?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #7892 - open_file_fchmod() leaves a stale lock.
[Samba.git] / source3 / smbd / reply.c
blob2dd4bad6afadeaf2006aa86169d1833092f20720
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 bool start_of_name_component = True;
50 bool stream_started = false;
51 bool check_quota = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 check_quota = true;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 }
132 /* Go back one level... */
133 /* We know this is safe as '/' cannot be part of a mb sequence. */
134 /* NOTE - if this assumption is invalid we are not in good shape... */
135 /* Decrement d first as d points to the *next* char to write into. */
136 for (d--; d > path; d--) {
137 if (*d == '/')
138 break;
139 }
140 s += 2; /* Else go past the .. */
141 /* We're still at the start of a name component, just the previous one. */
142 continue;
143
144 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
145 if (posix_path) {
146 /* Eat the '.' */
147 s++;
148 continue;
149 }
150 }
151
152 }
153
154 if (!(*s & 0x80)) {
155 if (!posix_path) {
156 if (*s <= 0x1f || *s == '|') {
157 return NT_STATUS_OBJECT_NAME_INVALID;
158 }
159 switch (*s) {
160 case '*':
161 case '?':
162 case '<':
163 case '>':
164 case '"':
165 *p_last_component_contains_wcard = True;
166 break;
167 default:
168 break;
169 }
170 }
171 *d++ = *s++;
172 } else {
173 size_t siz;
174 /* Get the size of the next MB character. */
175 next_codepoint(s,&siz);
176 switch(siz) {
177 case 5:
178 *d++ = *s++;
179 /*fall through*/
180 case 4:
181 *d++ = *s++;
182 /*fall through*/
183 case 3:
184 *d++ = *s++;
185 /*fall through*/
186 case 2:
187 *d++ = *s++;
188 /*fall through*/
189 case 1:
190 *d++ = *s++;
191 break;
192 default:
193 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
194 *d = '\0';
195 return NT_STATUS_INVALID_PARAMETER;
196 }
197 }
198 start_of_name_component = False;
199 }
200
201 *d = '\0';
202
203 if (check_quota) {
204 if (StrCaseCmp(path, FAKE_FILE_NAME_QUOTA_UNIX) != 0) {
205 return NT_STATUS_INVALID_PARAMETER;
206 }
207 }
208
209 return NT_STATUS_OK;
210 }
211
212 /****************************************************************************
213 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
214 No wildcards allowed.
215 ****************************************************************************/
216
217 NTSTATUS check_path_syntax(char *path)
218 {
219 bool ignore;
220 return check_path_syntax_internal(path, False, &ignore);
221 }
222
223 /****************************************************************************
224 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
225 Wildcards allowed - p_contains_wcard returns true if the last component contained
226 a wildcard.
227 ****************************************************************************/
228
229 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
230 {
231 return check_path_syntax_internal(path, False, p_contains_wcard);
232 }
233
234 /****************************************************************************
235 Check the path for a POSIX client.
236 We're assuming here that '/' is not the second byte in any multibyte char
237 set (a safe assumption).
238 ****************************************************************************/
239
240 NTSTATUS check_path_syntax_posix(char *path)
241 {
242 bool ignore;
243 return check_path_syntax_internal(path, True, &ignore);
244 }
245
246 /****************************************************************************
247 Pull a string and check the path allowing a wilcard - provide for error return.
248 ****************************************************************************/
249
250 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
251 const char *base_ptr,
252 uint16 smb_flags2,
253 char **pp_dest,
254 const char *src,
255 size_t src_len,
256 int flags,
257 NTSTATUS *err,
258 bool *contains_wcard)
259 {
260 size_t ret;
261
262 *pp_dest = NULL;
263
264 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
265 src_len, flags);
266
267 if (!*pp_dest) {
268 *err = NT_STATUS_INVALID_PARAMETER;
269 return ret;
270 }
271
272 *contains_wcard = False;
273
274 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
275 /*
276 * For a DFS path the function parse_dfs_path()
277 * will do the path processing, just make a copy.
278 */
279 *err = NT_STATUS_OK;
280 return ret;
281 }
282
283 if (lp_posix_pathnames()) {
284 *err = check_path_syntax_posix(*pp_dest);
285 } else {
286 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
287 }
288
289 return ret;
290 }
291
292 /****************************************************************************
293 Pull a string and check the path - provide for error return.
294 ****************************************************************************/
295
296 size_t srvstr_get_path(TALLOC_CTX *ctx,
297 const char *base_ptr,
298 uint16 smb_flags2,
299 char **pp_dest,
300 const char *src,
301 size_t src_len,
302 int flags,
303 NTSTATUS *err)
304 {
305 bool ignore;
306 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
307 src_len, flags, err, &ignore);
308 }
309
310 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
311 char **pp_dest, const char *src, int flags,
312 NTSTATUS *err, bool *contains_wcard)
313 {
314 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
315 pp_dest, src, smbreq_bufrem(req, src),
316 flags, err, contains_wcard);
317 }
318
319 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
320 char **pp_dest, const char *src, int flags,
321 NTSTATUS *err)
322 {
323 bool ignore;
324 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
325 flags, err, &ignore);
326 }
327
328 /****************************************************************************
329 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
330 ****************************************************************************/
331
332 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
333 files_struct *fsp)
334 {
335 if (!(fsp) || !(conn)) {
336 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
337 return False;
338 }
339 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
340 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
341 return False;
342 }
343 return True;
344 }
345
346 /****************************************************************************
347 Check if we have a correct fsp pointing to a file.
348 ****************************************************************************/
349
350 bool check_fsp(connection_struct *conn, struct smb_request *req,
351 files_struct *fsp)
352 {
353 if (!check_fsp_open(conn, req, fsp)) {
354 return False;
355 }
356 if ((fsp)->is_directory) {
357 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
358 return False;
359 }
360 if ((fsp)->fh->fd == -1) {
361 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
362 return False;
363 }
364 (fsp)->num_smb_operations++;
365 return True;
366 }
367
368 /****************************************************************************
369 Check if we have a correct fsp pointing to a quota fake file. Replacement for
370 the CHECK_NTQUOTA_HANDLE_OK macro.
371 ****************************************************************************/
372
373 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
374 files_struct *fsp)
375 {
376 if (!check_fsp_open(conn, req, fsp)) {
377 return false;
378 }
379
380 if (fsp->is_directory) {
381 return false;
382 }
383
384 if (fsp->fake_file_handle == NULL) {
385 return false;
386 }
387
388 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
389 return false;
390 }
391
392 if (fsp->fake_file_handle->private_data == NULL) {
393 return false;
394 }
395
396 return true;
397 }
398
399 /****************************************************************************
400 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
401 ****************************************************************************/
402
403 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
404 files_struct *fsp)
405 {
406 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
407 && (req->vuid == (fsp)->vuid)) {
408 return True;
409 }
410
411 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
412 return False;
413 }
414
415 /****************************************************************************
416 Reply to a (netbios-level) special message.
417 ****************************************************************************/
418
419 void reply_special(char *inbuf)
420 {
421 int msg_type = CVAL(inbuf,0);
422 int msg_flags = CVAL(inbuf,1);
423 fstring name1,name2;
424 char name_type = 0;
425
426 /*
427 * We only really use 4 bytes of the outbuf, but for the smb_setlen
428 * calculation & friends (srv_send_smb uses that) we need the full smb
429 * header.
430 */
431 char outbuf[smb_size];
432
433 *name1 = *name2 = 0;
434
435 memset(outbuf, '\0', sizeof(outbuf));
436
437 smb_setlen(outbuf,0);
438
439 switch (msg_type) {
440 case 0x81: /* session request */
441
442 if (already_got_session) {
443 exit_server_cleanly("multiple session request not permitted");
444 }
445
446 SCVAL(outbuf,0,0x82);
447 SCVAL(outbuf,3,0);
448 if (name_len(inbuf+4) > 50 ||
449 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
450 DEBUG(0,("Invalid name length in session request\n"));
451 return;
452 }
453 name_extract(inbuf,4,name1);
454 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
455 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
456 name1,name2));
457
458 set_local_machine_name(name1, True);
459 set_remote_machine_name(name2, True);
460
461 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
462 get_local_machine_name(), get_remote_machine_name(),
463 name_type));
464
465 if (name_type == 'R') {
466 /* We are being asked for a pathworks session ---
467 no thanks! */
468 SCVAL(outbuf, 0,0x83);
469 break;
470 }
471
472 /* only add the client's machine name to the list
473 of possibly valid usernames if we are operating
474 in share mode security */
475 if (lp_security() == SEC_SHARE) {
476 add_session_user(get_remote_machine_name());
477 }
478
479 reload_services(True);
480 reopen_logs();
481
482 already_got_session = True;
483 break;
484
485 case 0x89: /* session keepalive request
486 (some old clients produce this?) */
487 SCVAL(outbuf,0,SMBkeepalive);
488 SCVAL(outbuf,3,0);
489 break;
490
491 case 0x82: /* positive session response */
492 case 0x83: /* negative session response */
493 case 0x84: /* retarget session response */
494 DEBUG(0,("Unexpected session response\n"));
495 break;
496
497 case SMBkeepalive: /* session keepalive */
498 default:
499 return;
500 }
501
502 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
503 msg_type, msg_flags));
504
505 srv_send_smb(smbd_server_fd(), outbuf, false, NULL);
506 return;
507 }
508
509 /****************************************************************************
510 Reply to a tcon.
511 conn POINTER CAN BE NULL HERE !
512 ****************************************************************************/
513
514 void reply_tcon(struct smb_request *req)
515 {
516 connection_struct *conn = req->conn;
517 const char *service;
518 char *service_buf = NULL;
519 char *password = NULL;
520 char *dev = NULL;
521 int pwlen=0;
522 NTSTATUS nt_status;
523 const char *p;
524 DATA_BLOB password_blob;
525 TALLOC_CTX *ctx = talloc_tos();
526
527 START_PROFILE(SMBtcon);
528
529 if (req->buflen < 4) {
530 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
531 END_PROFILE(SMBtcon);
532 return;
533 }
534
535 p = (const char *)req->buf + 1;
536 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
537 p += 1;
538 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
539 p += pwlen+1;
540 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
541 p += 1;
542
543 if (service_buf == NULL || password == NULL || dev == NULL) {
544 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
545 END_PROFILE(SMBtcon);
546 return;
547 }
548 p = strrchr_m(service_buf,'\\');
549 if (p) {
550 service = p+1;
551 } else {
552 service = service_buf;
553 }
554
555 password_blob = data_blob(password, pwlen+1);
556
557 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
558 req->conn = conn;
559
560 data_blob_clear_free(&password_blob);
561
562 if (!conn) {
563 reply_nterror(req, nt_status);
564 END_PROFILE(SMBtcon);
565 return;
566 }
567
568 reply_outbuf(req, 2, 0);
569 SSVAL(req->outbuf,smb_vwv0,max_recv);
570 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
571 SSVAL(req->outbuf,smb_tid,conn->cnum);
572
573 DEBUG(3,("tcon service=%s cnum=%d\n",
574 service, conn->cnum));
575
576 END_PROFILE(SMBtcon);
577 return;
578 }
579
580 /****************************************************************************
581 Reply to a tcon and X.
582 conn POINTER CAN BE NULL HERE !
583 ****************************************************************************/
584
585 void reply_tcon_and_X(struct smb_request *req)
586 {
587 connection_struct *conn = req->conn;
588 const char *service = NULL;
589 DATA_BLOB password;
590 TALLOC_CTX *ctx = talloc_tos();
591 /* what the cleint thinks the device is */
592 char *client_devicetype = NULL;
593 /* what the server tells the client the share represents */
594 const char *server_devicetype;
595 NTSTATUS nt_status;
596 int passlen;
597 char *path = NULL;
598 const char *p, *q;
599 uint16 tcon_flags;
600
601 START_PROFILE(SMBtconX);
602
603 if (req->wct < 4) {
604 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
605 END_PROFILE(SMBtconX);
606 return;
607 }
608
609 passlen = SVAL(req->vwv+3, 0);
610 tcon_flags = SVAL(req->vwv+2, 0);
611
612 /* we might have to close an old one */
613 if ((tcon_flags & 0x1) && conn) {
614 close_cnum(conn,req->vuid);
615 req->conn = NULL;
616 conn = NULL;
617 }
618
619 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
620 reply_doserror(req, ERRDOS, ERRbuftoosmall);
621 END_PROFILE(SMBtconX);
622 return;
623 }
624
625 if (global_encrypted_passwords_negotiated) {
626 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
627 if (lp_security() == SEC_SHARE) {
628 /*
629 * Security = share always has a pad byte
630 * after the password.
631 */
632 p = (const char *)req->buf + passlen + 1;
633 } else {
634 p = (const char *)req->buf + passlen;
635 }
636 } else {
637 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
638 /* Ensure correct termination */
639 password.data[passlen]=0;
640 p = (const char *)req->buf + passlen + 1;
641 }
642
643 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
644
645 if (path == NULL) {
646 data_blob_clear_free(&password);
647 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
648 END_PROFILE(SMBtconX);
649 return;
650 }
651
652 /*
653 * the service name can be either: \\server\share
654 * or share directly like on the DELL PowerVault 705
655 */
656 if (*path=='\\') {
657 q = strchr_m(path+2,'\\');
658 if (!q) {
659 data_blob_clear_free(&password);
660 reply_doserror(req, ERRDOS, ERRnosuchshare);
661 END_PROFILE(SMBtconX);
662 return;
663 }
664 service = q+1;
665 } else {
666 service = path;
667 }
668
669 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
670 &client_devicetype, p,
671 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
672
673 if (client_devicetype == NULL) {
674 data_blob_clear_free(&password);
675 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
676 END_PROFILE(SMBtconX);
677 return;
678 }
679
680 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
681
682 conn = make_connection(service, password, client_devicetype,
683 req->vuid, &nt_status);
684 req->conn =conn;
685
686 data_blob_clear_free(&password);
687
688 if (!conn) {
689 reply_nterror(req, nt_status);
690 END_PROFILE(SMBtconX);
691 return;
692 }
693
694 if ( IS_IPC(conn) )
695 server_devicetype = "IPC";
696 else if ( IS_PRINT(conn) )
697 server_devicetype = "LPT1:";
698 else
699 server_devicetype = "A:";
700
701 if (Protocol < PROTOCOL_NT1) {
702 reply_outbuf(req, 2, 0);
703 if (message_push_string(&req->outbuf, server_devicetype,
704 STR_TERMINATE|STR_ASCII) == -1) {
705 reply_nterror(req, NT_STATUS_NO_MEMORY);
706 END_PROFILE(SMBtconX);
707 return;
708 }
709 } else {
710 /* NT sets the fstype of IPC$ to the null string */
711 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
712
713 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
714 /* Return permissions. */
715 uint32 perm1 = 0;
716 uint32 perm2 = 0;
717
718 reply_outbuf(req, 7, 0);
719
720 if (IS_IPC(conn)) {
721 perm1 = FILE_ALL_ACCESS;
722 perm2 = FILE_ALL_ACCESS;
723 } else {
724 perm1 = CAN_WRITE(conn) ?
725 SHARE_ALL_ACCESS :
726 SHARE_READ_ONLY;
727 }
728
729 SIVAL(req->outbuf, smb_vwv3, perm1);
730 SIVAL(req->outbuf, smb_vwv5, perm2);
731 } else {
732 reply_outbuf(req, 3, 0);
733 }
734
735 if ((message_push_string(&req->outbuf, server_devicetype,
736 STR_TERMINATE|STR_ASCII) == -1)
737 || (message_push_string(&req->outbuf, fstype,
738 STR_TERMINATE) == -1)) {
739 reply_nterror(req, NT_STATUS_NO_MEMORY);
740 END_PROFILE(SMBtconX);
741 return;
742 }
743
744 /* what does setting this bit do? It is set by NT4 and
745 may affect the ability to autorun mounted cdroms */
746 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
747 (lp_csc_policy(SNUM(conn)) << 2));
748
749 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
750 DEBUG(2,("Serving %s as a Dfs root\n",
751 lp_servicename(SNUM(conn)) ));
752 SSVAL(req->outbuf, smb_vwv2,
753 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
754 }
755 }
756
757
758 DEBUG(3,("tconX service=%s \n",
759 service));
760
761 /* set the incoming and outgoing tid to the just created one */
762 SSVAL(req->inbuf,smb_tid,conn->cnum);
763 SSVAL(req->outbuf,smb_tid,conn->cnum);
764
765 END_PROFILE(SMBtconX);
766
767 req->tid = conn->cnum;
768 chain_reply(req);
769 return;
770 }
771
772 /****************************************************************************
773 Reply to an unknown type.
774 ****************************************************************************/
775
776 void reply_unknown_new(struct smb_request *req, uint8 type)
777 {
778 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
779 smb_fn_name(type), type, type));
780 reply_doserror(req, ERRSRV, ERRunknownsmb);
781 return;
782 }
783
784 /****************************************************************************
785 Reply to an ioctl.
786 conn POINTER CAN BE NULL HERE !
787 ****************************************************************************/
788
789 void reply_ioctl(struct smb_request *req)
790 {
791 connection_struct *conn = req->conn;
792 uint16 device;
793 uint16 function;
794 uint32 ioctl_code;
795 int replysize;
796 char *p;
797
798 START_PROFILE(SMBioctl);
799
800 if (req->wct < 3) {
801 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
802 END_PROFILE(SMBioctl);
803 return;
804 }
805
806 device = SVAL(req->vwv+1, 0);
807 function = SVAL(req->vwv+2, 0);
808 ioctl_code = (device << 16) + function;
809
810 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
811
812 switch (ioctl_code) {
813 case IOCTL_QUERY_JOB_INFO:
814 replysize = 32;
815 break;
816 default:
817 reply_doserror(req, ERRSRV, ERRnosupport);
818 END_PROFILE(SMBioctl);
819 return;
820 }
821
822 reply_outbuf(req, 8, replysize+1);
823 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
824 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
825 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
826 p = smb_buf(req->outbuf);
827 memset(p, '\0', replysize+1); /* valgrind-safe. */
828 p += 1; /* Allow for alignment */
829
830 switch (ioctl_code) {
831 case IOCTL_QUERY_JOB_INFO:
832 {
833 files_struct *fsp = file_fsp(
834 req, SVAL(req->vwv+0, 0));
835 if (!fsp) {
836 reply_doserror(req, ERRDOS, ERRbadfid);
837 END_PROFILE(SMBioctl);
838 return;
839 }
840 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
841 srvstr_push((char *)req->outbuf, req->flags2, p+2,
842 global_myname(), 15,
843 STR_TERMINATE|STR_ASCII);
844 if (conn) {
845 srvstr_push((char *)req->outbuf, req->flags2,
846 p+18, lp_servicename(SNUM(conn)),
847 13, STR_TERMINATE|STR_ASCII);
848 } else {
849 memset(p+18, 0, 13);
850 }
851 break;
852 }
853 }
854
855 END_PROFILE(SMBioctl);
856 return;
857 }
858
859 /****************************************************************************
860 Strange checkpath NTSTATUS mapping.
861 ****************************************************************************/
862
863 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
864 {
865 /* Strange DOS error code semantics only for checkpath... */
866 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
867 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
868 /* We need to map to ERRbadpath */
869 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
870 }
871 }
872 return status;
873 }
874
875 /****************************************************************************
876 Reply to a checkpath.
877 ****************************************************************************/
878
879 void reply_checkpath(struct smb_request *req)
880 {
881 connection_struct *conn = req->conn;
882 char *name = NULL;
883 SMB_STRUCT_STAT sbuf;
884 NTSTATUS status;
885 TALLOC_CTX *ctx = talloc_tos();
886
887 START_PROFILE(SMBcheckpath);
888
889 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
890 STR_TERMINATE, &status);
891
892 if (!NT_STATUS_IS_OK(status)) {
893 status = map_checkpath_error(req->flags2, status);
894 reply_nterror(req, status);
895 END_PROFILE(SMBcheckpath);
896 return;
897 }
898
899 status = resolve_dfspath(ctx, conn,
900 req->flags2 & FLAGS2_DFS_PATHNAMES,
901 name,
902 &name);
903 if (!NT_STATUS_IS_OK(status)) {
904 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
905 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
906 ERRSRV, ERRbadpath);
907 END_PROFILE(SMBcheckpath);
908 return;
909 }
910 goto path_err;
911 }
912
913 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
914
915 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
916 if (!NT_STATUS_IS_OK(status)) {
917 goto path_err;
918 }
919
920 status = check_name(conn, name);
921 if (!NT_STATUS_IS_OK(status)) {
922 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
923 goto path_err;
924 }
925
926 if (!VALID_STAT(sbuf)) {
927 int ret;
928
929 if (lp_posix_pathnames()) {
930 ret = SMB_VFS_LSTAT(conn,name,&sbuf);
931 } else {
932 ret = SMB_VFS_STAT(conn,name,&sbuf);
933 }
934 if (ret != 0) {
935 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
936 status = map_nt_error_from_unix(errno);
937 goto path_err;
938 }
939 }
940
941 if (!S_ISDIR(sbuf.st_mode)) {
942 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
943 ERRDOS, ERRbadpath);
944 END_PROFILE(SMBcheckpath);
945 return;
946 }
947
948 reply_outbuf(req, 0, 0);
949
950 END_PROFILE(SMBcheckpath);
951 return;
952
953 path_err:
954
955 END_PROFILE(SMBcheckpath);
956
957 /* We special case this - as when a Windows machine
958 is parsing a path is steps through the components
959 one at a time - if a component fails it expects
960 ERRbadpath, not ERRbadfile.
961 */
962 status = map_checkpath_error(req->flags2, status);
963 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
964 /*
965 * Windows returns different error codes if
966 * the parent directory is valid but not the
967 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
968 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
969 * if the path is invalid.
970 */
971 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
972 ERRDOS, ERRbadpath);
973 return;
974 }
975
976 reply_nterror(req, status);
977 }
978
979 /****************************************************************************
980 Reply to a getatr.
981 ****************************************************************************/
982
983 void reply_getatr(struct smb_request *req)
984 {
985 connection_struct *conn = req->conn;
986 char *fname = NULL;
987 SMB_STRUCT_STAT sbuf;
988 int mode=0;
989 SMB_OFF_T size=0;
990 time_t mtime=0;
991 const char *p;
992 NTSTATUS status;
993 TALLOC_CTX *ctx = talloc_tos();
994
995 START_PROFILE(SMBgetatr);
996
997 p = (const char *)req->buf + 1;
998 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
999 if (!NT_STATUS_IS_OK(status)) {
1000 reply_nterror(req, status);
1001 END_PROFILE(SMBgetatr);
1002 return;
1003 }
1004
1005 status = resolve_dfspath(ctx, conn,
1006 req->flags2 & FLAGS2_DFS_PATHNAMES,
1007 fname,
1008 &fname);
1009 if (!NT_STATUS_IS_OK(status)) {
1010 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1011 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1012 ERRSRV, ERRbadpath);
1013 END_PROFILE(SMBgetatr);
1014 return;
1015 }
1016 reply_nterror(req, status);
1017 END_PROFILE(SMBgetatr);
1018 return;
1019 }
1020
1021 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1022 under WfWg - weird! */
1023 if (*fname == '\0') {
1024 mode = aHIDDEN | aDIR;
1025 if (!CAN_WRITE(conn)) {
1026 mode |= aRONLY;
1027 }
1028 size = 0;
1029 mtime = 0;
1030 } else {
1031 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1032 if (!NT_STATUS_IS_OK(status)) {
1033 reply_nterror(req, status);
1034 END_PROFILE(SMBgetatr);
1035 return;
1036 }
1037 status = check_name(conn, fname);
1038 if (!NT_STATUS_IS_OK(status)) {
1039 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1040 reply_nterror(req, status);
1041 END_PROFILE(SMBgetatr);
1042 return;
1043 }
1044 if (!VALID_STAT(sbuf)) {
1045 int ret;
1046
1047 if (lp_posix_pathnames()) {
1048 ret = SMB_VFS_LSTAT(conn,fname,&sbuf);
1049 } else {
1050 ret = SMB_VFS_STAT(conn,fname,&sbuf);
1051 }
1052 if (ret != 0) {
1053 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1054 reply_unixerror(req, ERRDOS,ERRbadfile);
1055 END_PROFILE(SMBgetatr);
1056 return;
1057 }
1058 }
1059
1060 mode = dos_mode(conn,fname,&sbuf);
1061 size = sbuf.st_size;
1062 mtime = sbuf.st_mtime;
1063 if (mode & aDIR) {
1064 size = 0;
1065 }
1066 }
1067
1068 reply_outbuf(req, 10, 0);
1069
1070 SSVAL(req->outbuf,smb_vwv0,mode);
1071 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1072 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1073 } else {
1074 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1075 }
1076 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1077
1078 if (Protocol >= PROTOCOL_NT1) {
1079 SSVAL(req->outbuf, smb_flg2,
1080 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1081 }
1082
1083 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1084
1085 END_PROFILE(SMBgetatr);
1086 return;
1087 }
1088
1089 /****************************************************************************
1090 Reply to a setatr.
1091 ****************************************************************************/
1092
1093 void reply_setatr(struct smb_request *req)
1094 {
1095 struct smb_file_time ft;
1096 connection_struct *conn = req->conn;
1097 char *fname = NULL;
1098 int mode;
1099 time_t mtime;
1100 SMB_STRUCT_STAT sbuf;
1101 const char *p;
1102 NTSTATUS status;
1103 TALLOC_CTX *ctx = talloc_tos();
1104
1105 START_PROFILE(SMBsetatr);
1106
1107 ZERO_STRUCT(ft);
1108
1109 if (req->wct < 2) {
1110 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1111 return;
1112 }
1113
1114 p = (const char *)req->buf + 1;
1115 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1116 if (!NT_STATUS_IS_OK(status)) {
1117 reply_nterror(req, status);
1118 END_PROFILE(SMBsetatr);
1119 return;
1120 }
1121
1122 status = resolve_dfspath(ctx, conn,
1123 req->flags2 & FLAGS2_DFS_PATHNAMES,
1124 fname,
1125 &fname);
1126 if (!NT_STATUS_IS_OK(status)) {
1127 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1128 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1129 ERRSRV, ERRbadpath);
1130 END_PROFILE(SMBsetatr);
1131 return;
1132 }
1133 reply_nterror(req, status);
1134 END_PROFILE(SMBsetatr);
1135 return;
1136 }
1137
1138 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 reply_nterror(req, status);
1141 END_PROFILE(SMBsetatr);
1142 return;
1143 }
1144
1145 status = check_name(conn, fname);
1146 if (!NT_STATUS_IS_OK(status)) {
1147 reply_nterror(req, status);
1148 END_PROFILE(SMBsetatr);
1149 return;
1150 }
1151
1152 if (fname[0] == '.' && fname[1] == '\0') {
1153 /*
1154 * Not sure here is the right place to catch this
1155 * condition. Might be moved to somewhere else later -- vl
1156 */
1157 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1158 END_PROFILE(SMBsetatr);
1159 return;
1160 }
1161
1162 mode = SVAL(req->vwv+0, 0);
1163 mtime = srv_make_unix_date3(req->vwv+1);
1164
1165 ft.mtime = convert_time_t_to_timespec(mtime);
1166 status = smb_set_file_time(conn, NULL, fname,
1167 &sbuf, &ft, true);
1168 if (!NT_STATUS_IS_OK(status)) {
1169 reply_unixerror(req, ERRDOS, ERRnoaccess);
1170 END_PROFILE(SMBsetatr);
1171 return;
1172 }
1173
1174 if (mode != FILE_ATTRIBUTE_NORMAL) {
1175 if (VALID_STAT_OF_DIR(sbuf))
1176 mode |= aDIR;
1177 else
1178 mode &= ~aDIR;
1179
1180 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1181 reply_unixerror(req, ERRDOS, ERRnoaccess);
1182 END_PROFILE(SMBsetatr);
1183 return;
1184 }
1185 }
1186
1187 reply_outbuf(req, 0, 0);
1188
1189 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1190
1191 END_PROFILE(SMBsetatr);
1192 return;
1193 }
1194
1195 /****************************************************************************
1196 Reply to a dskattr.
1197 ****************************************************************************/
1198
1199 void reply_dskattr(struct smb_request *req)
1200 {
1201 connection_struct *conn = req->conn;
1202 uint64_t dfree,dsize,bsize;
1203 START_PROFILE(SMBdskattr);
1204
1205 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1206 reply_unixerror(req, ERRHRD, ERRgeneral);
1207 END_PROFILE(SMBdskattr);
1208 return;
1209 }
1210
1211 reply_outbuf(req, 5, 0);
1212
1213 if (Protocol <= PROTOCOL_LANMAN2) {
1214 double total_space, free_space;
1215 /* we need to scale this to a number that DOS6 can handle. We
1216 use floating point so we can handle large drives on systems
1217 that don't have 64 bit integers
1218
1219 we end up displaying a maximum of 2G to DOS systems
1220 */
1221 total_space = dsize * (double)bsize;
1222 free_space = dfree * (double)bsize;
1223
1224 dsize = (uint64_t)((total_space+63*512) / (64*512));
1225 dfree = (uint64_t)((free_space+63*512) / (64*512));
1226
1227 if (dsize > 0xFFFF) dsize = 0xFFFF;
1228 if (dfree > 0xFFFF) dfree = 0xFFFF;
1229
1230 SSVAL(req->outbuf,smb_vwv0,dsize);
1231 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1232 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1233 SSVAL(req->outbuf,smb_vwv3,dfree);
1234 } else {
1235 SSVAL(req->outbuf,smb_vwv0,dsize);
1236 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1237 SSVAL(req->outbuf,smb_vwv2,512);
1238 SSVAL(req->outbuf,smb_vwv3,dfree);
1239 }
1240
1241 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1242
1243 END_PROFILE(SMBdskattr);
1244 return;
1245 }
1246
1247 /****************************************************************************
1248 Reply to a search.
1249 Can be called from SMBsearch, SMBffirst or SMBfunique.
1250 ****************************************************************************/
1251
1252 void reply_search(struct smb_request *req)
1253 {
1254 connection_struct *conn = req->conn;
1255 const char *mask = NULL;
1256 char *directory = NULL;
1257 char *fname = NULL;
1258 SMB_OFF_T size;
1259 uint32 mode;
1260 time_t date;
1261 uint32 dirtype;
1262 unsigned int numentries = 0;
1263 unsigned int maxentries = 0;
1264 bool finished = False;
1265 const char *p;
1266 int status_len;
1267 char *path = NULL;
1268 char status[21];
1269 int dptr_num= -1;
1270 bool check_descend = False;
1271 bool expect_close = False;
1272 NTSTATUS nt_status;
1273 bool mask_contains_wcard = False;
1274 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1275 TALLOC_CTX *ctx = talloc_tos();
1276 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1277
1278 START_PROFILE(SMBsearch);
1279
1280 if (req->wct < 2) {
1281 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1282 END_PROFILE(SMBsearch);
1283 return;
1284 }
1285
1286 if (lp_posix_pathnames()) {
1287 reply_unknown_new(req, req->cmd);
1288 END_PROFILE(SMBsearch);
1289 return;
1290 }
1291
1292 /* If we were called as SMBffirst then we must expect close. */
1293 if(req->cmd == SMBffirst) {
1294 expect_close = True;
1295 }
1296
1297 reply_outbuf(req, 1, 3);
1298 maxentries = SVAL(req->vwv+0, 0);
1299 dirtype = SVAL(req->vwv+1, 0);
1300 p = (const char *)req->buf + 1;
1301 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1302 &nt_status, &mask_contains_wcard);
1303 if (!NT_STATUS_IS_OK(nt_status)) {
1304 reply_nterror(req, nt_status);
1305 END_PROFILE(SMBsearch);
1306 return;
1307 }
1308
1309 nt_status = resolve_dfspath_wcard(ctx, conn,
1310 req->flags2 & FLAGS2_DFS_PATHNAMES,
1311 path,
1312 &path,
1313 &mask_contains_wcard);
1314 if (!NT_STATUS_IS_OK(nt_status)) {
1315 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1316 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1317 ERRSRV, ERRbadpath);
1318 END_PROFILE(SMBsearch);
1319 return;
1320 }
1321 reply_nterror(req, nt_status);
1322 END_PROFILE(SMBsearch);
1323 return;
1324 }
1325
1326 p++;
1327 status_len = SVAL(p, 0);
1328 p += 2;
1329
1330 /* dirtype &= ~aDIR; */
1331
1332 if (status_len == 0) {
1333 SMB_STRUCT_STAT sbuf;
1334
1335 nt_status = unix_convert(ctx, conn, path, True,
1336 &directory, NULL, &sbuf);
1337 if (!NT_STATUS_IS_OK(nt_status)) {
1338 reply_nterror(req, nt_status);
1339 END_PROFILE(SMBsearch);
1340 return;
1341 }
1342
1343 nt_status = check_name(conn, directory);
1344 if (!NT_STATUS_IS_OK(nt_status)) {
1345 reply_nterror(req, nt_status);
1346 END_PROFILE(SMBsearch);
1347 return;
1348 }
1349
1350 p = strrchr_m(directory,'/');
1351 if ((p != NULL) && (*directory != '/')) {
1352 mask = p + 1;
1353 directory = talloc_strndup(ctx, directory,
1354 PTR_DIFF(p, directory));
1355 } else {
1356 mask = directory;
1357 directory = talloc_strdup(ctx,".");
1358 }
1359
1360 if (!directory) {
1361 reply_nterror(req, NT_STATUS_NO_MEMORY);
1362 END_PROFILE(SMBsearch);
1363 return;
1364 }
1365
1366 memset((char *)status,'\0',21);
1367 SCVAL(status,0,(dirtype & 0x1F));
1368
1369 nt_status = dptr_create(conn,
1370 directory,
1371 True,
1372 expect_close,
1373 req->smbpid,
1374 mask,
1375 mask_contains_wcard,
1376 dirtype,
1377 &conn->dirptr);
1378 if (!NT_STATUS_IS_OK(nt_status)) {
1379 reply_nterror(req, nt_status);
1380 END_PROFILE(SMBsearch);
1381 return;
1382 }
1383 dptr_num = dptr_dnum(conn->dirptr);
1384 } else {
1385 int status_dirtype;
1386
1387 memcpy(status,p,21);
1388 status_dirtype = CVAL(status,0) & 0x1F;
1389 if (status_dirtype != (dirtype & 0x1F)) {
1390 dirtype = status_dirtype;
1391 }
1392
1393 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1394 if (!conn->dirptr) {
1395 goto SearchEmpty;
1396 }
1397 string_set(&conn->dirpath,dptr_path(dptr_num));
1398 mask = dptr_wcard(dptr_num);
1399 if (!mask) {
1400 goto SearchEmpty;
1401 }
1402 /*
1403 * For a 'continue' search we have no string. So
1404 * check from the initial saved string.
1405 */
1406 mask_contains_wcard = ms_has_wild(mask);
1407 dirtype = dptr_attr(dptr_num);
1408 }
1409
1410 DEBUG(4,("dptr_num is %d\n",dptr_num));
1411
1412 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1413 dptr_init_search_op(conn->dirptr);
1414
1415 if ((dirtype&0x1F) == aVOLID) {
1416 char buf[DIR_STRUCT_SIZE];
1417 memcpy(buf,status,21);
1418 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1419 0,aVOLID,0,!allow_long_path_components)) {
1420 reply_nterror(req, NT_STATUS_NO_MEMORY);
1421 END_PROFILE(SMBsearch);
1422 return;
1423 }
1424 dptr_fill(buf+12,dptr_num);
1425 if (dptr_zero(buf+12) && (status_len==0)) {
1426 numentries = 1;
1427 } else {
1428 numentries = 0;
1429 }
1430 if (message_push_blob(&req->outbuf,
1431 data_blob_const(buf, sizeof(buf)))
1432 == -1) {
1433 reply_nterror(req, NT_STATUS_NO_MEMORY);
1434 END_PROFILE(SMBsearch);
1435 return;
1436 }
1437 } else {
1438 unsigned int i;
1439 maxentries = MIN(
1440 maxentries,
1441 ((BUFFER_SIZE -
1442 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1443 /DIR_STRUCT_SIZE));
1444
1445 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1446 conn->dirpath,lp_dontdescend(SNUM(conn))));
1447 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1448 check_descend = True;
1449 }
1450
1451 for (i=numentries;(i<maxentries) && !finished;i++) {
1452 finished = !get_dir_entry(ctx,
1453 conn,
1454 mask,
1455 dirtype,
1456 &fname,
1457 &size,
1458 &mode,
1459 &date,
1460 check_descend,
1461 ask_sharemode);
1462 if (!finished) {
1463 char buf[DIR_STRUCT_SIZE];
1464 memcpy(buf,status,21);
1465 if (!make_dir_struct(ctx,
1466 buf,
1467 mask,
1468 fname,
1469 size,
1470 mode,
1471 date,
1472 !allow_long_path_components)) {
1473 reply_nterror(req, NT_STATUS_NO_MEMORY);
1474 END_PROFILE(SMBsearch);
1475 return;
1476 }
1477 if (!dptr_fill(buf+12,dptr_num)) {
1478 break;
1479 }
1480 if (message_push_blob(&req->outbuf,
1481 data_blob_const(buf, sizeof(buf)))
1482 == -1) {
1483 reply_nterror(req, NT_STATUS_NO_MEMORY);
1484 END_PROFILE(SMBsearch);
1485 return;
1486 }
1487 numentries++;
1488 }
1489 }
1490 }
1491
1492 SearchEmpty:
1493
1494 /* If we were called as SMBffirst with smb_search_id == NULL
1495 and no entries were found then return error and close dirptr
1496 (X/Open spec) */
1497
1498 if (numentries == 0) {
1499 dptr_close(&dptr_num);
1500 } else if(expect_close && status_len == 0) {
1501 /* Close the dptr - we know it's gone */
1502 dptr_close(&dptr_num);
1503 }
1504
1505 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1506 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1507 dptr_close(&dptr_num);
1508 }
1509
1510 if ((numentries == 0) && !mask_contains_wcard) {
1511 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1512 END_PROFILE(SMBsearch);
1513 return;
1514 }
1515
1516 SSVAL(req->outbuf,smb_vwv0,numentries);
1517 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1518 SCVAL(smb_buf(req->outbuf),0,5);
1519 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1520
1521 /* The replies here are never long name. */
1522 SSVAL(req->outbuf, smb_flg2,
1523 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1524 if (!allow_long_path_components) {
1525 SSVAL(req->outbuf, smb_flg2,
1526 SVAL(req->outbuf, smb_flg2)
1527 & (~FLAGS2_LONG_PATH_COMPONENTS));
1528 }
1529
1530 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1531 SSVAL(req->outbuf, smb_flg2,
1532 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1533
1534 if (!directory) {
1535 directory = dptr_path(dptr_num);
1536 }
1537
1538 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1539 smb_fn_name(req->cmd),
1540 mask,
1541 directory ? directory : "./",
1542 dirtype,
1543 numentries,
1544 maxentries ));
1545
1546 END_PROFILE(SMBsearch);
1547 return;
1548 }
1549
1550 /****************************************************************************
1551 Reply to a fclose (stop directory search).
1552 ****************************************************************************/
1553
1554 void reply_fclose(struct smb_request *req)
1555 {
1556 int status_len;
1557 char status[21];
1558 int dptr_num= -2;
1559 const char *p;
1560 char *path = NULL;
1561 NTSTATUS err;
1562 bool path_contains_wcard = False;
1563 TALLOC_CTX *ctx = talloc_tos();
1564
1565 START_PROFILE(SMBfclose);
1566
1567 if (lp_posix_pathnames()) {
1568 reply_unknown_new(req, req->cmd);
1569 END_PROFILE(SMBfclose);
1570 return;
1571 }
1572
1573 p = (const char *)req->buf + 1;
1574 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1575 &err, &path_contains_wcard);
1576 if (!NT_STATUS_IS_OK(err)) {
1577 reply_nterror(req, err);
1578 END_PROFILE(SMBfclose);
1579 return;
1580 }
1581 p++;
1582 status_len = SVAL(p,0);
1583 p += 2;
1584
1585 if (status_len == 0) {
1586 reply_doserror(req, ERRSRV, ERRsrverror);
1587 END_PROFILE(SMBfclose);
1588 return;
1589 }
1590
1591 memcpy(status,p,21);
1592
1593 if(dptr_fetch(status+12,&dptr_num)) {
1594 /* Close the dptr - we know it's gone */
1595 dptr_close(&dptr_num);
1596 }
1597
1598 reply_outbuf(req, 1, 0);
1599 SSVAL(req->outbuf,smb_vwv0,0);
1600
1601 DEBUG(3,("search close\n"));
1602
1603 END_PROFILE(SMBfclose);
1604 return;
1605 }
1606
1607 /****************************************************************************
1608 Reply to an open.
1609 ****************************************************************************/
1610
1611 void reply_open(struct smb_request *req)
1612 {
1613 connection_struct *conn = req->conn;
1614 char *fname = NULL;
1615 uint32 fattr=0;
1616 SMB_OFF_T size = 0;
1617 time_t mtime=0;
1618 int info;
1619 SMB_STRUCT_STAT sbuf;
1620 files_struct *fsp;
1621 int oplock_request;
1622 int deny_mode;
1623 uint32 dos_attr;
1624 uint32 access_mask;
1625 uint32 share_mode;
1626 uint32 create_disposition;
1627 uint32 create_options = 0;
1628 NTSTATUS status;
1629 TALLOC_CTX *ctx = talloc_tos();
1630
1631 START_PROFILE(SMBopen);
1632
1633 SET_STAT_INVALID(sbuf);
1634
1635 if (req->wct < 2) {
1636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1637 END_PROFILE(SMBopen);
1638 return;
1639 }
1640
1641 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1642 deny_mode = SVAL(req->vwv+0, 0);
1643 dos_attr = SVAL(req->vwv+1, 0);
1644
1645 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1646 STR_TERMINATE, &status);
1647 if (!NT_STATUS_IS_OK(status)) {
1648 reply_nterror(req, status);
1649 END_PROFILE(SMBopen);
1650 return;
1651 }
1652
1653 if (!map_open_params_to_ntcreate(
1654 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1655 &share_mode, &create_disposition, &create_options)) {
1656 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1657 END_PROFILE(SMBopen);
1658 return;
1659 }
1660
1661 status = SMB_VFS_CREATE_FILE(
1662 conn, /* conn */
1663 req, /* req */
1664 0, /* root_dir_fid */
1665 fname, /* fname */
1666 CFF_DOS_PATH, /* create_file_flags */
1667 access_mask, /* access_mask */
1668 share_mode, /* share_access */
1669 create_disposition, /* create_disposition*/
1670 create_options, /* create_options */
1671 dos_attr, /* file_attributes */
1672 oplock_request, /* oplock_request */
1673 0, /* allocation_size */
1674 NULL, /* sd */
1675 NULL, /* ea_list */
1676 &fsp, /* result */
1677 &info, /* pinfo */
1678 &sbuf); /* psbuf */
1679
1680 if (!NT_STATUS_IS_OK(status)) {
1681 if (open_was_deferred(req->mid)) {
1682 /* We have re-scheduled this call. */
1683 END_PROFILE(SMBopen);
1684 return;
1685 }
1686 reply_openerror(req, status);
1687 END_PROFILE(SMBopen);
1688 return;
1689 }
1690
1691 size = sbuf.st_size;
1692 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1693 mtime = sbuf.st_mtime;
1694
1695 if (fattr & aDIR) {
1696 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1697 close_file(req, fsp, ERROR_CLOSE);
1698 reply_doserror(req, ERRDOS,ERRnoaccess);
1699 END_PROFILE(SMBopen);
1700 return;
1701 }
1702
1703 reply_outbuf(req, 7, 0);
1704 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1705 SSVAL(req->outbuf,smb_vwv1,fattr);
1706 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1707 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1708 } else {
1709 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1710 }
1711 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1712 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1713
1714 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1715 SCVAL(req->outbuf,smb_flg,
1716 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1717 }
1718
1719 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1720 SCVAL(req->outbuf,smb_flg,
1721 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1722 }
1723 END_PROFILE(SMBopen);
1724 return;
1725 }
1726
1727 /****************************************************************************
1728 Reply to an open and X.
1729 ****************************************************************************/
1730
1731 void reply_open_and_X(struct smb_request *req)
1732 {
1733 connection_struct *conn = req->conn;
1734 char *fname = NULL;
1735 uint16 open_flags;
1736 int deny_mode;
1737 uint32 smb_attr;
1738 /* Breakout the oplock request bits so we can set the
1739 reply bits separately. */
1740 int ex_oplock_request;
1741 int core_oplock_request;
1742 int oplock_request;
1743 #if 0
1744 int smb_sattr = SVAL(req->vwv+4, 0);
1745 uint32 smb_time = make_unix_date3(req->vwv+6);
1746 #endif
1747 int smb_ofun;
1748 uint32 fattr=0;
1749 int mtime=0;
1750 SMB_STRUCT_STAT sbuf;
1751 int smb_action = 0;
1752 files_struct *fsp;
1753 NTSTATUS status;
1754 uint64_t allocation_size;
1755 ssize_t retval = -1;
1756 uint32 access_mask;
1757 uint32 share_mode;
1758 uint32 create_disposition;
1759 uint32 create_options = 0;
1760 TALLOC_CTX *ctx = talloc_tos();
1761
1762 START_PROFILE(SMBopenX);
1763
1764 if (req->wct < 15) {
1765 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1766 END_PROFILE(SMBopenX);
1767 return;
1768 }
1769
1770 SET_STAT_INVALID(sbuf);
1771
1772 open_flags = SVAL(req->vwv+2, 0);
1773 deny_mode = SVAL(req->vwv+3, 0);
1774 smb_attr = SVAL(req->vwv+5, 0);
1775 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1776 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1777 oplock_request = ex_oplock_request | core_oplock_request;
1778 smb_ofun = SVAL(req->vwv+8, 0);
1779 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1780
1781 /* If it's an IPC, pass off the pipe handler. */
1782 if (IS_IPC(conn)) {
1783 if (lp_nt_pipe_support()) {
1784 reply_open_pipe_and_X(conn, req);
1785 } else {
1786 reply_doserror(req, ERRSRV, ERRaccess);
1787 }
1788 END_PROFILE(SMBopenX);
1789 return;
1790 }
1791
1792 /* XXXX we need to handle passed times, sattr and flags */
1793 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1794 STR_TERMINATE, &status);
1795 if (!NT_STATUS_IS_OK(status)) {
1796 reply_nterror(req, status);
1797 END_PROFILE(SMBopenX);
1798 return;
1799 }
1800
1801 if (!map_open_params_to_ntcreate(
1802 fname, deny_mode, smb_ofun, &access_mask,
1803 &share_mode, &create_disposition, &create_options)) {
1804 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1805 END_PROFILE(SMBopenX);
1806 return;
1807 }
1808
1809 status = SMB_VFS_CREATE_FILE(
1810 conn, /* conn */
1811 req, /* req */
1812 0, /* root_dir_fid */
1813 fname, /* fname */
1814 CFF_DOS_PATH, /* create_file_flags */
1815 access_mask, /* access_mask */
1816 share_mode, /* share_access */
1817 create_disposition, /* create_disposition*/
1818 create_options, /* create_options */
1819 smb_attr, /* file_attributes */
1820 oplock_request, /* oplock_request */
1821 0, /* allocation_size */
1822 NULL, /* sd */
1823 NULL, /* ea_list */
1824 &fsp, /* result */
1825 &smb_action, /* pinfo */
1826 &sbuf); /* psbuf */
1827
1828 if (!NT_STATUS_IS_OK(status)) {
1829 END_PROFILE(SMBopenX);
1830 if (open_was_deferred(req->mid)) {
1831 /* We have re-scheduled this call. */
1832 return;
1833 }
1834 reply_openerror(req, status);
1835 return;
1836 }
1837
1838 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1839 if the file is truncated or created. */
1840 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1841 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1842 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1843 close_file(req, fsp, ERROR_CLOSE);
1844 reply_nterror(req, NT_STATUS_DISK_FULL);
1845 END_PROFILE(SMBopenX);
1846 return;
1847 }
1848 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1849 if (retval < 0) {
1850 close_file(req, fsp, ERROR_CLOSE);
1851 reply_nterror(req, NT_STATUS_DISK_FULL);
1852 END_PROFILE(SMBopenX);
1853 return;
1854 }
1855 sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1856 }
1857
1858 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1859 mtime = sbuf.st_mtime;
1860 if (fattr & aDIR) {
1861 close_file(req, fsp, ERROR_CLOSE);
1862 reply_doserror(req, ERRDOS, ERRnoaccess);
1863 END_PROFILE(SMBopenX);
1864 return;
1865 }
1866
1867 /* If the caller set the extended oplock request bit
1868 and we granted one (by whatever means) - set the
1869 correct bit for extended oplock reply.
1870 */
1871
1872 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1873 smb_action |= EXTENDED_OPLOCK_GRANTED;
1874 }
1875
1876 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1877 smb_action |= EXTENDED_OPLOCK_GRANTED;
1878 }
1879
1880 /* If the caller set the core oplock request bit
1881 and we granted one (by whatever means) - set the
1882 correct bit for core oplock reply.
1883 */
1884
1885 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1886 reply_outbuf(req, 19, 0);
1887 } else {
1888 reply_outbuf(req, 15, 0);
1889 }
1890
1891 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1892 SCVAL(req->outbuf, smb_flg,
1893 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1894 }
1895
1896 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1897 SCVAL(req->outbuf, smb_flg,
1898 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1899 }
1900
1901 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1902 SSVAL(req->outbuf,smb_vwv3,fattr);
1903 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1904 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1905 } else {
1906 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1907 }
1908 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1909 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1910 SSVAL(req->outbuf,smb_vwv11,smb_action);
1911
1912 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1913 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1914 }
1915
1916 END_PROFILE(SMBopenX);
1917 chain_reply(req);
1918 return;
1919 }
1920
1921 /****************************************************************************
1922 Reply to a SMBulogoffX.
1923 ****************************************************************************/
1924
1925 void reply_ulogoffX(struct smb_request *req)
1926 {
1927 user_struct *vuser;
1928
1929 START_PROFILE(SMBulogoffX);
1930
1931 vuser = get_valid_user_struct(req->vuid);
1932
1933 if(vuser == NULL) {
1934 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1935 req->vuid));
1936 }
1937
1938 /* in user level security we are supposed to close any files
1939 open by this user */
1940 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1941 file_close_user(req->vuid);
1942 }
1943
1944 invalidate_vuid(req->vuid);
1945
1946 reply_outbuf(req, 2, 0);
1947
1948 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1949
1950 END_PROFILE(SMBulogoffX);
1951 req->vuid = UID_FIELD_INVALID;
1952 chain_reply(req);
1953 }
1954
1955 /****************************************************************************
1956 Reply to a mknew or a create.
1957 ****************************************************************************/
1958
1959 void reply_mknew(struct smb_request *req)
1960 {
1961 connection_struct *conn = req->conn;
1962 char *fname = NULL;
1963 uint32 fattr = 0;
1964 struct smb_file_time ft;
1965 files_struct *fsp;
1966 int oplock_request = 0;
1967 SMB_STRUCT_STAT sbuf;
1968 NTSTATUS status;
1969 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1970 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1971 uint32 create_disposition;
1972 uint32 create_options = 0;
1973 TALLOC_CTX *ctx = talloc_tos();
1974
1975 START_PROFILE(SMBcreate);
1976 ZERO_STRUCT(ft);
1977 SET_STAT_INVALID(sbuf);
1978
1979 if (req->wct < 3) {
1980 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1981 END_PROFILE(SMBcreate);
1982 return;
1983 }
1984
1985 fattr = SVAL(req->vwv+0, 0);
1986 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1987
1988 /* mtime. */
1989 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
1990
1991 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
1992 STR_TERMINATE, &status);
1993 if (!NT_STATUS_IS_OK(status)) {
1994 reply_nterror(req, status);
1995 END_PROFILE(SMBcreate);
1996 return;
1997 }
1998
1999 if (fattr & aVOLID) {
2000 DEBUG(0,("Attempt to create file (%s) with volid set - "
2001 "please report this\n", fname));
2002 }
2003
2004 if(req->cmd == SMBmknew) {
2005 /* We should fail if file exists. */
2006 create_disposition = FILE_CREATE;
2007 } else {
2008 /* Create if file doesn't exist, truncate if it does. */
2009 create_disposition = FILE_OVERWRITE_IF;
2010 }
2011
2012 status = SMB_VFS_CREATE_FILE(
2013 conn, /* conn */
2014 req, /* req */
2015 0, /* root_dir_fid */
2016 fname, /* fname */
2017 CFF_DOS_PATH, /* create_file_flags */
2018 access_mask, /* access_mask */
2019 share_mode, /* share_access */
2020 create_disposition, /* create_disposition*/
2021 create_options, /* create_options */
2022 fattr, /* file_attributes */
2023 oplock_request, /* oplock_request */
2024 0, /* allocation_size */
2025 NULL, /* sd */
2026 NULL, /* ea_list */
2027 &fsp, /* result */
2028 NULL, /* pinfo */
2029 &sbuf); /* psbuf */
2030
2031 if (!NT_STATUS_IS_OK(status)) {
2032 END_PROFILE(SMBcreate);
2033 if (open_was_deferred(req->mid)) {
2034 /* We have re-scheduled this call. */
2035 return;
2036 }
2037 reply_openerror(req, status);
2038 return;
2039 }
2040
2041 ft.atime = get_atimespec(&sbuf); /* atime. */
2042 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2043 if (!NT_STATUS_IS_OK(status)) {
2044 END_PROFILE(SMBcreate);
2045 reply_openerror(req, status);
2046 return;
2047 }
2048
2049 reply_outbuf(req, 1, 0);
2050 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2051
2052 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2053 SCVAL(req->outbuf,smb_flg,
2054 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2055 }
2056
2057 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2058 SCVAL(req->outbuf,smb_flg,
2059 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2060 }
2061
2062 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2063 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2064 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2065
2066 END_PROFILE(SMBcreate);
2067 return;
2068 }
2069
2070 /****************************************************************************
2071 Reply to a create temporary file.
2072 ****************************************************************************/
2073
2074 void reply_ctemp(struct smb_request *req)
2075 {
2076 connection_struct *conn = req->conn;
2077 char *fname = NULL;
2078 uint32 fattr;
2079 files_struct *fsp;
2080 int oplock_request;
2081 int tmpfd;
2082 SMB_STRUCT_STAT sbuf;
2083 char *s;
2084 NTSTATUS status;
2085 TALLOC_CTX *ctx = talloc_tos();
2086
2087 START_PROFILE(SMBctemp);
2088
2089 if (req->wct < 3) {
2090 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2091 END_PROFILE(SMBctemp);
2092 return;
2093 }
2094
2095 fattr = SVAL(req->vwv+0, 0);
2096 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2097
2098 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2099 STR_TERMINATE, &status);
2100 if (!NT_STATUS_IS_OK(status)) {
2101 reply_nterror(req, status);
2102 END_PROFILE(SMBctemp);
2103 return;
2104 }
2105 if (*fname) {
2106 fname = talloc_asprintf(ctx,
2107 "%s/TMXXXXXX",
2108 fname);
2109 } else {
2110 fname = talloc_strdup(ctx, "TMXXXXXX");
2111 }
2112
2113 if (!fname) {
2114 reply_nterror(req, NT_STATUS_NO_MEMORY);
2115 END_PROFILE(SMBctemp);
2116 return;
2117 }
2118
2119 status = resolve_dfspath(ctx, conn,
2120 req->flags2 & FLAGS2_DFS_PATHNAMES,
2121 fname,
2122 &fname);
2123 if (!NT_STATUS_IS_OK(status)) {
2124 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2125 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2126 ERRSRV, ERRbadpath);
2127 END_PROFILE(SMBctemp);
2128 return;
2129 }
2130 reply_nterror(req, status);
2131 END_PROFILE(SMBctemp);
2132 return;
2133 }
2134
2135 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2136 if (!NT_STATUS_IS_OK(status)) {
2137 reply_nterror(req, status);
2138 END_PROFILE(SMBctemp);
2139 return;
2140 }
2141
2142 status = check_name(conn, fname);
2143 if (!NT_STATUS_IS_OK(status)) {
2144 reply_nterror(req, status);
2145 END_PROFILE(SMBctemp);
2146 return;
2147 }
2148
2149 tmpfd = smb_mkstemp(fname);
2150 if (tmpfd == -1) {
2151 reply_unixerror(req, ERRDOS, ERRnoaccess);
2152 END_PROFILE(SMBctemp);
2153 return;
2154 }
2155
2156 SET_STAT_INVALID(sbuf);
2157 SMB_VFS_STAT(conn,fname,&sbuf);
2158
2159 /* We should fail if file does not exist. */
2160 status = SMB_VFS_CREATE_FILE(
2161 conn, /* conn */
2162 req, /* req */
2163 0, /* root_dir_fid */
2164 fname, /* fname */
2165 0, /* create_file_flags */
2166 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2167 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2168 FILE_OPEN, /* create_disposition*/
2169 0, /* create_options */
2170 fattr, /* file_attributes */
2171 oplock_request, /* oplock_request */
2172 0, /* allocation_size */
2173 NULL, /* sd */
2174 NULL, /* ea_list */
2175 &fsp, /* result */
2176 NULL, /* pinfo */
2177 &sbuf); /* psbuf */
2178
2179 /* close fd from smb_mkstemp() */
2180 close(tmpfd);
2181
2182 if (!NT_STATUS_IS_OK(status)) {
2183 if (open_was_deferred(req->mid)) {
2184 /* We have re-scheduled this call. */
2185 END_PROFILE(SMBctemp);
2186 return;
2187 }
2188 reply_openerror(req, status);
2189 END_PROFILE(SMBctemp);
2190 return;
2191 }
2192
2193 reply_outbuf(req, 1, 0);
2194 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2195
2196 /* the returned filename is relative to the directory */
2197 s = strrchr_m(fsp->fsp_name, '/');
2198 if (!s) {
2199 s = fsp->fsp_name;
2200 } else {
2201 s++;
2202 }
2203
2204 #if 0
2205 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2206 thing in the byte section. JRA */
2207 SSVALS(p, 0, -1); /* what is this? not in spec */
2208 #endif
2209 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2210 == -1) {
2211 reply_nterror(req, NT_STATUS_NO_MEMORY);
2212 END_PROFILE(SMBctemp);
2213 return;
2214 }
2215
2216 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2217 SCVAL(req->outbuf, smb_flg,
2218 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2219 }
2220
2221 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2222 SCVAL(req->outbuf, smb_flg,
2223 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2224 }
2225
2226 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2227 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2228 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2229
2230 END_PROFILE(SMBctemp);
2231 return;
2232 }
2233
2234 /*******************************************************************
2235 Check if a user is allowed to rename a file.
2236 ********************************************************************/
2237
2238 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2239 uint16 dirtype, SMB_STRUCT_STAT *pst)
2240 {
2241 uint32 fmode;
2242
2243 if (!CAN_WRITE(conn)) {
2244 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2245 }
2246
2247 fmode = dos_mode(conn, fsp->fsp_name, pst);
2248 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2249 return NT_STATUS_NO_SUCH_FILE;
2250 }
2251
2252 if (S_ISDIR(pst->st_mode)) {
2253 if (fsp->posix_open) {
2254 return NT_STATUS_OK;
2255 }
2256
2257 /* If no pathnames are open below this
2258 directory, allow the rename. */
2259
2260 if (file_find_subpath(fsp)) {
2261 return NT_STATUS_ACCESS_DENIED;
2262 }
2263 return NT_STATUS_OK;
2264 }
2265
2266 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2267 return NT_STATUS_OK;
2268 }
2269
2270 return NT_STATUS_ACCESS_DENIED;
2271 }
2272
2273 /*******************************************************************
2274 * unlink a file with all relevant access checks
2275 *******************************************************************/
2276
2277 static NTSTATUS do_unlink(connection_struct *conn,
2278 struct smb_request *req,
2279 const char *fname,
2280 uint32 dirtype)
2281 {
2282 SMB_STRUCT_STAT sbuf;
2283 uint32 fattr;
2284 files_struct *fsp;
2285 uint32 dirtype_orig = dirtype;
2286 bool posix_paths = lp_posix_pathnames();
2287 int ret;
2288 NTSTATUS status;
2289
2290 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2291
2292 if (!CAN_WRITE(conn)) {
2293 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2294 }
2295
2296 if (posix_paths) {
2297 ret = SMB_VFS_LSTAT(conn,fname,&sbuf);
2298 } else {
2299 ret = SMB_VFS_STAT(conn,fname,&sbuf);
2300 }
2301 if (ret != 0) {
2302 return map_nt_error_from_unix(errno);
2303 }
2304
2305 fattr = dos_mode(conn,fname,&sbuf);
2306
2307 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2308 dirtype = aDIR|aARCH|aRONLY;
2309 }
2310
2311 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2312 if (!dirtype) {
2313 return NT_STATUS_NO_SUCH_FILE;
2314 }
2315
2316 if (!dir_check_ftype(conn, fattr, dirtype)) {
2317 if (fattr & aDIR) {
2318 return NT_STATUS_FILE_IS_A_DIRECTORY;
2319 }
2320 return NT_STATUS_NO_SUCH_FILE;
2321 }
2322
2323 if (dirtype_orig & 0x8000) {
2324 /* These will never be set for POSIX. */
2325 return NT_STATUS_NO_SUCH_FILE;
2326 }
2327
2328 #if 0
2329 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2330 return NT_STATUS_FILE_IS_A_DIRECTORY;
2331 }
2332
2333 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2334 return NT_STATUS_NO_SUCH_FILE;
2335 }
2336
2337 if (dirtype & 0xFF00) {
2338 /* These will never be set for POSIX. */
2339 return NT_STATUS_NO_SUCH_FILE;
2340 }
2341
2342 dirtype &= 0xFF;
2343 if (!dirtype) {
2344 return NT_STATUS_NO_SUCH_FILE;
2345 }
2346
2347 /* Can't delete a directory. */
2348 if (fattr & aDIR) {
2349 return NT_STATUS_FILE_IS_A_DIRECTORY;
2350 }
2351 #endif
2352
2353 #if 0 /* JRATEST */
2354 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2355 return NT_STATUS_OBJECT_NAME_INVALID;
2356 #endif /* JRATEST */
2357
2358 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2359
2360 On a Windows share, a file with read-only dosmode can be opened with
2361 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2362 fails with NT_STATUS_CANNOT_DELETE error.
2363
2364 This semantic causes a problem that a user can not
2365 rename a file with read-only dosmode on a Samba share
2366 from a Windows command prompt (i.e. cmd.exe, but can rename
2367 from Windows Explorer).
2368 */
2369
2370 if (!lp_delete_readonly(SNUM(conn))) {
2371 if (fattr & aRONLY) {
2372 return NT_STATUS_CANNOT_DELETE;
2373 }
2374 }
2375
2376 /* On open checks the open itself will check the share mode, so
2377 don't do it here as we'll get it wrong. */
2378
2379 status = SMB_VFS_CREATE_FILE
2380 (conn, /* conn */
2381 req, /* req */
2382 0, /* root_dir_fid */
2383 fname, /* fname */
2384 0, /* create_file_flags */
2385 DELETE_ACCESS, /* access_mask */
2386 FILE_SHARE_NONE, /* share_access */
2387 FILE_OPEN, /* create_disposition*/
2388 FILE_NON_DIRECTORY_FILE, /* create_options */
2389 /* file_attributes */
2390 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2391 FILE_ATTRIBUTE_NORMAL,
2392 0, /* oplock_request */
2393 0, /* allocation_size */
2394 NULL, /* sd */
2395 NULL, /* ea_list */
2396 &fsp, /* result */
2397 NULL, /* pinfo */
2398 &sbuf); /* psbuf */
2399
2400 if (!NT_STATUS_IS_OK(status)) {
2401 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2402 nt_errstr(status)));
2403 return status;
2404 }
2405
2406 /* The set is across all open files on this dev/inode pair. */
2407 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2408 close_file(req, fsp, NORMAL_CLOSE);
2409 return NT_STATUS_ACCESS_DENIED;
2410 }
2411
2412 return close_file(req, fsp, NORMAL_CLOSE);
2413 }
2414
2415 /****************************************************************************
2416 The guts of the unlink command, split out so it may be called by the NT SMB
2417 code.
2418 ****************************************************************************/
2419
2420 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2421 uint32 dirtype, const char *name_in, bool has_wild)
2422 {
2423 const char *directory = NULL;
2424 char *mask = NULL;
2425 char *name = NULL;
2426 char *p = NULL;
2427 int count=0;
2428 NTSTATUS status = NT_STATUS_OK;
2429 SMB_STRUCT_STAT sbuf, st;
2430 TALLOC_CTX *ctx = talloc_tos();
2431
2432 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2433 if (!NT_STATUS_IS_OK(status)) {
2434 return status;
2435 }
2436
2437 p = strrchr_m(name,'/');
2438 if (!p) {
2439 directory = talloc_strdup(ctx, ".");
2440 if (!directory) {
2441 return NT_STATUS_NO_MEMORY;
2442 }
2443 mask = name;
2444 } else {
2445 *p = 0;
2446 directory = name;
2447 mask = p+1;
2448 }
2449
2450 /*
2451 * We should only check the mangled cache
2452 * here if unix_convert failed. This means
2453 * that the path in 'mask' doesn't exist
2454 * on the file system and so we need to look
2455 * for a possible mangle. This patch from
2456 * Tine Smukavec <valentin.smukavec@hermes.si>.
2457 */
2458
2459 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2460 char *new_mask = NULL;
2461 mangle_lookup_name_from_8_3(ctx,
2462 mask,
2463 &new_mask,
2464 conn->params );
2465 if (new_mask) {
2466 mask = new_mask;
2467 }
2468 }
2469
2470 if (!has_wild) {
2471 directory = talloc_asprintf(ctx,
2472 "%s/%s",
2473 directory,
2474 mask);
2475 if (!directory) {
2476 return NT_STATUS_NO_MEMORY;
2477 }
2478 if (dirtype == 0) {
2479 dirtype = FILE_ATTRIBUTE_NORMAL;
2480 }
2481
2482 status = check_name(conn, directory);
2483 if (!NT_STATUS_IS_OK(status)) {
2484 return status;
2485 }
2486
2487 status = do_unlink(conn, req, directory, dirtype);
2488 if (!NT_STATUS_IS_OK(status)) {
2489 return status;
2490 }
2491
2492 count++;
2493 } else {
2494 struct smb_Dir *dir_hnd = NULL;
2495 long offset = 0;
2496 const char *dname;
2497
2498 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2499 return NT_STATUS_OBJECT_NAME_INVALID;
2500 }
2501
2502 if (strequal(mask,"????????.???")) {
2503 mask[0] = '*';
2504 mask[1] = '\0';
2505 }
2506
2507 status = check_name(conn, directory);
2508 if (!NT_STATUS_IS_OK(status)) {
2509 return status;
2510 }
2511
2512 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2513 dirtype);
2514 if (dir_hnd == NULL) {
2515 return map_nt_error_from_unix(errno);
2516 }
2517
2518 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2519 the pattern matches against the long name, otherwise the short name
2520 We don't implement this yet XXXX
2521 */
2522
2523 status = NT_STATUS_NO_SUCH_FILE;
2524
2525 while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
2526 char *fname = NULL;
2527
2528 if (!is_visible_file(conn, directory, dname, &st,
2529 true))
2530 {
2531 continue;
2532 }
2533
2534 /* Quick check for "." and ".." */
2535 if (ISDOT(dname) || ISDOTDOT(dname)) {
2536 continue;
2537 }
2538
2539 if(!mask_match(dname, mask, conn->case_sensitive)) {
2540 continue;
2541 }
2542
2543 fname = talloc_asprintf(ctx, "%s/%s",
2544 directory,
2545 dname);
2546 if (!fname) {
2547 return NT_STATUS_NO_MEMORY;
2548 }
2549
2550 status = check_name(conn, fname);
2551 if (!NT_STATUS_IS_OK(status)) {
2552 TALLOC_FREE(dir_hnd);
2553 return status;
2554 }
2555
2556 status = do_unlink(conn, req, fname, dirtype);
2557 if (!NT_STATUS_IS_OK(status)) {
2558 TALLOC_FREE(fname);
2559 continue;
2560 }
2561
2562 count++;
2563 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2564 fname));
2565
2566 TALLOC_FREE(fname);
2567 }
2568 TALLOC_FREE(dir_hnd);
2569 }
2570
2571 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2572 status = map_nt_error_from_unix(errno);
2573 }
2574
2575 return status;
2576 }
2577
2578 /****************************************************************************
2579 Reply to a unlink
2580 ****************************************************************************/
2581
2582 void reply_unlink(struct smb_request *req)
2583 {
2584 connection_struct *conn = req->conn;
2585 char *name = NULL;
2586 uint32 dirtype;
2587 NTSTATUS status;
2588 bool path_contains_wcard = False;
2589 TALLOC_CTX *ctx = talloc_tos();
2590
2591 START_PROFILE(SMBunlink);
2592
2593 if (req->wct < 1) {
2594 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2595 END_PROFILE(SMBunlink);
2596 return;
2597 }
2598
2599 dirtype = SVAL(req->vwv+0, 0);
2600
2601 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2602 STR_TERMINATE, &status,
2603 &path_contains_wcard);
2604 if (!NT_STATUS_IS_OK(status)) {
2605 reply_nterror(req, status);
2606 END_PROFILE(SMBunlink);
2607 return;
2608 }
2609
2610 status = resolve_dfspath_wcard(ctx, conn,
2611 req->flags2 & FLAGS2_DFS_PATHNAMES,
2612 name,
2613 &name,
2614 &path_contains_wcard);
2615 if (!NT_STATUS_IS_OK(status)) {
2616 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2617 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2618 ERRSRV, ERRbadpath);
2619 END_PROFILE(SMBunlink);
2620 return;
2621 }
2622 reply_nterror(req, status);
2623 END_PROFILE(SMBunlink);
2624 return;
2625 }
2626
2627 DEBUG(3,("reply_unlink : %s\n",name));
2628
2629 status = unlink_internals(conn, req, dirtype, name,
2630 path_contains_wcard);
2631 if (!NT_STATUS_IS_OK(status)) {
2632 if (open_was_deferred(req->mid)) {
2633 /* We have re-scheduled this call. */
2634 END_PROFILE(SMBunlink);
2635 return;
2636 }
2637 reply_nterror(req, status);
2638 END_PROFILE(SMBunlink);
2639 return;
2640 }
2641
2642 reply_outbuf(req, 0, 0);
2643 END_PROFILE(SMBunlink);
2644
2645 return;
2646 }
2647
2648 /****************************************************************************
2649 Fail for readbraw.
2650 ****************************************************************************/
2651
2652 static void fail_readraw(void)
2653 {
2654 const char *errstr = talloc_asprintf(talloc_tos(),
2655 "FAIL ! reply_readbraw: socket write fail (%s)",
2656 strerror(errno));
2657 if (!errstr) {
2658 errstr = "";
2659 }
2660 exit_server_cleanly(errstr);
2661 }
2662
2663 /****************************************************************************
2664 Fake (read/write) sendfile. Returns -1 on read or write fail.
2665 ****************************************************************************/
2666
2667 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2668 size_t nread)
2669 {
2670 size_t bufsize;
2671 size_t tosend = nread;
2672 char *buf;
2673
2674 if (nread == 0) {
2675 return 0;
2676 }
2677
2678 bufsize = MIN(nread, 65536);
2679
2680 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2681 return -1;
2682 }
2683
2684 while (tosend > 0) {
2685 ssize_t ret;
2686 size_t cur_read;
2687
2688 if (tosend > bufsize) {
2689 cur_read = bufsize;
2690 } else {
2691 cur_read = tosend;
2692 }
2693 ret = read_file(fsp,buf,startpos,cur_read);
2694 if (ret == -1) {
2695 SAFE_FREE(buf);
2696 return -1;
2697 }
2698
2699 /* If we had a short read, fill with zeros. */
2700 if (ret < cur_read) {
2701 memset(buf + ret, '\0', cur_read - ret);
2702 }
2703
2704 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2705 SAFE_FREE(buf);
2706 return -1;
2707 }
2708 tosend -= cur_read;
2709 startpos += cur_read;
2710 }
2711
2712 SAFE_FREE(buf);
2713 return (ssize_t)nread;
2714 }
2715
2716 #if defined(WITH_SENDFILE)
2717 /****************************************************************************
2718 Deal with the case of sendfile reading less bytes from the file than
2719 requested. Fill with zeros (all we can do).
2720 ****************************************************************************/
2721
2722 static void sendfile_short_send(files_struct *fsp,
2723 ssize_t nread,
2724 size_t headersize,
2725 size_t smb_maxcnt)
2726 {
2727 #define SHORT_SEND_BUFSIZE 1024
2728 if (nread < headersize) {
2729 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2730 "header for file %s (%s). Terminating\n",
2731 fsp->fsp_name, strerror(errno) ));
2732 exit_server_cleanly("sendfile_short_send failed");
2733 }
2734
2735 nread -= headersize;
2736
2737 if (nread < smb_maxcnt) {
2738 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2739 if (!buf) {
2740 exit_server_cleanly("sendfile_short_send: "
2741 "malloc failed");
2742 }
2743
2744 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2745 "with zeros !\n", fsp->fsp_name));
2746
2747 while (nread < smb_maxcnt) {
2748 /*
2749 * We asked for the real file size and told sendfile
2750 * to not go beyond the end of the file. But it can
2751 * happen that in between our fstat call and the
2752 * sendfile call the file was truncated. This is very
2753 * bad because we have already announced the larger
2754 * number of bytes to the client.
2755 *
2756 * The best we can do now is to send 0-bytes, just as
2757 * a read from a hole in a sparse file would do.
2758 *
2759 * This should happen rarely enough that I don't care
2760 * about efficiency here :-)
2761 */
2762 size_t to_write;
2763
2764 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2765 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2766 exit_server_cleanly("sendfile_short_send: "
2767 "write_data failed");
2768 }
2769 nread += to_write;
2770 }
2771 SAFE_FREE(buf);
2772 }
2773 }
2774 #endif /* defined WITH_SENDFILE */
2775
2776 /****************************************************************************
2777 Return a readbraw error (4 bytes of zero).
2778 ****************************************************************************/
2779
2780 static void reply_readbraw_error(void)
2781 {
2782 char header[4];
2783 SIVAL(header,0,0);
2784 if (write_data(smbd_server_fd(),header,4) != 4) {
2785 fail_readraw();
2786 }
2787 }
2788
2789 /****************************************************************************
2790 Use sendfile in readbraw.
2791 ****************************************************************************/
2792
2793 static void send_file_readbraw(connection_struct *conn,
2794 struct smb_request *req,
2795 files_struct *fsp,
2796 SMB_OFF_T startpos,
2797 size_t nread,
2798 ssize_t mincount)
2799 {
2800 char *outbuf = NULL;
2801 ssize_t ret=0;
2802
2803 #if defined(WITH_SENDFILE)
2804 /*
2805 * We can only use sendfile on a non-chained packet
2806 * but we can use on a non-oplocked file. tridge proved this
2807 * on a train in Germany :-). JRA.
2808 * reply_readbraw has already checked the length.
2809 */
2810
2811 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2812 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2813 ssize_t sendfile_read = -1;
2814 char header[4];
2815 DATA_BLOB header_blob;
2816
2817 _smb_setlen(header,nread);
2818 header_blob = data_blob_const(header, 4);
2819
2820 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2821 &header_blob, startpos, nread)) == -1) {
2822 /* Returning ENOSYS means no data at all was sent.
2823 * Do this as a normal read. */
2824 if (errno == ENOSYS) {
2825 goto normal_readbraw;
2826 }
2827
2828 /*
2829 * Special hack for broken Linux with no working sendfile. If we
2830 * return EINTR we sent the header but not the rest of the data.
2831 * Fake this up by doing read/write calls.
2832 */
2833 if (errno == EINTR) {
2834 /* Ensure we don't do this again. */
2835 set_use_sendfile(SNUM(conn), False);
2836 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2837
2838 if (fake_sendfile(fsp, startpos, nread) == -1) {
2839 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2840 fsp->fsp_name, strerror(errno) ));
2841 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2842 }
2843 return;
2844 }
2845
2846 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2847 fsp->fsp_name, strerror(errno) ));
2848 exit_server_cleanly("send_file_readbraw sendfile failed");
2849 } else if (sendfile_read == 0) {
2850 /*
2851 * Some sendfile implementations return 0 to indicate
2852 * that there was a short read, but nothing was
2853 * actually written to the socket. In this case,
2854 * fallback to the normal read path so the header gets
2855 * the correct byte count.
2856 */
2857 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2858 "bytes falling back to the normal read: "
2859 "%s\n", fsp->fsp_name));
2860 goto normal_readbraw;
2861 }
2862
2863 /* Deal with possible short send. */
2864 if (sendfile_read != 4+nread) {
2865 sendfile_short_send(fsp, sendfile_read, 4, nread);
2866 }
2867 return;
2868 }
2869
2870 normal_readbraw:
2871 #endif
2872
2873 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2874 if (!outbuf) {
2875 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2876 (unsigned)(nread+4)));
2877 reply_readbraw_error();
2878 return;
2879 }
2880
2881 if (nread > 0) {
2882 ret = read_file(fsp,outbuf+4,startpos,nread);
2883 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2884 if (ret < mincount)
2885 ret = 0;
2886 #else
2887 if (ret < nread)
2888 ret = 0;
2889 #endif
2890 }
2891
2892 _smb_setlen(outbuf,ret);
2893 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2894 fail_readraw();
2895
2896 TALLOC_FREE(outbuf);
2897 }
2898
2899 /****************************************************************************
2900 Reply to a readbraw (core+ protocol).
2901 ****************************************************************************/
2902
2903 void reply_readbraw(struct smb_request *req)
2904 {
2905 connection_struct *conn = req->conn;
2906 ssize_t maxcount,mincount;
2907 size_t nread = 0;
2908 SMB_OFF_T startpos;
2909 files_struct *fsp;
2910 struct lock_struct lock;
2911 SMB_STRUCT_STAT st;
2912 SMB_OFF_T size = 0;
2913
2914 START_PROFILE(SMBreadbraw);
2915
2916 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2917 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2918 "raw reads/writes are disallowed.");
2919 }
2920
2921 if (req->wct < 8) {
2922 reply_readbraw_error();
2923 END_PROFILE(SMBreadbraw);
2924 return;
2925 }
2926
2927 /*
2928 * Special check if an oplock break has been issued
2929 * and the readraw request croses on the wire, we must
2930 * return a zero length response here.
2931 */
2932
2933 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
2934
2935 /*
2936 * We have to do a check_fsp by hand here, as
2937 * we must always return 4 zero bytes on error,
2938 * not a NTSTATUS.
2939 */
2940
2941 if (!fsp || !conn || conn != fsp->conn ||
2942 req->vuid != fsp->vuid ||
2943 fsp->is_directory || fsp->fh->fd == -1) {
2944 /*
2945 * fsp could be NULL here so use the value from the packet. JRA.
2946 */
2947 DEBUG(3,("reply_readbraw: fnum %d not valid "
2948 "- cache prime?\n",
2949 (int)SVAL(req->vwv+0, 0)));
2950 reply_readbraw_error();
2951 END_PROFILE(SMBreadbraw);
2952 return;
2953 }
2954
2955 /* Do a "by hand" version of CHECK_READ. */
2956 if (!(fsp->can_read ||
2957 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2958 (fsp->access_mask & FILE_EXECUTE)))) {
2959 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2960 (int)SVAL(req->vwv+0, 0)));
2961 reply_readbraw_error();
2962 END_PROFILE(SMBreadbraw);
2963 return;
2964 }
2965
2966 flush_write_cache(fsp, READRAW_FLUSH);
2967
2968 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
2969 if(req->wct == 10) {
2970 /*
2971 * This is a large offset (64 bit) read.
2972 */
2973 #ifdef LARGE_SMB_OFF_T
2974
2975 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
2976
2977 #else /* !LARGE_SMB_OFF_T */
2978
2979 /*
2980 * Ensure we haven't been sent a >32 bit offset.
2981 */
2982
2983 if(IVAL(req->vwv+8, 0) != 0) {
2984 DEBUG(0,("reply_readbraw: large offset "
2985 "(%x << 32) used and we don't support "
2986 "64 bit offsets.\n",
2987 (unsigned int)IVAL(req->vwv+8, 0) ));
2988 reply_readbraw_error();
2989 END_PROFILE(SMBreadbraw);
2990 return;
2991 }
2992
2993 #endif /* LARGE_SMB_OFF_T */
2994
2995 if(startpos < 0) {
2996 DEBUG(0,("reply_readbraw: negative 64 bit "
2997 "readraw offset (%.0f) !\n",
2998 (double)startpos ));
2999 reply_readbraw_error();
3000 END_PROFILE(SMBreadbraw);
3001 return;
3002 }
3003 }
3004
3005 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3006 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3007
3008 /* ensure we don't overrun the packet size */
3009 maxcount = MIN(65535,maxcount);
3010
3011 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3012 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3013 &lock);
3014
3015 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3016 reply_readbraw_error();
3017 END_PROFILE(SMBreadbraw);
3018 return;
3019 }
3020
3021 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3022 size = st.st_size;
3023 }
3024
3025 if (startpos >= size) {
3026 nread = 0;
3027 } else {
3028 nread = MIN(maxcount,(size - startpos));
3029 }
3030
3031 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3032 if (nread < mincount)
3033 nread = 0;
3034 #endif
3035
3036 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3037 "min=%lu nread=%lu\n",
3038 fsp->fnum, (double)startpos,
3039 (unsigned long)maxcount,
3040 (unsigned long)mincount,
3041 (unsigned long)nread ) );
3042
3043 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3044
3045 DEBUG(5,("reply_readbraw finished\n"));
3046
3047 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3048
3049 END_PROFILE(SMBreadbraw);
3050 return;
3051 }
3052
3053 #undef DBGC_CLASS
3054 #define DBGC_CLASS DBGC_LOCKING
3055
3056 /****************************************************************************
3057 Reply to a lockread (core+ protocol).
3058 ****************************************************************************/
3059
3060 void reply_lockread(struct smb_request *req)
3061 {
3062 connection_struct *conn = req->conn;
3063 ssize_t nread = -1;
3064 char *data;
3065 SMB_OFF_T startpos;
3066 size_t numtoread;
3067 NTSTATUS status;
3068 files_struct *fsp;
3069 struct byte_range_lock *br_lck = NULL;
3070 char *p = NULL;
3071
3072 START_PROFILE(SMBlockread);
3073
3074 if (req->wct < 5) {
3075 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3076 END_PROFILE(SMBlockread);
3077 return;
3078 }
3079
3080 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3081
3082 if (!check_fsp(conn, req, fsp)) {
3083 END_PROFILE(SMBlockread);
3084 return;
3085 }
3086
3087 if (!CHECK_READ(fsp,req)) {
3088 reply_doserror(req, ERRDOS, ERRbadaccess);
3089 END_PROFILE(SMBlockread);
3090 return;
3091 }
3092
3093 numtoread = SVAL(req->vwv+1, 0);
3094 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3095
3096 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3097
3098 reply_outbuf(req, 5, numtoread + 3);
3099
3100 data = smb_buf(req->outbuf) + 3;
3101
3102 /*
3103 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3104 * protocol request that predates the read/write lock concept.
3105 * Thus instead of asking for a read lock here we need to ask
3106 * for a write lock. JRA.
3107 * Note that the requested lock size is unaffected by max_recv.
3108 */
3109
3110 br_lck = do_lock(smbd_messaging_context(),
3111 fsp,
3112 req->smbpid,
3113 (uint64_t)numtoread,
3114 (uint64_t)startpos,
3115 WRITE_LOCK,
3116 WINDOWS_LOCK,
3117 False, /* Non-blocking lock. */
3118 &status,
3119 NULL,
3120 NULL);
3121 TALLOC_FREE(br_lck);
3122
3123 if (NT_STATUS_V(status)) {
3124 reply_nterror(req, status);
3125 END_PROFILE(SMBlockread);
3126 return;
3127 }
3128
3129 /*
3130 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3131 */
3132
3133 if (numtoread > max_recv) {
3134 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3135 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3136 (unsigned int)numtoread, (unsigned int)max_recv ));
3137 numtoread = MIN(numtoread,max_recv);
3138 }
3139 nread = read_file(fsp,data,startpos,numtoread);
3140
3141 if (nread < 0) {
3142 reply_unixerror(req, ERRDOS, ERRnoaccess);
3143 END_PROFILE(SMBlockread);
3144 return;
3145 }
3146
3147 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3148
3149 SSVAL(req->outbuf,smb_vwv0,nread);
3150 SSVAL(req->outbuf,smb_vwv5,nread+3);
3151 p = smb_buf(req->outbuf);
3152 SCVAL(p,0,0); /* pad byte. */
3153 SSVAL(p,1,nread);
3154
3155 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3156 fsp->fnum, (int)numtoread, (int)nread));
3157
3158 END_PROFILE(SMBlockread);
3159 return;
3160 }
3161
3162 #undef DBGC_CLASS
3163 #define DBGC_CLASS DBGC_ALL
3164
3165 /****************************************************************************
3166 Reply to a read.
3167 ****************************************************************************/
3168
3169 void reply_read(struct smb_request *req)
3170 {
3171 connection_struct *conn = req->conn;
3172 size_t numtoread;
3173 ssize_t nread = 0;
3174 char *data;
3175 SMB_OFF_T startpos;
3176 int outsize = 0;
3177 files_struct *fsp;
3178 struct lock_struct lock;
3179
3180 START_PROFILE(SMBread);
3181
3182 if (req->wct < 3) {
3183 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3184 END_PROFILE(SMBread);
3185 return;
3186 }
3187
3188 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3189
3190 if (!check_fsp(conn, req, fsp)) {
3191 END_PROFILE(SMBread);
3192 return;
3193 }
3194
3195 if (!CHECK_READ(fsp,req)) {
3196 reply_doserror(req, ERRDOS, ERRbadaccess);
3197 END_PROFILE(SMBread);
3198 return;
3199 }
3200
3201 numtoread = SVAL(req->vwv+1, 0);
3202 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3203
3204 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3205
3206 /*
3207 * The requested read size cannot be greater than max_recv. JRA.
3208 */
3209 if (numtoread > max_recv) {
3210 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3211 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3212 (unsigned int)numtoread, (unsigned int)max_recv ));
3213 numtoread = MIN(numtoread,max_recv);
3214 }
3215
3216 reply_outbuf(req, 5, numtoread+3);
3217
3218 data = smb_buf(req->outbuf) + 3;
3219
3220 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3221 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3222 &lock);
3223
3224 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3225 reply_doserror(req, ERRDOS,ERRlock);
3226 END_PROFILE(SMBread);
3227 return;
3228 }
3229
3230 if (numtoread > 0)
3231 nread = read_file(fsp,data,startpos,numtoread);
3232
3233 if (nread < 0) {
3234 reply_unixerror(req, ERRDOS,ERRnoaccess);
3235 goto strict_unlock;
3236 }
3237
3238 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3239
3240 SSVAL(req->outbuf,smb_vwv0,nread);
3241 SSVAL(req->outbuf,smb_vwv5,nread+3);
3242 SCVAL(smb_buf(req->outbuf),0,1);
3243 SSVAL(smb_buf(req->outbuf),1,nread);
3244
3245 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3246 fsp->fnum, (int)numtoread, (int)nread ) );
3247
3248 strict_unlock:
3249 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3250
3251 END_PROFILE(SMBread);
3252 return;
3253 }
3254
3255 /****************************************************************************
3256 Setup readX header.
3257 ****************************************************************************/
3258
3259 static int setup_readX_header(struct smb_request *req, char *outbuf,
3260 size_t smb_maxcnt)
3261 {
3262 int outsize;
3263 char *data;
3264
3265 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3266 data = smb_buf(outbuf);
3267
3268 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3269
3270 SCVAL(outbuf,smb_vwv0,0xFF);
3271 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3272 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3273 SSVAL(outbuf,smb_vwv6,
3274 req_wct_ofs(req)
3275 + 1 /* the wct field */
3276 + 12 * sizeof(uint16_t) /* vwv */
3277 + 2); /* the buflen field */
3278 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3279 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3280 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3281 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3282 return outsize;
3283 }
3284
3285 /****************************************************************************
3286 Reply to a read and X - possibly using sendfile.
3287 ****************************************************************************/
3288
3289 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3290 files_struct *fsp, SMB_OFF_T startpos,
3291 size_t smb_maxcnt)
3292 {
3293 SMB_STRUCT_STAT sbuf;
3294 ssize_t nread = -1;
3295 struct lock_struct lock;
3296
3297 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3298 reply_unixerror(req, ERRDOS, ERRnoaccess);
3299 return;
3300 }
3301
3302 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3303 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3304 &lock);
3305
3306 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3307 reply_doserror(req, ERRDOS, ERRlock);
3308 return;
3309 }
3310
3311 if (!S_ISREG(sbuf.st_mode) || (startpos > sbuf.st_size)
3312 || (smb_maxcnt > (sbuf.st_size - startpos))) {
3313 /*
3314 * We already know that we would do a short read, so don't
3315 * try the sendfile() path.
3316 */
3317 goto nosendfile_read;
3318 }
3319
3320 #if defined(WITH_SENDFILE)
3321 /*
3322 * We can only use sendfile on a non-chained packet
3323 * but we can use on a non-oplocked file. tridge proved this
3324 * on a train in Germany :-). JRA.
3325 */
3326
3327 if (!req_is_in_chain(req) &&
3328 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3329 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3330 uint8 headerbuf[smb_size + 12 * 2];
3331 DATA_BLOB header;
3332
3333 /*
3334 * Set up the packet header before send. We
3335 * assume here the sendfile will work (get the
3336 * correct amount of data).
3337 */
3338
3339 header = data_blob_const(headerbuf, sizeof(headerbuf));
3340
3341 construct_reply_common_req(req, (char *)headerbuf);
3342 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3343
3344 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3345 /* Returning ENOSYS means no data at all was sent.
3346 Do this as a normal read. */
3347 if (errno == ENOSYS) {
3348 goto normal_read;
3349 }
3350
3351 /*
3352 * Special hack for broken Linux with no working sendfile. If we
3353 * return EINTR we sent the header but not the rest of the data.
3354 * Fake this up by doing read/write calls.
3355 */
3356
3357 if (errno == EINTR) {
3358 /* Ensure we don't do this again. */
3359 set_use_sendfile(SNUM(conn), False);
3360 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3361 nread = fake_sendfile(fsp, startpos,
3362 smb_maxcnt);
3363 if (nread == -1) {
3364 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3365 fsp->fsp_name, strerror(errno) ));
3366 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3367 }
3368 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3369 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3370 /* No outbuf here means successful sendfile. */
3371 goto strict_unlock;
3372 }
3373
3374 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3375 fsp->fsp_name, strerror(errno) ));
3376 exit_server_cleanly("send_file_readX sendfile failed");
3377 } else if (nread == 0) {
3378 /*
3379 * Some sendfile implementations return 0 to indicate
3380 * that there was a short read, but nothing was
3381 * actually written to the socket. In this case,
3382 * fallback to the normal read path so the header gets
3383 * the correct byte count.
3384 */
3385 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3386 "falling back to the normal read: %s\n",
3387 fsp->fsp_name));
3388 goto normal_read;
3389 }
3390
3391 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3392 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3393
3394 /* Deal with possible short send. */
3395 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3396 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3397 }
3398 /* No outbuf here means successful sendfile. */
3399 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3400 SMB_PERFCOUNT_END(&req->pcd);
3401 goto strict_unlock;
3402 }
3403
3404 normal_read:
3405
3406 #endif
3407
3408 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3409 uint8 headerbuf[smb_size + 2*12];
3410
3411 construct_reply_common_req(req, (char *)headerbuf);
3412 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3413
3414 /* Send out the header. */
3415 if (write_data(smbd_server_fd(), (char *)headerbuf,
3416 sizeof(headerbuf)) != sizeof(headerbuf)) {
3417 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3418 fsp->fsp_name, strerror(errno) ));
3419 exit_server_cleanly("send_file_readX sendfile failed");
3420 }
3421 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3422 if (nread == -1) {
3423 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3424 fsp->fsp_name, strerror(errno) ));
3425 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3426 }
3427 goto strict_unlock;
3428 }
3429
3430 nosendfile_read:
3431
3432 reply_outbuf(req, 12, smb_maxcnt);
3433
3434 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3435
3436 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3437
3438 if (nread < 0) {
3439 reply_unixerror(req, ERRDOS, ERRnoaccess);
3440 return;
3441 }
3442
3443 setup_readX_header(req, (char *)req->outbuf, nread);
3444
3445 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3446 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3447
3448 chain_reply(req);
3449 return;
3450
3451 strict_unlock:
3452 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3453 TALLOC_FREE(req->outbuf);
3454 return;
3455 }
3456
3457 /****************************************************************************
3458 Reply to a read and X.
3459 ****************************************************************************/
3460
3461 void reply_read_and_X(struct smb_request *req)
3462 {
3463 connection_struct *conn = req->conn;
3464 files_struct *fsp;
3465 SMB_OFF_T startpos;
3466 size_t smb_maxcnt;
3467 bool big_readX = False;
3468 #if 0
3469 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3470 #endif
3471
3472 START_PROFILE(SMBreadX);
3473
3474 if ((req->wct != 10) && (req->wct != 12)) {
3475 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3476 return;
3477 }
3478
3479 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3480 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3481 smb_maxcnt = SVAL(req->vwv+5, 0);
3482
3483 /* If it's an IPC, pass off the pipe handler. */
3484 if (IS_IPC(conn)) {
3485 reply_pipe_read_and_X(req);
3486 END_PROFILE(SMBreadX);
3487 return;
3488 }
3489
3490 if (!check_fsp(conn, req, fsp)) {
3491 END_PROFILE(SMBreadX);
3492 return;
3493 }
3494
3495 if (!CHECK_READ(fsp,req)) {
3496 reply_doserror(req, ERRDOS,ERRbadaccess);
3497 END_PROFILE(SMBreadX);
3498 return;
3499 }
3500
3501 if (global_client_caps & CAP_LARGE_READX) {
3502 size_t upper_size = SVAL(req->vwv+7, 0);
3503 smb_maxcnt |= (upper_size<<16);
3504 if (upper_size > 1) {
3505 /* Can't do this on a chained packet. */
3506 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3507 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3508 END_PROFILE(SMBreadX);
3509 return;
3510 }
3511 /* We currently don't do this on signed or sealed data. */
3512 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3513 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3514 END_PROFILE(SMBreadX);
3515 return;
3516 }
3517 /* Is there room in the reply for this data ? */
3518 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3519 reply_nterror(req,
3520 NT_STATUS_INVALID_PARAMETER);
3521 END_PROFILE(SMBreadX);
3522 return;
3523 }
3524 big_readX = True;
3525 }
3526 }
3527
3528 if (req->wct == 12) {
3529 #ifdef LARGE_SMB_OFF_T
3530 /*
3531 * This is a large offset (64 bit) read.
3532 */
3533 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3534
3535 #else /* !LARGE_SMB_OFF_T */
3536
3537 /*
3538 * Ensure we haven't been sent a >32 bit offset.
3539 */
3540
3541 if(IVAL(req->vwv+10, 0) != 0) {
3542 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3543 "used and we don't support 64 bit offsets.\n",
3544 (unsigned int)IVAL(req->vwv+10, 0) ));
3545 END_PROFILE(SMBreadX);
3546 reply_doserror(req, ERRDOS, ERRbadaccess);
3547 return;
3548 }
3549
3550 #endif /* LARGE_SMB_OFF_T */
3551
3552 }
3553
3554 if (!big_readX &&
3555 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3556 goto out;
3557 }
3558
3559 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3560
3561 out:
3562 END_PROFILE(SMBreadX);
3563 return;
3564 }
3565
3566 /****************************************************************************
3567 Error replies to writebraw must have smb_wct == 1. Fix this up.
3568 ****************************************************************************/
3569
3570 void error_to_writebrawerr(struct smb_request *req)
3571 {
3572 uint8 *old_outbuf = req->outbuf;
3573
3574 reply_outbuf(req, 1, 0);
3575
3576 memcpy(req->outbuf, old_outbuf, smb_size);
3577 TALLOC_FREE(old_outbuf);
3578 }
3579
3580 /****************************************************************************
3581 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3582 ****************************************************************************/
3583
3584 void reply_writebraw(struct smb_request *req)
3585 {
3586 connection_struct *conn = req->conn;
3587 char *buf = NULL;
3588 ssize_t nwritten=0;
3589 ssize_t total_written=0;
3590 size_t numtowrite=0;
3591 size_t tcount;
3592 SMB_OFF_T startpos;
3593 char *data=NULL;
3594 bool write_through;
3595 files_struct *fsp;
3596 struct lock_struct lock;
3597 NTSTATUS status;
3598
3599 START_PROFILE(SMBwritebraw);
3600
3601 /*
3602 * If we ever reply with an error, it must have the SMB command
3603 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3604 * we're finished.
3605 */
3606 SCVAL(req->inbuf,smb_com,SMBwritec);
3607
3608 if (srv_is_signing_active()) {
3609 END_PROFILE(SMBwritebraw);
3610 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3611 "raw reads/writes are disallowed.");
3612 }
3613
3614 if (req->wct < 12) {
3615 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3616 error_to_writebrawerr(req);
3617 END_PROFILE(SMBwritebraw);
3618 return;
3619 }
3620
3621 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3622 if (!check_fsp(conn, req, fsp)) {
3623 error_to_writebrawerr(req);
3624 END_PROFILE(SMBwritebraw);
3625 return;
3626 }
3627
3628 if (!CHECK_WRITE(fsp)) {
3629 reply_doserror(req, ERRDOS, ERRbadaccess);
3630 error_to_writebrawerr(req);
3631 END_PROFILE(SMBwritebraw);
3632 return;
3633 }
3634
3635 tcount = IVAL(req->vwv+1, 0);
3636 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3637 write_through = BITSETW(req->vwv+7,0);
3638
3639 /* We have to deal with slightly different formats depending
3640 on whether we are using the core+ or lanman1.0 protocol */
3641
3642 if(Protocol <= PROTOCOL_COREPLUS) {
3643 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3644 data = smb_buf(req->inbuf);
3645 } else {
3646 numtowrite = SVAL(req->vwv+10, 0);
3647 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3648 }
3649
3650 /* Ensure we don't write bytes past the end of this packet. */
3651 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3652 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3653 error_to_writebrawerr(req);
3654 END_PROFILE(SMBwritebraw);
3655 return;
3656 }
3657
3658 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3659 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3660 &lock);
3661
3662 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3663 reply_doserror(req, ERRDOS, ERRlock);
3664 error_to_writebrawerr(req);
3665 END_PROFILE(SMBwritebraw);
3666 return;
3667 }
3668
3669 if (numtowrite>0) {
3670 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3671 }
3672
3673 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3674 "wrote=%d sync=%d\n",
3675 fsp->fnum, (double)startpos, (int)numtowrite,
3676 (int)nwritten, (int)write_through));
3677
3678 if (nwritten < (ssize_t)numtowrite) {
3679 reply_unixerror(req, ERRHRD, ERRdiskfull);
3680 error_to_writebrawerr(req);
3681 goto strict_unlock;
3682 }
3683
3684 total_written = nwritten;
3685
3686 /* Allocate a buffer of 64k + length. */
3687 buf = TALLOC_ARRAY(NULL, char, 65540);
3688 if (!buf) {
3689 reply_doserror(req, ERRDOS, ERRnomem);
3690 error_to_writebrawerr(req);
3691 goto strict_unlock;
3692 }
3693
3694 /* Return a SMBwritebraw message to the redirector to tell
3695 * it to send more bytes */
3696
3697 memcpy(buf, req->inbuf, smb_size);
3698 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3699 SCVAL(buf,smb_com,SMBwritebraw);
3700 SSVALS(buf,smb_vwv0,0xFFFF);
3701 show_msg(buf);
3702 if (!srv_send_smb(smbd_server_fd(),
3703 buf,
3704 IS_CONN_ENCRYPTED(conn),
3705 &req->pcd)) {
3706 exit_server_cleanly("reply_writebraw: srv_send_smb "
3707 "failed.");
3708 }
3709
3710 /* Now read the raw data into the buffer and write it */
3711 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3712 &numtowrite);
3713 if (!NT_STATUS_IS_OK(status)) {
3714 exit_server_cleanly("secondary writebraw failed");
3715 }
3716
3717 /* Set up outbuf to return the correct size */
3718 reply_outbuf(req, 1, 0);
3719
3720 if (numtowrite != 0) {
3721
3722 if (numtowrite > 0xFFFF) {
3723 DEBUG(0,("reply_writebraw: Oversize secondary write "
3724 "raw requested (%u). Terminating\n",
3725 (unsigned int)numtowrite ));
3726 exit_server_cleanly("secondary writebraw failed");
3727 }
3728
3729 if (tcount > nwritten+numtowrite) {
3730 DEBUG(3,("reply_writebraw: Client overestimated the "
3731 "write %d %d %d\n",
3732 (int)tcount,(int)nwritten,(int)numtowrite));
3733 }
3734
3735 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3736
3737 if (!NT_STATUS_IS_OK(status)) {
3738 DEBUG(0,("reply_writebraw: Oversize secondary write "
3739 "raw read failed (%s). Terminating\n",
3740 nt_errstr(status)));
3741 exit_server_cleanly("secondary writebraw failed");
3742 }
3743
3744 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3745 if (nwritten == -1) {
3746 TALLOC_FREE(buf);
3747 reply_unixerror(req, ERRHRD, ERRdiskfull);
3748 error_to_writebrawerr(req);
3749 goto strict_unlock;
3750 }
3751
3752 if (nwritten < (ssize_t)numtowrite) {
3753 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3754 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3755 }
3756
3757 if (nwritten > 0) {
3758 total_written += nwritten;
3759 }
3760 }
3761
3762 TALLOC_FREE(buf);
3763 SSVAL(req->outbuf,smb_vwv0,total_written);
3764
3765 status = sync_file(conn, fsp, write_through);
3766 if (!NT_STATUS_IS_OK(status)) {
3767 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3768 fsp->fsp_name, nt_errstr(status) ));
3769 reply_nterror(req, status);
3770 error_to_writebrawerr(req);
3771 goto strict_unlock;
3772 }
3773
3774 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3775 "wrote=%d\n",
3776 fsp->fnum, (double)startpos, (int)numtowrite,
3777 (int)total_written));
3778
3779 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3780
3781 /* We won't return a status if write through is not selected - this
3782 * follows what WfWg does */
3783 END_PROFILE(SMBwritebraw);
3784
3785 if (!write_through && total_written==tcount) {
3786
3787 #if RABBIT_PELLET_FIX
3788 /*
3789 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3790 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3791 * JRA.
3792 */
3793 if (!send_keepalive(smbd_server_fd())) {
3794 exit_server_cleanly("reply_writebraw: send of "
3795 "keepalive failed");
3796 }
3797 #endif
3798 TALLOC_FREE(req->outbuf);
3799 }
3800 return;
3801
3802 strict_unlock:
3803 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3804
3805 END_PROFILE(SMBwritebraw);
3806 return;
3807 }
3808
3809 #undef DBGC_CLASS
3810 #define DBGC_CLASS DBGC_LOCKING
3811
3812 /****************************************************************************
3813 Reply to a writeunlock (core+).
3814 ****************************************************************************/
3815
3816 void reply_writeunlock(struct smb_request *req)
3817 {
3818 connection_struct *conn = req->conn;
3819 ssize_t nwritten = -1;
3820 size_t numtowrite;
3821 SMB_OFF_T startpos;
3822 const char *data;
3823 NTSTATUS status = NT_STATUS_OK;
3824 files_struct *fsp;
3825 struct lock_struct lock;
3826
3827 START_PROFILE(SMBwriteunlock);
3828
3829 if (req->wct < 5) {
3830 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3831 END_PROFILE(SMBwriteunlock);
3832 return;
3833 }
3834
3835 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3836
3837 if (!check_fsp(conn, req, fsp)) {
3838 END_PROFILE(SMBwriteunlock);
3839 return;
3840 }
3841
3842 if (!CHECK_WRITE(fsp)) {
3843 reply_doserror(req, ERRDOS,ERRbadaccess);
3844 END_PROFILE(SMBwriteunlock);
3845 return;
3846 }
3847
3848 numtowrite = SVAL(req->vwv+1, 0);
3849 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3850 data = (const char *)req->buf + 3;
3851
3852 if (numtowrite) {
3853 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3854 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3855 &lock);
3856
3857 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3858 reply_doserror(req, ERRDOS, ERRlock);
3859 END_PROFILE(SMBwriteunlock);
3860 return;
3861 }
3862 }
3863
3864 /* The special X/Open SMB protocol handling of
3865 zero length writes is *NOT* done for
3866 this call */
3867 if(numtowrite == 0) {
3868 nwritten = 0;
3869 } else {
3870 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3871 }
3872
3873 status = sync_file(conn, fsp, False /* write through */);
3874 if (!NT_STATUS_IS_OK(status)) {
3875 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3876 fsp->fsp_name, nt_errstr(status) ));
3877 reply_nterror(req, status);
3878 goto strict_unlock;
3879 }
3880
3881 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3882 reply_unixerror(req, ERRHRD, ERRdiskfull);
3883 goto strict_unlock;
3884 }
3885
3886 if (numtowrite) {
3887 status = do_unlock(smbd_messaging_context(),
3888 fsp,
3889 req->smbpid,
3890 (uint64_t)numtowrite,
3891 (uint64_t)startpos,
3892 WINDOWS_LOCK);
3893
3894 if (NT_STATUS_V(status)) {
3895 reply_nterror(req, status);
3896 goto strict_unlock;
3897 }
3898 }
3899
3900 reply_outbuf(req, 1, 0);
3901
3902 SSVAL(req->outbuf,smb_vwv0,nwritten);
3903
3904 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3905 fsp->fnum, (int)numtowrite, (int)nwritten));
3906
3907 strict_unlock:
3908 if (numtowrite) {
3909 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3910 }
3911
3912 END_PROFILE(SMBwriteunlock);
3913 return;
3914 }
3915
3916 #undef DBGC_CLASS
3917 #define DBGC_CLASS DBGC_ALL
3918
3919 /****************************************************************************
3920 Reply to a write.
3921 ****************************************************************************/
3922
3923 void reply_write(struct smb_request *req)
3924 {
3925 connection_struct *conn = req->conn;
3926 size_t numtowrite;
3927 ssize_t nwritten = -1;
3928 SMB_OFF_T startpos;
3929 const char *data;
3930 files_struct *fsp;
3931 struct lock_struct lock;
3932 NTSTATUS status;
3933
3934 START_PROFILE(SMBwrite);
3935
3936 if (req->wct < 5) {
3937 END_PROFILE(SMBwrite);
3938 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3939 return;
3940 }
3941
3942 /* If it's an IPC, pass off the pipe handler. */
3943 if (IS_IPC(conn)) {
3944 reply_pipe_write(req);
3945 END_PROFILE(SMBwrite);
3946 return;
3947 }
3948
3949 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3950
3951 if (!check_fsp(conn, req, fsp)) {
3952 END_PROFILE(SMBwrite);
3953 return;
3954 }
3955
3956 if (!CHECK_WRITE(fsp)) {
3957 reply_doserror(req, ERRDOS, ERRbadaccess);
3958 END_PROFILE(SMBwrite);
3959 return;
3960 }
3961
3962 numtowrite = SVAL(req->vwv+1, 0);
3963 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3964 data = (const char *)req->buf + 3;
3965
3966 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3967 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3968 &lock);
3969
3970 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3971 reply_doserror(req, ERRDOS, ERRlock);
3972 END_PROFILE(SMBwrite);
3973 return;
3974 }
3975
3976 /*
3977 * X/Open SMB protocol says that if smb_vwv1 is
3978 * zero then the file size should be extended or
3979 * truncated to the size given in smb_vwv[2-3].
3980 */
3981
3982 if(numtowrite == 0) {
3983 /*
3984 * This is actually an allocate call, and set EOF. JRA.
3985 */
3986 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3987 if (nwritten < 0) {
3988 reply_nterror(req, NT_STATUS_DISK_FULL);
3989 goto strict_unlock;
3990 }
3991 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3992 if (nwritten < 0) {
3993 reply_nterror(req, NT_STATUS_DISK_FULL);
3994 goto strict_unlock;
3995 }
3996 trigger_write_time_update_immediate(fsp);
3997 } else {
3998 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3999 }
4000
4001 status = sync_file(conn, fsp, False);
4002 if (!NT_STATUS_IS_OK(status)) {
4003 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4004 fsp->fsp_name, nt_errstr(status) ));
4005 reply_nterror(req, status);
4006 goto strict_unlock;
4007 }
4008
4009 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4010 reply_unixerror(req, ERRHRD, ERRdiskfull);
4011 goto strict_unlock;
4012 }
4013
4014 reply_outbuf(req, 1, 0);
4015
4016 SSVAL(req->outbuf,smb_vwv0,nwritten);
4017
4018 if (nwritten < (ssize_t)numtowrite) {
4019 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4020 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4021 }
4022
4023 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4024
4025 strict_unlock:
4026 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4027
4028 END_PROFILE(SMBwrite);
4029 return;
4030 }
4031
4032 /****************************************************************************
4033 Ensure a buffer is a valid writeX for recvfile purposes.
4034 ****************************************************************************/
4035
4036 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4037 (2*14) + /* word count (including bcc) */ \
4038 1 /* pad byte */)
4039
4040 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4041 {
4042 size_t numtowrite;
4043 connection_struct *conn = NULL;
4044 unsigned int doff = 0;
4045 size_t len = smb_len_large(inbuf);
4046
4047 if (is_encrypted_packet(inbuf)) {
4048 /* Can't do this on encrypted
4049 * connections. */
4050 return false;
4051 }
4052
4053 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4054 return false;
4055 }
4056
4057 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4058 CVAL(inbuf,smb_wct) != 14) {
4059 DEBUG(10,("is_valid_writeX_buffer: chained or "
4060 "invalid word length.\n"));
4061 return false;
4062 }
4063
4064 conn = conn_find(SVAL(inbuf, smb_tid));
4065 if (conn == NULL) {
4066 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4067 return false;
4068 }
4069 if (IS_IPC(conn)) {
4070 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4071 return false;
4072 }
4073 if (IS_PRINT(conn)) {
4074 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4075 return false;
4076 }
4077 doff = SVAL(inbuf,smb_vwv11);
4078
4079 numtowrite = SVAL(inbuf,smb_vwv10);
4080
4081 if (len > doff && len - doff > 0xFFFF) {
4082 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4083 }
4084
4085 if (numtowrite == 0) {
4086 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4087 return false;
4088 }
4089
4090 /* Ensure the sizes match up. */
4091 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4092 /* no pad byte...old smbclient :-( */
4093 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4094 (unsigned int)doff,
4095 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4096 return false;
4097 }
4098
4099 if (len - doff != numtowrite) {
4100 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4101 "len = %u, doff = %u, numtowrite = %u\n",
4102 (unsigned int)len,
4103 (unsigned int)doff,
4104 (unsigned int)numtowrite ));
4105 return false;
4106 }
4107
4108 DEBUG(10,("is_valid_writeX_buffer: true "
4109 "len = %u, doff = %u, numtowrite = %u\n",
4110 (unsigned int)len,
4111 (unsigned int)doff,
4112 (unsigned int)numtowrite ));
4113
4114 return true;
4115 }
4116
4117 /****************************************************************************
4118 Reply to a write and X.
4119 ****************************************************************************/
4120
4121 void reply_write_and_X(struct smb_request *req)
4122 {
4123 connection_struct *conn = req->conn;
4124 files_struct *fsp;
4125 struct lock_struct lock;
4126 SMB_OFF_T startpos;
4127 size_t numtowrite;
4128 bool write_through;
4129 ssize_t nwritten;
4130 unsigned int smb_doff;
4131 unsigned int smblen;
4132 char *data;
4133 NTSTATUS status;
4134
4135 START_PROFILE(SMBwriteX);
4136
4137 if ((req->wct != 12) && (req->wct != 14)) {
4138 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4139 END_PROFILE(SMBwriteX);
4140 return;
4141 }
4142
4143 numtowrite = SVAL(req->vwv+10, 0);
4144 smb_doff = SVAL(req->vwv+11, 0);
4145 smblen = smb_len(req->inbuf);
4146
4147 if (req->unread_bytes > 0xFFFF ||
4148 (smblen > smb_doff &&
4149 smblen - smb_doff > 0xFFFF)) {
4150 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4151 }
4152
4153 if (req->unread_bytes) {
4154 /* Can't do a recvfile write on IPC$ */
4155 if (IS_IPC(conn)) {
4156 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4157 END_PROFILE(SMBwriteX);
4158 return;
4159 }
4160 if (numtowrite != req->unread_bytes) {
4161 reply_doserror(req, ERRDOS, ERRbadmem);
4162 END_PROFILE(SMBwriteX);
4163 return;
4164 }
4165 } else {
4166 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4167 smb_doff + numtowrite > smblen) {
4168 reply_doserror(req, ERRDOS, ERRbadmem);
4169 END_PROFILE(SMBwriteX);
4170 return;
4171 }
4172 }
4173
4174 /* If it's an IPC, pass off the pipe handler. */
4175 if (IS_IPC(conn)) {
4176 if (req->unread_bytes) {
4177 reply_doserror(req, ERRDOS, ERRbadmem);
4178 END_PROFILE(SMBwriteX);
4179 return;
4180 }
4181 reply_pipe_write_and_X(req);
4182 END_PROFILE(SMBwriteX);
4183 return;
4184 }
4185
4186 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4187 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4188 write_through = BITSETW(req->vwv+7,0);
4189
4190 if (!check_fsp(conn, req, fsp)) {
4191 END_PROFILE(SMBwriteX);
4192 return;
4193 }
4194
4195 if (!CHECK_WRITE(fsp)) {
4196 reply_doserror(req, ERRDOS, ERRbadaccess);
4197 END_PROFILE(SMBwriteX);
4198 return;
4199 }
4200
4201 data = smb_base(req->inbuf) + smb_doff;
4202
4203 if(req->wct == 14) {
4204 #ifdef LARGE_SMB_OFF_T
4205 /*
4206 * This is a large offset (64 bit) write.
4207 */
4208 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4209
4210 #else /* !LARGE_SMB_OFF_T */
4211
4212 /*
4213 * Ensure we haven't been sent a >32 bit offset.
4214 */
4215
4216 if(IVAL(req->vwv+12, 0) != 0) {
4217 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4218 "used and we don't support 64 bit offsets.\n",
4219 (unsigned int)IVAL(req->vwv+12, 0) ));
4220 reply_doserror(req, ERRDOS, ERRbadaccess);
4221 END_PROFILE(SMBwriteX);
4222 return;
4223 }
4224
4225 #endif /* LARGE_SMB_OFF_T */
4226 }
4227
4228 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4229 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4230 &lock);
4231
4232 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4233 reply_doserror(req, ERRDOS, ERRlock);
4234 END_PROFILE(SMBwriteX);
4235 return;
4236 }
4237
4238 /* X/Open SMB protocol says that, unlike SMBwrite
4239 if the length is zero then NO truncation is
4240 done, just a write of zero. To truncate a file,
4241 use SMBwrite. */
4242
4243 if(numtowrite == 0) {
4244 nwritten = 0;
4245 } else {
4246
4247 if ((req->unread_bytes == 0) &&
4248 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4249 numtowrite)) {
4250 goto strict_unlock;
4251 }
4252
4253 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4254 }
4255
4256 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4257 reply_unixerror(req, ERRHRD, ERRdiskfull);
4258 goto strict_unlock;
4259 }
4260
4261 reply_outbuf(req, 6, 0);
4262 SSVAL(req->outbuf,smb_vwv2,nwritten);
4263 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4264
4265 if (nwritten < (ssize_t)numtowrite) {
4266 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4267 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4268 }
4269
4270 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4271 fsp->fnum, (int)numtowrite, (int)nwritten));
4272
4273 status = sync_file(conn, fsp, write_through);
4274 if (!NT_STATUS_IS_OK(status)) {
4275 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4276 fsp->fsp_name, nt_errstr(status) ));
4277 reply_nterror(req, status);
4278 goto strict_unlock;
4279 }
4280
4281 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4282
4283 END_PROFILE(SMBwriteX);
4284 chain_reply(req);
4285 return;
4286
4287 strict_unlock:
4288 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4289
4290 END_PROFILE(SMBwriteX);
4291 return;
4292 }
4293
4294 /****************************************************************************
4295 Reply to a lseek.
4296 ****************************************************************************/
4297
4298 void reply_lseek(struct smb_request *req)
4299 {
4300 connection_struct *conn = req->conn;
4301 SMB_OFF_T startpos;
4302 SMB_OFF_T res= -1;
4303 int mode,umode;
4304 files_struct *fsp;
4305
4306 START_PROFILE(SMBlseek);
4307
4308 if (req->wct < 4) {
4309 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4310 END_PROFILE(SMBlseek);
4311 return;
4312 }
4313
4314 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4315
4316 if (!check_fsp(conn, req, fsp)) {
4317 return;
4318 }
4319
4320 flush_write_cache(fsp, SEEK_FLUSH);
4321
4322 mode = SVAL(req->vwv+1, 0) & 3;
4323 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4324 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4325
4326 switch (mode) {
4327 case 0:
4328 umode = SEEK_SET;
4329 res = startpos;
4330 break;
4331 case 1:
4332 umode = SEEK_CUR;
4333 res = fsp->fh->pos + startpos;
4334 break;
4335 case 2:
4336 umode = SEEK_END;
4337 break;
4338 default:
4339 umode = SEEK_SET;
4340 res = startpos;
4341 break;
4342 }
4343
4344 if (umode == SEEK_END) {
4345 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4346 if(errno == EINVAL) {
4347 SMB_OFF_T current_pos = startpos;
4348 SMB_STRUCT_STAT sbuf;
4349
4350 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4351 reply_unixerror(req, ERRDOS,
4352 ERRnoaccess);
4353 END_PROFILE(SMBlseek);
4354 return;
4355 }
4356
4357 current_pos += sbuf.st_size;
4358 if(current_pos < 0)
4359 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4360 }
4361 }
4362
4363 if(res == -1) {
4364 reply_unixerror(req, ERRDOS, ERRnoaccess);
4365 END_PROFILE(SMBlseek);
4366 return;
4367 }
4368 }
4369
4370 fsp->fh->pos = res;
4371
4372 reply_outbuf(req, 2, 0);
4373 SIVAL(req->outbuf,smb_vwv0,res);
4374
4375 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4376 fsp->fnum, (double)startpos, (double)res, mode));
4377
4378 END_PROFILE(SMBlseek);
4379 return;
4380 }
4381
4382 /****************************************************************************
4383 Reply to a flush.
4384 ****************************************************************************/
4385
4386 void reply_flush(struct smb_request *req)
4387 {
4388 connection_struct *conn = req->conn;
4389 uint16 fnum;
4390 files_struct *fsp;
4391
4392 START_PROFILE(SMBflush);
4393
4394 if (req->wct < 1) {
4395 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4396 return;
4397 }
4398
4399 fnum = SVAL(req->vwv+0, 0);
4400 fsp = file_fsp(req, fnum);
4401
4402 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4403 return;
4404 }
4405
4406 if (!fsp) {
4407 file_sync_all(conn);
4408 } else {
4409 NTSTATUS status = sync_file(conn, fsp, True);
4410 if (!NT_STATUS_IS_OK(status)) {
4411 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4412 fsp->fsp_name, nt_errstr(status) ));
4413 reply_nterror(req, status);
4414 END_PROFILE(SMBflush);
4415 return;
4416 }
4417 }
4418
4419 reply_outbuf(req, 0, 0);
4420
4421 DEBUG(3,("flush\n"));
4422 END_PROFILE(SMBflush);
4423 return;
4424 }
4425
4426 /****************************************************************************
4427 Reply to a exit.
4428 conn POINTER CAN BE NULL HERE !
4429 ****************************************************************************/
4430
4431 void reply_exit(struct smb_request *req)
4432 {
4433 START_PROFILE(SMBexit);
4434
4435 file_close_pid(req->smbpid, req->vuid);
4436
4437 reply_outbuf(req, 0, 0);
4438
4439 DEBUG(3,("exit\n"));
4440
4441 END_PROFILE(SMBexit);
4442 return;
4443 }
4444
4445 /****************************************************************************
4446 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4447 ****************************************************************************/
4448
4449 void reply_close(struct smb_request *req)
4450 {
4451 connection_struct *conn = req->conn;
4452 NTSTATUS status = NT_STATUS_OK;
4453 files_struct *fsp = NULL;
4454 START_PROFILE(SMBclose);
4455
4456 if (req->wct < 3) {
4457 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4458 END_PROFILE(SMBclose);
4459 return;
4460 }
4461
4462 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4463
4464 /*
4465 * We can only use check_fsp if we know it's not a directory.
4466 */
4467
4468 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4469 reply_doserror(req, ERRDOS, ERRbadfid);
4470 END_PROFILE(SMBclose);
4471 return;
4472 }
4473
4474 if(fsp->is_directory) {
4475 /*
4476 * Special case - close NT SMB directory handle.
4477 */
4478 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4479 status = close_file(req, fsp, NORMAL_CLOSE);
4480 } else {
4481 time_t t;
4482 /*
4483 * Close ordinary file.
4484 */
4485
4486 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4487 fsp->fh->fd, fsp->fnum,
4488 conn->num_files_open));
4489
4490 /*
4491 * Take care of any time sent in the close.
4492 */
4493
4494 t = srv_make_unix_date3(req->vwv+1);
4495 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4496
4497 /*
4498 * close_file() returns the unix errno if an error
4499 * was detected on close - normally this is due to
4500 * a disk full error. If not then it was probably an I/O error.
4501 */
4502
4503 status = close_file(req, fsp, NORMAL_CLOSE);
4504 }
4505
4506 if (!NT_STATUS_IS_OK(status)) {
4507 reply_nterror(req, status);
4508 END_PROFILE(SMBclose);
4509 return;
4510 }
4511
4512 reply_outbuf(req, 0, 0);
4513 END_PROFILE(SMBclose);
4514 return;
4515 }
4516
4517 /****************************************************************************
4518 Reply to a writeclose (Core+ protocol).
4519 ****************************************************************************/
4520
4521 void reply_writeclose(struct smb_request *req)
4522 {
4523 connection_struct *conn = req->conn;
4524 size_t numtowrite;
4525 ssize_t nwritten = -1;
4526 NTSTATUS close_status = NT_STATUS_OK;
4527 SMB_OFF_T startpos;
4528 const char *data;
4529 struct timespec mtime;
4530 files_struct *fsp;
4531 struct lock_struct lock;
4532
4533 START_PROFILE(SMBwriteclose);
4534
4535 if (req->wct < 6) {
4536 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4537 END_PROFILE(SMBwriteclose);
4538 return;
4539 }
4540
4541 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4542
4543 if (!check_fsp(conn, req, fsp)) {
4544 END_PROFILE(SMBwriteclose);
4545 return;
4546 }
4547 if (!CHECK_WRITE(fsp)) {
4548 reply_doserror(req, ERRDOS,ERRbadaccess);
4549 END_PROFILE(SMBwriteclose);
4550 return;
4551 }
4552
4553 numtowrite = SVAL(req->vwv+1, 0);
4554 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4555 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4556 data = (const char *)req->buf + 1;
4557
4558 if (numtowrite) {
4559 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4560 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4561 &lock);
4562
4563 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4564 reply_doserror(req, ERRDOS,ERRlock);
4565 END_PROFILE(SMBwriteclose);
4566 return;
4567 }
4568 }
4569
4570 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4571
4572 set_close_write_time(fsp, mtime);
4573
4574 /*
4575 * More insanity. W2K only closes the file if writelen > 0.
4576 * JRA.
4577 */
4578
4579 if (numtowrite) {
4580 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4581 fsp->fsp_name ));
4582 close_status = close_file(req, fsp, NORMAL_CLOSE);
4583 }
4584
4585 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4586 fsp->fnum, (int)numtowrite, (int)nwritten,
4587 conn->num_files_open));
4588
4589 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4590 reply_doserror(req, ERRHRD, ERRdiskfull);
4591 goto strict_unlock;
4592 }
4593
4594 if(!NT_STATUS_IS_OK(close_status)) {
4595 reply_nterror(req, close_status);
4596 goto strict_unlock;
4597 }
4598
4599 reply_outbuf(req, 1, 0);
4600
4601 SSVAL(req->outbuf,smb_vwv0,nwritten);
4602
4603 strict_unlock:
4604 if (numtowrite) {
4605 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4606 }
4607
4608 END_PROFILE(SMBwriteclose);
4609 return;
4610 }
4611
4612 #undef DBGC_CLASS
4613 #define DBGC_CLASS DBGC_LOCKING
4614
4615 /****************************************************************************
4616 Reply to a lock.
4617 ****************************************************************************/
4618
4619 void reply_lock(struct smb_request *req)
4620 {
4621 connection_struct *conn = req->conn;
4622 uint64_t count,offset;
4623 NTSTATUS status;
4624 files_struct *fsp;
4625 struct byte_range_lock *br_lck = NULL;
4626
4627 START_PROFILE(SMBlock);
4628
4629 if (req->wct < 5) {
4630 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4631 END_PROFILE(SMBlock);
4632 return;
4633 }
4634
4635 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4636
4637 if (!check_fsp(conn, req, fsp)) {
4638 END_PROFILE(SMBlock);
4639 return;
4640 }
4641
4642 count = (uint64_t)IVAL(req->vwv+1, 0);
4643 offset = (uint64_t)IVAL(req->vwv+3, 0);
4644
4645 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4646 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4647
4648 br_lck = do_lock(smbd_messaging_context(),
4649 fsp,
4650 req->smbpid,
4651 count,
4652 offset,
4653 WRITE_LOCK,
4654 WINDOWS_LOCK,
4655 False, /* Non-blocking lock. */
4656 &status,
4657 NULL,
4658 NULL);
4659
4660 TALLOC_FREE(br_lck);
4661
4662 if (NT_STATUS_V(status)) {
4663 reply_nterror(req, status);
4664 END_PROFILE(SMBlock);
4665 return;
4666 }
4667
4668 reply_outbuf(req, 0, 0);
4669
4670 END_PROFILE(SMBlock);
4671 return;
4672 }
4673
4674 /****************************************************************************
4675 Reply to a unlock.
4676 ****************************************************************************/
4677
4678 void reply_unlock(struct smb_request *req)
4679 {
4680 connection_struct *conn = req->conn;
4681 uint64_t count,offset;
4682 NTSTATUS status;
4683 files_struct *fsp;
4684
4685 START_PROFILE(SMBunlock);
4686
4687 if (req->wct < 5) {
4688 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4689 END_PROFILE(SMBunlock);
4690 return;
4691 }
4692
4693 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4694
4695 if (!check_fsp(conn, req, fsp)) {
4696 END_PROFILE(SMBunlock);
4697 return;
4698 }
4699
4700 count = (uint64_t)IVAL(req->vwv+1, 0);
4701 offset = (uint64_t)IVAL(req->vwv+3, 0);
4702
4703 status = do_unlock(smbd_messaging_context(),
4704 fsp,
4705 req->smbpid,
4706 count,
4707 offset,
4708 WINDOWS_LOCK);
4709
4710 if (NT_STATUS_V(status)) {
4711 reply_nterror(req, status);
4712 END_PROFILE(SMBunlock);
4713 return;
4714 }
4715
4716 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4717 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4718
4719 reply_outbuf(req, 0, 0);
4720
4721 END_PROFILE(SMBunlock);
4722 return;
4723 }
4724
4725 #undef DBGC_CLASS
4726 #define DBGC_CLASS DBGC_ALL
4727
4728 /****************************************************************************
4729 Reply to a tdis.
4730 conn POINTER CAN BE NULL HERE !
4731 ****************************************************************************/
4732
4733 void reply_tdis(struct smb_request *req)
4734 {
4735 connection_struct *conn = req->conn;
4736 START_PROFILE(SMBtdis);
4737
4738 if (!conn) {
4739 DEBUG(4,("Invalid connection in tdis\n"));
4740 reply_doserror(req, ERRSRV, ERRinvnid);
4741 END_PROFILE(SMBtdis);
4742 return;
4743 }
4744
4745 conn->used = False;
4746
4747 close_cnum(conn,req->vuid);
4748 req->conn = NULL;
4749
4750 reply_outbuf(req, 0, 0);
4751 END_PROFILE(SMBtdis);
4752 return;
4753 }
4754
4755 /****************************************************************************
4756 Reply to a echo.
4757 conn POINTER CAN BE NULL HERE !
4758 ****************************************************************************/
4759
4760 void reply_echo(struct smb_request *req)
4761 {
4762 connection_struct *conn = req->conn;
4763 struct smb_perfcount_data local_pcd;
4764 struct smb_perfcount_data *cur_pcd;
4765 int smb_reverb;
4766 int seq_num;
4767
4768 START_PROFILE(SMBecho);
4769
4770 smb_init_perfcount_data(&local_pcd);
4771
4772 if (req->wct < 1) {
4773 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4774 END_PROFILE(SMBecho);
4775 return;
4776 }
4777
4778 smb_reverb = SVAL(req->vwv+0, 0);
4779
4780 reply_outbuf(req, 1, req->buflen);
4781
4782 /* copy any incoming data back out */
4783 if (req->buflen > 0) {
4784 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4785 }
4786
4787 if (smb_reverb > 100) {
4788 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4789 smb_reverb = 100;
4790 }
4791
4792 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4793
4794 /* this makes sure we catch the request pcd */
4795 if (seq_num == smb_reverb) {
4796 cur_pcd = &req->pcd;
4797 } else {
4798 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4799 cur_pcd = &local_pcd;
4800 }
4801
4802 SSVAL(req->outbuf,smb_vwv0,seq_num);
4803
4804 show_msg((char *)req->outbuf);
4805 if (!srv_send_smb(smbd_server_fd(),
4806 (char *)req->outbuf,
4807 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4808 cur_pcd))
4809 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4810 }
4811
4812 DEBUG(3,("echo %d times\n", smb_reverb));
4813
4814 TALLOC_FREE(req->outbuf);
4815
4816 END_PROFILE(SMBecho);
4817 return;
4818 }
4819
4820 /****************************************************************************
4821 Reply to a printopen.
4822 ****************************************************************************/
4823
4824 void reply_printopen(struct smb_request *req)
4825 {
4826 connection_struct *conn = req->conn;
4827 files_struct *fsp;
4828 SMB_STRUCT_STAT sbuf;
4829 NTSTATUS status;
4830
4831 START_PROFILE(SMBsplopen);
4832
4833 if (req->wct < 2) {
4834 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4835 END_PROFILE(SMBsplopen);
4836 return;
4837 }
4838
4839 if (!CAN_PRINT(conn)) {
4840 reply_doserror(req, ERRDOS, ERRnoaccess);
4841 END_PROFILE(SMBsplopen);
4842 return;
4843 }
4844
4845 status = file_new(req, conn, &fsp);
4846 if(!NT_STATUS_IS_OK(status)) {
4847 reply_nterror(req, status);
4848 END_PROFILE(SMBsplopen);
4849 return;
4850 }
4851
4852 /* Open for exclusive use, write only. */
4853 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4854
4855 if (!NT_STATUS_IS_OK(status)) {
4856 reply_nterror(req, status);
4857 END_PROFILE(SMBsplopen);
4858 return;
4859 }
4860
4861 reply_outbuf(req, 1, 0);
4862 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4863
4864 DEBUG(3,("openprint fd=%d fnum=%d\n",
4865 fsp->fh->fd, fsp->fnum));
4866
4867 END_PROFILE(SMBsplopen);
4868 return;
4869 }
4870
4871 /****************************************************************************
4872 Reply to a printclose.
4873 ****************************************************************************/
4874
4875 void reply_printclose(struct smb_request *req)
4876 {
4877 connection_struct *conn = req->conn;
4878 files_struct *fsp;
4879 NTSTATUS status;
4880
4881 START_PROFILE(SMBsplclose);
4882
4883 if (req->wct < 1) {
4884 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4885 END_PROFILE(SMBsplclose);
4886 return;
4887 }
4888
4889 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4890
4891 if (!check_fsp(conn, req, fsp)) {
4892 END_PROFILE(SMBsplclose);
4893 return;
4894 }
4895
4896 if (!CAN_PRINT(conn)) {
4897 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4898 END_PROFILE(SMBsplclose);
4899 return;
4900 }
4901
4902 DEBUG(3,("printclose fd=%d fnum=%d\n",
4903 fsp->fh->fd,fsp->fnum));
4904
4905 status = close_file(req, fsp, NORMAL_CLOSE);
4906
4907 if(!NT_STATUS_IS_OK(status)) {
4908 reply_nterror(req, status);
4909 END_PROFILE(SMBsplclose);
4910 return;
4911 }
4912
4913 reply_outbuf(req, 0, 0);
4914
4915 END_PROFILE(SMBsplclose);
4916 return;
4917 }
4918
4919 /****************************************************************************
4920 Reply to a printqueue.
4921 ****************************************************************************/
4922
4923 void reply_printqueue(struct smb_request *req)
4924 {
4925 connection_struct *conn = req->conn;
4926 int max_count;
4927 int start_index;
4928
4929 START_PROFILE(SMBsplretq);
4930
4931 if (req->wct < 2) {
4932 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4933 END_PROFILE(SMBsplretq);
4934 return;
4935 }
4936
4937 max_count = SVAL(req->vwv+0, 0);
4938 start_index = SVAL(req->vwv+1, 0);
4939
4940 /* we used to allow the client to get the cnum wrong, but that
4941 is really quite gross and only worked when there was only
4942 one printer - I think we should now only accept it if they
4943 get it right (tridge) */
4944 if (!CAN_PRINT(conn)) {
4945 reply_doserror(req, ERRDOS, ERRnoaccess);
4946 END_PROFILE(SMBsplretq);
4947 return;
4948 }
4949
4950 reply_outbuf(req, 2, 3);
4951 SSVAL(req->outbuf,smb_vwv0,0);
4952 SSVAL(req->outbuf,smb_vwv1,0);
4953 SCVAL(smb_buf(req->outbuf),0,1);
4954 SSVAL(smb_buf(req->outbuf),1,0);
4955
4956 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4957 start_index, max_count));
4958
4959 {
4960 print_queue_struct *queue = NULL;
4961 print_status_struct status;
4962 int count = print_queue_status(SNUM(conn), &queue, &status);
4963 int num_to_get = ABS(max_count);
4964 int first = (max_count>0?start_index:start_index+max_count+1);
4965 int i;
4966
4967 if (first >= count)
4968 num_to_get = 0;
4969 else
4970 num_to_get = MIN(num_to_get,count-first);
4971
4972
4973 for (i=first;i<first+num_to_get;i++) {
4974 char blob[28];
4975 char *p = blob;
4976
4977 srv_put_dos_date2(p,0,queue[i].time);
4978 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4979 SSVAL(p,5, queue[i].job);
4980 SIVAL(p,7,queue[i].size);
4981 SCVAL(p,11,0);
4982 srvstr_push(blob, req->flags2, p+12,
4983 queue[i].fs_user, 16, STR_ASCII);
4984
4985 if (message_push_blob(
4986 &req->outbuf,
4987 data_blob_const(
4988 blob, sizeof(blob))) == -1) {
4989 reply_nterror(req, NT_STATUS_NO_MEMORY);
4990 END_PROFILE(SMBsplretq);
4991 return;
4992 }
4993 }
4994
4995 if (count > 0) {
4996 SSVAL(req->outbuf,smb_vwv0,count);
4997 SSVAL(req->outbuf,smb_vwv1,
4998 (max_count>0?first+count:first-1));
4999 SCVAL(smb_buf(req->outbuf),0,1);
5000 SSVAL(smb_buf(req->outbuf),1,28*count);
5001 }
5002
5003 SAFE_FREE(queue);
5004
5005 DEBUG(3,("%d entries returned in queue\n",count));
5006 }
5007
5008 END_PROFILE(SMBsplretq);
5009 return;
5010 }
5011
5012 /****************************************************************************
5013 Reply to a printwrite.
5014 ****************************************************************************/
5015
5016 void reply_printwrite(struct smb_request *req)
5017 {
5018 connection_struct *conn = req->conn;
5019 int numtowrite;
5020 const char *data;
5021 files_struct *fsp;
5022
5023 START_PROFILE(SMBsplwr);
5024
5025 if (req->wct < 1) {
5026 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5027 END_PROFILE(SMBsplwr);
5028 return;
5029 }
5030
5031 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5032
5033 if (!check_fsp(conn, req, fsp)) {
5034 END_PROFILE(SMBsplwr);
5035 return;
5036 }
5037
5038 if (!CAN_PRINT(conn)) {
5039 reply_doserror(req, ERRDOS, ERRnoaccess);
5040 END_PROFILE(SMBsplwr);
5041 return;
5042 }
5043
5044 if (!CHECK_WRITE(fsp)) {
5045 reply_doserror(req, ERRDOS, ERRbadaccess);
5046 END_PROFILE(SMBsplwr);
5047 return;
5048 }
5049
5050 numtowrite = SVAL(req->buf, 1);
5051
5052 if (req->buflen < numtowrite + 3) {
5053 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5054 END_PROFILE(SMBsplwr);
5055 return;
5056 }
5057
5058 data = (const char *)req->buf + 3;
5059
5060 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5061 reply_unixerror(req, ERRHRD, ERRdiskfull);
5062 END_PROFILE(SMBsplwr);
5063 return;
5064 }
5065
5066 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5067
5068 END_PROFILE(SMBsplwr);
5069 return;
5070 }
5071
5072 /****************************************************************************
5073 Reply to a mkdir.
5074 ****************************************************************************/
5075
5076 void reply_mkdir(struct smb_request *req)
5077 {
5078 connection_struct *conn = req->conn;
5079 char *directory = NULL;
5080 NTSTATUS status;
5081 SMB_STRUCT_STAT sbuf;
5082 TALLOC_CTX *ctx = talloc_tos();
5083
5084 START_PROFILE(SMBmkdir);
5085
5086 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5087 STR_TERMINATE, &status);
5088 if (!NT_STATUS_IS_OK(status)) {
5089 reply_nterror(req, status);
5090 END_PROFILE(SMBmkdir);
5091 return;
5092 }
5093
5094 status = resolve_dfspath(ctx, conn,
5095 req->flags2 & FLAGS2_DFS_PATHNAMES,
5096 directory,
5097 &directory);
5098 if (!NT_STATUS_IS_OK(status)) {
5099 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5100 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5101 ERRSRV, ERRbadpath);
5102 END_PROFILE(SMBmkdir);
5103 return;
5104 }
5105 reply_nterror(req, status);
5106 END_PROFILE(SMBmkdir);
5107 return;
5108 }
5109
5110 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
5111 if (!NT_STATUS_IS_OK(status)) {
5112 reply_nterror(req, status);
5113 END_PROFILE(SMBmkdir);
5114 return;
5115 }
5116
5117 status = check_name(conn, directory);
5118 if (!NT_STATUS_IS_OK(status)) {
5119 reply_nterror(req, status);
5120 END_PROFILE(SMBmkdir);
5121 return;
5122 }
5123
5124 status = create_directory(conn, req, directory);
5125
5126 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5127
5128 if (!NT_STATUS_IS_OK(status)) {
5129
5130 if (!use_nt_status()
5131 && NT_STATUS_EQUAL(status,
5132 NT_STATUS_OBJECT_NAME_COLLISION)) {
5133 /*
5134 * Yes, in the DOS error code case we get a
5135 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5136 * samba4 torture test.
5137 */
5138 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5139 }
5140
5141 reply_nterror(req, status);
5142 END_PROFILE(SMBmkdir);
5143 return;
5144 }
5145
5146 reply_outbuf(req, 0, 0);
5147
5148 DEBUG( 3, ( "mkdir %s\n", directory ) );
5149
5150 END_PROFILE(SMBmkdir);
5151 return;
5152 }
5153
5154 /****************************************************************************
5155 Static function used by reply_rmdir to delete an entire directory
5156 tree recursively. Return True on ok, False on fail.
5157 ****************************************************************************/
5158
5159 static bool recursive_rmdir(TALLOC_CTX *ctx,
5160 connection_struct *conn,
5161 char *directory)
5162 {
5163 const char *dname = NULL;
5164 bool ret = True;
5165 long offset = 0;
5166 SMB_STRUCT_STAT st;
5167 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5168 NULL, 0);
5169
5170 if(dir_hnd == NULL)
5171 return False;
5172
5173 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5174 char *fullname = NULL;
5175
5176 if (ISDOT(dname) || ISDOTDOT(dname)) {
5177 continue;
5178 }
5179
5180 if (!is_visible_file(conn, directory, dname, &st, False)) {
5181 continue;
5182 }
5183
5184 /* Construct the full name. */
5185 fullname = talloc_asprintf(ctx,
5186 "%s/%s",
5187 directory,
5188 dname);
5189 if (!fullname) {
5190 errno = ENOMEM;
5191 ret = False;
5192 break;
5193 }
5194
5195 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5196 ret = False;
5197 break;
5198 }
5199
5200 if(st.st_mode & S_IFDIR) {
5201 if(!recursive_rmdir(ctx, conn, fullname)) {
5202 ret = False;
5203 break;
5204 }
5205 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5206 ret = False;
5207 break;
5208 }
5209 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5210 ret = False;
5211 break;
5212 }
5213 TALLOC_FREE(fullname);
5214 }
5215 TALLOC_FREE(dir_hnd);
5216 return ret;
5217 }
5218
5219 /****************************************************************************
5220 The internals of the rmdir code - called elsewhere.
5221 ****************************************************************************/
5222
5223 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5224 connection_struct *conn,
5225 const char *directory)
5226 {
5227 int ret;
5228 SMB_STRUCT_STAT st;
5229
5230 /* Might be a symlink. */
5231 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5232 return map_nt_error_from_unix(errno);
5233 }
5234
5235 if (S_ISLNK(st.st_mode)) {
5236 /* Is what it points to a directory ? */
5237 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5238 return map_nt_error_from_unix(errno);
5239 }
5240 if (!(S_ISDIR(st.st_mode))) {
5241 return NT_STATUS_NOT_A_DIRECTORY;
5242 }
5243 ret = SMB_VFS_UNLINK(conn,directory);
5244 } else {
5245 ret = SMB_VFS_RMDIR(conn,directory);
5246 }
5247 if (ret == 0) {
5248 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5249 FILE_NOTIFY_CHANGE_DIR_NAME,
5250 directory);
5251 return NT_STATUS_OK;
5252 }
5253
5254 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5255 /*
5256 * Check to see if the only thing in this directory are
5257 * vetoed files/directories. If so then delete them and
5258 * retry. If we fail to delete any of them (and we *don't*
5259 * do a recursive delete) then fail the rmdir.
5260 */
5261 const char *dname;
5262 long dirpos = 0;
5263 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5264 directory, NULL, 0);
5265
5266 if(dir_hnd == NULL) {
5267 errno = ENOTEMPTY;
5268 goto err;
5269 }
5270
5271 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5272 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5273 continue;
5274 if (!is_visible_file(conn, directory, dname, &st, False))
5275 continue;
5276 if(!IS_VETO_PATH(conn, dname)) {
5277 TALLOC_FREE(dir_hnd);
5278 errno = ENOTEMPTY;
5279 goto err;
5280 }
5281 }
5282
5283 /* We only have veto files/directories.
5284 * Are we allowed to delete them ? */
5285
5286 if(!lp_recursive_veto_delete(SNUM(conn))) {
5287 TALLOC_FREE(dir_hnd);
5288 errno = ENOTEMPTY;
5289 goto err;
5290 }
5291
5292 /* Do a recursive delete. */
5293 RewindDir(dir_hnd,&dirpos);
5294 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5295 char *fullname = NULL;
5296
5297 if (ISDOT(dname) || ISDOTDOT(dname)) {
5298 continue;
5299 }
5300 if (!is_visible_file(conn, directory, dname, &st, False)) {
5301 continue;
5302 }
5303
5304 fullname = talloc_asprintf(ctx,
5305 "%s/%s",
5306 directory,
5307 dname);
5308
5309 if(!fullname) {
5310 errno = ENOMEM;
5311 break;
5312 }
5313
5314 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5315 break;
5316 }
5317 if(st.st_mode & S_IFDIR) {
5318 if(!recursive_rmdir(ctx, conn, fullname)) {
5319 break;
5320 }
5321 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5322 break;
5323 }
5324 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5325 break;
5326 }
5327 TALLOC_FREE(fullname);
5328 }
5329 TALLOC_FREE(dir_hnd);
5330 /* Retry the rmdir */
5331 ret = SMB_VFS_RMDIR(conn,directory);
5332 }
5333
5334 err:
5335
5336 if (ret != 0) {
5337 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5338 "%s\n", directory,strerror(errno)));
5339 return map_nt_error_from_unix(errno);
5340 }
5341
5342 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5343 FILE_NOTIFY_CHANGE_DIR_NAME,
5344 directory);
5345
5346 return NT_STATUS_OK;
5347 }
5348
5349 /****************************************************************************
5350 Reply to a rmdir.
5351 ****************************************************************************/
5352
5353 void reply_rmdir(struct smb_request *req)
5354 {
5355 connection_struct *conn = req->conn;
5356 char *directory = NULL;
5357 SMB_STRUCT_STAT sbuf;
5358 NTSTATUS status;
5359 TALLOC_CTX *ctx = talloc_tos();
5360
5361 START_PROFILE(SMBrmdir);
5362
5363 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5364 STR_TERMINATE, &status);
5365 if (!NT_STATUS_IS_OK(status)) {
5366 reply_nterror(req, status);
5367 END_PROFILE(SMBrmdir);
5368 return;
5369 }
5370
5371 status = resolve_dfspath(ctx, conn,
5372 req->flags2 & FLAGS2_DFS_PATHNAMES,
5373 directory,
5374 &directory);
5375 if (!NT_STATUS_IS_OK(status)) {
5376 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5377 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5378 ERRSRV, ERRbadpath);
5379 END_PROFILE(SMBrmdir);
5380 return;
5381 }
5382 reply_nterror(req, status);
5383 END_PROFILE(SMBrmdir);
5384 return;
5385 }
5386
5387 status = unix_convert(ctx, conn, directory, False, &directory,
5388 NULL, &sbuf);
5389 if (!NT_STATUS_IS_OK(status)) {
5390 reply_nterror(req, status);
5391 END_PROFILE(SMBrmdir);
5392 return;
5393 }
5394
5395 status = check_name(conn, directory);
5396 if (!NT_STATUS_IS_OK(status)) {
5397 reply_nterror(req, status);
5398 END_PROFILE(SMBrmdir);
5399 return;
5400 }
5401
5402 dptr_closepath(directory, req->smbpid);
5403 status = rmdir_internals(ctx, conn, directory);
5404 if (!NT_STATUS_IS_OK(status)) {
5405 reply_nterror(req, status);
5406 END_PROFILE(SMBrmdir);
5407 return;
5408 }
5409
5410 reply_outbuf(req, 0, 0);
5411
5412 DEBUG( 3, ( "rmdir %s\n", directory ) );
5413
5414 END_PROFILE(SMBrmdir);
5415 return;
5416 }
5417
5418 /*******************************************************************
5419 Resolve wildcards in a filename rename.
5420 ********************************************************************/
5421
5422 static bool resolve_wildcards(TALLOC_CTX *ctx,
5423 const char *name1,
5424 const char *name2,
5425 char **pp_newname)
5426 {
5427 char *name2_copy = NULL;
5428 char *root1 = NULL;
5429 char *root2 = NULL;
5430 char *ext1 = NULL;
5431 char *ext2 = NULL;
5432 char *p,*p2, *pname1, *pname2;
5433
5434 name2_copy = talloc_strdup(ctx, name2);
5435 if (!name2_copy) {
5436 return False;
5437 }
5438
5439 pname1 = strrchr_m(name1,'/');
5440 pname2 = strrchr_m(name2_copy,'/');
5441
5442 if (!pname1 || !pname2) {
5443 return False;
5444 }
5445
5446 /* Truncate the copy of name2 at the last '/' */
5447 *pname2 = '\0';
5448
5449 /* Now go past the '/' */
5450 pname1++;
5451 pname2++;
5452
5453 root1 = talloc_strdup(ctx, pname1);
5454 root2 = talloc_strdup(ctx, pname2);
5455
5456 if (!root1 || !root2) {
5457 return False;
5458 }
5459
5460 p = strrchr_m(root1,'.');
5461 if (p) {
5462 *p = 0;
5463 ext1 = talloc_strdup(ctx, p+1);
5464 } else {
5465 ext1 = talloc_strdup(ctx, "");
5466 }
5467 p = strrchr_m(root2,'.');
5468 if (p) {
5469 *p = 0;
5470 ext2 = talloc_strdup(ctx, p+1);
5471 } else {
5472 ext2 = talloc_strdup(ctx, "");
5473 }
5474
5475 if (!ext1 || !ext2) {
5476 return False;
5477 }
5478
5479 p = root1;
5480 p2 = root2;
5481 while (*p2) {
5482 if (*p2 == '?') {
5483 /* Hmmm. Should this be mb-aware ? */
5484 *p2 = *p;
5485 p2++;
5486 } else if (*p2 == '*') {
5487 *p2 = '\0';
5488 root2 = talloc_asprintf(ctx, "%s%s",
5489 root2,
5490 p);
5491 if (!root2) {
5492 return False;
5493 }
5494 break;
5495 } else {
5496 p2++;
5497 }
5498 if (*p) {
5499 p++;
5500 }
5501 }
5502
5503 p = ext1;
5504 p2 = ext2;
5505 while (*p2) {
5506 if (*p2 == '?') {
5507 /* Hmmm. Should this be mb-aware ? */
5508 *p2 = *p;
5509 p2++;
5510 } else if (*p2 == '*') {
5511 *p2 = '\0';
5512 ext2 = talloc_asprintf(ctx, "%s%s",
5513 ext2,
5514 p);
5515 if (!ext2) {
5516 return False;
5517 }
5518 break;
5519 } else {
5520 p2++;
5521 }
5522 if (*p) {
5523 p++;
5524 }
5525 }
5526
5527 if (*ext2) {
5528 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5529 name2_copy,
5530 root2,
5531 ext2);
5532 } else {
5533 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5534 name2_copy,
5535 root2);
5536 }
5537
5538 if (!*pp_newname) {
5539 return False;
5540 }
5541
5542 return True;
5543 }
5544
5545 /****************************************************************************
5546 Ensure open files have their names updated. Updated to notify other smbd's
5547 asynchronously.
5548 ****************************************************************************/
5549
5550 static void rename_open_files(connection_struct *conn,
5551 struct share_mode_lock *lck,
5552 const char *newname)
5553 {
5554 files_struct *fsp;
5555 bool did_rename = False;
5556
5557 for(fsp = file_find_di_first(lck->id); fsp;
5558 fsp = file_find_di_next(fsp)) {
5559 /* fsp_name is a relative path under the fsp. To change this for other
5560 sharepaths we need to manipulate relative paths. */
5561 /* TODO - create the absolute path and manipulate the newname
5562 relative to the sharepath. */
5563 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5564 continue;
5565 }
5566 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5567 fsp->fnum, file_id_string_tos(&fsp->file_id),
5568 fsp->fsp_name, newname ));
5569 string_set(&fsp->fsp_name, newname);
5570 did_rename = True;
5571 }
5572
5573 if (!did_rename) {
5574 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5575 file_id_string_tos(&lck->id), newname ));
5576 }
5577
5578 /* Send messages to all smbd's (not ourself) that the name has changed. */
5579 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5580 newname);
5581 }
5582
5583 /****************************************************************************
5584 We need to check if the source path is a parent directory of the destination
5585 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5586 refuse the rename with a sharing violation. Under UNIX the above call can
5587 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5588 probably need to check that the client is a Windows one before disallowing
5589 this as a UNIX client (one with UNIX extensions) can know the source is a
5590 symlink and make this decision intelligently. Found by an excellent bug
5591 report from <AndyLiebman@aol.com>.
5592 ****************************************************************************/
5593
5594 static bool rename_path_prefix_equal(const char *src, const char *dest)
5595 {
5596 const char *psrc = src;
5597 const char *pdst = dest;
5598 size_t slen;
5599
5600 if (psrc[0] == '.' && psrc[1] == '/') {
5601 psrc += 2;
5602 }
5603 if (pdst[0] == '.' && pdst[1] == '/') {
5604 pdst += 2;
5605 }
5606 if ((slen = strlen(psrc)) > strlen(pdst)) {
5607 return False;
5608 }
5609 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5610 }
5611
5612 /*
5613 * Do the notify calls from a rename
5614 */
5615
5616 static void notify_rename(connection_struct *conn, bool is_dir,
5617 const char *oldpath, const char *newpath)
5618 {
5619 char *olddir, *newdir;
5620 const char *oldname, *newname;
5621 uint32 mask;
5622
5623 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5624 : FILE_NOTIFY_CHANGE_FILE_NAME;
5625
5626 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5627 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5628 TALLOC_FREE(olddir);
5629 return;
5630 }
5631
5632 if (strcmp(olddir, newdir) == 0) {
5633 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5634 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5635 }
5636 else {
5637 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5638 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5639 }
5640 TALLOC_FREE(olddir);
5641 TALLOC_FREE(newdir);
5642
5643 /* this is a strange one. w2k3 gives an additional event for
5644 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5645 files, but not directories */
5646 if (!is_dir) {
5647 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5648 FILE_NOTIFY_CHANGE_ATTRIBUTES
5649 |FILE_NOTIFY_CHANGE_CREATION,
5650 newpath);
5651 }
5652 }
5653
5654 /****************************************************************************
5655 Rename an open file - given an fsp.
5656 ****************************************************************************/
5657
5658 NTSTATUS rename_internals_fsp(connection_struct *conn,
5659 files_struct *fsp,
5660 char *newname,
5661 const char *newname_last_component,
5662 uint32 attrs,
5663 bool replace_if_exists)
5664 {
5665 TALLOC_CTX *ctx = talloc_tos();
5666 SMB_STRUCT_STAT sbuf, sbuf1;
5667 NTSTATUS status = NT_STATUS_OK;
5668 struct share_mode_lock *lck = NULL;
5669 bool dst_exists, old_is_stream, new_is_stream;
5670
5671 ZERO_STRUCT(sbuf);
5672
5673 status = check_name(conn, newname);
5674 if (!NT_STATUS_IS_OK(status)) {
5675 return status;
5676 }
5677
5678 /* Ensure newname contains a '/' */
5679 if(strrchr_m(newname,'/') == 0) {
5680 newname = talloc_asprintf(ctx,
5681 "./%s",
5682 newname);
5683 if (!newname) {
5684 return NT_STATUS_NO_MEMORY;
5685 }
5686 }
5687
5688 /*
5689 * Check for special case with case preserving and not
5690 * case sensitive. If the old last component differs from the original
5691 * last component only by case, then we should allow
5692 * the rename (user is trying to change the case of the
5693 * filename).
5694 */
5695
5696 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5697 strequal(newname, fsp->fsp_name)) {
5698 char *p;
5699 char *newname_modified_last_component = NULL;
5700
5701 /*
5702 * Get the last component of the modified name.
5703 * Note that we guarantee that newname contains a '/'
5704 * character above.
5705 */
5706 p = strrchr_m(newname,'/');
5707 newname_modified_last_component = talloc_strdup(ctx,
5708 p+1);
5709 if (!newname_modified_last_component) {
5710 return NT_STATUS_NO_MEMORY;
5711 }
5712
5713 if(strcsequal(newname_modified_last_component,
5714 newname_last_component) == False) {
5715 /*
5716 * Replace the modified last component with
5717 * the original.
5718 */
5719 *p = '\0'; /* Truncate at the '/' */
5720 newname = talloc_asprintf(ctx,
5721 "%s/%s",
5722 newname,
5723 newname_last_component);
5724 }
5725 }
5726
5727 /*
5728 * If the src and dest names are identical - including case,
5729 * don't do the rename, just return success.
5730 */
5731
5732 if (strcsequal(fsp->fsp_name, newname)) {
5733 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5734 newname));
5735 return NT_STATUS_OK;
5736 }
5737
5738 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5739 new_is_stream = is_ntfs_stream_name(newname);
5740
5741 /* Return the correct error code if both names aren't streams. */
5742 if (!old_is_stream && new_is_stream) {
5743 return NT_STATUS_OBJECT_NAME_INVALID;
5744 }
5745
5746 if (old_is_stream && !new_is_stream) {
5747 return NT_STATUS_INVALID_PARAMETER;
5748 }
5749
5750 /*
5751 * Have vfs_object_exist also fill sbuf1
5752 */
5753 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5754
5755 if(!replace_if_exists && dst_exists) {
5756 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5757 fsp->fsp_name,newname));
5758 return NT_STATUS_OBJECT_NAME_COLLISION;
5759 }
5760
5761 if (dst_exists) {
5762 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5763 files_struct *dst_fsp = file_find_di_first(fileid);
5764 /* The file can be open when renaming a stream */
5765 if (dst_fsp && !new_is_stream) {
5766 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5767 return NT_STATUS_ACCESS_DENIED;
5768 }
5769 }
5770
5771 /* Ensure we have a valid stat struct for the source. */
5772 if (fsp->fh->fd != -1) {
5773 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5774 return map_nt_error_from_unix(errno);
5775 }
5776 } else {
5777 int ret = -1;
5778 if (fsp->posix_open) {
5779 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5780 } else {
5781 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5782 }
5783 if (ret == -1) {
5784 return map_nt_error_from_unix(errno);
5785 }
5786 }
5787
5788 status = can_rename(conn, fsp, attrs, &sbuf);
5789
5790 if (!NT_STATUS_IS_OK(status)) {
5791 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5792 nt_errstr(status), fsp->fsp_name,newname));
5793 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5794 status = NT_STATUS_ACCESS_DENIED;
5795 return status;
5796 }
5797
5798 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5799 return NT_STATUS_ACCESS_DENIED;
5800 }
5801
5802 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5803 NULL);
5804
5805 /*
5806 * We have the file open ourselves, so not being able to get the
5807 * corresponding share mode lock is a fatal error.
5808 */
5809
5810 SMB_ASSERT(lck != NULL);
5811
5812 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5813 uint32 create_options = fsp->fh->private_options;
5814
5815 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5816 fsp->fsp_name,newname));
5817
5818 if (lp_map_archive(SNUM(conn)) ||
5819 lp_store_dos_attributes(SNUM(conn))) {
5820 /* We must set the archive bit on the newly
5821 renamed file. */
5822 if (SMB_VFS_STAT(conn,newname,&sbuf1) == 0) {
5823 uint32_t old_dosmode = dos_mode(conn,
5824 newname,
5825 &sbuf1);
5826 file_set_dosmode(conn,
5827 newname,
5828 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
5829 &sbuf1,
5830 NULL,
5831 true);
5832 }
5833 }
5834
5835 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5836
5837 rename_open_files(conn, lck, newname);
5838
5839 /*
5840 * A rename acts as a new file create w.r.t. allowing an initial delete
5841 * on close, probably because in Windows there is a new handle to the
5842 * new file. If initial delete on close was requested but not
5843 * originally set, we need to set it here. This is probably not 100% correct,
5844 * but will work for the CIFSFS client which in non-posix mode
5845 * depends on these semantics. JRA.
5846 */
5847
5848 if (create_options & FILE_DELETE_ON_CLOSE) {
5849 status = can_set_delete_on_close(fsp, True, 0);
5850
5851 if (NT_STATUS_IS_OK(status)) {
5852 /* Note that here we set the *inital* delete on close flag,
5853 * not the regular one. The magic gets handled in close. */
5854 fsp->initial_delete_on_close = True;
5855 }
5856 }
5857 TALLOC_FREE(lck);
5858 return NT_STATUS_OK;
5859 }
5860
5861 TALLOC_FREE(lck);
5862
5863 if (errno == ENOTDIR || errno == EISDIR) {
5864 status = NT_STATUS_OBJECT_NAME_COLLISION;
5865 } else {
5866 status = map_nt_error_from_unix(errno);
5867 }
5868
5869 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5870 nt_errstr(status), fsp->fsp_name,newname));
5871
5872 return status;
5873 }
5874
5875 /****************************************************************************
5876 The guts of the rename command, split out so it may be called by the NT SMB
5877 code.
5878 ****************************************************************************/
5879
5880 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5881 connection_struct *conn,
5882 struct smb_request *req,
5883 const char *name_in,
5884 const char *newname_in,
5885 uint32 attrs,
5886 bool replace_if_exists,
5887 bool src_has_wild,
5888 bool dest_has_wild,
5889 uint32_t access_mask)
5890 {
5891 char *directory = NULL;
5892 char *mask = NULL;
5893 char *last_component_src = NULL;
5894 char *last_component_dest = NULL;
5895 char *name = NULL;
5896 char *newname = NULL;
5897 char *p;
5898 int count=0;
5899 NTSTATUS status = NT_STATUS_OK;
5900 SMB_STRUCT_STAT sbuf1, sbuf2;
5901 struct smb_Dir *dir_hnd = NULL;
5902 const char *dname;
5903 long offset = 0;
5904 int create_options = 0;
5905 bool posix_pathnames = lp_posix_pathnames();
5906
5907 ZERO_STRUCT(sbuf1);
5908 ZERO_STRUCT(sbuf2);
5909
5910 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5911 &last_component_src, &sbuf1);
5912 if (!NT_STATUS_IS_OK(status)) {
5913 return status;
5914 }
5915
5916 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5917 &last_component_dest, &sbuf2);
5918 if (!NT_STATUS_IS_OK(status)) {
5919 return status;
5920 }
5921
5922 /*
5923 * Split the old name into directory and last component
5924 * strings. Note that unix_convert may have stripped off a
5925 * leading ./ from both name and newname if the rename is
5926 * at the root of the share. We need to make sure either both
5927 * name and newname contain a / character or neither of them do
5928 * as this is checked in resolve_wildcards().
5929 */
5930
5931 p = strrchr_m(name,'/');
5932 if (!p) {
5933 directory = talloc_strdup(ctx, ".");
5934 if (!directory) {
5935 return NT_STATUS_NO_MEMORY;
5936 }
5937 mask = name;
5938 } else {
5939 *p = 0;
5940 directory = talloc_strdup(ctx, name);
5941 if (!directory) {
5942 return NT_STATUS_NO_MEMORY;
5943 }
5944 mask = p+1;
5945 *p = '/'; /* Replace needed for exceptional test below. */
5946 }
5947
5948 /*
5949 * We should only check the mangled cache
5950 * here if unix_convert failed. This means
5951 * that the path in 'mask' doesn't exist
5952 * on the file system and so we need to look
5953 * for a possible mangle. This patch from
5954 * Tine Smukavec <valentin.smukavec@hermes.si>.
5955 */
5956
5957 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5958 char *new_mask = NULL;
5959 mangle_lookup_name_from_8_3(ctx,
5960 mask,
5961 &new_mask,
5962 conn->params );
5963 if (new_mask) {
5964 mask = new_mask;
5965 }
5966 }
5967
5968 if (!src_has_wild) {
5969 files_struct *fsp;
5970
5971 /*
5972 * No wildcards - just process the one file.
5973 */
5974 /* Add a terminating '/' to the directory name. */
5975 directory = talloc_asprintf_append(directory,
5976 "/%s",
5977 mask);
5978 if (!directory) {
5979 return NT_STATUS_NO_MEMORY;
5980 }
5981
5982 /* Ensure newname contains a '/' also */
5983 if(strrchr_m(newname,'/') == 0) {
5984 newname = talloc_asprintf(ctx,
5985 "./%s",
5986 newname);
5987 if (!newname) {
5988 return NT_STATUS_NO_MEMORY;
5989 }
5990 }
5991
5992 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5993 "case_preserve = %d, short case preserve = %d, "
5994 "directory = %s, newname = %s, "
5995 "last_component_dest = %s\n",
5996 conn->case_sensitive, conn->case_preserve,
5997 conn->short_case_preserve, directory,
5998 newname, last_component_dest));
5999
6000 /* The dest name still may have wildcards. */
6001 if (dest_has_wild) {
6002 char *mod_newname = NULL;
6003 if (!resolve_wildcards(ctx,
6004 directory,newname,&mod_newname)) {
6005 DEBUG(6, ("rename_internals: resolve_wildcards "
6006 "%s %s failed\n",
6007 directory,
6008 newname));
6009 return NT_STATUS_NO_MEMORY;
6010 }
6011 newname = mod_newname;
6012 }
6013
6014 ZERO_STRUCT(sbuf1);
6015 if (posix_pathnames) {
6016 SMB_VFS_LSTAT(conn, directory, &sbuf1);
6017 } else {
6018 SMB_VFS_STAT(conn, directory, &sbuf1);
6019 }
6020
6021 if (S_ISDIR(sbuf1.st_mode)) {
6022 create_options |= FILE_DIRECTORY_FILE;
6023 }
6024
6025 status = SMB_VFS_CREATE_FILE(
6026 conn, /* conn */
6027 req, /* req */
6028 0, /* root_dir_fid */
6029 directory, /* fname */
6030 0, /* create_file_flags */
6031 access_mask, /* access_mask */
6032 (FILE_SHARE_READ | /* share_access */
6033 FILE_SHARE_WRITE),
6034 FILE_OPEN, /* create_disposition*/
6035 create_options, /* create_options */
6036 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6037 0, /* oplock_request */
6038 0, /* allocation_size */
6039 NULL, /* sd */
6040 NULL, /* ea_list */
6041 &fsp, /* result */
6042 NULL, /* pinfo */
6043 &sbuf1); /* psbuf */
6044
6045 if (!NT_STATUS_IS_OK(status)) {
6046 DEBUG(3, ("Could not open rename source %s: %s\n",
6047 directory, nt_errstr(status)));
6048 return status;
6049 }
6050
6051 status = rename_internals_fsp(conn, fsp, newname,
6052 last_component_dest,
6053 attrs, replace_if_exists);
6054
6055 close_file(req, fsp, NORMAL_CLOSE);
6056
6057 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6058 nt_errstr(status), directory,newname));
6059
6060 return status;
6061 }
6062
6063 /*
6064 * Wildcards - process each file that matches.
6065 */
6066 if (strequal(mask,"????????.???")) {
6067 mask[0] = '*';
6068 mask[1] = '\0';
6069 }
6070
6071 status = check_name(conn, directory);
6072 if (!NT_STATUS_IS_OK(status)) {
6073 return status;
6074 }
6075
6076 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
6077 if (dir_hnd == NULL) {
6078 return map_nt_error_from_unix(errno);
6079 }
6080
6081 status = NT_STATUS_NO_SUCH_FILE;
6082 /*
6083 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6084 * - gentest fix. JRA
6085 */
6086
6087 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6088 files_struct *fsp = NULL;
6089 char *fname = NULL;
6090 char *destname = NULL;
6091 bool sysdir_entry = False;
6092
6093 /* Quick check for "." and ".." */
6094 if (ISDOT(dname) || ISDOTDOT(dname)) {
6095 if (attrs & aDIR) {
6096 sysdir_entry = True;
6097 } else {
6098 continue;
6099 }
6100 }
6101
6102 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6103 continue;
6104 }
6105
6106 if(!mask_match(dname, mask, conn->case_sensitive)) {
6107 continue;
6108 }
6109
6110 if (sysdir_entry) {
6111 status = NT_STATUS_OBJECT_NAME_INVALID;
6112 break;
6113 }
6114
6115 fname = talloc_asprintf(ctx,
6116 "%s/%s",
6117 directory,
6118 dname);
6119 if (!fname) {
6120 return NT_STATUS_NO_MEMORY;
6121 }
6122
6123 if (!resolve_wildcards(ctx,
6124 fname,newname,&destname)) {
6125 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6126 fname, destname));
6127 TALLOC_FREE(fname);
6128 continue;
6129 }
6130 if (!destname) {
6131 return NT_STATUS_NO_MEMORY;
6132 }
6133
6134 ZERO_STRUCT(sbuf1);
6135 if (posix_pathnames) {
6136 SMB_VFS_LSTAT(conn, fname, &sbuf1);
6137 } else {
6138 SMB_VFS_STAT(conn, fname, &sbuf1);
6139 }
6140
6141 create_options = 0;
6142
6143 if (S_ISDIR(sbuf1.st_mode)) {
6144 create_options |= FILE_DIRECTORY_FILE;
6145 }
6146
6147 status = SMB_VFS_CREATE_FILE(
6148 conn, /* conn */
6149 req, /* req */
6150 0, /* root_dir_fid */
6151 fname, /* fname */
6152 0, /* create_file_flags */
6153 access_mask, /* access_mask */
6154 (FILE_SHARE_READ | /* share_access */
6155 FILE_SHARE_WRITE),
6156 FILE_OPEN, /* create_disposition*/
6157 create_options, /* create_options */
6158 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6159 0, /* oplock_request */
6160 0, /* allocation_size */
6161 NULL, /* sd */
6162 NULL, /* ea_list */
6163 &fsp, /* result */
6164 NULL, /* pinfo */
6165 &sbuf1); /* psbuf */
6166
6167 if (!NT_STATUS_IS_OK(status)) {
6168 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6169 "returned %s rename %s -> %s\n",
6170 nt_errstr(status), directory, newname));
6171 break;
6172 }
6173
6174 status = rename_internals_fsp(conn, fsp, destname, dname,
6175 attrs, replace_if_exists);
6176
6177 close_file(req, fsp, NORMAL_CLOSE);
6178
6179 if (!NT_STATUS_IS_OK(status)) {
6180 DEBUG(3, ("rename_internals_fsp returned %s for "
6181 "rename %s -> %s\n", nt_errstr(status),
6182 directory, newname));
6183 break;
6184 }
6185
6186 count++;
6187
6188 DEBUG(3,("rename_internals: doing rename on %s -> "
6189 "%s\n",fname,destname));
6190
6191 TALLOC_FREE(fname);
6192 TALLOC_FREE(destname);
6193 }
6194 TALLOC_FREE(dir_hnd);
6195
6196 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6197 status = map_nt_error_from_unix(errno);
6198 }
6199
6200 return status;
6201 }
6202
6203 /****************************************************************************
6204 Reply to a mv.
6205 ****************************************************************************/
6206
6207 void reply_mv(struct smb_request *req)
6208 {
6209 connection_struct *conn = req->conn;
6210 char *name = NULL;
6211 char *newname = NULL;
6212 const char *p;
6213 uint32 attrs;
6214 NTSTATUS status;
6215 bool src_has_wcard = False;
6216 bool dest_has_wcard = False;
6217 TALLOC_CTX *ctx = talloc_tos();
6218
6219 START_PROFILE(SMBmv);
6220
6221 if (req->wct < 1) {
6222 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6223 END_PROFILE(SMBmv);
6224 return;
6225 }
6226
6227 attrs = SVAL(req->vwv+0, 0);
6228
6229 p = (const char *)req->buf + 1;
6230 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6231 &status, &src_has_wcard);
6232 if (!NT_STATUS_IS_OK(status)) {
6233 reply_nterror(req, status);
6234 END_PROFILE(SMBmv);
6235 return;
6236 }
6237 p++;
6238 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6239 &status, &dest_has_wcard);
6240 if (!NT_STATUS_IS_OK(status)) {
6241 reply_nterror(req, status);
6242 END_PROFILE(SMBmv);
6243 return;
6244 }
6245
6246 status = resolve_dfspath_wcard(ctx, conn,
6247 req->flags2 & FLAGS2_DFS_PATHNAMES,
6248 name,
6249 &name,
6250 &src_has_wcard);
6251 if (!NT_STATUS_IS_OK(status)) {
6252 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6253 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6254 ERRSRV, ERRbadpath);
6255 END_PROFILE(SMBmv);
6256 return;
6257 }
6258 reply_nterror(req, status);
6259 END_PROFILE(SMBmv);
6260 return;
6261 }
6262
6263 status = resolve_dfspath_wcard(ctx, conn,
6264 req->flags2 & FLAGS2_DFS_PATHNAMES,
6265 newname,
6266 &newname,
6267 &dest_has_wcard);
6268 if (!NT_STATUS_IS_OK(status)) {
6269 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6270 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6271 ERRSRV, ERRbadpath);
6272 END_PROFILE(SMBmv);
6273 return;
6274 }
6275 reply_nterror(req, status);
6276 END_PROFILE(SMBmv);
6277 return;
6278 }
6279
6280 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6281
6282 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6283 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6284 if (!NT_STATUS_IS_OK(status)) {
6285 if (open_was_deferred(req->mid)) {
6286 /* We have re-scheduled this call. */
6287 END_PROFILE(SMBmv);
6288 return;
6289 }
6290 reply_nterror(req, status);
6291 END_PROFILE(SMBmv);
6292 return;
6293 }
6294
6295 reply_outbuf(req, 0, 0);
6296
6297 END_PROFILE(SMBmv);
6298 return;
6299 }
6300
6301 /*******************************************************************
6302 Copy a file as part of a reply_copy.
6303 ******************************************************************/
6304
6305 /*
6306 * TODO: check error codes on all callers
6307 */
6308
6309 NTSTATUS copy_file(TALLOC_CTX *ctx,
6310 connection_struct *conn,
6311 const char *src,
6312 const char *dest1,
6313 int ofun,
6314 int count,
6315 bool target_is_directory)
6316 {
6317 SMB_STRUCT_STAT src_sbuf, sbuf2;
6318 SMB_OFF_T ret=-1;
6319 files_struct *fsp1,*fsp2;
6320 char *dest = NULL;
6321 uint32 dosattrs;
6322 uint32 new_create_disposition;
6323 NTSTATUS status;
6324
6325 dest = talloc_strdup(ctx, dest1);
6326 if (!dest) {
6327 return NT_STATUS_NO_MEMORY;
6328 }
6329 if (target_is_directory) {
6330 const char *p = strrchr_m(src,'/');
6331 if (p) {
6332 p++;
6333 } else {
6334 p = src;
6335 }
6336 dest = talloc_asprintf_append(dest,
6337 "/%s",
6338 p);
6339 if (!dest) {
6340 return NT_STATUS_NO_MEMORY;
6341 }
6342 }
6343
6344 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6345 TALLOC_FREE(dest);
6346 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6347 }
6348
6349 if (!target_is_directory && count) {
6350 new_create_disposition = FILE_OPEN;
6351 } else {
6352 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6353 NULL, NULL, &new_create_disposition, NULL)) {
6354 TALLOC_FREE(dest);
6355 return NT_STATUS_INVALID_PARAMETER;
6356 }
6357 }
6358
6359 status = SMB_VFS_CREATE_FILE(
6360 conn, /* conn */
6361 NULL, /* req */
6362 0, /* root_dir_fid */
6363 src, /* fname */
6364 0, /* create_file_flags */
6365 FILE_GENERIC_READ, /* access_mask */
6366 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6367 FILE_OPEN, /* create_disposition*/
6368 0, /* create_options */
6369 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6370 INTERNAL_OPEN_ONLY, /* oplock_request */
6371 0, /* allocation_size */
6372 NULL, /* sd */
6373 NULL, /* ea_list */
6374 &fsp1, /* result */
6375 NULL, /* pinfo */
6376 &src_sbuf); /* psbuf */
6377
6378 if (!NT_STATUS_IS_OK(status)) {
6379 TALLOC_FREE(dest);
6380 return status;
6381 }
6382
6383 dosattrs = dos_mode(conn, src, &src_sbuf);
6384 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6385 ZERO_STRUCTP(&sbuf2);
6386 }
6387
6388 status = SMB_VFS_CREATE_FILE(
6389 conn, /* conn */
6390 NULL, /* req */
6391 0, /* root_dir_fid */
6392 dest, /* fname */
6393 0, /* create_file_flags */
6394 FILE_GENERIC_WRITE, /* access_mask */
6395 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6396 new_create_disposition, /* create_disposition*/
6397 0, /* create_options */
6398 dosattrs, /* file_attributes */
6399 INTERNAL_OPEN_ONLY, /* oplock_request */
6400 0, /* allocation_size */
6401 NULL, /* sd */
6402 NULL, /* ea_list */
6403 &fsp2, /* result */
6404 NULL, /* pinfo */
6405 &sbuf2); /* psbuf */
6406
6407 TALLOC_FREE(dest);
6408
6409 if (!NT_STATUS_IS_OK(status)) {
6410 close_file(NULL, fsp1, ERROR_CLOSE);
6411 return status;
6412 }
6413
6414 if ((ofun&3) == 1) {
6415 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6416 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6417 /*
6418 * Stop the copy from occurring.
6419 */
6420 ret = -1;
6421 src_sbuf.st_size = 0;
6422 }
6423 }
6424
6425 if (src_sbuf.st_size) {
6426 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6427 }
6428
6429 close_file(NULL, fsp1, NORMAL_CLOSE);
6430
6431 /* Ensure the modtime is set correctly on the destination file. */
6432 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6433
6434 /*
6435 * As we are opening fsp1 read-only we only expect
6436 * an error on close on fsp2 if we are out of space.
6437 * Thus we don't look at the error return from the
6438 * close of fsp1.
6439 */
6440 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6441
6442 if (!NT_STATUS_IS_OK(status)) {
6443 return status;
6444 }
6445
6446 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6447 return NT_STATUS_DISK_FULL;
6448 }
6449
6450 return NT_STATUS_OK;
6451 }
6452
6453 /****************************************************************************
6454 Reply to a file copy.
6455 ****************************************************************************/
6456
6457 void reply_copy(struct smb_request *req)
6458 {
6459 connection_struct *conn = req->conn;
6460 char *name = NULL;
6461 char *newname = NULL;
6462 char *directory = NULL;
6463 const char *mask = NULL;
6464 const char mask_star[] = "*";
6465 const char *p;
6466 int count=0;
6467 int error = ERRnoaccess;
6468 int err = 0;
6469 int tid2;
6470 int ofun;
6471 int flags;
6472 bool target_is_directory=False;
6473 bool source_has_wild = False;
6474 bool dest_has_wild = False;
6475 SMB_STRUCT_STAT sbuf1, sbuf2;
6476 NTSTATUS status;
6477 TALLOC_CTX *ctx = talloc_tos();
6478
6479 START_PROFILE(SMBcopy);
6480
6481 if (req->wct < 3) {
6482 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6483 END_PROFILE(SMBcopy);
6484 return;
6485 }
6486
6487 tid2 = SVAL(req->vwv+0, 0);
6488 ofun = SVAL(req->vwv+1, 0);
6489 flags = SVAL(req->vwv+2, 0);
6490
6491 p = (const char *)req->buf;
6492 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6493 &status, &source_has_wild);
6494 if (!NT_STATUS_IS_OK(status)) {
6495 reply_nterror(req, status);
6496 END_PROFILE(SMBcopy);
6497 return;
6498 }
6499 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6500 &status, &dest_has_wild);
6501 if (!NT_STATUS_IS_OK(status)) {
6502 reply_nterror(req, status);
6503 END_PROFILE(SMBcopy);
6504 return;
6505 }
6506
6507 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6508
6509 if (tid2 != conn->cnum) {
6510 /* can't currently handle inter share copies XXXX */
6511 DEBUG(3,("Rejecting inter-share copy\n"));
6512 reply_doserror(req, ERRSRV, ERRinvdevice);
6513 END_PROFILE(SMBcopy);
6514 return;
6515 }
6516
6517 status = resolve_dfspath_wcard(ctx, conn,
6518 req->flags2 & FLAGS2_DFS_PATHNAMES,
6519 name,
6520 &name,
6521 &source_has_wild);
6522 if (!NT_STATUS_IS_OK(status)) {
6523 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6524 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6525 ERRSRV, ERRbadpath);
6526 END_PROFILE(SMBcopy);
6527 return;
6528 }
6529 reply_nterror(req, status);
6530 END_PROFILE(SMBcopy);
6531 return;
6532 }
6533
6534 status = resolve_dfspath_wcard(ctx, conn,
6535 req->flags2 & FLAGS2_DFS_PATHNAMES,
6536 newname,
6537 &newname,
6538 &dest_has_wild);
6539 if (!NT_STATUS_IS_OK(status)) {
6540 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6541 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6542 ERRSRV, ERRbadpath);
6543 END_PROFILE(SMBcopy);
6544 return;
6545 }
6546 reply_nterror(req, status);
6547 END_PROFILE(SMBcopy);
6548 return;
6549 }
6550
6551 status = unix_convert(ctx, conn, name, source_has_wild,
6552 &name, NULL, &sbuf1);
6553 if (!NT_STATUS_IS_OK(status)) {
6554 reply_nterror(req, status);
6555 END_PROFILE(SMBcopy);
6556 return;
6557 }
6558
6559 status = unix_convert(ctx, conn, newname, dest_has_wild,
6560 &newname, NULL, &sbuf2);
6561 if (!NT_STATUS_IS_OK(status)) {
6562 reply_nterror(req, status);
6563 END_PROFILE(SMBcopy);
6564 return;
6565 }
6566
6567 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6568
6569 if ((flags&1) && target_is_directory) {
6570 reply_doserror(req, ERRDOS, ERRbadfile);
6571 END_PROFILE(SMBcopy);
6572 return;
6573 }
6574
6575 if ((flags&2) && !target_is_directory) {
6576 reply_doserror(req, ERRDOS, ERRbadpath);
6577 END_PROFILE(SMBcopy);
6578 return;
6579 }
6580
6581 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6582 /* wants a tree copy! XXXX */
6583 DEBUG(3,("Rejecting tree copy\n"));
6584 reply_doserror(req, ERRSRV, ERRerror);
6585 END_PROFILE(SMBcopy);
6586 return;
6587 }
6588
6589 p = strrchr_m(name,'/');
6590 if (p != NULL) {
6591 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6592 mask = p+1;
6593 } else {
6594 directory = talloc_strdup(ctx, "./");
6595 mask = name;
6596 }
6597
6598 if (!directory) {
6599 reply_nterror(req, NT_STATUS_NO_MEMORY);
6600 END_PROFILE(SMBcopy);
6601 return;
6602 }
6603
6604 /*
6605 * We should only check the mangled cache
6606 * here if unix_convert failed. This means
6607 * that the path in 'mask' doesn't exist
6608 * on the file system and so we need to look
6609 * for a possible mangle. This patch from
6610 * Tine Smukavec <valentin.smukavec@hermes.si>.
6611 */
6612
6613 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6614 char *new_mask = NULL;
6615 mangle_lookup_name_from_8_3(ctx,
6616 mask,
6617 &new_mask,
6618 conn->params );
6619 if (new_mask) {
6620 mask = new_mask;
6621 }
6622 }
6623
6624 if (!source_has_wild) {
6625 directory = talloc_asprintf_append(directory,
6626 "/%s",
6627 mask);
6628 if (dest_has_wild) {
6629 char *mod_newname = NULL;
6630 if (!resolve_wildcards(ctx,
6631 directory,newname,&mod_newname)) {
6632 reply_nterror(req, NT_STATUS_NO_MEMORY);
6633 END_PROFILE(SMBcopy);
6634 return;
6635 }
6636 newname = mod_newname;
6637 }
6638
6639 status = check_name(conn, directory);
6640 if (!NT_STATUS_IS_OK(status)) {
6641 reply_nterror(req, status);
6642 END_PROFILE(SMBcopy);
6643 return;
6644 }
6645
6646 status = check_name(conn, newname);
6647 if (!NT_STATUS_IS_OK(status)) {
6648 reply_nterror(req, status);
6649 END_PROFILE(SMBcopy);
6650 return;
6651 }
6652
6653 status = copy_file(ctx,conn,directory,newname,ofun,
6654 count,target_is_directory);
6655
6656 if(!NT_STATUS_IS_OK(status)) {
6657 reply_nterror(req, status);
6658 END_PROFILE(SMBcopy);
6659 return;
6660 } else {
6661 count++;
6662 }
6663 } else {
6664 struct smb_Dir *dir_hnd = NULL;
6665 const char *dname = NULL;
6666 long offset = 0;
6667
6668 if (strequal(mask,"????????.???")) {
6669 mask = mask_star;
6670 }
6671
6672 status = check_name(conn, directory);
6673 if (!NT_STATUS_IS_OK(status)) {
6674 reply_nterror(req, status);
6675 END_PROFILE(SMBcopy);
6676 return;
6677 }
6678
6679 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6680 if (dir_hnd == NULL) {
6681 status = map_nt_error_from_unix(errno);
6682 reply_nterror(req, status);
6683 END_PROFILE(SMBcopy);
6684 return;
6685 }
6686
6687 error = ERRbadfile;
6688
6689 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6690 char *destname = NULL;
6691 char *fname = NULL;
6692
6693 if (ISDOT(dname) || ISDOTDOT(dname)) {
6694 continue;
6695 }
6696
6697 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6698 continue;
6699 }
6700
6701 if(!mask_match(dname, mask, conn->case_sensitive)) {
6702 continue;
6703 }
6704
6705 error = ERRnoaccess;
6706 fname = talloc_asprintf(ctx,
6707 "%s/%s",
6708 directory,
6709 dname);
6710 if (!fname) {
6711 TALLOC_FREE(dir_hnd);
6712 reply_nterror(req, NT_STATUS_NO_MEMORY);
6713 END_PROFILE(SMBcopy);
6714 return;
6715 }
6716
6717 if (!resolve_wildcards(ctx,
6718 fname,newname,&destname)) {
6719 continue;
6720 }
6721 if (!destname) {
6722 TALLOC_FREE(dir_hnd);
6723 reply_nterror(req, NT_STATUS_NO_MEMORY);
6724 END_PROFILE(SMBcopy);
6725 return;
6726 }
6727
6728 status = check_name(conn, fname);
6729 if (!NT_STATUS_IS_OK(status)) {
6730 TALLOC_FREE(dir_hnd);
6731 reply_nterror(req, status);
6732 END_PROFILE(SMBcopy);
6733 return;
6734 }
6735
6736 status = check_name(conn, destname);
6737 if (!NT_STATUS_IS_OK(status)) {
6738 TALLOC_FREE(dir_hnd);
6739 reply_nterror(req, status);
6740 END_PROFILE(SMBcopy);
6741 return;
6742 }
6743
6744 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6745
6746 status = copy_file(ctx,conn,fname,destname,ofun,
6747 count,target_is_directory);
6748 if (NT_STATUS_IS_OK(status)) {
6749 count++;
6750 }
6751 TALLOC_FREE(fname);
6752 TALLOC_FREE(destname);
6753 }
6754 TALLOC_FREE(dir_hnd);
6755 }
6756
6757 if (count == 0) {
6758 if(err) {
6759 /* Error on close... */
6760 errno = err;
6761 reply_unixerror(req, ERRHRD, ERRgeneral);
6762 END_PROFILE(SMBcopy);
6763 return;
6764 }
6765
6766 reply_doserror(req, ERRDOS, error);
6767 END_PROFILE(SMBcopy);
6768 return;
6769 }
6770
6771 reply_outbuf(req, 1, 0);
6772 SSVAL(req->outbuf,smb_vwv0,count);
6773
6774 END_PROFILE(SMBcopy);
6775 return;
6776 }
6777
6778 #undef DBGC_CLASS
6779 #define DBGC_CLASS DBGC_LOCKING
6780
6781 /****************************************************************************
6782 Get a lock pid, dealing with large count requests.
6783 ****************************************************************************/
6784
6785 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6786 bool large_file_format)
6787 {
6788 if(!large_file_format)
6789 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6790 else
6791 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6792 }
6793
6794 /****************************************************************************
6795 Get a lock count, dealing with large count requests.
6796 ****************************************************************************/
6797
6798 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6799 bool large_file_format)
6800 {
6801 uint64_t count = 0;
6802
6803 if(!large_file_format) {
6804 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6805 } else {
6806
6807 #if defined(HAVE_LONGLONG)
6808 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6809 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6810 #else /* HAVE_LONGLONG */
6811
6812 /*
6813 * NT4.x seems to be broken in that it sends large file (64 bit)
6814 * lockingX calls even if the CAP_LARGE_FILES was *not*
6815 * negotiated. For boxes without large unsigned ints truncate the
6816 * lock count by dropping the top 32 bits.
6817 */
6818
6819 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6820 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6821 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6822 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6823 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6824 }
6825
6826 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6827 #endif /* HAVE_LONGLONG */
6828 }
6829
6830 return count;
6831 }
6832
6833 #if !defined(HAVE_LONGLONG)
6834 /****************************************************************************
6835 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6836 ****************************************************************************/
6837
6838 static uint32 map_lock_offset(uint32 high, uint32 low)
6839 {
6840 unsigned int i;
6841 uint32 mask = 0;
6842 uint32 highcopy = high;
6843
6844 /*
6845 * Try and find out how many significant bits there are in high.
6846 */
6847
6848 for(i = 0; highcopy; i++)
6849 highcopy >>= 1;
6850
6851 /*
6852 * We use 31 bits not 32 here as POSIX
6853 * lock offsets may not be negative.
6854 */
6855
6856 mask = (~0) << (31 - i);
6857
6858 if(low & mask)
6859 return 0; /* Fail. */
6860
6861 high <<= (31 - i);
6862
6863 return (high|low);
6864 }
6865 #endif /* !defined(HAVE_LONGLONG) */
6866
6867 /****************************************************************************
6868 Get a lock offset, dealing with large offset requests.
6869 ****************************************************************************/
6870
6871 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6872 bool large_file_format, bool *err)
6873 {
6874 uint64_t offset = 0;
6875
6876 *err = False;
6877
6878 if(!large_file_format) {
6879 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6880 } else {
6881
6882 #if defined(HAVE_LONGLONG)
6883 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6884 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6885 #else /* HAVE_LONGLONG */
6886
6887 /*
6888 * NT4.x seems to be broken in that it sends large file (64 bit)
6889 * lockingX calls even if the CAP_LARGE_FILES was *not*
6890 * negotiated. For boxes without large unsigned ints mangle the
6891 * lock offset by mapping the top 32 bits onto the lower 32.
6892 */
6893
6894 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6895 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6896 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6897 uint32 new_low = 0;
6898
6899 if((new_low = map_lock_offset(high, low)) == 0) {
6900 *err = True;
6901 return (uint64_t)-1;
6902 }
6903
6904 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6905 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6906 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6907 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6908 }
6909
6910 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6911 #endif /* HAVE_LONGLONG */
6912 }
6913
6914 return offset;
6915 }
6916
6917 /****************************************************************************
6918 Reply to a lockingX request.
6919 ****************************************************************************/
6920
6921 void reply_lockingX(struct smb_request *req)
6922 {
6923 connection_struct *conn = req->conn;
6924 files_struct *fsp;
6925 unsigned char locktype;
6926 unsigned char oplocklevel;
6927 uint16 num_ulocks;
6928 uint16 num_locks;
6929 uint64_t count = 0, offset = 0;
6930 uint32 lock_pid;
6931 int32 lock_timeout;
6932 int i;
6933 const uint8_t *data;
6934 bool large_file_format;
6935 bool err;
6936 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6937
6938 START_PROFILE(SMBlockingX);
6939
6940 if (req->wct < 8) {
6941 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6942 END_PROFILE(SMBlockingX);
6943 return;
6944 }
6945
6946 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
6947 locktype = CVAL(req->vwv+3, 0);
6948 oplocklevel = CVAL(req->vwv+3, 1);
6949 num_ulocks = SVAL(req->vwv+6, 0);
6950 num_locks = SVAL(req->vwv+7, 0);
6951 lock_timeout = IVAL(req->vwv+4, 0);
6952 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6953
6954 if (!check_fsp(conn, req, fsp)) {
6955 END_PROFILE(SMBlockingX);
6956 return;
6957 }
6958
6959 data = req->buf;
6960
6961 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6962 /* we don't support these - and CANCEL_LOCK makes w2k
6963 and XP reboot so I don't really want to be
6964 compatible! (tridge) */
6965 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6966 END_PROFILE(SMBlockingX);
6967 return;
6968 }
6969
6970 /* Check if this is an oplock break on a file
6971 we have granted an oplock on.
6972 */
6973 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6974 /* Client can insist on breaking to none. */
6975 bool break_to_none = (oplocklevel == 0);
6976 bool result;
6977
6978 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6979 "for fnum = %d\n", (unsigned int)oplocklevel,
6980 fsp->fnum ));
6981
6982 /*
6983 * Make sure we have granted an exclusive or batch oplock on
6984 * this file.
6985 */
6986
6987 if (fsp->oplock_type == 0) {
6988
6989 /* The Samba4 nbench simulator doesn't understand
6990 the difference between break to level2 and break
6991 to none from level2 - it sends oplock break
6992 replies in both cases. Don't keep logging an error
6993 message here - just ignore it. JRA. */
6994
6995 DEBUG(5,("reply_lockingX: Error : oplock break from "
6996 "client for fnum = %d (oplock=%d) and no "
6997 "oplock granted on this file (%s).\n",
6998 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6999
7000 /* if this is a pure oplock break request then don't
7001 * send a reply */
7002 if (num_locks == 0 && num_ulocks == 0) {
7003 END_PROFILE(SMBlockingX);
7004 return;
7005 } else {
7006 END_PROFILE(SMBlockingX);
7007 reply_doserror(req, ERRDOS, ERRlock);
7008 return;
7009 }
7010 }
7011
7012 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7013 (break_to_none)) {
7014 result = remove_oplock(fsp);
7015 } else {
7016 result = downgrade_oplock(fsp);
7017 }
7018
7019 if (!result) {
7020 DEBUG(0, ("reply_lockingX: error in removing "
7021 "oplock on file %s\n", fsp->fsp_name));
7022 /* Hmmm. Is this panic justified? */
7023 smb_panic("internal tdb error");
7024 }
7025
7026 reply_to_oplock_break_requests(fsp);
7027
7028 /* if this is a pure oplock break request then don't send a
7029 * reply */
7030 if (num_locks == 0 && num_ulocks == 0) {
7031 /* Sanity check - ensure a pure oplock break is not a
7032 chained request. */
7033 if(CVAL(req->vwv+0, 0) != 0xff)
7034 DEBUG(0,("reply_lockingX: Error : pure oplock "
7035 "break is a chained %d request !\n",
7036 (unsigned int)CVAL(req->vwv+0, 0)));
7037 END_PROFILE(SMBlockingX);
7038 return;
7039 }
7040 }
7041
7042 if (req->buflen <
7043 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7044 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7045 END_PROFILE(SMBlockingX);
7046 return;
7047 }
7048
7049 /* Data now points at the beginning of the list
7050 of smb_unlkrng structs */
7051 for(i = 0; i < (int)num_ulocks; i++) {
7052 lock_pid = get_lock_pid( data, i, large_file_format);
7053 count = get_lock_count( data, i, large_file_format);
7054 offset = get_lock_offset( data, i, large_file_format, &err);
7055
7056 /*
7057 * There is no error code marked "stupid client bug".... :-).
7058 */
7059 if(err) {
7060 END_PROFILE(SMBlockingX);
7061 reply_doserror(req, ERRDOS, ERRnoaccess);
7062 return;
7063 }
7064
7065 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
7066 "pid %u, file %s\n", (double)offset, (double)count,
7067 (unsigned int)lock_pid, fsp->fsp_name ));
7068
7069 status = do_unlock(smbd_messaging_context(),
7070 fsp,
7071 lock_pid,
7072 count,
7073 offset,
7074 WINDOWS_LOCK);
7075
7076 DEBUG(10, ("reply_lockingX: unlock returned %s\n",
7077 nt_errstr(status)));
7078
7079 if (NT_STATUS_V(status)) {
7080 END_PROFILE(SMBlockingX);
7081 reply_nterror(req, status);
7082 return;
7083 }
7084 }
7085
7086 /* Setup the timeout in seconds. */
7087
7088 if (!lp_blocking_locks(SNUM(conn))) {
7089 lock_timeout = 0;
7090 }
7091
7092 /* Now do any requested locks */
7093 data += ((large_file_format ? 20 : 10)*num_ulocks);
7094
7095 /* Data now points at the beginning of the list
7096 of smb_lkrng structs */
7097
7098 for(i = 0; i < (int)num_locks; i++) {
7099 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
7100 READ_LOCK:WRITE_LOCK);
7101 lock_pid = get_lock_pid( data, i, large_file_format);
7102 count = get_lock_count( data, i, large_file_format);
7103 offset = get_lock_offset( data, i, large_file_format, &err);
7104
7105 /*
7106 * There is no error code marked "stupid client bug".... :-).
7107 */
7108 if(err) {
7109 END_PROFILE(SMBlockingX);
7110 reply_doserror(req, ERRDOS, ERRnoaccess);
7111 return;
7112 }
7113
7114 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
7115 "%u, file %s timeout = %d\n", (double)offset,
7116 (double)count, (unsigned int)lock_pid,
7117 fsp->fsp_name, (int)lock_timeout ));
7118
7119 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7120 struct blocking_lock_record *blr = NULL;
7121
7122 if (lp_blocking_locks(SNUM(conn))) {
7123
7124 /* Schedule a message to ourselves to
7125 remove the blocking lock record and
7126 return the right error. */
7127
7128 blr = blocking_lock_cancel(fsp,
7129 lock_pid,
7130 offset,
7131 count,
7132 WINDOWS_LOCK,
7133 locktype,
7134 NT_STATUS_FILE_LOCK_CONFLICT);
7135 if (blr == NULL) {
7136 END_PROFILE(SMBlockingX);
7137 reply_nterror(
7138 req,
7139 NT_STATUS_DOS(
7140 ERRDOS,
7141 ERRcancelviolation));
7142 return;
7143 }
7144 }
7145 /* Remove a matching pending lock. */
7146 status = do_lock_cancel(fsp,
7147 lock_pid,
7148 count,
7149 offset,
7150 WINDOWS_LOCK,
7151 blr);
7152 } else {
7153 bool blocking_lock = lock_timeout ? True : False;
7154 bool defer_lock = False;
7155 struct byte_range_lock *br_lck;
7156 uint32 block_smbpid;
7157
7158 br_lck = do_lock(smbd_messaging_context(),
7159 fsp,
7160 lock_pid,
7161 count,
7162 offset,
7163 lock_type,
7164 WINDOWS_LOCK,
7165 blocking_lock,
7166 &status,
7167 &block_smbpid,
7168 NULL);
7169
7170 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7171 /* Windows internal resolution for blocking locks seems
7172 to be about 200ms... Don't wait for less than that. JRA. */
7173 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7174 lock_timeout = lp_lock_spin_time();
7175 }
7176 defer_lock = True;
7177 }
7178
7179 /* This heuristic seems to match W2K3 very well. If a
7180 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7181 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7182 far as I can tell. Replacement for do_lock_spin(). JRA. */
7183
7184 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7185 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7186 defer_lock = True;
7187 lock_timeout = lp_lock_spin_time();
7188 }
7189
7190 if (br_lck && defer_lock) {
7191 /*
7192 * A blocking lock was requested. Package up
7193 * this smb into a queued request and push it
7194 * onto the blocking lock queue.
7195 */
7196 if(push_blocking_lock_request(br_lck,
7197 req,
7198 fsp,
7199 lock_timeout,
7200 i,
7201 lock_pid,
7202 lock_type,
7203 WINDOWS_LOCK,
7204 offset,
7205 count,
7206 block_smbpid)) {
7207 TALLOC_FREE(br_lck);
7208 END_PROFILE(SMBlockingX);
7209 return;
7210 }
7211 }
7212
7213 TALLOC_FREE(br_lck);
7214 }
7215
7216 if (NT_STATUS_V(status)) {
7217 break;
7218 }
7219 }
7220
7221 /* If any of the above locks failed, then we must unlock
7222 all of the previous locks (X/Open spec). */
7223 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7224
7225 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7226 i = -1; /* we want to skip the for loop */
7227 }
7228
7229 /*
7230 * Ensure we don't do a remove on the lock that just failed,
7231 * as under POSIX rules, if we have a lock already there, we
7232 * will delete it (and we shouldn't) .....
7233 */
7234 for(i--; i >= 0; i--) {
7235 lock_pid = get_lock_pid( data, i, large_file_format);
7236 count = get_lock_count( data, i, large_file_format);
7237 offset = get_lock_offset( data, i, large_file_format,
7238 &err);
7239
7240 /*
7241 * There is no error code marked "stupid client
7242 * bug".... :-).
7243 */
7244 if(err) {
7245 END_PROFILE(SMBlockingX);
7246 reply_doserror(req, ERRDOS, ERRnoaccess);
7247 return;
7248 }
7249
7250 do_unlock(smbd_messaging_context(),
7251 fsp,
7252 lock_pid,
7253 count,
7254 offset,
7255 WINDOWS_LOCK);
7256 }
7257 END_PROFILE(SMBlockingX);
7258 reply_nterror(req, status);
7259 return;
7260 }
7261
7262 reply_outbuf(req, 2, 0);
7263
7264 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7265 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7266
7267 END_PROFILE(SMBlockingX);
7268 chain_reply(req);
7269 }
7270
7271 #undef DBGC_CLASS
7272 #define DBGC_CLASS DBGC_ALL
7273
7274 /****************************************************************************
7275 Reply to a SMBreadbmpx (read block multiplex) request.
7276 Always reply with an error, if someone has a platform really needs this,
7277 please contact vl@samba.org
7278 ****************************************************************************/
7279
7280 void reply_readbmpx(struct smb_request *req)
7281 {
7282 START_PROFILE(SMBreadBmpx);
7283 reply_doserror(req, ERRSRV, ERRuseSTD);
7284 END_PROFILE(SMBreadBmpx);
7285 return;
7286 }
7287
7288 /****************************************************************************
7289 Reply to a SMBreadbs (read block multiplex secondary) request.
7290 Always reply with an error, if someone has a platform really needs this,
7291 please contact vl@samba.org
7292 ****************************************************************************/
7293
7294 void reply_readbs(struct smb_request *req)
7295 {
7296 START_PROFILE(SMBreadBs);
7297 reply_doserror(req, ERRSRV, ERRuseSTD);
7298 END_PROFILE(SMBreadBs);
7299 return;
7300 }
7301
7302 /****************************************************************************
7303 Reply to a SMBsetattrE.
7304 ****************************************************************************/
7305
7306 void reply_setattrE(struct smb_request *req)
7307 {
7308 connection_struct *conn = req->conn;
7309 struct smb_file_time ft;
7310 files_struct *fsp;
7311 SMB_STRUCT_STAT sbuf;
7312 NTSTATUS status;
7313
7314 START_PROFILE(SMBsetattrE);
7315 ZERO_STRUCT(ft);
7316
7317 if (req->wct < 7) {
7318 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7319 END_PROFILE(SMBsetattrE);
7320 return;
7321 }
7322
7323 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7324
7325 if(!fsp || (fsp->conn != conn)) {
7326 reply_doserror(req, ERRDOS, ERRbadfid);
7327 END_PROFILE(SMBsetattrE);
7328 return;
7329 }
7330
7331
7332 /*
7333 * Convert the DOS times into unix times.
7334 */
7335
7336 ft.atime = convert_time_t_to_timespec(
7337 srv_make_unix_date2(req->vwv+3));
7338 ft.mtime = convert_time_t_to_timespec(
7339 srv_make_unix_date2(req->vwv+5));
7340 ft.create_time = convert_time_t_to_timespec(
7341 srv_make_unix_date2(req->vwv+1));
7342
7343 reply_outbuf(req, 0, 0);
7344
7345 /*
7346 * Patch from Ray Frush <frush@engr.colostate.edu>
7347 * Sometimes times are sent as zero - ignore them.
7348 */
7349
7350 /* Ensure we have a valid stat struct for the source. */
7351 if (fsp->fh->fd != -1) {
7352 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7353 status = map_nt_error_from_unix(errno);
7354 reply_nterror(req, status);
7355 END_PROFILE(SMBsetattrE);
7356 return;
7357 }
7358 } else {
7359 int ret = -1;
7360
7361 if (fsp->posix_open) {
7362 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7363 } else {
7364 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7365 }
7366 if (ret == -1) {
7367 status = map_nt_error_from_unix(errno);
7368 reply_nterror(req, status);
7369 END_PROFILE(SMBsetattrE);
7370 return;
7371 }
7372 }
7373
7374 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7375 &sbuf, &ft, true);
7376 if (!NT_STATUS_IS_OK(status)) {
7377 reply_doserror(req, ERRDOS, ERRnoaccess);
7378 END_PROFILE(SMBsetattrE);
7379 return;
7380 }
7381
7382 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7383 " createtime=%u\n",
7384 fsp->fnum,
7385 (unsigned int)ft.atime.tv_sec,
7386 (unsigned int)ft.mtime.tv_sec,
7387 (unsigned int)ft.create_time.tv_sec
7388 ));
7389
7390 END_PROFILE(SMBsetattrE);
7391 return;
7392 }
7393
7394
7395 /* Back from the dead for OS/2..... JRA. */
7396
7397 /****************************************************************************
7398 Reply to a SMBwritebmpx (write block multiplex primary) request.
7399 Always reply with an error, if someone has a platform really needs this,
7400 please contact vl@samba.org
7401 ****************************************************************************/
7402
7403 void reply_writebmpx(struct smb_request *req)
7404 {
7405 START_PROFILE(SMBwriteBmpx);
7406 reply_doserror(req, ERRSRV, ERRuseSTD);
7407 END_PROFILE(SMBwriteBmpx);
7408 return;
7409 }
7410
7411 /****************************************************************************
7412 Reply to a SMBwritebs (write block multiplex secondary) request.
7413 Always reply with an error, if someone has a platform really needs this,
7414 please contact vl@samba.org
7415 ****************************************************************************/
7416
7417 void reply_writebs(struct smb_request *req)
7418 {
7419 START_PROFILE(SMBwriteBs);
7420 reply_doserror(req, ERRSRV, ERRuseSTD);
7421 END_PROFILE(SMBwriteBs);
7422 return;
7423 }
7424
7425 /****************************************************************************
7426 Reply to a SMBgetattrE.
7427 ****************************************************************************/
7428
7429 void reply_getattrE(struct smb_request *req)
7430 {
7431 connection_struct *conn = req->conn;
7432 SMB_STRUCT_STAT sbuf;
7433 int mode;
7434 files_struct *fsp;
7435 struct timespec create_ts;
7436
7437 START_PROFILE(SMBgetattrE);
7438
7439 if (req->wct < 1) {
7440 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7441 END_PROFILE(SMBgetattrE);
7442 return;
7443 }
7444
7445 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7446
7447 if(!fsp || (fsp->conn != conn)) {
7448 reply_doserror(req, ERRDOS, ERRbadfid);
7449 END_PROFILE(SMBgetattrE);
7450 return;
7451 }
7452
7453 /* Do an fstat on this file */
7454 if(fsp_stat(fsp, &sbuf)) {
7455 reply_unixerror(req, ERRDOS, ERRnoaccess);
7456 END_PROFILE(SMBgetattrE);
7457 return;
7458 }
7459
7460 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7461
7462 /*
7463 * Convert the times into dos times. Set create
7464 * date to be last modify date as UNIX doesn't save
7465 * this.
7466 */
7467
7468 reply_outbuf(req, 11, 0);
7469
7470 create_ts = get_create_timespec(&sbuf,
7471 lp_fake_dir_create_times(SNUM(conn)));
7472 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7473 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7474 /* Should we check pending modtime here ? JRA */
7475 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7476
7477 if (mode & aDIR) {
7478 SIVAL(req->outbuf, smb_vwv6, 0);
7479 SIVAL(req->outbuf, smb_vwv8, 0);
7480 } else {
7481 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7482 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7483 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7484 }
7485 SSVAL(req->outbuf,smb_vwv10, mode);
7486
7487 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7488
7489 END_PROFILE(SMBgetattrE);
7490 return;
7491 }
Samba GIT mirror