(parameter_count < 54) {
918 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
919 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
920 return;
921 }
922
923 flags = IVAL(params,0);
924 access_mask = IVAL(params,8);
925 file_attributes = IVAL(params,20);
926 share_access = IVAL(params,24);
927 create_disposition = IVAL(params,28);
928 create_options = IVAL(params,32);
929 sd_len = IVAL(params,36);
930 ea_len = IVAL(params,40);
931 root_dir_fid = (uint16)IVAL(params,4);
932 allocation_size = (uint64_t)IVAL(params,12);
933 #ifdef LARGE_SMB_OFF_T
934 allocation_size |= (((uint64_t)IVAL(params,16)) << 32);
935 #endif
936
937 /*
938 * we need to remove ignored bits when they come directly from the client
939 * because we reuse some of them for internal stuff
940 */
941 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
942
943 /* Ensure the data_len is correct for the sd and ea values given. */
944 if ((ea_len + sd_len > data_count)
945 || (ea_len > data_count) || (sd_len > data_count)
946 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
947 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
948 "%u, data_count = %u\n", (unsigned int)ea_len,
949 (unsigned int)sd_len, (unsigned int)data_count));
950 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
951 return;
952 }
953
954 if (sd_len) {
955 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
956 sd_len));
957
958 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
959 &sd);
960 if (!NT_STATUS_IS_OK(status)) {
961 DEBUG(10, ("call_nt_transact_create: "
962 "unmarshall_sec_desc failed: %s\n",
963 nt_errstr(status)));
964 reply_nterror(req, status);
965 return;
966 }
967 }
968
969 if (ea_len) {
970 if (!lp_ea_support(SNUM(conn))) {
971 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
972 "EA's not supported.\n",
973 (unsigned int)ea_len));
974 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
975 return;
976 }
977
978 if (ea_len < 10) {
979 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
980 "too small (should be more than 10)\n",
981 (unsigned int)ea_len ));
982 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
983 return;
984 }
985
986 /* We have already checked that ea_len <= data_count here. */
987 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
988 ea_len);
989 if (ea_list == NULL) {
990 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
991 return;
992 }
993 }
994
995 srvstr_get_path(ctx, params, req->flags2, &fname,
996 params+53, parameter_count-53,
997 STR_TERMINATE, &status);
998 if (!NT_STATUS_IS_OK(status)) {
999 reply_nterror(req, status);
1000 return;
1001 }
1002
1003 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1004 if (oplock_request) {
1005 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
1006 ? BATCH_OPLOCK : 0;
1007 }
1008
1009 /*
1010 * Check if POSIX semantics are wanted.
1011 */
1012
1013 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1014 case_state = set_posix_case_semantics(ctx, conn);
1015 if (!case_state) {
1016 reply_nterror(req, NT_STATUS_NO_MEMORY);
1017 return;
1018 }
1019 /*
1020 * Bug #6898 - clients using Windows opens should
1021 * never be able to set this attribute into the
1022 * VFS.
1023 */
1024 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1025 }
1026
1027 status = SMB_VFS_CREATE_FILE(
1028 conn, /* conn */
1029 req, /* req */
1030 root_dir_fid, /* root_dir_fid */
1031 fname, /* fname */
1032 CFF_DOS_PATH, /* create_file_flags */
1033 access_mask, /* access_mask */
1034 share_access, /* share_access */
1035 create_disposition, /* create_disposition*/
1036 create_options, /* create_options */
1037 file_attributes, /* file_attributes */
1038 oplock_request, /* oplock_request */
1039 allocation_size, /* allocation_size */
1040 sd, /* sd */
1041 ea_list, /* ea_list */
1042 &fsp, /* result */
1043 &info, /* pinfo */
1044 &sbuf); /* psbuf */
1045
1046 TALLOC_FREE(case_state);
1047
1048 if(!NT_STATUS_IS_OK(status)) {
1049 if (open_was_deferred(req->mid)) {
1050 /* We have re-scheduled this call, no error. */
1051 return;
1052 }
1053 reply_openerror(req, status);
1054 return;
1055 }
1056
1057 /*
1058 * If the caller set the extended oplock request bit
1059 * and we granted one (by whatever means) - set the
1060 * correct bit for extended oplock reply.
1061 */
1062
1063 if (oplock_request &&
1064 (lp_fake_oplocks(SNUM(conn))
1065 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1066
1067 /*
1068 * Exclusive oplock granted
1069 */
1070
1071 if (flags & REQUEST_BATCH_OPLOCK) {
1072 oplock_granted = BATCH_OPLOCK_RETURN;
1073 } else {
1074 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1075 }
1076 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1077 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1078 } else {
1079 oplock_granted = NO_OPLOCK_RETURN;
1080 }
1081
1082 file_len = sbuf.st_size;
1083 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1084 if (fattr == 0) {
1085 fattr = FILE_ATTRIBUTE_NORMAL;
1086 }
1087
1088 /* Realloc the size of parameters and data we will return */
1089 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1090 /* Extended response is 32 more byyes. */
1091 param_len = 101;
1092 } else {
1093 param_len = 69;
1094 }
1095 params = nttrans_realloc(ppparams, param_len);
1096 if(params == NULL) {
1097 reply_doserror(req, ERRDOS, ERRnomem);
1098 return;
1099 }
1100
1101 p = params;
1102 SCVAL(p, 0, oplock_granted);
1103
1104 p += 2;
1105 SSVAL(p,0,fsp->fnum);
1106 p += 2;
1107 if ((create_disposition == FILE_SUPERSEDE)
1108 && (info == FILE_WAS_OVERWRITTEN)) {
1109 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1110 } else {
1111 SIVAL(p,0,info);
1112 }
1113 p += 8;
1114
1115 /* Create time. */
1116 c_timespec = get_create_timespec(
1117 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1118 a_timespec = get_atimespec(&sbuf);
1119 m_timespec = get_mtimespec(&sbuf);
1120
1121 if (lp_dos_filetime_resolution(SNUM(conn))) {
1122 dos_filetime_timespec(&c_timespec);
1123 dos_filetime_timespec(&a_timespec);
1124 dos_filetime_timespec(&m_timespec);
1125 }
1126
1127 put_long_date_timespec(conn->ts_res, p, c_timespec); /* create time. */
1128 p += 8;
1129 put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
1130 p += 8;
1131 put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
1132 p += 8;
1133 put_long_date_timespec(conn->ts_res, p, m_timespec); /* change time */
1134 p += 8;
1135 SIVAL(p,0,fattr); /* File Attributes. */
1136 p += 4;
1137 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf));
1138 p += 8;
1139 SOFF_T(p,0,file_len);
1140 p += 8;
1141 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1142 SSVAL(p,2,0x7);
1143 }
1144 p += 4;
1145 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1146
1147 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1148 uint32 perms = 0;
1149 p += 25;
1150 if (fsp->is_directory
1151 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1152 perms = FILE_GENERIC_ALL;
1153 } else {
1154 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1155 }
1156 SIVAL(p,0,perms);
1157 }
1158
1159 DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1160
1161 /* Send the required number of replies */
1162 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1163
1164 return;
1165 }
1166
1167 /****************************************************************************
1168 Reply to a NT CANCEL request.
1169 conn POINTER CAN BE NULL HERE !
1170 ****************************************************************************/
1171
1172 void reply_ntcancel(struct smb_request *req)
1173 {
1174 /*
1175 * Go through and cancel any pending change notifies.
1176 */
1177
1178 START_PROFILE(SMBntcancel);
1179 remove_pending_change_notify_requests_by_mid(req->mid);
1180 remove_pending_lock_requests_by_mid(req->mid);
1181 srv_cancel_sign_response(req->mid, true);
1182
1183 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1184
1185 END_PROFILE(SMBntcancel);
1186 return;
1187 }
1188
1189 /****************************************************************************
1190 Copy a file.
1191 ****************************************************************************/
1192
1193 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1194 connection_struct *conn,
1195 struct smb_request *req,
1196 const char *oldname_in,
1197 const char *newname_in,
1198 uint32 attrs)
1199 {
1200 SMB_STRUCT_STAT sbuf1, sbuf2;
1201 char *oldname = NULL;
1202 char *newname = NULL;
1203 char *last_component_oldname = NULL;
1204 char *last_component_newname = NULL;
1205 files_struct *fsp1,*fsp2;
1206 uint32 fattr;
1207 int info;
1208 SMB_OFF_T ret=-1;
1209 NTSTATUS status = NT_STATUS_OK;
1210 char *parent;
1211
1212 ZERO_STRUCT(sbuf1);
1213 ZERO_STRUCT(sbuf2);
1214
1215 if (!CAN_WRITE(conn)) {
1216 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1217 }
1218
1219 status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1220 &last_component_oldname, &sbuf1);
1221 if (!NT_STATUS_IS_OK(status)) {
1222 return status;
1223 }
1224
1225 status = check_name(conn, oldname);
1226 if (!NT_STATUS_IS_OK(status)) {
1227 return status;
1228 }
1229
1230 /* Source must already exist. */
1231 if (!VALID_STAT(sbuf1)) {
1232 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1233 }
1234 /* Ensure attributes match. */
1235 fattr = dos_mode(conn,oldname,&sbuf1);
1236 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1237 return NT_STATUS_NO_SUCH_FILE;
1238 }
1239
1240 status = unix_convert(ctx, conn, newname_in, False, &newname,
1241 &last_component_newname, &sbuf2);
1242 if (!NT_STATUS_IS_OK(status)) {
1243 return status;
1244 }
1245
1246 status = check_name(conn, newname);
1247 if (!NT_STATUS_IS_OK(status)) {
1248 return status;
1249 }
1250
1251 /* Disallow if newname already exists. */
1252 if (VALID_STAT(sbuf2)) {
1253 return NT_STATUS_OBJECT_NAME_COLLISION;
1254 }
1255
1256 /* No links from a directory. */
1257 if (S_ISDIR(sbuf1.st_mode)) {
1258 return NT_STATUS_FILE_IS_A_DIRECTORY;
1259 }
1260
1261 /* Ensure this is within the share. */
1262 status = check_reduced_name(conn, oldname);
1263 if (!NT_STATUS_IS_OK(status)) {
1264 return status;
1265 }
1266
1267 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1268 oldname, newname));
1269
1270 status = SMB_VFS_CREATE_FILE(
1271 conn, /* conn */
1272 req, /* req */
1273 0, /* root_dir_fid */
1274 oldname, /* fname */
1275 0, /* create_file_flags */
1276 FILE_READ_DATA, /* access_mask */
1277 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1278 FILE_SHARE_DELETE),
1279 FILE_OPEN, /* create_disposition*/
1280 0, /* create_options */
1281 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1282 NO_OPLOCK, /* oplock_request */
1283 0, /* allocation_size */
1284 NULL, /* sd */
1285 NULL, /* ea_list */
1286 &fsp1, /* result */
1287 &info, /* pinfo */
1288 &sbuf1); /* psbuf */
1289
1290 if (!NT_STATUS_IS_OK(status)) {
1291 return status;
1292 }
1293
1294 status = SMB_VFS_CREATE_FILE(
1295 conn, /* conn */
1296 req, /* req */
1297 0, /* root_dir_fid */
1298 newname, /* fname */
1299 0, /* create_file_flags */
1300 FILE_WRITE_DATA, /* access_mask */
1301 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1302 FILE_SHARE_DELETE),
1303 FILE_CREATE, /* create_disposition*/
1304 0, /* create_options */
1305 fattr, /* file_attributes */
1306 NO_OPLOCK, /* oplock_request */
1307 0, /* allocation_size */
1308 NULL, /* sd */
1309 NULL, /* ea_list */
1310 &fsp2, /* result */
1311 &info, /* pinfo */
1312 &sbuf2); /* psbuf */
1313
1314 if (!NT_STATUS_IS_OK(status)) {
1315 close_file(NULL, fsp1, ERROR_CLOSE);
1316 return status;
1317 }
1318
1319 if (sbuf1.st_size) {
1320 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1321 }
1322
1323 /*
1324 * As we are opening fsp1 read-only we only expect
1325 * an error on close on fsp2 if we are out of space.
1326 * Thus we don't look at the error return from the
1327 * close of fsp1.
1328 */
1329 close_file(NULL, fsp1, NORMAL_CLOSE);
1330
1331 /* Ensure the modtime is set correctly on the destination file. */
1332 set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1333
1334 status = close_file(NULL, fsp2, NORMAL_CLOSE);
1335
1336 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1337 creates the file. This isn't the correct thing to do in the copy
1338 case. JRA */
1339 if (!parent_dirname(talloc_tos(), newname, &parent, NULL)) {
1340 return NT_STATUS_NO_MEMORY;
1341 }
1342 file_set_dosmode(conn, newname, fattr, &sbuf2, parent, false);
1343 TALLOC_FREE(parent);
1344
1345 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1346 return NT_STATUS_DISK_FULL;
1347 }
1348
1349 if (!NT_STATUS_IS_OK(status)) {
1350 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1351 nt_errstr(status), oldname, newname));
1352 }
1353 return status;
1354 }
1355
1356 /****************************************************************************
1357 Reply to a NT rename request.
1358 ****************************************************************************/
1359
1360 void reply_ntrename(struct smb_request *req)
1361 {
1362 connection_struct *conn = req->conn;
1363 char *oldname = NULL;
1364 char *newname = NULL;
1365 const char *p;
1366 NTSTATUS status;
1367 bool src_has_wcard = False;
1368 bool dest_has_wcard = False;
1369 uint32 attrs;
1370 uint16 rename_type;
1371 TALLOC_CTX *ctx = talloc_tos();
1372
1373 START_PROFILE(SMBntrename);
1374
1375 if (req->wct < 4) {
1376 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1377 END_PROFILE(SMBntrename);
1378 return;
1379 }
1380
1381 attrs = SVAL(req->vwv+0, 0);
1382 rename_type = SVAL(req->vwv+1, 0);
1383
1384 p = (const char *)req->buf + 1;
1385 p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1386 &status, &src_has_wcard);
1387 if (!NT_STATUS_IS_OK(status)) {
1388 reply_nterror(req, status);
1389 END_PROFILE(SMBntrename);
1390 return;
1391 }
1392
1393 if (ms_has_wild(oldname)) {
1394 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1395 END_PROFILE(SMBntrename);
1396 return;
1397 }
1398
1399 p++;
1400 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1401 &status, &dest_has_wcard);
1402 if (!NT_STATUS_IS_OK(status)) {
1403 reply_nterror(req, status);
1404 END_PROFILE(SMBntrename);
1405 return;
1406 }
1407
1408 status = resolve_dfspath(ctx, conn,
1409 req->flags2 & FLAGS2_DFS_PATHNAMES,
1410 oldname,
1411 &oldname);
1412 if (!NT_STATUS_IS_OK(status)) {
1413 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1414 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1415 ERRSRV, ERRbadpath);
1416 END_PROFILE(SMBntrename);
1417 return;
1418 }
1419 reply_nterror(req, status);
1420 END_PROFILE(SMBntrename);
1421 return;
1422 }
1423
1424 status = resolve_dfspath(ctx, conn,
1425 req->flags2 & FLAGS2_DFS_PATHNAMES,
1426 newname,
1427 &newname);
1428 if (!NT_STATUS_IS_OK(status)) {
1429 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1430 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1431 ERRSRV, ERRbadpath);
1432 END_PROFILE(SMBntrename);
1433 return;
1434 }
1435 reply_nterror(req, status);
1436 END_PROFILE(SMBntrename);
1437 return;
1438 }
1439
1440 /* The new name must begin with a ':' if the old name is a stream. */
1441 if (is_ntfs_stream_name(oldname) && (newname[0] != ':')) {
1442 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1443 END_PROFILE(SMBntrename);
1444 return;
1445 }
1446
1447 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1448
1449 switch(rename_type) {
1450 case RENAME_FLAG_RENAME:
1451 status = rename_internals(ctx, conn, req, oldname,
1452 newname, attrs, False, src_has_wcard,
1453 dest_has_wcard, DELETE_ACCESS);
1454 break;
1455 case RENAME_FLAG_HARD_LINK:
1456 if (src_has_wcard || dest_has_wcard) {
1457 /* No wildcards. */
1458 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1459 } else {
1460 status = hardlink_internals(ctx,
1461 conn,
1462 oldname,
1463 newname);
1464 }
1465 break;
1466 case RENAME_FLAG_COPY:
1467 if (src_has_wcard || dest_has_wcard) {
1468 /* No wildcards. */
1469 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1470 } else {
1471 status = copy_internals(ctx, conn, req, oldname,
1472 newname, attrs);
1473 }
1474 break;
1475 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1476 status = NT_STATUS_INVALID_PARAMETER;
1477 break;
1478 default:
1479 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1480 break;
1481 }
1482
1483 if (!NT_STATUS_IS_OK(status)) {
1484 if (open_was_deferred(req->mid)) {
1485 /* We have re-scheduled this call. */
1486 END_PROFILE(SMBntrename);
1487 return;
1488 }
1489
1490 reply_nterror(req, status);
1491 END_PROFILE(SMBntrename);
1492 return;
1493 }
1494
1495 reply_outbuf(req, 0, 0);
1496
1497 END_PROFILE(SMBntrename);
1498 return;
1499 }
1500
1501 /****************************************************************************
1502 Reply to a notify change - queue the request and
1503 don't allow a directory to be opened.
1504 ****************************************************************************/
1505
1506 static void call_nt_transact_notify_change(connection_struct *conn,
1507 struct smb_request *req,
1508 uint16 **ppsetup,
1509 uint32 setup_count,
1510 char **ppparams,
1511 uint32 parameter_count,
1512 char **ppdata, uint32 data_count,
1513 uint32 max_data_count,
1514 uint32 max_param_count)
1515 {
1516 uint16 *setup = *ppsetup;
1517 files_struct *fsp;
1518 uint32 filter;
1519 NTSTATUS status;
1520 bool recursive;
1521
1522 if(setup_count < 6) {
1523 reply_doserror(req, ERRDOS, ERRbadfunc);
1524 return;
1525 }
1526
1527 fsp = file_fsp(req, SVAL(setup,4));
1528 filter = IVAL(setup, 0);
1529 recursive = (SVAL(setup, 6) != 0) ? True : False;
1530
1531 DEBUG(3,("call_nt_transact_notify_change\n"));
1532
1533 if(!fsp) {
1534 reply_doserror(req, ERRDOS, ERRbadfid);
1535 return;
1536 }
1537
1538 {
1539 char *filter_string;
1540
1541 if (!(filter_string = notify_filter_string(NULL, filter))) {
1542 reply_nterror(req,NT_STATUS_NO_MEMORY);
1543 return;
1544 }
1545
1546 DEBUG(3,("call_nt_transact_notify_change: notify change "
1547 "called on %s, filter = %s, recursive = %d\n",
1548 fsp->fsp_name, filter_string, recursive));
1549
1550 TALLOC_FREE(filter_string);
1551 }
1552
1553 if((!fsp->is_directory) || (conn != fsp->conn)) {
1554 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1555 return;
1556 }
1557
1558 if (fsp->notify == NULL) {
1559
1560 status = change_notify_create(fsp, filter, recursive);
1561
1562 if (!NT_STATUS_IS_OK(status)) {
1563 DEBUG(10, ("change_notify_create returned %s\n",
1564 nt_errstr(status)));
1565 reply_nterror(req, status);
1566 return;
1567 }
1568 }
1569
1570 if (fsp->notify->num_changes != 0) {
1571
1572 /*
1573 * We've got changes pending, respond immediately
1574 */
1575
1576 /*
1577 * TODO: write a torture test to check the filtering behaviour
1578 * here.
1579 */
1580
1581 change_notify_reply(fsp->conn, req, max_param_count,
1582 fsp->notify);
1583
1584 /*
1585 * change_notify_reply() above has independently sent its
1586 * results
1587 */
1588 return;
1589 }
1590
1591 /*
1592 * No changes pending, queue the request
1593 */
1594
1595 status = change_notify_add_request(req,
1596 max_param_count,
1597 filter,
1598 recursive, fsp);
1599 if (!NT_STATUS_IS_OK(status)) {
1600 reply_nterror(req, status);
1601 }
1602 return;
1603 }
1604
1605 /****************************************************************************
1606 Reply to an NT transact rename command.
1607 ****************************************************************************/
1608
1609 static void call_nt_transact_rename(connection_struct *conn,
1610 struct smb_request *req,
1611 uint16 **ppsetup, uint32 setup_count,
1612 char **ppparams, uint32 parameter_count,
1613 char **ppdata, uint32 data_count,
1614 uint32 max_data_count)
1615 {
1616 char *params = *ppparams;
1617 char *new_name = NULL;
1618 files_struct *fsp = NULL;
1619 bool dest_has_wcard = False;
1620 NTSTATUS status;
1621 TALLOC_CTX *ctx = talloc_tos();
1622
1623 if(parameter_count < 5) {
1624 reply_doserror(req, ERRDOS, ERRbadfunc);
1625 return;
1626 }
1627
1628 fsp = file_fsp(req, SVAL(params, 0));
1629 if (!check_fsp(conn, req, fsp)) {
1630 return;
1631 }
1632 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1633 parameter_count - 4,
1634 STR_TERMINATE, &status, &dest_has_wcard);
1635 if (!NT_STATUS_IS_OK(status)) {
1636 reply_nterror(req, status);
1637 return;
1638 }
1639
1640 /*
1641 * W2K3 ignores this request as the RAW-RENAME test
1642 * demonstrates, so we do.
1643 */
1644 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1645
1646 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1647 fsp->fsp_name, new_name));
1648
1649 return;
1650 }
1651
1652 /******************************************************************************
1653 Fake up a completely empty SD.
1654 *******************************************************************************/
1655
1656 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1657 {
1658 size_t sd_size;
1659
1660 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1661 if(!*ppsd) {
1662 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1663 return NT_STATUS_NO_MEMORY;
1664 }
1665
1666 return NT_STATUS_OK;
1667 }
1668
1669 /****************************************************************************
1670 Reply to query a security descriptor.
1671 ****************************************************************************/
1672
1673 static void call_nt_transact_query_security_desc(connection_struct *conn,
1674 struct smb_request *req,
1675 uint16 **ppsetup,
1676 uint32 setup_count,
1677 char **ppparams,
1678 uint32 parameter_count,
1679 char **ppdata,
1680 uint32 data_count,
1681 uint32 max_data_count)
1682 {
1683 char *params = *ppparams;
1684 char *data = *ppdata;
1685 SEC_DESC *psd = NULL;
1686 size_t sd_size;
1687 uint32 security_info_wanted;
1688 files_struct *fsp = NULL;
1689 NTSTATUS status;
1690 DATA_BLOB blob;
1691
1692 if(parameter_count < 8) {
1693 reply_doserror(req, ERRDOS, ERRbadfunc);
1694 return;
1695 }
1696
1697 fsp = file_fsp(req, SVAL(params,0));
1698 if(!fsp) {
1699 reply_doserror(req, ERRDOS, ERRbadfid);
1700 return;
1701 }
1702
1703 security_info_wanted = IVAL(params,4);
1704
1705 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1706 (unsigned int)security_info_wanted ));
1707
1708 params = nttrans_realloc(ppparams, 4);
1709 if(params == NULL) {
1710 reply_doserror(req, ERRDOS, ERRnomem);
1711 return;
1712 }
1713
1714 /*
1715 * Get the permissions to return.
1716 */
1717
1718 if (!lp_nt_acl_support(SNUM(conn))) {
1719 status = get_null_nt_acl(talloc_tos(), &psd);
1720 } else {
1721 status = SMB_VFS_FGET_NT_ACL(
1722 fsp, security_info_wanted, &psd);
1723 }
1724 if (!NT_STATUS_IS_OK(status)) {
1725 reply_nterror(req, status);
1726 return;
1727 }
1728
1729 /* If the SACL/DACL is NULL, but was requested, we mark that it is
1730 * present in the reply to match Windows behavior */
1731 if (psd->sacl == NULL &&
1732 security_info_wanted & SACL_SECURITY_INFORMATION)
1733 psd->type |= SEC_DESC_SACL_PRESENT;
1734 if (psd->dacl == NULL &&
1735 security_info_wanted & DACL_SECURITY_INFORMATION)
1736 psd->type |= SEC_DESC_DACL_PRESENT;
1737
1738 sd_size = ndr_size_security_descriptor(psd, NULL, 0);
1739
1740 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1741
1742 if (DEBUGLEVEL >= 10) {
1743 DEBUG(10,("call_nt_transact_query_security_desc for file %s\n", fsp->fsp_name));
1744 NDR_PRINT_DEBUG(security_descriptor, psd);
1745 }
1746
1747 SIVAL(params,0,(uint32)sd_size);
1748
1749 if (max_data_count < sd_size) {
1750 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1751 params, 4, *ppdata, 0);
1752 return;
1753 }
1754
1755 /*
1756 * Allocate the data we will point this at.
1757 */
1758
1759 data = nttrans_realloc(ppdata, sd_size);
1760 if(data == NULL) {
1761 reply_doserror(req, ERRDOS, ERRnomem);
1762 return;
1763 }
1764
1765 status = marshall_sec_desc(talloc_tos(), psd,
1766 &blob.data, &blob.length);
1767
1768 if (!NT_STATUS_IS_OK(status)) {
1769 reply_nterror(req, status);
1770 return;
1771 }
1772
1773 SMB_ASSERT(sd_size == blob.length);
1774 memcpy(data, blob.data, sd_size);
1775
1776 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1777
1778 return;
1779 }
1780
1781 /****************************************************************************
1782 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1783 ****************************************************************************/
1784
1785 static void call_nt_transact_set_security_desc(connection_struct *conn,
1786 struct smb_request *req,
1787 uint16 **ppsetup,
1788 uint32 setup_count,
1789 char **ppparams,
1790 uint32 parameter_count,
1791 char **ppdata,
1792 uint32 data_count,
1793 uint32 max_data_count)
1794 {
1795 char *params= *ppparams;
1796 char *data = *ppdata;
1797 files_struct *fsp = NULL;
1798 uint32 security_info_sent = 0;
1799 NTSTATUS status;
1800
1801 if(parameter_count < 8) {
1802 reply_doserror(req, ERRDOS, ERRbadfunc);
1803 return;
1804 }
1805
1806 if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1807 reply_doserror(req, ERRDOS, ERRbadfid);
1808 return;
1809 }
1810
1811 if(!lp_nt_acl_support(SNUM(conn))) {
1812 goto done;
1813 }
1814
1815 security_info_sent = IVAL(params,4);
1816
1817 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1818 (unsigned int)security_info_sent ));
1819
1820 if (data_count == 0) {
1821 reply_doserror(req, ERRDOS, ERRnoaccess);
1822 return;
1823 }
1824
1825 status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1826
1827 if (!NT_STATUS_IS_OK(status)) {
1828 reply_nterror(req, status);
1829 return;
1830 }
1831
1832 done:
1833 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1834 return;
1835 }
1836
1837 /****************************************************************************
1838 Reply to NT IOCTL
1839 ****************************************************************************/
1840
1841 static void call_nt_transact_ioctl(connection_struct *conn,
1842 struct smb_request *req,
1843 uint16 **ppsetup, uint32 setup_count,
1844 char **ppparams, uint32 parameter_count,
1845 char **ppdata, uint32 data_count,
1846 uint32 max_data_count)
1847 {
1848 uint32 function;
1849 uint16 fidnum;
1850 files_struct *fsp;
1851 uint8 isFSctl;
1852 uint8 compfilter;
1853 char *pdata = *ppdata;
1854
1855 if (setup_count != 8) {
1856 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1857 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1858 return;
1859 }
1860
1861 function = IVAL(*ppsetup, 0);
1862 fidnum = SVAL(*ppsetup, 4);
1863 isFSctl = CVAL(*ppsetup, 6);
1864 compfilter = CVAL(*ppsetup, 7);
1865
1866 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1867 function, fidnum, isFSctl, compfilter));
1868
1869 fsp=file_fsp(req, fidnum);
1870 /* this check is done in each implemented function case for now
1871 because I don't want to break anything... --metze
1872 FSP_BELONGS_CONN(fsp,conn);*/
1873
1874 SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
1875
1876 switch (function) {
1877 case FSCTL_SET_SPARSE:
1878 /* pretend this succeeded - tho strictly we should
1879 mark the file sparse (if the local fs supports it)
1880 so we can know if we need to pre-allocate or not */
1881
1882 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1883 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1884 return;
1885
1886 case FSCTL_CREATE_OR_GET_OBJECT_ID:
1887 {
1888 unsigned char objid[16];
1889
1890 /* This should return the object-id on this file.
1891 * I think I'll make this be the inode+dev. JRA.
1892 */
1893
1894 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1895
1896 if (!fsp_belongs_conn(conn, req, fsp)) {
1897 return;
1898 }
1899
1900 data_count = 64;
1901 pdata = nttrans_realloc(ppdata, data_count);
1902 if (pdata == NULL) {
1903 reply_nterror(req, NT_STATUS_NO_MEMORY);
1904 return;
1905 }
1906
1907 /* For backwards compatibility only store the dev/inode. */
1908 push_file_id_16(pdata, &fsp->file_id);
1909 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1910 push_file_id_16(pdata+32, &fsp->file_id);
1911 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1912 pdata, data_count);
1913 return;
1914 }
1915
1916 case FSCTL_GET_REPARSE_POINT:
1917 /* pretend this fail - my winXP does it like this
1918 * --metze
1919 */
1920
1921 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1922 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1923 return;
1924
1925 case FSCTL_SET_REPARSE_POINT:
1926 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1927 * --metze
1928 */
1929
1930 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1931 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1932 return;
1933
1934 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1935 {
1936 /*
1937 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1938 * and return their volume names. If max_data_count is 16, then it is just
1939 * asking for the number of volumes and length of the combined names.
1940 *
1941 * pdata is the data allocated by our caller, but that uses
1942 * total_data_count (which is 0 in our case) rather than max_data_count.
1943 * Allocate the correct amount and return the pointer to let
1944 * it be deallocated when we return.
1945 */
1946 SHADOW_COPY_DATA *shadow_data = NULL;
1947 TALLOC_CTX *shadow_mem_ctx = NULL;
1948 bool labels = False;
1949 uint32 labels_data_count = 0;
1950 uint32 i;
1951 char *cur_pdata;
1952
1953 if (!fsp_belongs_conn(conn, req, fsp)) {
1954 return;
1955 }
1956
1957 if (max_data_count < 16) {
1958 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1959 max_data_count));
1960 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1961 return;
1962 }
1963
1964 if (max_data_count > 16) {
1965 labels = True;
1966 }
1967
1968 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1969 if (shadow_mem_ctx == NULL) {
1970 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1971 reply_nterror(req, NT_STATUS_NO_MEMORY);
1972 return;
1973 }
1974
1975 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1976 if (shadow_data == NULL) {
1977 DEBUG(0,("TALLOC_ZERO() failed!\n"));
1978 talloc_destroy(shadow_mem_ctx);
1979 reply_nterror(req, NT_STATUS_NO_MEMORY);
1980 return;
1981 }
1982
1983 shadow_data->mem_ctx = shadow_mem_ctx;
1984
1985 /*
1986 * Call the VFS routine to actually do the work.
1987 */
1988 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1989 talloc_destroy(shadow_data->mem_ctx);
1990 if (errno == ENOSYS) {
1991 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1992 conn->connectpath));
1993 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1994 return;
1995 } else {
1996 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1997 conn->connectpath));
1998 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1999 return;
2000 }
2001 }
2002
2003 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2004
2005 if (!labels) {
2006 data_count = 16;
2007 } else {
2008 data_count = 12+labels_data_count+4;
2009 }
2010
2011 if (max_data_count<data_count) {
2012 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2013 max_data_count,data_count));
2014 talloc_destroy(shadow_data->mem_ctx);
2015 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2016 return;
2017 }
2018
2019 pdata = nttrans_realloc(ppdata, data_count);
2020 if (pdata == NULL) {
2021 talloc_destroy(shadow_data->mem_ctx);
2022 reply_nterror(req, NT_STATUS_NO_MEMORY);
2023 return;
2024 }
2025
2026 cur_pdata = pdata;
2027
2028 /* num_volumes 4 bytes */
2029 SIVAL(pdata,0,shadow_data->num_volumes);
2030
2031 if (labels) {
2032 /* num_labels 4 bytes */
2033 SIVAL(pdata,4,shadow_data->num_volumes);
2034 }
2035
2036 /* needed_data_count 4 bytes */
2037 SIVAL(pdata, 8, labels_data_count+4);
2038
2039 cur_pdata+=12;
2040
2041 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2042 shadow_data->num_volumes,fsp->fsp_name));
2043 if (labels && shadow_data->labels) {
2044 for (i=0;i<shadow_data->num_volumes;i++) {
2045 srvstr_push(pdata, req->flags2,
2046 cur_pdata, shadow_data->labels[i],
2047 2*sizeof(SHADOW_COPY_LABEL),
2048 STR_UNICODE|STR_TERMINATE);
2049 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2050 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2051 }
2052 }
2053
2054 talloc_destroy(shadow_data->mem_ctx);
2055
2056 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2057 pdata, data_count);
2058
2059 return;
2060 }
2061
2062 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2063 {
2064 /* pretend this succeeded -
2065 *
2066 * we have to send back a list with all files owned by this SID
2067 *
2068 * but I have to check that --metze
2069 */
2070 DOM_SID sid;
2071 uid_t uid;
2072 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2073
2074 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2075
2076 if (!fsp_belongs_conn(conn, req, fsp)) {
2077 return;
2078 }
2079
2080 /* unknown 4 bytes: this is not the length of the sid :-( */
2081 /*unknown = IVAL(pdata,0);*/
2082
2083 if (!sid_parse(pdata+4,sid_len,&sid)) {
2084 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2085 return;
2086 }
2087
2088 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
2089
2090 if (!sid_to_uid(&sid, &uid)) {
2091 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2092 sid_string_dbg(&sid),
2093 (unsigned long)sid_len));
2094 uid = (-1);
2095 }
2096
2097 /* we can take a look at the find source :-)
2098 *
2099 * find ./ -uid $uid -name '*' is what we need here
2100 *
2101 *
2102 * and send 4bytes len and then NULL terminated unicode strings
2103 * for each file
2104 *
2105 * but I don't know how to deal with the paged results
2106 * (maybe we can hang the result anywhere in the fsp struct)
2107 *
2108 * we don't send all files at once
2109 * and at the next we should *not* start from the beginning,
2110 * so we have to cache the result
2111 *
2112 * --metze
2113 */
2114
2115 /* this works for now... */
2116 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2117 return;
2118 }
2119 default:
2120 if (!logged_ioctl_message) {
2121 logged_ioctl_message = true; /* Only print this once... */
2122 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2123 function));
2124 }
2125 }
2126
2127 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2128 }
2129
2130
2131 #ifdef HAVE_SYS_QUOTAS
2132 /****************************************************************************
2133 Reply to get user quota
2134 ****************************************************************************/
2135
2136 static void call_nt_transact_get_user_quota(connection_struct *conn,
2137 struct smb_request *req,
2138 uint16 **ppsetup,
2139 uint32 setup_count,
2140 char **ppparams,
2141 uint32 parameter_count,
2142 char **ppdata,
2143 uint32 data_count,
2144 uint32 max_data_count)
2145 {
2146 NTSTATUS nt_status = NT_STATUS_OK;
2147 char *params = *ppparams;
2148 char *pdata = *ppdata;
2149 char *entry;
2150 int data_len=0,param_len=0;
2151 int qt_len=0;
2152 int entry_len = 0;
2153 files_struct *fsp = NULL;
2154 uint16 level = 0;
2155 size_t sid_len;
2156 DOM_SID sid;
2157 bool start_enum = True;
2158 SMB_NTQUOTA_STRUCT qt;
2159 SMB_NTQUOTA_LIST *tmp_list;
2160 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2161
2162 ZERO_STRUCT(qt);
2163
2164 /* access check */
2165 if (conn->server_info->utok.uid != 0) {
2166 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2167 "[%s]\n", lp_servicename(SNUM(conn)),
2168 conn->server_info->unix_name));
2169 reply_doserror(req, ERRDOS, ERRnoaccess);
2170 return;
2171 }
2172
2173 /*
2174 * Ensure minimum number of parameters sent.
2175 */
2176
2177 if (parameter_count < 4) {
2178 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2179 reply_doserror(req, ERRDOS, ERRinvalidparam);
2180 return;
2181 }
2182
2183 /* maybe we can check the quota_fnum */
2184 fsp = file_fsp(req, SVAL(params,0));
2185 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2186 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2187 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2188 return;
2189 }
2190
2191 /* the NULL pointer checking for fsp->fake_file_handle->pd
2192 * is done by CHECK_NTQUOTA_HANDLE_OK()
2193 */
2194 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2195
2196 level = SVAL(params,2);
2197
2198 /* unknown 12 bytes leading in params */
2199
2200 switch (level) {
2201 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2202 /* seems that we should continue with the enum here --metze */
2203
2204 if (qt_handle->quota_list!=NULL &&
2205 qt_handle->tmp_list==NULL) {
2206
2207 /* free the list */
2208 free_ntquota_list(&(qt_handle->quota_list));
2209
2210 /* Realloc the size of parameters and data we will return */
2211 param_len = 4;
2212 params = nttrans_realloc(ppparams, param_len);
2213 if(params == NULL) {
2214 reply_doserror(req, ERRDOS, ERRnomem);
2215 return;
2216 }
2217
2218 data_len = 0;
2219 SIVAL(params,0,data_len);
2220
2221 break;
2222 }
2223
2224 start_enum = False;
2225
2226 case TRANSACT_GET_USER_QUOTA_LIST_START:
2227
2228 if (qt_handle->quota_list==NULL &&
2229 qt_handle->tmp_list==NULL) {
2230 start_enum = True;
2231 }
2232
2233 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2234 reply_doserror(req, ERRSRV, ERRerror);
2235 return;
2236 }
2237
2238 /* Realloc the size of parameters and data we will return */
2239 param_len = 4;
2240 params = nttrans_realloc(ppparams, param_len);
2241 if(params == NULL) {
2242 reply_doserror(req, ERRDOS, ERRnomem);
2243 return;
2244 }
2245
2246 /* we should not trust the value in max_data_count*/
2247 max_data_count = MIN(max_data_count,2048);
2248
2249 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2250 if(pdata == NULL) {
2251 reply_doserror(req, ERRDOS, ERRnomem);
2252 return;
2253 }
2254
2255 entry = pdata;
2256
2257 /* set params Size of returned Quota Data 4 bytes*/
2258 /* but set it later when we know it */
2259
2260 /* for each entry push the data */
2261
2262 if (start_enum) {
2263 qt_handle->tmp_list = qt_handle->quota_list;
2264 }
2265
2266 tmp_list = qt_handle->tmp_list;
2267
2268 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2269 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2270
2271 sid_len = ndr_size_dom_sid(
2272 &tmp_list->quotas->sid, NULL, 0);
2273 entry_len = 40 + sid_len;
2274
2275 /* nextoffset entry 4 bytes */
2276 SIVAL(entry,0,entry_len);
2277
2278 /* then the len of the SID 4 bytes */
2279 SIVAL(entry,4,sid_len);
2280
2281 /* unknown data 8 bytes uint64_t */
2282 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2283
2284 /* the used disk space 8 bytes uint64_t */
2285 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2286
2287 /* the soft quotas 8 bytes uint64_t */
2288 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2289
2290 /* the hard quotas 8 bytes uint64_t */
2291 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2292
2293 /* and now the SID */
2294 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2295 }
2296
2297 qt_handle->tmp_list = tmp_list;
2298
2299 /* overwrite the offset of the last entry */
2300 SIVAL(entry-entry_len,0,0);
2301
2302 data_len = 4+qt_len;
2303 /* overwrite the params quota_data_len */
2304 SIVAL(params,0,data_len);
2305
2306 break;
2307
2308 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2309
2310 /* unknown 4 bytes IVAL(pdata,0) */
2311
2312 if (data_count < 8) {
2313 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2314 reply_doserror(req, ERRDOS, ERRunknownlevel);
2315 return;
2316 }
2317
2318 sid_len = IVAL(pdata,4);
2319 /* Ensure this is less than 1mb. */
2320 if (sid_len > (1024*1024)) {
2321 reply_doserror(req, ERRDOS, ERRnomem);
2322 return;
2323 }
2324
2325 if (data_count < 8+sid_len) {
2326 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2327 reply_doserror(req, ERRDOS, ERRunknownlevel);
2328 return;
2329 }
2330
2331 data_len = 4+40+sid_len;
2332
2333 if (max_data_count < data_len) {
2334 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2335 max_data_count, data_len));
2336 param_len = 4;
2337 SIVAL(params,0,data_len);
2338 data_len = 0;
2339 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2340 break;
2341 }
2342
2343 if (!sid_parse(pdata+8,sid_len,&sid)) {
2344 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2345 return;
2346 }
2347
2348 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2349 ZERO_STRUCT(qt);
2350 /*
2351 * we have to return zero's in all fields
2352 * instead of returning an error here
2353 * --metze
2354 */
2355 }
2356
2357 /* Realloc the size of parameters and data we will return */
2358 param_len = 4;
2359 params = nttrans_realloc(ppparams, param_len);
2360 if(params == NULL) {
2361 reply_doserror(req, ERRDOS, ERRnomem);
2362 return;
2363 }
2364
2365 pdata = nttrans_realloc(ppdata, data_len);
2366 if(pdata == NULL) {
2367 reply_doserror(req, ERRDOS, ERRnomem);
2368 return;
2369 }
2370
2371 entry = pdata;
2372
2373 /* set params Size of returned Quota Data 4 bytes*/
2374 SIVAL(params,0,data_len);
2375
2376 /* nextoffset entry 4 bytes */
2377 SIVAL(entry,0,0);
2378
2379 /* then the len of the SID 4 bytes */
2380 SIVAL(entry,4,sid_len);
2381
2382 /* unknown data 8 bytes uint64_t */
2383 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2384
2385 /* the used disk space 8 bytes uint64_t */
2386 SBIG_UINT(entry,16,qt.usedspace);
2387
2388 /* the soft quotas 8 bytes uint64_t */
2389 SBIG_UINT(entry,24,qt.softlim);
2390
2391 /* the hard quotas 8 bytes uint64_t */
2392 SBIG_UINT(entry,32,qt.hardlim);
2393
2394 /* and now the SID */
2395 sid_linearize(entry+40, sid_len, &sid);
2396
2397 break;
2398
2399 default:
2400 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2401 reply_doserror(req, ERRSRV, ERRerror);
2402 return;
2403 break;
2404 }
2405
2406 send_nt_replies(conn, req, nt_status, params, param_len,
2407 pdata, data_len);
2408 }
2409
2410 /****************************************************************************
2411 Reply to set user quota
2412 ****************************************************************************/
2413
2414 static void call_nt_transact_set_user_quota(connection_struct *conn,
2415 struct smb_request *req,
2416 uint16 **ppsetup,
2417 uint32 setup_count,
2418 char **ppparams,
2419 uint32 parameter_count,
2420 char **ppdata,
2421 uint32 data_count,
2422 uint32 max_data_count)
2423 {
2424 char *params = *ppparams;
2425 char *pdata = *ppdata;
2426 int data_len=0,param_len=0;
2427 SMB_NTQUOTA_STRUCT qt;
2428 size_t sid_len;
2429 DOM_SID sid;
2430 files_struct *fsp = NULL;
2431
2432 ZERO_STRUCT(qt);
2433
2434 /* access check */
2435 if (conn->server_info->utok.uid != 0) {
2436 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2437 "[%s]\n", lp_servicename(SNUM(conn)),
2438 conn->server_info->unix_name));
2439 reply_doserror(req, ERRDOS, ERRnoaccess);
2440 return;
2441 }
2442
2443 /*
2444 * Ensure minimum number of parameters sent.
2445 */
2446
2447 if (parameter_count < 2) {
2448 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2449 reply_doserror(req, ERRDOS, ERRinvalidparam);
2450 return;
2451 }
2452
2453 /* maybe we can check the quota_fnum */
2454 fsp = file_fsp(req, SVAL(params,0));
2455 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2456 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2457 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2458 return;
2459 }
2460
2461 if (data_count < 40) {
2462 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2463 reply_doserror(req, ERRDOS, ERRunknownlevel);
2464 return;
2465 }
2466
2467 /* offset to next quota record.
2468 * 4 bytes IVAL(pdata,0)
2469 * unused here...
2470 */
2471
2472 /* sid len */
2473 sid_len = IVAL(pdata,4);
2474
2475 if (data_count < 40+sid_len) {
2476 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2477 reply_doserror(req, ERRDOS, ERRunknownlevel);
2478 return;
2479 }
2480
2481 /* unknown 8 bytes in pdata
2482 * maybe its the change time in NTTIME
2483 */
2484
2485 /* the used space 8 bytes (uint64_t)*/
2486 qt.usedspace = (uint64_t)IVAL(pdata,16);
2487 #ifdef LARGE_SMB_OFF_T
2488 qt.usedspace |= (((uint64_t)IVAL(pdata,20)) << 32);
2489 #else /* LARGE_SMB_OFF_T */
2490 if ((IVAL(pdata,20) != 0)&&
2491 ((qt.usedspace != 0xFFFFFFFF)||
2492 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2493 /* more than 32 bits? */
2494 reply_doserror(req, ERRDOS, ERRunknownlevel);
2495 return;
2496 }
2497 #endif /* LARGE_SMB_OFF_T */
2498
2499 /* the soft quotas 8 bytes (uint64_t)*/
2500 qt.softlim = (uint64_t)IVAL(pdata,24);
2501 #ifdef LARGE_SMB_OFF_T
2502 qt.softlim |= (((uint64_t)IVAL(pdata,28)) << 32);
2503 #else /* LARGE_SMB_OFF_T */
2504 if ((IVAL(pdata,28) != 0)&&
2505 ((qt.softlim != 0xFFFFFFFF)||
2506 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2507 /* more than 32 bits? */
2508 reply_doserror(req, ERRDOS, ERRunknownlevel);
2509 return;
2510 }
2511 #endif /* LARGE_SMB_OFF_T */
2512
2513 /* the hard quotas 8 bytes (uint64_t)*/
2514 qt.hardlim = (uint64_t)IVAL(pdata,32);
2515 #ifdef LARGE_SMB_OFF_T
2516 qt.hardlim |= (((uint64_t)IVAL(pdata,36)) << 32);
2517 #else /* LARGE_SMB_OFF_T */
2518 if ((IVAL(pdata,36) != 0)&&
2519 ((qt.hardlim != 0xFFFFFFFF)||
2520 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2521 /* more than 32 bits? */
2522 reply_doserror(req, ERRDOS, ERRunknownlevel);
2523 return;
2524 }
2525 #endif /* LARGE_SMB_OFF_T */
2526
2527 if (!sid_parse(pdata+40,sid_len,&sid)) {
2528 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2529 return;
2530 }
2531
2532 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2533
2534 /* 44 unknown bytes left... */
2535
2536 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2537 reply_doserror(req, ERRSRV, ERRerror);
2538 return;
2539 }
2540
2541 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2542 pdata, data_len);
2543 }
2544 #endif /* HAVE_SYS_QUOTAS */
2545
2546 static void handle_nttrans(connection_struct *conn,
2547 struct trans_state *state,
2548 struct smb_request *req)
2549 {
2550 if (Protocol >= PROTOCOL_NT1) {
2551 req->flags2 |= 0x40; /* IS_LONG_NAME */
2552 SSVAL(req->inbuf,smb_flg2,req->flags2);
2553 }
2554
2555
2556 SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2557
2558 /* Now we must call the relevant NT_TRANS function */
2559 switch(state->call) {
2560 case NT_TRANSACT_CREATE:
2561 {
2562 START_PROFILE(NT_transact_create);
2563 call_nt_transact_create(
2564 conn, req,
2565 &state->setup, state->setup_count,
2566 &state->param, state->total_param,
2567 &state->data, state->total_data,
2568 state->max_data_return);
2569 END_PROFILE(NT_transact_create);
2570 break;
2571 }
2572
2573 case NT_TRANSACT_IOCTL:
2574 {
2575 START_PROFILE(NT_transact_ioctl);
2576 call_nt_transact_ioctl(
2577 conn, req,
2578 &state->setup, state->setup_count,
2579 &state->param, state->total_param,
2580 &state->data, state->total_data,
2581 state->max_data_return);
2582 END_PROFILE(NT_transact_ioctl);
2583 break;
2584 }
2585
2586 case NT_TRANSACT_SET_SECURITY_DESC:
2587 {
2588 START_PROFILE(NT_transact_set_security_desc);
2589 call_nt_transact_set_security_desc(
2590 conn, req,
2591 &state->setup, state->setup_count,
2592 &state->param, state->total_param,
2593 &state->data, state->total_data,
2594 state->max_data_return);
2595 END_PROFILE(NT_transact_set_security_desc);
2596 break;
2597 }
2598
2599 case NT_TRANSACT_NOTIFY_CHANGE:
2600 {
2601 START_PROFILE(NT_transact_notify_change);
2602 call_nt_transact_notify_change(
2603 conn, req,
2604 &state->setup, state->setup_count,
2605 &state->param, state->total_param,
2606 &state->data, state->total_data,
2607 state->max_data_return,
2608 state->max_param_return);
2609 END_PROFILE(NT_transact_notify_change);
2610 break;
2611 }
2612
2613 case NT_TRANSACT_RENAME:
2614 {
2615 START_PROFILE(NT_transact_rename);
2616 call_nt_transact_rename(
2617 conn, req,
2618 &state->setup, state->setup_count,
2619 &state->param, state->total_param,
2620 &state->data, state->total_data,
2621 state->max_data_return);
2622 END_PROFILE(NT_transact_rename);
2623 break;
2624 }
2625
2626 case NT_TRANSACT_QUERY_SECURITY_DESC:
2627 {
2628 START_PROFILE(NT_transact_query_security_desc);
2629 call_nt_transact_query_security_desc(
2630 conn, req,
2631 &state->setup, state->setup_count,
2632 &state->param, state->total_param,
2633 &state->data, state->total_data,
2634 state->max_data_return);
2635 END_PROFILE(NT_transact_query_security_desc);
2636 break;
2637 }
2638
2639 #ifdef HAVE_SYS_QUOTAS
2640 case NT_TRANSACT_GET_USER_QUOTA:
2641 {
2642 START_PROFILE(NT_transact_get_user_quota);
2643 call_nt_transact_get_user_quota(
2644 conn, req,
2645 &state->setup, state->setup_count,
2646 &state->param, state->total_param,
2647 &state->data, state->total_data,
2648 state->max_data_return);
2649 END_PROFILE(NT_transact_get_user_quota);
2650 break;
2651 }
2652
2653 case NT_TRANSACT_SET_USER_QUOTA:
2654 {
2655 START_PROFILE(NT_transact_set_user_quota);
2656 call_nt_transact_set_user_quota(
2657 conn, req,
2658 &state->setup, state->setup_count,
2659 &state->param, state->total_param,
2660 &state->data, state->total_data,
2661 state->max_data_return);
2662 END_PROFILE(NT_transact_set_user_quota);
2663 break;
2664 }
2665 #endif /* HAVE_SYS_QUOTAS */
2666
2667 default:
2668 /* Error in request */
2669 DEBUG(0,("handle_nttrans: Unknown request %d in "
2670 "nttrans call\n", state->call));
2671 reply_doserror(req, ERRSRV, ERRerror);
2672 return;
2673 }
2674 return;
2675 }
2676
2677 /****************************************************************************
2678 Reply to a SMBNTtrans.
2679 ****************************************************************************/
2680
2681 void reply_nttrans(struct smb_request *req)
2682 {
2683 connection_struct *conn = req->conn;
2684 uint32_t pscnt;
2685 uint32_t psoff;
2686 uint32_t dscnt;
2687 uint32_t dsoff;
2688 uint16 function_code;
2689 NTSTATUS result;
2690 struct trans_state *state;
2691
2692 START_PROFILE(SMBnttrans);
2693
2694 if (req->wct < 19) {
2695 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2696 END_PROFILE(SMBnttrans);
2697 return;
2698 }
2699
2700 pscnt = IVAL(req->vwv+9, 1);
2701 psoff = IVAL(req->vwv+11, 1);
2702 dscnt = IVAL(req->vwv+13, 1);
2703 dsoff = IVAL(req->vwv+15, 1);
2704 function_code = SVAL(req->vwv+18, 0);
2705
2706 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2707 reply_doserror(req, ERRSRV, ERRaccess);
2708 END_PROFILE(SMBnttrans);
2709 return;
2710 }
2711
2712 result = allow_new_trans(conn->pending_trans, req->mid);
2713 if (!NT_STATUS_IS_OK(result)) {
2714 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2715 reply_nterror(req, result);
2716 END_PROFILE(SMBnttrans);
2717 return;
2718 }
2719
2720 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2721 reply_doserror(req, ERRSRV, ERRaccess);
2722 END_PROFILE(SMBnttrans);
2723 return;
2724 }
2725
2726 state->cmd = SMBnttrans;
2727
2728 state->mid = req->mid;
2729 state->vuid = req->vuid;
2730 state->total_data = IVAL(req->vwv+3, 1);
2731 state->data = NULL;
2732 state->total_param = IVAL(req->vwv+1, 1);
2733 state->param = NULL;
2734 state->max_data_return = IVAL(req->vwv+7, 1);
2735 state->max_param_return = IVAL(req->vwv+5, 1);
2736
2737 /* setup count is in *words* */
2738 state->setup_count = 2*CVAL(req->vwv+17, 1);
2739 state->setup = NULL;
2740 state->call = function_code;
2741
2742 DEBUG(10, ("num_setup=%u, "
2743 "param_total=%u, this_param=%u, max_param=%u, "
2744 "data_total=%u, this_data=%u, max_data=%u, "
2745 "param_offset=%u, data_offset=%u\n",
2746 (unsigned)state->setup_count,
2747 (unsigned)state->total_param, (unsigned)pscnt,
2748 (unsigned)state->max_param_return,
2749 (unsigned)state->total_data, (unsigned)dscnt,
2750 (unsigned)state->max_data_return,
2751 (unsigned)psoff, (unsigned)dsoff));
2752
2753 /*
2754 * All nttrans messages we handle have smb_wct == 19 +
2755 * state->setup_count. Ensure this is so as a sanity check.
2756 */
2757
2758 if(req->wct != 19 + (state->setup_count/2)) {
2759 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2760 req->wct, 19 + (state->setup_count/2)));
2761 goto bad_param;
2762 }
2763
2764 /* Don't allow more than 128mb for each value. */
2765 if ((state->total_data > (1024*1024*128)) ||
2766 (state->total_param > (1024*1024*128))) {
2767 reply_doserror(req, ERRDOS, ERRnomem);
2768 END_PROFILE(SMBnttrans);
2769 return;
2770 }
2771
2772 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2773 goto bad_param;
2774
2775 if (state->total_data) {
2776
2777 if (trans_oob(state->total_data, 0, dscnt)
2778 || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
2779 goto bad_param;
2780 }
2781
2782 /* Can't use talloc here, the core routines do realloc on the
2783 * params and data. */
2784 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2785 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2786 "bytes !\n", (unsigned int)state->total_data));
2787 TALLOC_FREE(state);
2788 reply_doserror(req, ERRDOS, ERRnomem);
2789 END_PROFILE(SMBnttrans);
2790 return;
2791 }
2792
2793 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2794 }
2795
2796 if (state->total_param) {
2797
2798 if (trans_oob(state->total_param, 0, pscnt)
2799 || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
2800 goto bad_param;
2801 }
2802
2803 /* Can't use talloc here, the core routines do realloc on the
2804 * params and data. */
2805 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2806 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2807 "bytes !\n", (unsigned int)state->total_param));
2808 SAFE_FREE(state->data);
2809 TALLOC_FREE(state);
2810 reply_doserror(req, ERRDOS, ERRnomem);
2811 END_PROFILE(SMBnttrans);
2812 return;
2813 }
2814
2815 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2816 }
2817
2818 state->received_data = dscnt;
2819 state->received_param = pscnt;
2820
2821 if(state->setup_count > 0) {
2822 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2823 state->setup_count));
2824
2825 /*
2826 * No overflow possible here, state->setup_count is an
2827 * unsigned int, being filled by a single byte from
2828 * CVAL(req->vwv+13, 0) above. The cast in the comparison
2829 * below is not necessary, it's here to clarify things. The
2830 * validity of req->vwv and req->wct has been checked in
2831 * init_smb_request already.
2832 */
2833 if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
2834 goto bad_param;
2835 }
2836
2837 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2838 if (state->setup == NULL) {
2839 DEBUG(0,("reply_nttrans : Out of memory\n"));
2840 SAFE_FREE(state->data);
2841 SAFE_FREE(state->param);
2842 TALLOC_FREE(state);
2843 reply_doserror(req, ERRDOS, ERRnomem);
2844 END_PROFILE(SMBnttrans);
2845 return;
2846 }
2847
2848 memcpy(state->setup, req->vwv+19, state->setup_count);
2849 dump_data(10, (uint8 *)state->setup, state->setup_count);
2850 }
2851
2852 if ((state->received_data == state->total_data) &&
2853 (state->received_param == state->total_param)) {
2854 handle_nttrans(conn, state, req);
2855 SAFE_FREE(state->param);
2856 SAFE_FREE(state->data);
2857 TALLOC_FREE(state);
2858 END_PROFILE(SMBnttrans);
2859 return;
2860 }
2861
2862 DLIST_ADD(conn->pending_trans, state);
2863
2864 /* We need to send an interim response then receive the rest
2865 of the parameter/data bytes */
2866 reply_outbuf(req, 0, 0);
2867 show_msg((char *)req->outbuf);
2868 END_PROFILE(SMBnttrans);
2869 return;
2870
2871 bad_param:
2872
2873 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2874 SAFE_FREE(state->data);
2875 SAFE_FREE(state->param);
2876 TALLOC_FREE(state);
2877 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2878 END_PROFILE(SMBnttrans);
2879 return;
2880 }
2881
2882 /****************************************************************************
2883 Reply to a SMBnttranss
2884 ****************************************************************************/
2885
2886 void reply_nttranss(struct smb_request *req)
2887 {
2888 connection_struct *conn = req->conn;
2889 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2890 struct trans_state *state;
2891
2892 START_PROFILE(SMBnttranss);
2893
2894 show_msg((char *)req->inbuf);
2895
2896 if (req->wct < 18) {
2897 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2898 END_PROFILE(SMBnttranss);
2899 return;
2900 }
2901
2902 for (state = conn->pending_trans; state != NULL;
2903 state = state->next) {
2904 if (state->mid == req->mid) {
2905 break;
2906 }
2907 }
2908
2909 if ((state == NULL) || (state->cmd != SMBnttrans)) {
2910 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2911 END_PROFILE(SMBnttranss);
2912 return;
2913 }
2914
2915 /* Revise state->total_param and state->total_data in case they have
2916 changed downwards */
2917 if (IVAL(req->vwv+1, 1) < state->total_param) {
2918 state->total_param = IVAL(req->vwv+1, 1);
2919 }
2920 if (IVAL(req->vwv+3, 1) < state->total_data) {
2921 state->total_data = IVAL(req->vwv+3, 1);
2922 }
2923
2924 pcnt = IVAL(req->vwv+5, 1);
2925 poff = IVAL(req->vwv+7, 1);
2926 pdisp = IVAL(req->vwv+9, 1);
2927
2928 dcnt = IVAL(req->vwv+11, 1);
2929 doff = IVAL(req->vwv+13, 1);
2930 ddisp = IVAL(req->vwv+15, 1);
2931
2932 state->received_param += pcnt;
2933 state->received_data += dcnt;
2934
2935 if ((state->received_data > state->total_data) ||
2936 (state->received_param > state->total_param))
2937 goto bad_param;
2938
2939 if (pcnt) {
2940 if (trans_oob(state->total_param, pdisp, pcnt)
2941 || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
2942 goto bad_param;
2943 }
2944 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
2945 }
2946
2947 if (dcnt) {
2948 if (trans_oob(state->total_data, ddisp, dcnt)
2949 || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
2950 goto bad_param;
2951 }
2952 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
2953 }
2954
2955 if ((state->received_param < state->total_param) ||
2956 (state->received_data < state->total_data)) {
2957 END_PROFILE(SMBnttranss);
2958 return;
2959 }
2960
2961 handle_nttrans(conn, state, req);
2962
2963 DLIST_REMOVE(conn->pending_trans, state);
2964 SAFE_FREE(state->data);
2965 SAFE_FREE(state->param);
2966 TALLOC_FREE(state);
2967 END_PROFILE(SMBnttranss);
2968 return;
2969
2970 bad_param:
2971
2972 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2973 DLIST_REMOVE(conn->pending_trans, state);
2974 SAFE_FREE(state->data);
2975 SAFE_FREE(state->param);
2976 TALLOC_FREE(state);
2977 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2978 END_PROFILE(SMBnttranss);
2979 return;
2980 }
Samba GIT mirror