?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libgpo/security_CSE: fix unicode preamble check of SecEdit/GptTmpl.inf files.
[Samba.git] / source3 / smbd / reply.c
blob72dadf6dbbf4bf729249f53ab2c83218da265706
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const char *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
535 {
536 int msg_type = CVAL(inbuf,0);
537 int msg_flags = CVAL(inbuf,1);
538 /*
539 * We only really use 4 bytes of the outbuf, but for the smb_setlen
540 * calculation & friends (srv_send_smb uses that) we need the full smb
541 * header.
542 */
543 char outbuf[smb_size];
544
545 memset(outbuf, '\0', sizeof(outbuf));
546
547 smb_setlen(outbuf,0);
548
549 switch (msg_type) {
550 case NBSSrequest: /* session request */
551 {
552 /* inbuf_size is guarenteed to be at least 4. */
553 fstring name1,name2;
554 int name_type1, name_type2;
555 int name_len1, name_len2;
556
557 *name1 = *name2 = 0;
558
559 if (sconn->nbt.got_session) {
560 exit_server_cleanly("multiple session request not permitted");
561 }
562
563 SCVAL(outbuf,0,NBSSpositive);
564 SCVAL(outbuf,3,0);
565
566 /* inbuf_size is guaranteed to be at least 4. */
567 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
568 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
569 DEBUG(0,("Invalid name length in session request\n"));
570 reply_called_name_not_present(outbuf);
571 break;
572 }
573 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
574 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
575 DEBUG(0,("Invalid name length in session request\n"));
576 reply_called_name_not_present(outbuf);
577 break;
578 }
579
580 name_type1 = name_extract((unsigned char *)inbuf,
581 inbuf_size,(unsigned int)4,name1);
582 name_type2 = name_extract((unsigned char *)inbuf,
583 inbuf_size,(unsigned int)(4 + name_len1),name2);
584
585 if (name_type1 == -1 || name_type2 == -1) {
586 DEBUG(0,("Invalid name type in session request\n"));
587 reply_called_name_not_present(outbuf);
588 break;
589 }
590
591 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
592 name1, name_type1, name2, name_type2));
593
594 if (netbios_session_retarget(sconn, name1, name_type1)) {
595 exit_server_cleanly("retargeted client");
596 }
597
598 /*
599 * Windows NT/2k uses "*SMBSERVER" and XP uses
600 * "*SMBSERV" arrggg!!!
601 */
602 if (strequal(name1, "*SMBSERVER ")
603 || strequal(name1, "*SMBSERV ")) {
604 char *raddr;
605
606 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
607 talloc_tos());
608 if (raddr == NULL) {
609 exit_server_cleanly("could not allocate raddr");
610 }
611
612 fstrcpy(name1, raddr);
613 }
614
615 set_local_machine_name(name1, True);
616 set_remote_machine_name(name2, True);
617
618 if (is_ipaddress(sconn->remote_hostname)) {
619 char *p = discard_const_p(char, sconn->remote_hostname);
620
621 talloc_free(p);
622
623 sconn->remote_hostname = talloc_strdup(sconn,
624 get_remote_machine_name());
625 if (sconn->remote_hostname == NULL) {
626 exit_server_cleanly("could not copy remote name");
627 }
628 sconn->conn->remote_hostname = sconn->remote_hostname;
629 }
630
631 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
632 get_local_machine_name(), get_remote_machine_name(),
633 name_type2));
634
635 if (name_type2 == 'R') {
636 /* We are being asked for a pathworks session ---
637 no thanks! */
638 reply_called_name_not_present(outbuf);
639 break;
640 }
641
642 reload_services(sconn, conn_snum_used, true);
643 reopen_logs();
644
645 sconn->nbt.got_session = true;
646 break;
647 }
648
649 case 0x89: /* session keepalive request
650 (some old clients produce this?) */
651 SCVAL(outbuf,0,NBSSkeepalive);
652 SCVAL(outbuf,3,0);
653 break;
654
655 case NBSSpositive: /* positive session response */
656 case NBSSnegative: /* negative session response */
657 case NBSSretarget: /* retarget session response */
658 DEBUG(0,("Unexpected session response\n"));
659 break;
660
661 case NBSSkeepalive: /* session keepalive */
662 default:
663 return;
664 }
665
666 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
667 msg_type, msg_flags));
668
669 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
670
671 if (CVAL(outbuf, 0) != 0x82) {
672 exit_server_cleanly("invalid netbios session");
673 }
674 return;
675 }
676
677 /****************************************************************************
678 Reply to a tcon.
679 conn POINTER CAN BE NULL HERE !
680 ****************************************************************************/
681
682 void reply_tcon(struct smb_request *req)
683 {
684 connection_struct *conn = req->conn;
685 const char *service;
686 char *service_buf = NULL;
687 char *password = NULL;
688 char *dev = NULL;
689 int pwlen=0;
690 NTSTATUS nt_status;
691 const char *p;
692 TALLOC_CTX *ctx = talloc_tos();
693 struct smbd_server_connection *sconn = req->sconn;
694 NTTIME now = timeval_to_nttime(&req->request_time);
695
696 START_PROFILE(SMBtcon);
697
698 if (req->buflen < 4) {
699 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
700 END_PROFILE(SMBtcon);
701 return;
702 }
703
704 p = (const char *)req->buf + 1;
705 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
706 p += 1;
707 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
708 p += pwlen+1;
709 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
710 p += 1;
711
712 if (service_buf == NULL || password == NULL || dev == NULL) {
713 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
714 END_PROFILE(SMBtcon);
715 return;
716 }
717 p = strrchr_m(service_buf,'\\');
718 if (p) {
719 service = p+1;
720 } else {
721 service = service_buf;
722 }
723
724 conn = make_connection(sconn, now, service, dev,
725 req->vuid,&nt_status);
726 req->conn = conn;
727
728 if (!conn) {
729 reply_nterror(req, nt_status);
730 END_PROFILE(SMBtcon);
731 return;
732 }
733
734 reply_outbuf(req, 2, 0);
735 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
736 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
737 SSVAL(req->outbuf,smb_tid,conn->cnum);
738
739 DEBUG(3,("tcon service=%s cnum=%d\n",
740 service, conn->cnum));
741
742 END_PROFILE(SMBtcon);
743 return;
744 }
745
746 /****************************************************************************
747 Reply to a tcon and X.
748 conn POINTER CAN BE NULL HERE !
749 ****************************************************************************/
750
751 void reply_tcon_and_X(struct smb_request *req)
752 {
753 connection_struct *conn = req->conn;
754 const char *service = NULL;
755 TALLOC_CTX *ctx = talloc_tos();
756 /* what the cleint thinks the device is */
757 char *client_devicetype = NULL;
758 /* what the server tells the client the share represents */
759 const char *server_devicetype;
760 NTSTATUS nt_status;
761 int passlen;
762 char *path = NULL;
763 const char *p, *q;
764 uint16_t tcon_flags;
765 struct smbXsrv_session *session = NULL;
766 NTTIME now = timeval_to_nttime(&req->request_time);
767 bool session_key_updated = false;
768 uint16_t optional_support = 0;
769 struct smbd_server_connection *sconn = req->sconn;
770
771 START_PROFILE(SMBtconX);
772
773 if (req->wct < 4) {
774 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
775 END_PROFILE(SMBtconX);
776 return;
777 }
778
779 passlen = SVAL(req->vwv+3, 0);
780 tcon_flags = SVAL(req->vwv+2, 0);
781
782 /* we might have to close an old one */
783 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
784 struct smbXsrv_tcon *tcon;
785 NTSTATUS status;
786
787 tcon = conn->tcon;
788 req->conn = NULL;
789 conn = NULL;
790
791 /*
792 * TODO: cancel all outstanding requests on the tcon
793 */
794 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
795 if (!NT_STATUS_IS_OK(status)) {
796 DEBUG(0, ("reply_tcon_and_X: "
797 "smbXsrv_tcon_disconnect() failed: %s\n",
798 nt_errstr(status)));
799 /*
800 * If we hit this case, there is something completely
801 * wrong, so we better disconnect the transport connection.
802 */
803 END_PROFILE(SMBtconX);
804 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
805 return;
806 }
807
808 TALLOC_FREE(tcon);
809 }
810
811 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
812 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
813 END_PROFILE(SMBtconX);
814 return;
815 }
816
817 if (sconn->smb1.negprot.encrypted_passwords) {
818 p = (const char *)req->buf + passlen;
819 } else {
820 p = (const char *)req->buf + passlen + 1;
821 }
822
823 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
824
825 if (path == NULL) {
826 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
827 END_PROFILE(SMBtconX);
828 return;
829 }
830
831 /*
832 * the service name can be either: \\server\share
833 * or share directly like on the DELL PowerVault 705
834 */
835 if (*path=='\\') {
836 q = strchr_m(path+2,'\\');
837 if (!q) {
838 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
839 END_PROFILE(SMBtconX);
840 return;
841 }
842 service = q+1;
843 } else {
844 service = path;
845 }
846
847 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
848 &client_devicetype, p,
849 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
850
851 if (client_devicetype == NULL) {
852 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
853 END_PROFILE(SMBtconX);
854 return;
855 }
856
857 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
858
859 nt_status = smb1srv_session_lookup(req->sconn->conn,
860 req->vuid, now, &session);
861 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
862 reply_force_doserror(req, ERRSRV, ERRbaduid);
863 END_PROFILE(SMBtconX);
864 return;
865 }
866 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
867 reply_nterror(req, nt_status);
868 END_PROFILE(SMBtconX);
869 return;
870 }
871 if (!NT_STATUS_IS_OK(nt_status)) {
872 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
873 END_PROFILE(SMBtconX);
874 return;
875 }
876
877 if (session->global->auth_session_info == NULL) {
878 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
879 END_PROFILE(SMBtconX);
880 return;
881 }
882
883 /*
884 * If there is no application key defined yet
885 * we create one.
886 *
887 * This means we setup the application key on the
888 * first tcon that happens via the given session.
889 *
890 * Once the application key is defined, it does not
891 * change any more.
892 */
893 if (session->global->application_key.length == 0 &&
894 session->global->signing_key.length > 0)
895 {
896 struct smbXsrv_session *x = session;
897 struct auth_session_info *session_info =
898 session->global->auth_session_info;
899 uint8_t session_key[16];
900
901 ZERO_STRUCT(session_key);
902 memcpy(session_key, x->global->signing_key.data,
903 MIN(x->global->signing_key.length, sizeof(session_key)));
904
905 /*
906 * The application key is truncated/padded to 16 bytes
907 */
908 x->global->application_key = data_blob_talloc(x->global,
909 session_key,
910 sizeof(session_key));
911 ZERO_STRUCT(session_key);
912 if (x->global->application_key.data == NULL) {
913 reply_nterror(req, NT_STATUS_NO_MEMORY);
914 END_PROFILE(SMBtconX);
915 return;
916 }
917
918 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
919 smb_key_derivation(x->global->application_key.data,
920 x->global->application_key.length,
921 x->global->application_key.data);
922 optional_support |= SMB_EXTENDED_SIGNATURES;
923 }
924
925 /*
926 * Place the application key into the session_info
927 */
928 data_blob_clear_free(&session_info->session_key);
929 session_info->session_key = data_blob_dup_talloc(session_info,
930 x->global->application_key);
931 if (session_info->session_key.data == NULL) {
932 data_blob_clear_free(&x->global->application_key);
933 reply_nterror(req, NT_STATUS_NO_MEMORY);
934 END_PROFILE(SMBtconX);
935 return;
936 }
937 session_key_updated = true;
938 }
939
940 conn = make_connection(sconn, now, service, client_devicetype,
941 req->vuid, &nt_status);
942 req->conn =conn;
943
944 if (!conn) {
945 if (session_key_updated) {
946 struct smbXsrv_session *x = session;
947 struct auth_session_info *session_info =
948 session->global->auth_session_info;
949 data_blob_clear_free(&x->global->application_key);
950 data_blob_clear_free(&session_info->session_key);
951 }
952 reply_nterror(req, nt_status);
953 END_PROFILE(SMBtconX);
954 return;
955 }
956
957 if ( IS_IPC(conn) )
958 server_devicetype = "IPC";
959 else if ( IS_PRINT(conn) )
960 server_devicetype = "LPT1:";
961 else
962 server_devicetype = "A:";
963
964 if (get_Protocol() < PROTOCOL_NT1) {
965 reply_outbuf(req, 2, 0);
966 if (message_push_string(&req->outbuf, server_devicetype,
967 STR_TERMINATE|STR_ASCII) == -1) {
968 reply_nterror(req, NT_STATUS_NO_MEMORY);
969 END_PROFILE(SMBtconX);
970 return;
971 }
972 } else {
973 /* NT sets the fstype of IPC$ to the null string */
974 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
975
976 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
977 /* Return permissions. */
978 uint32 perm1 = 0;
979 uint32 perm2 = 0;
980
981 reply_outbuf(req, 7, 0);
982
983 if (IS_IPC(conn)) {
984 perm1 = FILE_ALL_ACCESS;
985 perm2 = FILE_ALL_ACCESS;
986 } else {
987 perm1 = conn->share_access;
988 }
989
990 SIVAL(req->outbuf, smb_vwv3, perm1);
991 SIVAL(req->outbuf, smb_vwv5, perm2);
992 } else {
993 reply_outbuf(req, 3, 0);
994 }
995
996 if ((message_push_string(&req->outbuf, server_devicetype,
997 STR_TERMINATE|STR_ASCII) == -1)
998 || (message_push_string(&req->outbuf, fstype,
999 STR_TERMINATE) == -1)) {
1000 reply_nterror(req, NT_STATUS_NO_MEMORY);
1001 END_PROFILE(SMBtconX);
1002 return;
1003 }
1004
1005 /* what does setting this bit do? It is set by NT4 and
1006 may affect the ability to autorun mounted cdroms */
1007 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008 optional_support |=
1009 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012 DEBUG(2,("Serving %s as a Dfs root\n",
1013 lp_servicename(ctx, SNUM(conn)) ));
1014 optional_support |= SMB_SHARE_IN_DFS;
1015 }
1016
1017 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018 }
1019
1020 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1022
1023 DEBUG(3,("tconX service=%s \n",
1024 service));
1025
1026 /* set the incoming and outgoing tid to the just created one */
1027 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028 SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030 END_PROFILE(SMBtconX);
1031
1032 req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036 Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042 smb_fn_name(type), type, type));
1043 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044 return;
1045 }
1046
1047 /****************************************************************************
1048 Reply to an ioctl.
1049 conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054 connection_struct *conn = req->conn;
1055 uint16 device;
1056 uint16 function;
1057 uint32 ioctl_code;
1058 int replysize;
1059 char *p;
1060
1061 START_PROFILE(SMBioctl);
1062
1063 if (req->wct < 3) {
1064 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065 END_PROFILE(SMBioctl);
1066 return;
1067 }
1068
1069 device = SVAL(req->vwv+1, 0);
1070 function = SVAL(req->vwv+2, 0);
1071 ioctl_code = (device << 16) + function;
1072
1073 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075 switch (ioctl_code) {
1076 case IOCTL_QUERY_JOB_INFO:
1077 replysize = 32;
1078 break;
1079 default:
1080 reply_force_doserror(req, ERRSRV, ERRnosupport);
1081 END_PROFILE(SMBioctl);
1082 return;
1083 }
1084
1085 reply_outbuf(req, 8, replysize+1);
1086 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1089 p = smb_buf(req->outbuf);
1090 memset(p, '\0', replysize+1); /* valgrind-safe. */
1091 p += 1; /* Allow for alignment */
1092
1093 switch (ioctl_code) {
1094 case IOCTL_QUERY_JOB_INFO:
1095 {
1096 files_struct *fsp = file_fsp(
1097 req, SVAL(req->vwv+0, 0));
1098 if (!fsp) {
1099 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100 END_PROFILE(SMBioctl);
1101 return;
1102 }
1103 /* Job number */
1104 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107 lp_netbios_name(), 15,
1108 STR_TERMINATE|STR_ASCII);
1109 if (conn) {
1110 srvstr_push((char *)req->outbuf, req->flags2,
1111 p+18,
1112 lp_servicename(talloc_tos(),
1113 SNUM(conn)),
1114 13, STR_TERMINATE|STR_ASCII);
1115 } else {
1116 memset(p+18, 0, 13);
1117 }
1118 break;
1119 }
1120 }
1121
1122 END_PROFILE(SMBioctl);
1123 return;
1124 }
1125
1126 /****************************************************************************
1127 Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132 /* Strange DOS error code semantics only for checkpath... */
1133 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135 /* We need to map to ERRbadpath */
1136 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137 }
1138 }
1139 return status;
1140 }
1141
1142 /****************************************************************************
1143 Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148 connection_struct *conn = req->conn;
1149 struct smb_filename *smb_fname = NULL;
1150 char *name = NULL;
1151 NTSTATUS status;
1152 TALLOC_CTX *ctx = talloc_tos();
1153
1154 START_PROFILE(SMBcheckpath);
1155
1156 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157 STR_TERMINATE, &status);
1158
1159 if (!NT_STATUS_IS_OK(status)) {
1160 status = map_checkpath_error(req->flags2, status);
1161 reply_nterror(req, status);
1162 END_PROFILE(SMBcheckpath);
1163 return;
1164 }
1165
1166 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168 status = filename_convert(ctx,
1169 conn,
1170 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171 name,
1172 0,
1173 NULL,
1174 &smb_fname);
1175
1176 if (!NT_STATUS_IS_OK(status)) {
1177 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179 ERRSRV, ERRbadpath);
1180 END_PROFILE(SMBcheckpath);
1181 return;
1182 }
1183 goto path_err;
1184 }
1185
1186 if (!VALID_STAT(smb_fname->st) &&
1187 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189 smb_fname_str_dbg(smb_fname), strerror(errno)));
1190 status = map_nt_error_from_unix(errno);
1191 goto path_err;
1192 }
1193
1194 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196 ERRDOS, ERRbadpath);
1197 goto out;
1198 }
1199
1200 reply_outbuf(req, 0, 0);
1201
1202 path_err:
1203 /* We special case this - as when a Windows machine
1204 is parsing a path is steps through the components
1205 one at a time - if a component fails it expects
1206 ERRbadpath, not ERRbadfile.
1207 */
1208 status = map_checkpath_error(req->flags2, status);
1209 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210 /*
1211 * Windows returns different error codes if
1212 * the parent directory is valid but not the
1213 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215 * if the path is invalid.
1216 */
1217 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218 ERRDOS, ERRbadpath);
1219 goto out;
1220 }
1221
1222 reply_nterror(req, status);
1223
1224 out:
1225 TALLOC_FREE(smb_fname);
1226 END_PROFILE(SMBcheckpath);
1227 return;
1228 }
1229
1230 /****************************************************************************
1231 Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236 connection_struct *conn = req->conn;
1237 struct smb_filename *smb_fname = NULL;
1238 char *fname = NULL;
1239 int mode=0;
1240 off_t size=0;
1241 time_t mtime=0;
1242 const char *p;
1243 NTSTATUS status;
1244 TALLOC_CTX *ctx = talloc_tos();
1245 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247 START_PROFILE(SMBgetatr);
1248
1249 p = (const char *)req->buf + 1;
1250 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251 if (!NT_STATUS_IS_OK(status)) {
1252 reply_nterror(req, status);
1253 goto out;
1254 }
1255
1256 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257 under WfWg - weird! */
1258 if (*fname == '\0') {
1259 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260 if (!CAN_WRITE(conn)) {
1261 mode |= FILE_ATTRIBUTE_READONLY;
1262 }
1263 size = 0;
1264 mtime = 0;
1265 } else {
1266 status = filename_convert(ctx,
1267 conn,
1268 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269 fname,
1270 0,
1271 NULL,
1272 &smb_fname);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276 ERRSRV, ERRbadpath);
1277 goto out;
1278 }
1279 reply_nterror(req, status);
1280 goto out;
1281 }
1282 if (!VALID_STAT(smb_fname->st) &&
1283 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285 smb_fname_str_dbg(smb_fname),
1286 strerror(errno)));
1287 reply_nterror(req, map_nt_error_from_unix(errno));
1288 goto out;
1289 }
1290
1291 mode = dos_mode(conn, smb_fname);
1292 size = smb_fname->st.st_ex_size;
1293
1294 if (ask_sharemode) {
1295 struct timespec write_time_ts;
1296 struct file_id fileid;
1297
1298 ZERO_STRUCT(write_time_ts);
1299 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300 get_file_infos(fileid, 0, NULL, &write_time_ts);
1301 if (!null_timespec(write_time_ts)) {
1302 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303 }
1304 }
1305
1306 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308 size = 0;
1309 }
1310 }
1311
1312 reply_outbuf(req, 10, 0);
1313
1314 SSVAL(req->outbuf,smb_vwv0,mode);
1315 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317 } else {
1318 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319 }
1320 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322 if (get_Protocol() >= PROTOCOL_NT1) {
1323 SSVAL(req->outbuf, smb_flg2,
1324 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325 }
1326
1327 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330 out:
1331 TALLOC_FREE(smb_fname);
1332 TALLOC_FREE(fname);
1333 END_PROFILE(SMBgetatr);
1334 return;
1335 }
1336
1337 /****************************************************************************
1338 Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343 struct smb_file_time ft;
1344 connection_struct *conn = req->conn;
1345 struct smb_filename *smb_fname = NULL;
1346 char *fname = NULL;
1347 int mode;
1348 time_t mtime;
1349 const char *p;
1350 NTSTATUS status;
1351 TALLOC_CTX *ctx = talloc_tos();
1352
1353 START_PROFILE(SMBsetatr);
1354
1355 ZERO_STRUCT(ft);
1356
1357 if (req->wct < 2) {
1358 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359 goto out;
1360 }
1361
1362 p = (const char *)req->buf + 1;
1363 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 reply_nterror(req, status);
1366 goto out;
1367 }
1368
1369 status = filename_convert(ctx,
1370 conn,
1371 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372 fname,
1373 0,
1374 NULL,
1375 &smb_fname);
1376 if (!NT_STATUS_IS_OK(status)) {
1377 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379 ERRSRV, ERRbadpath);
1380 goto out;
1381 }
1382 reply_nterror(req, status);
1383 goto out;
1384 }
1385
1386 if (smb_fname->base_name[0] == '.' &&
1387 smb_fname->base_name[1] == '\0') {
1388 /*
1389 * Not sure here is the right place to catch this
1390 * condition. Might be moved to somewhere else later -- vl
1391 */
1392 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393 goto out;
1394 }
1395
1396 mode = SVAL(req->vwv+0, 0);
1397 mtime = srv_make_unix_date3(req->vwv+1);
1398
1399 if (mode != FILE_ATTRIBUTE_NORMAL) {
1400 if (VALID_STAT_OF_DIR(smb_fname->st))
1401 mode |= FILE_ATTRIBUTE_DIRECTORY;
1402 else
1403 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405 status = check_access(conn, NULL, smb_fname,
1406 FILE_WRITE_ATTRIBUTES);
1407 if (!NT_STATUS_IS_OK(status)) {
1408 reply_nterror(req, status);
1409 goto out;
1410 }
1411
1412 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413 false) != 0) {
1414 reply_nterror(req, map_nt_error_from_unix(errno));
1415 goto out;
1416 }
1417 }
1418
1419 ft.mtime = convert_time_t_to_timespec(mtime);
1420 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421 if (!NT_STATUS_IS_OK(status)) {
1422 reply_nterror(req, status);
1423 goto out;
1424 }
1425
1426 reply_outbuf(req, 0, 0);
1427
1428 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429 mode));
1430 out:
1431 TALLOC_FREE(smb_fname);
1432 END_PROFILE(SMBsetatr);
1433 return;
1434 }
1435
1436 /****************************************************************************
1437 Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442 connection_struct *conn = req->conn;
1443 uint64_t dfree,dsize,bsize;
1444 START_PROFILE(SMBdskattr);
1445
1446 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447 reply_nterror(req, map_nt_error_from_unix(errno));
1448 END_PROFILE(SMBdskattr);
1449 return;
1450 }
1451
1452 reply_outbuf(req, 5, 0);
1453
1454 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455 double total_space, free_space;
1456 /* we need to scale this to a number that DOS6 can handle. We
1457 use floating point so we can handle large drives on systems
1458 that don't have 64 bit integers
1459
1460 we end up displaying a maximum of 2G to DOS systems
1461 */
1462 total_space = dsize * (double)bsize;
1463 free_space = dfree * (double)bsize;
1464
1465 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471 SSVAL(req->outbuf,smb_vwv0,dsize);
1472 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474 SSVAL(req->outbuf,smb_vwv3,dfree);
1475 } else {
1476 SSVAL(req->outbuf,smb_vwv0,dsize);
1477 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478 SSVAL(req->outbuf,smb_vwv2,512);
1479 SSVAL(req->outbuf,smb_vwv3,dfree);
1480 }
1481
1482 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484 END_PROFILE(SMBdskattr);
1485 return;
1486 }
1487
1488 /*
1489 * Utility function to split the filename from the directory.
1490 */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492 char **fname_dir_out,
1493 char **fname_mask_out)
1494 {
1495 const char *p = NULL;
1496 char *fname_dir = NULL;
1497 char *fname_mask = NULL;
1498
1499 p = strrchr_m(fname_in, '/');
1500 if (!p) {
1501 fname_dir = talloc_strdup(ctx, ".");
1502 fname_mask = talloc_strdup(ctx, fname_in);
1503 } else {
1504 fname_dir = talloc_strndup(ctx, fname_in,
1505 PTR_DIFF(p, fname_in));
1506 fname_mask = talloc_strdup(ctx, p+1);
1507 }
1508
1509 if (!fname_dir || !fname_mask) {
1510 TALLOC_FREE(fname_dir);
1511 TALLOC_FREE(fname_mask);
1512 return NT_STATUS_NO_MEMORY;
1513 }
1514
1515 *fname_dir_out = fname_dir;
1516 *fname_mask_out = fname_mask;
1517 return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521 Reply to a search.
1522 Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527 connection_struct *conn = req->conn;
1528 char *path = NULL;
1529 const char *mask = NULL;
1530 char *directory = NULL;
1531 struct smb_filename *smb_fname = NULL;
1532 char *fname = NULL;
1533 off_t size;
1534 uint32 mode;
1535 struct timespec date;
1536 uint32 dirtype;
1537 unsigned int numentries = 0;
1538 unsigned int maxentries = 0;
1539 bool finished = False;
1540 const char *p;
1541 int status_len;
1542 char status[21];
1543 int dptr_num= -1;
1544 bool check_descend = False;
1545 bool expect_close = False;
1546 NTSTATUS nt_status;
1547 bool mask_contains_wcard = False;
1548 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549 TALLOC_CTX *ctx = talloc_tos();
1550 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551 struct dptr_struct *dirptr = NULL;
1552 struct smbd_server_connection *sconn = req->sconn;
1553
1554 START_PROFILE(SMBsearch);
1555
1556 if (req->wct < 2) {
1557 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558 goto out;
1559 }
1560
1561 if (lp_posix_pathnames()) {
1562 reply_unknown_new(req, req->cmd);
1563 goto out;
1564 }
1565
1566 /* If we were called as SMBffirst then we must expect close. */
1567 if(req->cmd == SMBffirst) {
1568 expect_close = True;
1569 }
1570
1571 reply_outbuf(req, 1, 3);
1572 maxentries = SVAL(req->vwv+0, 0);
1573 dirtype = SVAL(req->vwv+1, 0);
1574 p = (const char *)req->buf + 1;
1575 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576 &nt_status, &mask_contains_wcard);
1577 if (!NT_STATUS_IS_OK(nt_status)) {
1578 reply_nterror(req, nt_status);
1579 goto out;
1580 }
1581
1582 p++;
1583 status_len = SVAL(p, 0);
1584 p += 2;
1585
1586 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588 if (status_len == 0) {
1589 nt_status = filename_convert(ctx, conn,
1590 req->flags2 & FLAGS2_DFS_PATHNAMES,
1591 path,
1592 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593 &mask_contains_wcard,
1594 &smb_fname);
1595 if (!NT_STATUS_IS_OK(nt_status)) {
1596 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598 ERRSRV, ERRbadpath);
1599 goto out;
1600 }
1601 reply_nterror(req, nt_status);
1602 goto out;
1603 }
1604
1605 directory = smb_fname->base_name;
1606
1607 p = strrchr_m(directory,'/');
1608 if ((p != NULL) && (*directory != '/')) {
1609 mask = p + 1;
1610 directory = talloc_strndup(ctx, directory,
1611 PTR_DIFF(p, directory));
1612 } else {
1613 mask = directory;
1614 directory = talloc_strdup(ctx,".");
1615 }
1616
1617 if (!directory) {
1618 reply_nterror(req, NT_STATUS_NO_MEMORY);
1619 goto out;
1620 }
1621
1622 memset((char *)status,'\0',21);
1623 SCVAL(status,0,(dirtype & 0x1F));
1624
1625 nt_status = dptr_create(conn,
1626 NULL, /* req */
1627 NULL, /* fsp */
1628 directory,
1629 True,
1630 expect_close,
1631 req->smbpid,
1632 mask,
1633 mask_contains_wcard,
1634 dirtype,
1635 &dirptr);
1636 if (!NT_STATUS_IS_OK(nt_status)) {
1637 reply_nterror(req, nt_status);
1638 goto out;
1639 }
1640 dptr_num = dptr_dnum(dirptr);
1641 } else {
1642 int status_dirtype;
1643 const char *dirpath;
1644
1645 memcpy(status,p,21);
1646 status_dirtype = CVAL(status,0) & 0x1F;
1647 if (status_dirtype != (dirtype & 0x1F)) {
1648 dirtype = status_dirtype;
1649 }
1650
1651 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652 if (!dirptr) {
1653 goto SearchEmpty;
1654 }
1655 dirpath = dptr_path(sconn, dptr_num);
1656 directory = talloc_strdup(ctx, dirpath);
1657 if (!directory) {
1658 reply_nterror(req, NT_STATUS_NO_MEMORY);
1659 goto out;
1660 }
1661
1662 mask = dptr_wcard(sconn, dptr_num);
1663 if (!mask) {
1664 goto SearchEmpty;
1665 }
1666 /*
1667 * For a 'continue' search we have no string. So
1668 * check from the initial saved string.
1669 */
1670 mask_contains_wcard = ms_has_wild(mask);
1671 dirtype = dptr_attr(sconn, dptr_num);
1672 }
1673
1674 DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677 dptr_init_search_op(dirptr);
1678
1679 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680 char buf[DIR_STRUCT_SIZE];
1681 memcpy(buf,status,21);
1682 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684 reply_nterror(req, NT_STATUS_NO_MEMORY);
1685 goto out;
1686 }
1687 dptr_fill(sconn, buf+12,dptr_num);
1688 if (dptr_zero(buf+12) && (status_len==0)) {
1689 numentries = 1;
1690 } else {
1691 numentries = 0;
1692 }
1693 if (message_push_blob(&req->outbuf,
1694 data_blob_const(buf, sizeof(buf)))
1695 == -1) {
1696 reply_nterror(req, NT_STATUS_NO_MEMORY);
1697 goto out;
1698 }
1699 } else {
1700 unsigned int i;
1701 maxentries = MIN(
1702 maxentries,
1703 ((BUFFER_SIZE -
1704 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1705 /DIR_STRUCT_SIZE));
1706
1707 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1708 directory,lp_dontdescend(ctx, SNUM(conn))));
1709 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1710 check_descend = True;
1711 }
1712
1713 for (i=numentries;(i<maxentries) && !finished;i++) {
1714 finished = !get_dir_entry(ctx,
1715 dirptr,
1716 mask,
1717 dirtype,
1718 &fname,
1719 &size,
1720 &mode,
1721 &date,
1722 check_descend,
1723 ask_sharemode);
1724 if (!finished) {
1725 char buf[DIR_STRUCT_SIZE];
1726 memcpy(buf,status,21);
1727 if (!make_dir_struct(ctx,
1728 buf,
1729 mask,
1730 fname,
1731 size,
1732 mode,
1733 convert_timespec_to_time_t(date),
1734 !allow_long_path_components)) {
1735 reply_nterror(req, NT_STATUS_NO_MEMORY);
1736 goto out;
1737 }
1738 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1739 break;
1740 }
1741 if (message_push_blob(&req->outbuf,
1742 data_blob_const(buf, sizeof(buf)))
1743 == -1) {
1744 reply_nterror(req, NT_STATUS_NO_MEMORY);
1745 goto out;
1746 }
1747 numentries++;
1748 }
1749 }
1750 }
1751
1752 SearchEmpty:
1753
1754 /* If we were called as SMBffirst with smb_search_id == NULL
1755 and no entries were found then return error and close dirptr
1756 (X/Open spec) */
1757
1758 if (numentries == 0) {
1759 dptr_close(sconn, &dptr_num);
1760 } else if(expect_close && status_len == 0) {
1761 /* Close the dptr - we know it's gone */
1762 dptr_close(sconn, &dptr_num);
1763 }
1764
1765 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1766 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1767 dptr_close(sconn, &dptr_num);
1768 }
1769
1770 if ((numentries == 0) && !mask_contains_wcard) {
1771 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1772 goto out;
1773 }
1774
1775 SSVAL(req->outbuf,smb_vwv0,numentries);
1776 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1777 SCVAL(smb_buf(req->outbuf),0,5);
1778 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1779
1780 /* The replies here are never long name. */
1781 SSVAL(req->outbuf, smb_flg2,
1782 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1783 if (!allow_long_path_components) {
1784 SSVAL(req->outbuf, smb_flg2,
1785 SVAL(req->outbuf, smb_flg2)
1786 & (~FLAGS2_LONG_PATH_COMPONENTS));
1787 }
1788
1789 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1790 SSVAL(req->outbuf, smb_flg2,
1791 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1792
1793 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1794 smb_fn_name(req->cmd),
1795 mask,
1796 directory,
1797 dirtype,
1798 numentries,
1799 maxentries ));
1800 out:
1801 TALLOC_FREE(directory);
1802 TALLOC_FREE(smb_fname);
1803 END_PROFILE(SMBsearch);
1804 return;
1805 }
1806
1807 /****************************************************************************
1808 Reply to a fclose (stop directory search).
1809 ****************************************************************************/
1810
1811 void reply_fclose(struct smb_request *req)
1812 {
1813 int status_len;
1814 char status[21];
1815 int dptr_num= -2;
1816 const char *p;
1817 char *path = NULL;
1818 NTSTATUS err;
1819 bool path_contains_wcard = False;
1820 TALLOC_CTX *ctx = talloc_tos();
1821 struct smbd_server_connection *sconn = req->sconn;
1822
1823 START_PROFILE(SMBfclose);
1824
1825 if (lp_posix_pathnames()) {
1826 reply_unknown_new(req, req->cmd);
1827 END_PROFILE(SMBfclose);
1828 return;
1829 }
1830
1831 p = (const char *)req->buf + 1;
1832 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1833 &err, &path_contains_wcard);
1834 if (!NT_STATUS_IS_OK(err)) {
1835 reply_nterror(req, err);
1836 END_PROFILE(SMBfclose);
1837 return;
1838 }
1839 p++;
1840 status_len = SVAL(p,0);
1841 p += 2;
1842
1843 if (status_len == 0) {
1844 reply_force_doserror(req, ERRSRV, ERRsrverror);
1845 END_PROFILE(SMBfclose);
1846 return;
1847 }
1848
1849 memcpy(status,p,21);
1850
1851 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1852 /* Close the dptr - we know it's gone */
1853 dptr_close(sconn, &dptr_num);
1854 }
1855
1856 reply_outbuf(req, 1, 0);
1857 SSVAL(req->outbuf,smb_vwv0,0);
1858
1859 DEBUG(3,("search close\n"));
1860
1861 END_PROFILE(SMBfclose);
1862 return;
1863 }
1864
1865 /****************************************************************************
1866 Reply to an open.
1867 ****************************************************************************/
1868
1869 void reply_open(struct smb_request *req)
1870 {
1871 connection_struct *conn = req->conn;
1872 struct smb_filename *smb_fname = NULL;
1873 char *fname = NULL;
1874 uint32 fattr=0;
1875 off_t size = 0;
1876 time_t mtime=0;
1877 int info;
1878 files_struct *fsp;
1879 int oplock_request;
1880 int deny_mode;
1881 uint32 dos_attr;
1882 uint32 access_mask;
1883 uint32 share_mode;
1884 uint32 create_disposition;
1885 uint32 create_options = 0;
1886 uint32_t private_flags = 0;
1887 NTSTATUS status;
1888 TALLOC_CTX *ctx = talloc_tos();
1889
1890 START_PROFILE(SMBopen);
1891
1892 if (req->wct < 2) {
1893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1894 goto out;
1895 }
1896
1897 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1898 deny_mode = SVAL(req->vwv+0, 0);
1899 dos_attr = SVAL(req->vwv+1, 0);
1900
1901 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1902 STR_TERMINATE, &status);
1903 if (!NT_STATUS_IS_OK(status)) {
1904 reply_nterror(req, status);
1905 goto out;
1906 }
1907
1908 if (!map_open_params_to_ntcreate(fname, deny_mode,
1909 OPENX_FILE_EXISTS_OPEN, &access_mask,
1910 &share_mode, &create_disposition,
1911 &create_options, &private_flags)) {
1912 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1913 goto out;
1914 }
1915
1916 status = filename_convert(ctx,
1917 conn,
1918 req->flags2 & FLAGS2_DFS_PATHNAMES,
1919 fname,
1920 UCF_PREP_CREATEFILE,
1921 NULL,
1922 &smb_fname);
1923 if (!NT_STATUS_IS_OK(status)) {
1924 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1925 reply_botherror(req,
1926 NT_STATUS_PATH_NOT_COVERED,
1927 ERRSRV, ERRbadpath);
1928 goto out;
1929 }
1930 reply_nterror(req, status);
1931 goto out;
1932 }
1933
1934 status = SMB_VFS_CREATE_FILE(
1935 conn, /* conn */
1936 req, /* req */
1937 0, /* root_dir_fid */
1938 smb_fname, /* fname */
1939 access_mask, /* access_mask */
1940 share_mode, /* share_access */
1941 create_disposition, /* create_disposition*/
1942 create_options, /* create_options */
1943 dos_attr, /* file_attributes */
1944 oplock_request, /* oplock_request */
1945 0, /* allocation_size */
1946 private_flags,
1947 NULL, /* sd */
1948 NULL, /* ea_list */
1949 &fsp, /* result */
1950 &info); /* pinfo */
1951
1952 if (!NT_STATUS_IS_OK(status)) {
1953 if (open_was_deferred(req->sconn, req->mid)) {
1954 /* We have re-scheduled this call. */
1955 goto out;
1956 }
1957 reply_openerror(req, status);
1958 goto out;
1959 }
1960
1961 /* Ensure we're pointing at the correct stat struct. */
1962 TALLOC_FREE(smb_fname);
1963 smb_fname = fsp->fsp_name;
1964
1965 size = smb_fname->st.st_ex_size;
1966 fattr = dos_mode(conn, smb_fname);
1967
1968 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1969
1970 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1971 DEBUG(3,("attempt to open a directory %s\n",
1972 fsp_str_dbg(fsp)));
1973 close_file(req, fsp, ERROR_CLOSE);
1974 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1975 ERRDOS, ERRnoaccess);
1976 goto out;
1977 }
1978
1979 reply_outbuf(req, 7, 0);
1980 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1981 SSVAL(req->outbuf,smb_vwv1,fattr);
1982 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1983 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1984 } else {
1985 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1986 }
1987 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1988 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1989
1990 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1991 SCVAL(req->outbuf,smb_flg,
1992 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1993 }
1994
1995 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1996 SCVAL(req->outbuf,smb_flg,
1997 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1998 }
1999 out:
2000 END_PROFILE(SMBopen);
2001 return;
2002 }
2003
2004 /****************************************************************************
2005 Reply to an open and X.
2006 ****************************************************************************/
2007
2008 void reply_open_and_X(struct smb_request *req)
2009 {
2010 connection_struct *conn = req->conn;
2011 struct smb_filename *smb_fname = NULL;
2012 char *fname = NULL;
2013 uint16 open_flags;
2014 int deny_mode;
2015 uint32 smb_attr;
2016 /* Breakout the oplock request bits so we can set the
2017 reply bits separately. */
2018 int ex_oplock_request;
2019 int core_oplock_request;
2020 int oplock_request;
2021 #if 0
2022 int smb_sattr = SVAL(req->vwv+4, 0);
2023 uint32 smb_time = make_unix_date3(req->vwv+6);
2024 #endif
2025 int smb_ofun;
2026 uint32 fattr=0;
2027 int mtime=0;
2028 int smb_action = 0;
2029 files_struct *fsp;
2030 NTSTATUS status;
2031 uint64_t allocation_size;
2032 ssize_t retval = -1;
2033 uint32 access_mask;
2034 uint32 share_mode;
2035 uint32 create_disposition;
2036 uint32 create_options = 0;
2037 uint32_t private_flags = 0;
2038 TALLOC_CTX *ctx = talloc_tos();
2039
2040 START_PROFILE(SMBopenX);
2041
2042 if (req->wct < 15) {
2043 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2044 goto out;
2045 }
2046
2047 open_flags = SVAL(req->vwv+2, 0);
2048 deny_mode = SVAL(req->vwv+3, 0);
2049 smb_attr = SVAL(req->vwv+5, 0);
2050 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2051 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2052 oplock_request = ex_oplock_request | core_oplock_request;
2053 smb_ofun = SVAL(req->vwv+8, 0);
2054 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2055
2056 /* If it's an IPC, pass off the pipe handler. */
2057 if (IS_IPC(conn)) {
2058 if (lp_nt_pipe_support()) {
2059 reply_open_pipe_and_X(conn, req);
2060 } else {
2061 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2062 }
2063 goto out;
2064 }
2065
2066 /* XXXX we need to handle passed times, sattr and flags */
2067 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2068 STR_TERMINATE, &status);
2069 if (!NT_STATUS_IS_OK(status)) {
2070 reply_nterror(req, status);
2071 goto out;
2072 }
2073
2074 if (!map_open_params_to_ntcreate(fname, deny_mode,
2075 smb_ofun,
2076 &access_mask, &share_mode,
2077 &create_disposition,
2078 &create_options,
2079 &private_flags)) {
2080 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2081 goto out;
2082 }
2083
2084 status = filename_convert(ctx,
2085 conn,
2086 req->flags2 & FLAGS2_DFS_PATHNAMES,
2087 fname,
2088 UCF_PREP_CREATEFILE,
2089 NULL,
2090 &smb_fname);
2091 if (!NT_STATUS_IS_OK(status)) {
2092 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2093 reply_botherror(req,
2094 NT_STATUS_PATH_NOT_COVERED,
2095 ERRSRV, ERRbadpath);
2096 goto out;
2097 }
2098 reply_nterror(req, status);
2099 goto out;
2100 }
2101
2102 status = SMB_VFS_CREATE_FILE(
2103 conn, /* conn */
2104 req, /* req */
2105 0, /* root_dir_fid */
2106 smb_fname, /* fname */
2107 access_mask, /* access_mask */
2108 share_mode, /* share_access */
2109 create_disposition, /* create_disposition*/
2110 create_options, /* create_options */
2111 smb_attr, /* file_attributes */
2112 oplock_request, /* oplock_request */
2113 0, /* allocation_size */
2114 private_flags,
2115 NULL, /* sd */
2116 NULL, /* ea_list */
2117 &fsp, /* result */
2118 &smb_action); /* pinfo */
2119
2120 if (!NT_STATUS_IS_OK(status)) {
2121 if (open_was_deferred(req->sconn, req->mid)) {
2122 /* We have re-scheduled this call. */
2123 goto out;
2124 }
2125 reply_openerror(req, status);
2126 goto out;
2127 }
2128
2129 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2130 if the file is truncated or created. */
2131 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2132 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2133 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2134 close_file(req, fsp, ERROR_CLOSE);
2135 reply_nterror(req, NT_STATUS_DISK_FULL);
2136 goto out;
2137 }
2138 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2139 if (retval < 0) {
2140 close_file(req, fsp, ERROR_CLOSE);
2141 reply_nterror(req, NT_STATUS_DISK_FULL);
2142 goto out;
2143 }
2144 status = vfs_stat_fsp(fsp);
2145 if (!NT_STATUS_IS_OK(status)) {
2146 close_file(req, fsp, ERROR_CLOSE);
2147 reply_nterror(req, status);
2148 goto out;
2149 }
2150 }
2151
2152 fattr = dos_mode(conn, fsp->fsp_name);
2153 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2154 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2155 close_file(req, fsp, ERROR_CLOSE);
2156 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2157 goto out;
2158 }
2159
2160 /* If the caller set the extended oplock request bit
2161 and we granted one (by whatever means) - set the
2162 correct bit for extended oplock reply.
2163 */
2164
2165 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2166 smb_action |= EXTENDED_OPLOCK_GRANTED;
2167 }
2168
2169 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2170 smb_action |= EXTENDED_OPLOCK_GRANTED;
2171 }
2172
2173 /* If the caller set the core oplock request bit
2174 and we granted one (by whatever means) - set the
2175 correct bit for core oplock reply.
2176 */
2177
2178 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2179 reply_outbuf(req, 19, 0);
2180 } else {
2181 reply_outbuf(req, 15, 0);
2182 }
2183
2184 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2185 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2186
2187 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2188 SCVAL(req->outbuf, smb_flg,
2189 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2190 }
2191
2192 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2193 SCVAL(req->outbuf, smb_flg,
2194 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2195 }
2196
2197 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2198 SSVAL(req->outbuf,smb_vwv3,fattr);
2199 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2200 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2201 } else {
2202 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2203 }
2204 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2205 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2206 SSVAL(req->outbuf,smb_vwv11,smb_action);
2207
2208 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2209 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2210 }
2211
2212 out:
2213 TALLOC_FREE(smb_fname);
2214 END_PROFILE(SMBopenX);
2215 return;
2216 }
2217
2218 /****************************************************************************
2219 Reply to a SMBulogoffX.
2220 ****************************************************************************/
2221
2222 void reply_ulogoffX(struct smb_request *req)
2223 {
2224 struct smbd_server_connection *sconn = req->sconn;
2225 struct user_struct *vuser;
2226 struct smbXsrv_session *session = NULL;
2227 NTSTATUS status;
2228
2229 START_PROFILE(SMBulogoffX);
2230
2231 vuser = get_valid_user_struct(sconn, req->vuid);
2232
2233 if(vuser == NULL) {
2234 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2235 (unsigned long long)req->vuid));
2236
2237 req->vuid = UID_FIELD_INVALID;
2238 reply_force_doserror(req, ERRSRV, ERRbaduid);
2239 END_PROFILE(SMBulogoffX);
2240 return;
2241 }
2242
2243 session = vuser->session;
2244 vuser = NULL;
2245
2246 /*
2247 * TODO: cancel all outstanding requests on the session
2248 */
2249 status = smbXsrv_session_logoff(session);
2250 if (!NT_STATUS_IS_OK(status)) {
2251 DEBUG(0, ("reply_ulogoff: "
2252 "smbXsrv_session_logoff() failed: %s\n",
2253 nt_errstr(status)));
2254 /*
2255 * If we hit this case, there is something completely
2256 * wrong, so we better disconnect the transport connection.
2257 */
2258 END_PROFILE(SMBulogoffX);
2259 exit_server(__location__ ": smbXsrv_session_logoff failed");
2260 return;
2261 }
2262
2263 TALLOC_FREE(session);
2264
2265 reply_outbuf(req, 2, 0);
2266 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2267 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2268
2269 DEBUG(3, ("ulogoffX vuid=%llu\n",
2270 (unsigned long long)req->vuid));
2271
2272 END_PROFILE(SMBulogoffX);
2273 req->vuid = UID_FIELD_INVALID;
2274 }
2275
2276 /****************************************************************************
2277 Reply to a mknew or a create.
2278 ****************************************************************************/
2279
2280 void reply_mknew(struct smb_request *req)
2281 {
2282 connection_struct *conn = req->conn;
2283 struct smb_filename *smb_fname = NULL;
2284 char *fname = NULL;
2285 uint32 fattr = 0;
2286 struct smb_file_time ft;
2287 files_struct *fsp;
2288 int oplock_request = 0;
2289 NTSTATUS status;
2290 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2291 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2292 uint32 create_disposition;
2293 uint32 create_options = 0;
2294 TALLOC_CTX *ctx = talloc_tos();
2295
2296 START_PROFILE(SMBcreate);
2297 ZERO_STRUCT(ft);
2298
2299 if (req->wct < 3) {
2300 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2301 goto out;
2302 }
2303
2304 fattr = SVAL(req->vwv+0, 0);
2305 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2306
2307 /* mtime. */
2308 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2309
2310 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2311 STR_TERMINATE, &status);
2312 if (!NT_STATUS_IS_OK(status)) {
2313 reply_nterror(req, status);
2314 goto out;
2315 }
2316
2317 status = filename_convert(ctx,
2318 conn,
2319 req->flags2 & FLAGS2_DFS_PATHNAMES,
2320 fname,
2321 UCF_PREP_CREATEFILE,
2322 NULL,
2323 &smb_fname);
2324 if (!NT_STATUS_IS_OK(status)) {
2325 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2326 reply_botherror(req,
2327 NT_STATUS_PATH_NOT_COVERED,
2328 ERRSRV, ERRbadpath);
2329 goto out;
2330 }
2331 reply_nterror(req, status);
2332 goto out;
2333 }
2334
2335 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2336 DEBUG(0,("Attempt to create file (%s) with volid set - "
2337 "please report this\n",
2338 smb_fname_str_dbg(smb_fname)));
2339 }
2340
2341 if(req->cmd == SMBmknew) {
2342 /* We should fail if file exists. */
2343 create_disposition = FILE_CREATE;
2344 } else {
2345 /* Create if file doesn't exist, truncate if it does. */
2346 create_disposition = FILE_OVERWRITE_IF;
2347 }
2348
2349 status = SMB_VFS_CREATE_FILE(
2350 conn, /* conn */
2351 req, /* req */
2352 0, /* root_dir_fid */
2353 smb_fname, /* fname */
2354 access_mask, /* access_mask */
2355 share_mode, /* share_access */
2356 create_disposition, /* create_disposition*/
2357 create_options, /* create_options */
2358 fattr, /* file_attributes */
2359 oplock_request, /* oplock_request */
2360 0, /* allocation_size */
2361 0, /* private_flags */
2362 NULL, /* sd */
2363 NULL, /* ea_list */
2364 &fsp, /* result */
2365 NULL); /* pinfo */
2366
2367 if (!NT_STATUS_IS_OK(status)) {
2368 if (open_was_deferred(req->sconn, req->mid)) {
2369 /* We have re-scheduled this call. */
2370 goto out;
2371 }
2372 reply_openerror(req, status);
2373 goto out;
2374 }
2375
2376 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2377 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2378 if (!NT_STATUS_IS_OK(status)) {
2379 END_PROFILE(SMBcreate);
2380 goto out;
2381 }
2382
2383 reply_outbuf(req, 1, 0);
2384 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2385
2386 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2387 SCVAL(req->outbuf,smb_flg,
2388 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2389 }
2390
2391 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2392 SCVAL(req->outbuf,smb_flg,
2393 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2394 }
2395
2396 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2397 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2398 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2399 (unsigned int)fattr));
2400
2401 out:
2402 TALLOC_FREE(smb_fname);
2403 END_PROFILE(SMBcreate);
2404 return;
2405 }
2406
2407 /****************************************************************************
2408 Reply to a create temporary file.
2409 ****************************************************************************/
2410
2411 void reply_ctemp(struct smb_request *req)
2412 {
2413 connection_struct *conn = req->conn;
2414 struct smb_filename *smb_fname = NULL;
2415 char *wire_name = NULL;
2416 char *fname = NULL;
2417 uint32 fattr;
2418 files_struct *fsp;
2419 int oplock_request;
2420 char *s;
2421 NTSTATUS status;
2422 int i;
2423 TALLOC_CTX *ctx = talloc_tos();
2424
2425 START_PROFILE(SMBctemp);
2426
2427 if (req->wct < 3) {
2428 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2429 goto out;
2430 }
2431
2432 fattr = SVAL(req->vwv+0, 0);
2433 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2434
2435 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2436 STR_TERMINATE, &status);
2437 if (!NT_STATUS_IS_OK(status)) {
2438 reply_nterror(req, status);
2439 goto out;
2440 }
2441
2442 for (i = 0; i < 10; i++) {
2443 if (*wire_name) {
2444 fname = talloc_asprintf(ctx,
2445 "%s/TMP%s",
2446 wire_name,
2447 generate_random_str_list(ctx, 5, "0123456789"));
2448 } else {
2449 fname = talloc_asprintf(ctx,
2450 "TMP%s",
2451 generate_random_str_list(ctx, 5, "0123456789"));
2452 }
2453
2454 if (!fname) {
2455 reply_nterror(req, NT_STATUS_NO_MEMORY);
2456 goto out;
2457 }
2458
2459 status = filename_convert(ctx, conn,
2460 req->flags2 & FLAGS2_DFS_PATHNAMES,
2461 fname,
2462 UCF_PREP_CREATEFILE,
2463 NULL,
2464 &smb_fname);
2465 if (!NT_STATUS_IS_OK(status)) {
2466 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2467 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2468 ERRSRV, ERRbadpath);
2469 goto out;
2470 }
2471 reply_nterror(req, status);
2472 goto out;
2473 }
2474
2475 /* Create the file. */
2476 status = SMB_VFS_CREATE_FILE(
2477 conn, /* conn */
2478 req, /* req */
2479 0, /* root_dir_fid */
2480 smb_fname, /* fname */
2481 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2482 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2483 FILE_CREATE, /* create_disposition*/
2484 0, /* create_options */
2485 fattr, /* file_attributes */
2486 oplock_request, /* oplock_request */
2487 0, /* allocation_size */
2488 0, /* private_flags */
2489 NULL, /* sd */
2490 NULL, /* ea_list */
2491 &fsp, /* result */
2492 NULL); /* pinfo */
2493
2494 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2495 TALLOC_FREE(fname);
2496 TALLOC_FREE(smb_fname);
2497 continue;
2498 }
2499
2500 if (!NT_STATUS_IS_OK(status)) {
2501 if (open_was_deferred(req->sconn, req->mid)) {
2502 /* We have re-scheduled this call. */
2503 goto out;
2504 }
2505 reply_openerror(req, status);
2506 goto out;
2507 }
2508
2509 break;
2510 }
2511
2512 if (i == 10) {
2513 /* Collision after 10 times... */
2514 reply_nterror(req, status);
2515 goto out;
2516 }
2517
2518 reply_outbuf(req, 1, 0);
2519 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2520
2521 /* the returned filename is relative to the directory */
2522 s = strrchr_m(fsp->fsp_name->base_name, '/');
2523 if (!s) {
2524 s = fsp->fsp_name->base_name;
2525 } else {
2526 s++;
2527 }
2528
2529 #if 0
2530 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2531 thing in the byte section. JRA */
2532 SSVALS(p, 0, -1); /* what is this? not in spec */
2533 #endif
2534 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2535 == -1) {
2536 reply_nterror(req, NT_STATUS_NO_MEMORY);
2537 goto out;
2538 }
2539
2540 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2541 SCVAL(req->outbuf, smb_flg,
2542 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2543 }
2544
2545 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2546 SCVAL(req->outbuf, smb_flg,
2547 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2548 }
2549
2550 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2551 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2552 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2553 out:
2554 TALLOC_FREE(smb_fname);
2555 TALLOC_FREE(wire_name);
2556 END_PROFILE(SMBctemp);
2557 return;
2558 }
2559
2560 /*******************************************************************
2561 Check if a user is allowed to rename a file.
2562 ********************************************************************/
2563
2564 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2565 uint16 dirtype)
2566 {
2567 if (!CAN_WRITE(conn)) {
2568 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2569 }
2570
2571 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2572 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2573 /* Only bother to read the DOS attribute if we might deny the
2574 rename on the grounds of attribute missmatch. */
2575 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2576 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2577 return NT_STATUS_NO_SUCH_FILE;
2578 }
2579 }
2580
2581 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2582 if (fsp->posix_open) {
2583 return NT_STATUS_OK;
2584 }
2585
2586 /* If no pathnames are open below this
2587 directory, allow the rename. */
2588
2589 if (file_find_subpath(fsp)) {
2590 return NT_STATUS_ACCESS_DENIED;
2591 }
2592 return NT_STATUS_OK;
2593 }
2594
2595 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2596 return NT_STATUS_OK;
2597 }
2598
2599 return NT_STATUS_ACCESS_DENIED;
2600 }
2601
2602 /*******************************************************************
2603 * unlink a file with all relevant access checks
2604 *******************************************************************/
2605
2606 static NTSTATUS do_unlink(connection_struct *conn,
2607 struct smb_request *req,
2608 struct smb_filename *smb_fname,
2609 uint32 dirtype)
2610 {
2611 uint32 fattr;
2612 files_struct *fsp;
2613 uint32 dirtype_orig = dirtype;
2614 NTSTATUS status;
2615 int ret;
2616 bool posix_paths = lp_posix_pathnames();
2617
2618 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2619 smb_fname_str_dbg(smb_fname),
2620 dirtype));
2621
2622 if (!CAN_WRITE(conn)) {
2623 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2624 }
2625
2626 if (posix_paths) {
2627 ret = SMB_VFS_LSTAT(conn, smb_fname);
2628 } else {
2629 ret = SMB_VFS_STAT(conn, smb_fname);
2630 }
2631 if (ret != 0) {
2632 return map_nt_error_from_unix(errno);
2633 }
2634
2635 fattr = dos_mode(conn, smb_fname);
2636
2637 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2638 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2639 }
2640
2641 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2642 if (!dirtype) {
2643 return NT_STATUS_NO_SUCH_FILE;
2644 }
2645
2646 if (!dir_check_ftype(fattr, dirtype)) {
2647 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2648 return NT_STATUS_FILE_IS_A_DIRECTORY;
2649 }
2650 return NT_STATUS_NO_SUCH_FILE;
2651 }
2652
2653 if (dirtype_orig & 0x8000) {
2654 /* These will never be set for POSIX. */
2655 return NT_STATUS_NO_SUCH_FILE;
2656 }
2657
2658 #if 0
2659 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2660 return NT_STATUS_FILE_IS_A_DIRECTORY;
2661 }
2662
2663 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2664 return NT_STATUS_NO_SUCH_FILE;
2665 }
2666
2667 if (dirtype & 0xFF00) {
2668 /* These will never be set for POSIX. */
2669 return NT_STATUS_NO_SUCH_FILE;
2670 }
2671
2672 dirtype &= 0xFF;
2673 if (!dirtype) {
2674 return NT_STATUS_NO_SUCH_FILE;
2675 }
2676
2677 /* Can't delete a directory. */
2678 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2679 return NT_STATUS_FILE_IS_A_DIRECTORY;
2680 }
2681 #endif
2682
2683 #if 0 /* JRATEST */
2684 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2685 return NT_STATUS_OBJECT_NAME_INVALID;
2686 #endif /* JRATEST */
2687
2688 /* On open checks the open itself will check the share mode, so
2689 don't do it here as we'll get it wrong. */
2690
2691 status = SMB_VFS_CREATE_FILE
2692 (conn, /* conn */
2693 req, /* req */
2694 0, /* root_dir_fid */
2695 smb_fname, /* fname */
2696 DELETE_ACCESS, /* access_mask */
2697 FILE_SHARE_NONE, /* share_access */
2698 FILE_OPEN, /* create_disposition*/
2699 FILE_NON_DIRECTORY_FILE, /* create_options */
2700 /* file_attributes */
2701 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2702 FILE_ATTRIBUTE_NORMAL,
2703 0, /* oplock_request */
2704 0, /* allocation_size */
2705 0, /* private_flags */
2706 NULL, /* sd */
2707 NULL, /* ea_list */
2708 &fsp, /* result */
2709 NULL); /* pinfo */
2710
2711 if (!NT_STATUS_IS_OK(status)) {
2712 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2713 nt_errstr(status)));
2714 return status;
2715 }
2716
2717 status = can_set_delete_on_close(fsp, fattr);
2718 if (!NT_STATUS_IS_OK(status)) {
2719 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2720 "(%s)\n",
2721 smb_fname_str_dbg(smb_fname),
2722 nt_errstr(status)));
2723 close_file(req, fsp, NORMAL_CLOSE);
2724 return status;
2725 }
2726
2727 /* The set is across all open files on this dev/inode pair. */
2728 if (!set_delete_on_close(fsp, True,
2729 conn->session_info->security_token,
2730 conn->session_info->unix_token)) {
2731 close_file(req, fsp, NORMAL_CLOSE);
2732 return NT_STATUS_ACCESS_DENIED;
2733 }
2734
2735 return close_file(req, fsp, NORMAL_CLOSE);
2736 }
2737
2738 /****************************************************************************
2739 The guts of the unlink command, split out so it may be called by the NT SMB
2740 code.
2741 ****************************************************************************/
2742
2743 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2744 uint32 dirtype, struct smb_filename *smb_fname,
2745 bool has_wild)
2746 {
2747 char *fname_dir = NULL;
2748 char *fname_mask = NULL;
2749 int count=0;
2750 NTSTATUS status = NT_STATUS_OK;
2751 TALLOC_CTX *ctx = talloc_tos();
2752
2753 /* Split up the directory from the filename/mask. */
2754 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2755 &fname_dir, &fname_mask);
2756 if (!NT_STATUS_IS_OK(status)) {
2757 goto out;
2758 }
2759
2760 /*
2761 * We should only check the mangled cache
2762 * here if unix_convert failed. This means
2763 * that the path in 'mask' doesn't exist
2764 * on the file system and so we need to look
2765 * for a possible mangle. This patch from
2766 * Tine Smukavec <valentin.smukavec@hermes.si>.
2767 */
2768
2769 if (!VALID_STAT(smb_fname->st) &&
2770 mangle_is_mangled(fname_mask, conn->params)) {
2771 char *new_mask = NULL;
2772 mangle_lookup_name_from_8_3(ctx, fname_mask,
2773 &new_mask, conn->params);
2774 if (new_mask) {
2775 TALLOC_FREE(fname_mask);
2776 fname_mask = new_mask;
2777 }
2778 }
2779
2780 if (!has_wild) {
2781
2782 /*
2783 * Only one file needs to be unlinked. Append the mask back
2784 * onto the directory.
2785 */
2786 TALLOC_FREE(smb_fname->base_name);
2787 if (ISDOT(fname_dir)) {
2788 /* Ensure we use canonical names on open. */
2789 smb_fname->base_name = talloc_asprintf(smb_fname,
2790 "%s",
2791 fname_mask);
2792 } else {
2793 smb_fname->base_name = talloc_asprintf(smb_fname,
2794 "%s/%s",
2795 fname_dir,
2796 fname_mask);
2797 }
2798 if (!smb_fname->base_name) {
2799 status = NT_STATUS_NO_MEMORY;
2800 goto out;
2801 }
2802 if (dirtype == 0) {
2803 dirtype = FILE_ATTRIBUTE_NORMAL;
2804 }
2805
2806 status = check_name(conn, smb_fname->base_name);
2807 if (!NT_STATUS_IS_OK(status)) {
2808 goto out;
2809 }
2810
2811 status = do_unlink(conn, req, smb_fname, dirtype);
2812 if (!NT_STATUS_IS_OK(status)) {
2813 goto out;
2814 }
2815
2816 count++;
2817 } else {
2818 struct smb_Dir *dir_hnd = NULL;
2819 long offset = 0;
2820 const char *dname = NULL;
2821 char *talloced = NULL;
2822
2823 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2824 status = NT_STATUS_OBJECT_NAME_INVALID;
2825 goto out;
2826 }
2827
2828 if (strequal(fname_mask,"????????.???")) {
2829 TALLOC_FREE(fname_mask);
2830 fname_mask = talloc_strdup(ctx, "*");
2831 if (!fname_mask) {
2832 status = NT_STATUS_NO_MEMORY;
2833 goto out;
2834 }
2835 }
2836
2837 status = check_name(conn, fname_dir);
2838 if (!NT_STATUS_IS_OK(status)) {
2839 goto out;
2840 }
2841
2842 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2843 dirtype);
2844 if (dir_hnd == NULL) {
2845 status = map_nt_error_from_unix(errno);
2846 goto out;
2847 }
2848
2849 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2850 the pattern matches against the long name, otherwise the short name
2851 We don't implement this yet XXXX
2852 */
2853
2854 status = NT_STATUS_NO_SUCH_FILE;
2855
2856 while ((dname = ReadDirName(dir_hnd, &offset,
2857 &smb_fname->st, &talloced))) {
2858 TALLOC_CTX *frame = talloc_stackframe();
2859
2860 if (!is_visible_file(conn, fname_dir, dname,
2861 &smb_fname->st, true)) {
2862 TALLOC_FREE(frame);
2863 TALLOC_FREE(talloced);
2864 continue;
2865 }
2866
2867 /* Quick check for "." and ".." */
2868 if (ISDOT(dname) || ISDOTDOT(dname)) {
2869 TALLOC_FREE(frame);
2870 TALLOC_FREE(talloced);
2871 continue;
2872 }
2873
2874 if(!mask_match(dname, fname_mask,
2875 conn->case_sensitive)) {
2876 TALLOC_FREE(frame);
2877 TALLOC_FREE(talloced);
2878 continue;
2879 }
2880
2881 TALLOC_FREE(smb_fname->base_name);
2882 if (ISDOT(fname_dir)) {
2883 /* Ensure we use canonical names on open. */
2884 smb_fname->base_name =
2885 talloc_asprintf(smb_fname, "%s",
2886 dname);
2887 } else {
2888 smb_fname->base_name =
2889 talloc_asprintf(smb_fname, "%s/%s",
2890 fname_dir, dname);
2891 }
2892
2893 if (!smb_fname->base_name) {
2894 TALLOC_FREE(dir_hnd);
2895 status = NT_STATUS_NO_MEMORY;
2896 TALLOC_FREE(frame);
2897 TALLOC_FREE(talloced);
2898 goto out;
2899 }
2900
2901 status = check_name(conn, smb_fname->base_name);
2902 if (!NT_STATUS_IS_OK(status)) {
2903 TALLOC_FREE(dir_hnd);
2904 TALLOC_FREE(frame);
2905 TALLOC_FREE(talloced);
2906 goto out;
2907 }
2908
2909 status = do_unlink(conn, req, smb_fname, dirtype);
2910 if (!NT_STATUS_IS_OK(status)) {
2911 TALLOC_FREE(frame);
2912 TALLOC_FREE(talloced);
2913 continue;
2914 }
2915
2916 count++;
2917 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2918 smb_fname->base_name));
2919
2920 TALLOC_FREE(frame);
2921 TALLOC_FREE(talloced);
2922 }
2923 TALLOC_FREE(dir_hnd);
2924 }
2925
2926 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2927 status = map_nt_error_from_unix(errno);
2928 }
2929
2930 out:
2931 TALLOC_FREE(fname_dir);
2932 TALLOC_FREE(fname_mask);
2933 return status;
2934 }
2935
2936 /****************************************************************************
2937 Reply to a unlink
2938 ****************************************************************************/
2939
2940 void reply_unlink(struct smb_request *req)
2941 {
2942 connection_struct *conn = req->conn;
2943 char *name = NULL;
2944 struct smb_filename *smb_fname = NULL;
2945 uint32 dirtype;
2946 NTSTATUS status;
2947 bool path_contains_wcard = False;
2948 TALLOC_CTX *ctx = talloc_tos();
2949
2950 START_PROFILE(SMBunlink);
2951
2952 if (req->wct < 1) {
2953 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2954 goto out;
2955 }
2956
2957 dirtype = SVAL(req->vwv+0, 0);
2958
2959 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2960 STR_TERMINATE, &status,
2961 &path_contains_wcard);
2962 if (!NT_STATUS_IS_OK(status)) {
2963 reply_nterror(req, status);
2964 goto out;
2965 }
2966
2967 status = filename_convert(ctx, conn,
2968 req->flags2 & FLAGS2_DFS_PATHNAMES,
2969 name,
2970 UCF_COND_ALLOW_WCARD_LCOMP,
2971 &path_contains_wcard,
2972 &smb_fname);
2973 if (!NT_STATUS_IS_OK(status)) {
2974 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2975 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2976 ERRSRV, ERRbadpath);
2977 goto out;
2978 }
2979 reply_nterror(req, status);
2980 goto out;
2981 }
2982
2983 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2984
2985 status = unlink_internals(conn, req, dirtype, smb_fname,
2986 path_contains_wcard);
2987 if (!NT_STATUS_IS_OK(status)) {
2988 if (open_was_deferred(req->sconn, req->mid)) {
2989 /* We have re-scheduled this call. */
2990 goto out;
2991 }
2992 reply_nterror(req, status);
2993 goto out;
2994 }
2995
2996 reply_outbuf(req, 0, 0);
2997 out:
2998 TALLOC_FREE(smb_fname);
2999 END_PROFILE(SMBunlink);
3000 return;
3001 }
3002
3003 /****************************************************************************
3004 Fail for readbraw.
3005 ****************************************************************************/
3006
3007 static void fail_readraw(void)
3008 {
3009 const char *errstr = talloc_asprintf(talloc_tos(),
3010 "FAIL ! reply_readbraw: socket write fail (%s)",
3011 strerror(errno));
3012 if (!errstr) {
3013 errstr = "";
3014 }
3015 exit_server_cleanly(errstr);
3016 }
3017
3018 /****************************************************************************
3019 Fake (read/write) sendfile. Returns -1 on read or write fail.
3020 ****************************************************************************/
3021
3022 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3023 {
3024 size_t bufsize;
3025 size_t tosend = nread;
3026 char *buf;
3027
3028 if (nread == 0) {
3029 return 0;
3030 }
3031
3032 bufsize = MIN(nread, 65536);
3033
3034 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3035 return -1;
3036 }
3037
3038 while (tosend > 0) {
3039 ssize_t ret;
3040 size_t cur_read;
3041
3042 if (tosend > bufsize) {
3043 cur_read = bufsize;
3044 } else {
3045 cur_read = tosend;
3046 }
3047 ret = read_file(fsp,buf,startpos,cur_read);
3048 if (ret == -1) {
3049 SAFE_FREE(buf);
3050 return -1;
3051 }
3052
3053 /* If we had a short read, fill with zeros. */
3054 if (ret < cur_read) {
3055 memset(buf + ret, '\0', cur_read - ret);
3056 }
3057
3058 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3059 != cur_read) {
3060 char addr[INET6_ADDRSTRLEN];
3061 /*
3062 * Try and give an error message saying what
3063 * client failed.
3064 */
3065 DEBUG(0, ("write_data failed for client %s. "
3066 "Error %s\n",
3067 get_peer_addr(fsp->conn->sconn->sock, addr,
3068 sizeof(addr)),
3069 strerror(errno)));
3070 SAFE_FREE(buf);
3071 return -1;
3072 }
3073 tosend -= cur_read;
3074 startpos += cur_read;
3075 }
3076
3077 SAFE_FREE(buf);
3078 return (ssize_t)nread;
3079 }
3080
3081 /****************************************************************************
3082 Deal with the case of sendfile reading less bytes from the file than
3083 requested. Fill with zeros (all we can do).
3084 ****************************************************************************/
3085
3086 void sendfile_short_send(files_struct *fsp,
3087 ssize_t nread,
3088 size_t headersize,
3089 size_t smb_maxcnt)
3090 {
3091 #define SHORT_SEND_BUFSIZE 1024
3092 if (nread < headersize) {
3093 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3094 "header for file %s (%s). Terminating\n",
3095 fsp_str_dbg(fsp), strerror(errno)));
3096 exit_server_cleanly("sendfile_short_send failed");
3097 }
3098
3099 nread -= headersize;
3100
3101 if (nread < smb_maxcnt) {
3102 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3103 if (!buf) {
3104 exit_server_cleanly("sendfile_short_send: "
3105 "malloc failed");
3106 }
3107
3108 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3109 "with zeros !\n", fsp_str_dbg(fsp)));
3110
3111 while (nread < smb_maxcnt) {
3112 /*
3113 * We asked for the real file size and told sendfile
3114 * to not go beyond the end of the file. But it can
3115 * happen that in between our fstat call and the
3116 * sendfile call the file was truncated. This is very
3117 * bad because we have already announced the larger
3118 * number of bytes to the client.
3119 *
3120 * The best we can do now is to send 0-bytes, just as
3121 * a read from a hole in a sparse file would do.
3122 *
3123 * This should happen rarely enough that I don't care
3124 * about efficiency here :-)
3125 */
3126 size_t to_write;
3127
3128 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3129 if (write_data(fsp->conn->sconn->sock, buf, to_write)
3130 != to_write) {
3131 char addr[INET6_ADDRSTRLEN];
3132 /*
3133 * Try and give an error message saying what
3134 * client failed.
3135 */
3136 DEBUG(0, ("write_data failed for client %s. "
3137 "Error %s\n",
3138 get_peer_addr(
3139 fsp->conn->sconn->sock, addr,
3140 sizeof(addr)),
3141 strerror(errno)));
3142 exit_server_cleanly("sendfile_short_send: "
3143 "write_data failed");
3144 }
3145 nread += to_write;
3146 }
3147 SAFE_FREE(buf);
3148 }
3149 }
3150
3151 /****************************************************************************
3152 Return a readbraw error (4 bytes of zero).
3153 ****************************************************************************/
3154
3155 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3156 {
3157 char header[4];
3158
3159 SIVAL(header,0,0);
3160
3161 smbd_lock_socket(sconn);
3162 if (write_data(sconn->sock,header,4) != 4) {
3163 char addr[INET6_ADDRSTRLEN];
3164 /*
3165 * Try and give an error message saying what
3166 * client failed.
3167 */
3168 DEBUG(0, ("write_data failed for client %s. "
3169 "Error %s\n",
3170 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3171 strerror(errno)));
3172
3173 fail_readraw();
3174 }
3175 smbd_unlock_socket(sconn);
3176 }
3177
3178 /****************************************************************************
3179 Use sendfile in readbraw.
3180 ****************************************************************************/
3181
3182 static void send_file_readbraw(connection_struct *conn,
3183 struct smb_request *req,
3184 files_struct *fsp,
3185 off_t startpos,
3186 size_t nread,
3187 ssize_t mincount)
3188 {
3189 struct smbd_server_connection *sconn = req->sconn;
3190 char *outbuf = NULL;
3191 ssize_t ret=0;
3192
3193 /*
3194 * We can only use sendfile on a non-chained packet
3195 * but we can use on a non-oplocked file. tridge proved this
3196 * on a train in Germany :-). JRA.
3197 * reply_readbraw has already checked the length.
3198 */
3199
3200 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3201 (fsp->wcp == NULL) &&
3202 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3203 ssize_t sendfile_read = -1;
3204 char header[4];
3205 DATA_BLOB header_blob;
3206
3207 _smb_setlen(header,nread);
3208 header_blob = data_blob_const(header, 4);
3209
3210 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3211 &header_blob, startpos,
3212 nread);
3213 if (sendfile_read == -1) {
3214 /* Returning ENOSYS means no data at all was sent.
3215 * Do this as a normal read. */
3216 if (errno == ENOSYS) {
3217 goto normal_readbraw;
3218 }
3219
3220 /*
3221 * Special hack for broken Linux with no working sendfile. If we
3222 * return EINTR we sent the header but not the rest of the data.
3223 * Fake this up by doing read/write calls.
3224 */
3225 if (errno == EINTR) {
3226 /* Ensure we don't do this again. */
3227 set_use_sendfile(SNUM(conn), False);
3228 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3229
3230 if (fake_sendfile(fsp, startpos, nread) == -1) {
3231 DEBUG(0,("send_file_readbraw: "
3232 "fake_sendfile failed for "
3233 "file %s (%s).\n",
3234 fsp_str_dbg(fsp),
3235 strerror(errno)));
3236 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3237 }
3238 return;
3239 }
3240
3241 DEBUG(0,("send_file_readbraw: sendfile failed for "
3242 "file %s (%s). Terminating\n",
3243 fsp_str_dbg(fsp), strerror(errno)));
3244 exit_server_cleanly("send_file_readbraw sendfile failed");
3245 } else if (sendfile_read == 0) {
3246 /*
3247 * Some sendfile implementations return 0 to indicate
3248 * that there was a short read, but nothing was
3249 * actually written to the socket. In this case,
3250 * fallback to the normal read path so the header gets
3251 * the correct byte count.
3252 */
3253 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3254 "bytes falling back to the normal read: "
3255 "%s\n", fsp_str_dbg(fsp)));
3256 goto normal_readbraw;
3257 }
3258
3259 /* Deal with possible short send. */
3260 if (sendfile_read != 4+nread) {
3261 sendfile_short_send(fsp, sendfile_read, 4, nread);
3262 }
3263 return;
3264 }
3265
3266 normal_readbraw:
3267
3268 outbuf = talloc_array(NULL, char, nread+4);
3269 if (!outbuf) {
3270 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3271 (unsigned)(nread+4)));
3272 reply_readbraw_error(sconn);
3273 return;
3274 }
3275
3276 if (nread > 0) {
3277 ret = read_file(fsp,outbuf+4,startpos,nread);
3278 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3279 if (ret < mincount)
3280 ret = 0;
3281 #else
3282 if (ret < nread)
3283 ret = 0;
3284 #endif
3285 }
3286
3287 _smb_setlen(outbuf,ret);
3288 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3289 char addr[INET6_ADDRSTRLEN];
3290 /*
3291 * Try and give an error message saying what
3292 * client failed.
3293 */
3294 DEBUG(0, ("write_data failed for client %s. "
3295 "Error %s\n",
3296 get_peer_addr(fsp->conn->sconn->sock, addr,
3297 sizeof(addr)),
3298 strerror(errno)));
3299
3300 fail_readraw();
3301 }
3302
3303 TALLOC_FREE(outbuf);
3304 }
3305
3306 /****************************************************************************
3307 Reply to a readbraw (core+ protocol).
3308 ****************************************************************************/
3309
3310 void reply_readbraw(struct smb_request *req)
3311 {
3312 connection_struct *conn = req->conn;
3313 struct smbd_server_connection *sconn = req->sconn;
3314 ssize_t maxcount,mincount;
3315 size_t nread = 0;
3316 off_t startpos;
3317 files_struct *fsp;
3318 struct lock_struct lock;
3319 off_t size = 0;
3320
3321 START_PROFILE(SMBreadbraw);
3322
3323 if (srv_is_signing_active(sconn) || req->encrypted) {
3324 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3325 "raw reads/writes are disallowed.");
3326 }
3327
3328 if (req->wct < 8) {
3329 reply_readbraw_error(sconn);
3330 END_PROFILE(SMBreadbraw);
3331 return;
3332 }
3333
3334 if (sconn->smb1.echo_handler.trusted_fde) {
3335 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3336 "'async smb echo handler = yes'\n"));
3337 reply_readbraw_error(sconn);
3338 END_PROFILE(SMBreadbraw);
3339 return;
3340 }
3341
3342 /*
3343 * Special check if an oplock break has been issued
3344 * and the readraw request croses on the wire, we must
3345 * return a zero length response here.
3346 */
3347
3348 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3349
3350 /*
3351 * We have to do a check_fsp by hand here, as
3352 * we must always return 4 zero bytes on error,
3353 * not a NTSTATUS.
3354 */
3355
3356 if (!fsp || !conn || conn != fsp->conn ||
3357 req->vuid != fsp->vuid ||
3358 fsp->is_directory || fsp->fh->fd == -1) {
3359 /*
3360 * fsp could be NULL here so use the value from the packet. JRA.
3361 */
3362 DEBUG(3,("reply_readbraw: fnum %d not valid "
3363 "- cache prime?\n",
3364 (int)SVAL(req->vwv+0, 0)));
3365 reply_readbraw_error(sconn);
3366 END_PROFILE(SMBreadbraw);
3367 return;
3368 }
3369
3370 /* Do a "by hand" version of CHECK_READ. */
3371 if (!(fsp->can_read ||
3372 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3373 (fsp->access_mask & FILE_EXECUTE)))) {
3374 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3375 (int)SVAL(req->vwv+0, 0)));
3376 reply_readbraw_error(sconn);
3377 END_PROFILE(SMBreadbraw);
3378 return;
3379 }
3380
3381 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3382
3383 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3384 if(req->wct == 10) {
3385 /*
3386 * This is a large offset (64 bit) read.
3387 */
3388
3389 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3390
3391 if(startpos < 0) {
3392 DEBUG(0,("reply_readbraw: negative 64 bit "
3393 "readraw offset (%.0f) !\n",
3394 (double)startpos ));
3395 reply_readbraw_error(sconn);
3396 END_PROFILE(SMBreadbraw);
3397 return;
3398 }
3399 }
3400
3401 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3402 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3403
3404 /* ensure we don't overrun the packet size */
3405 maxcount = MIN(65535,maxcount);
3406
3407 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3408 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3409 &lock);
3410
3411 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3412 reply_readbraw_error(sconn);
3413 END_PROFILE(SMBreadbraw);
3414 return;
3415 }
3416
3417 if (fsp_stat(fsp) == 0) {
3418 size = fsp->fsp_name->st.st_ex_size;
3419 }
3420
3421 if (startpos >= size) {
3422 nread = 0;
3423 } else {
3424 nread = MIN(maxcount,(size - startpos));
3425 }
3426
3427 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3428 if (nread < mincount)
3429 nread = 0;
3430 #endif
3431
3432 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3433 "min=%lu nread=%lu\n",
3434 fsp_fnum_dbg(fsp), (double)startpos,
3435 (unsigned long)maxcount,
3436 (unsigned long)mincount,
3437 (unsigned long)nread ) );
3438
3439 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3440
3441 DEBUG(5,("reply_readbraw finished\n"));
3442
3443 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3444
3445 END_PROFILE(SMBreadbraw);
3446 return;
3447 }
3448
3449 #undef DBGC_CLASS
3450 #define DBGC_CLASS DBGC_LOCKING
3451
3452 /****************************************************************************
3453 Reply to a lockread (core+ protocol).
3454 ****************************************************************************/
3455
3456 void reply_lockread(struct smb_request *req)
3457 {
3458 connection_struct *conn = req->conn;
3459 ssize_t nread = -1;
3460 char *data;
3461 off_t startpos;
3462 size_t numtoread;
3463 NTSTATUS status;
3464 files_struct *fsp;
3465 struct byte_range_lock *br_lck = NULL;
3466 char *p = NULL;
3467 struct smbd_server_connection *sconn = req->sconn;
3468
3469 START_PROFILE(SMBlockread);
3470
3471 if (req->wct < 5) {
3472 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3473 END_PROFILE(SMBlockread);
3474 return;
3475 }
3476
3477 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3478
3479 if (!check_fsp(conn, req, fsp)) {
3480 END_PROFILE(SMBlockread);
3481 return;
3482 }
3483
3484 if (!CHECK_READ(fsp,req)) {
3485 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3486 END_PROFILE(SMBlockread);
3487 return;
3488 }
3489
3490 numtoread = SVAL(req->vwv+1, 0);
3491 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3492
3493 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3494
3495 reply_outbuf(req, 5, numtoread + 3);
3496
3497 data = smb_buf(req->outbuf) + 3;
3498
3499 /*
3500 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3501 * protocol request that predates the read/write lock concept.
3502 * Thus instead of asking for a read lock here we need to ask
3503 * for a write lock. JRA.
3504 * Note that the requested lock size is unaffected by max_recv.
3505 */
3506
3507 br_lck = do_lock(req->sconn->msg_ctx,
3508 fsp,
3509 (uint64_t)req->smbpid,
3510 (uint64_t)numtoread,
3511 (uint64_t)startpos,
3512 WRITE_LOCK,
3513 WINDOWS_LOCK,
3514 False, /* Non-blocking lock. */
3515 &status,
3516 NULL,
3517 NULL);
3518 TALLOC_FREE(br_lck);
3519
3520 if (NT_STATUS_V(status)) {
3521 reply_nterror(req, status);
3522 END_PROFILE(SMBlockread);
3523 return;
3524 }
3525
3526 /*
3527 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3528 */
3529
3530 if (numtoread > sconn->smb1.negprot.max_recv) {
3531 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3532 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3533 (unsigned int)numtoread,
3534 (unsigned int)sconn->smb1.negprot.max_recv));
3535 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3536 }
3537 nread = read_file(fsp,data,startpos,numtoread);
3538
3539 if (nread < 0) {
3540 reply_nterror(req, map_nt_error_from_unix(errno));
3541 END_PROFILE(SMBlockread);
3542 return;
3543 }
3544
3545 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3546
3547 SSVAL(req->outbuf,smb_vwv0,nread);
3548 SSVAL(req->outbuf,smb_vwv5,nread+3);
3549 p = smb_buf(req->outbuf);
3550 SCVAL(p,0,0); /* pad byte. */
3551 SSVAL(p,1,nread);
3552
3553 DEBUG(3,("lockread %s num=%d nread=%d\n",
3554 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3555
3556 END_PROFILE(SMBlockread);
3557 return;
3558 }
3559
3560 #undef DBGC_CLASS
3561 #define DBGC_CLASS DBGC_ALL
3562
3563 /****************************************************************************
3564 Reply to a read.
3565 ****************************************************************************/
3566
3567 void reply_read(struct smb_request *req)
3568 {
3569 connection_struct *conn = req->conn;
3570 size_t numtoread;
3571 ssize_t nread = 0;
3572 char *data;
3573 off_t startpos;
3574 int outsize = 0;
3575 files_struct *fsp;
3576 struct lock_struct lock;
3577 struct smbd_server_connection *sconn = req->sconn;
3578
3579 START_PROFILE(SMBread);
3580
3581 if (req->wct < 3) {
3582 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3583 END_PROFILE(SMBread);
3584 return;
3585 }
3586
3587 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3588
3589 if (!check_fsp(conn, req, fsp)) {
3590 END_PROFILE(SMBread);
3591 return;
3592 }
3593
3594 if (!CHECK_READ(fsp,req)) {
3595 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3596 END_PROFILE(SMBread);
3597 return;
3598 }
3599
3600 numtoread = SVAL(req->vwv+1, 0);
3601 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3602
3603 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3604
3605 /*
3606 * The requested read size cannot be greater than max_recv. JRA.
3607 */
3608 if (numtoread > sconn->smb1.negprot.max_recv) {
3609 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3610 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3611 (unsigned int)numtoread,
3612 (unsigned int)sconn->smb1.negprot.max_recv));
3613 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3614 }
3615
3616 reply_outbuf(req, 5, numtoread+3);
3617
3618 data = smb_buf(req->outbuf) + 3;
3619
3620 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3621 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3622 &lock);
3623
3624 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3625 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3626 END_PROFILE(SMBread);
3627 return;
3628 }
3629
3630 if (numtoread > 0)
3631 nread = read_file(fsp,data,startpos,numtoread);
3632
3633 if (nread < 0) {
3634 reply_nterror(req, map_nt_error_from_unix(errno));
3635 goto strict_unlock;
3636 }
3637
3638 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3639
3640 SSVAL(req->outbuf,smb_vwv0,nread);
3641 SSVAL(req->outbuf,smb_vwv5,nread+3);
3642 SCVAL(smb_buf(req->outbuf),0,1);
3643 SSVAL(smb_buf(req->outbuf),1,nread);
3644
3645 DEBUG(3, ("read %s num=%d nread=%d\n",
3646 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3647
3648 strict_unlock:
3649 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3650
3651 END_PROFILE(SMBread);
3652 return;
3653 }
3654
3655 /****************************************************************************
3656 Setup readX header.
3657 ****************************************************************************/
3658
3659 static int setup_readX_header(struct smb_request *req, char *outbuf,
3660 size_t smb_maxcnt)
3661 {
3662 int outsize;
3663
3664 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3665
3666 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3667
3668 SCVAL(outbuf,smb_vwv0,0xFF);
3669 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3670 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3671 SSVAL(outbuf,smb_vwv6,
3672 (smb_wct - 4) /* offset from smb header to wct */
3673 + 1 /* the wct field */
3674 + 12 * sizeof(uint16_t) /* vwv */
3675 + 2); /* the buflen field */
3676 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3677 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3678 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3679 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3680 return outsize;
3681 }
3682
3683 /****************************************************************************
3684 Reply to a read and X - possibly using sendfile.
3685 ****************************************************************************/
3686
3687 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3688 files_struct *fsp, off_t startpos,
3689 size_t smb_maxcnt)
3690 {
3691 ssize_t nread = -1;
3692 struct lock_struct lock;
3693 int saved_errno = 0;
3694
3695 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3696 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3697 &lock);
3698
3699 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3700 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3701 return;
3702 }
3703
3704 /*
3705 * We can only use sendfile on a non-chained packet
3706 * but we can use on a non-oplocked file. tridge proved this
3707 * on a train in Germany :-). JRA.
3708 */
3709
3710 if (!req_is_in_chain(req) &&
3711 !req->encrypted &&
3712 (fsp->base_fsp == NULL) &&
3713 (fsp->wcp == NULL) &&
3714 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3715 uint8 headerbuf[smb_size + 12 * 2];
3716 DATA_BLOB header;
3717
3718 if(fsp_stat(fsp) == -1) {
3719 reply_nterror(req, map_nt_error_from_unix(errno));
3720 goto strict_unlock;
3721 }
3722
3723 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3724 (startpos > fsp->fsp_name->st.st_ex_size) ||
3725 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3726 /*
3727 * We already know that we would do a short read, so don't
3728 * try the sendfile() path.
3729 */
3730 goto nosendfile_read;
3731 }
3732
3733 /*
3734 * Set up the packet header before send. We
3735 * assume here the sendfile will work (get the
3736 * correct amount of data).
3737 */
3738
3739 header = data_blob_const(headerbuf, sizeof(headerbuf));
3740
3741 construct_reply_common_req(req, (char *)headerbuf);
3742 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3743
3744 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3745 startpos, smb_maxcnt);
3746 if (nread == -1) {
3747 /* Returning ENOSYS means no data at all was sent.
3748 Do this as a normal read. */
3749 if (errno == ENOSYS) {
3750 goto normal_read;
3751 }
3752
3753 /*
3754 * Special hack for broken Linux with no working sendfile. If we
3755 * return EINTR we sent the header but not the rest of the data.
3756 * Fake this up by doing read/write calls.
3757 */
3758
3759 if (errno == EINTR) {
3760 /* Ensure we don't do this again. */
3761 set_use_sendfile(SNUM(conn), False);
3762 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3763 nread = fake_sendfile(fsp, startpos,
3764 smb_maxcnt);
3765 if (nread == -1) {
3766 DEBUG(0,("send_file_readX: "
3767 "fake_sendfile failed for "
3768 "file %s (%s).\n",
3769 fsp_str_dbg(fsp),
3770 strerror(errno)));
3771 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3772 }
3773 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3774 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3775 /* No outbuf here means successful sendfile. */
3776 goto strict_unlock;
3777 }
3778
3779 DEBUG(0,("send_file_readX: sendfile failed for file "
3780 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3781 strerror(errno)));
3782 exit_server_cleanly("send_file_readX sendfile failed");
3783 } else if (nread == 0) {
3784 /*
3785 * Some sendfile implementations return 0 to indicate
3786 * that there was a short read, but nothing was
3787 * actually written to the socket. In this case,
3788 * fallback to the normal read path so the header gets
3789 * the correct byte count.
3790 */
3791 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3792 "falling back to the normal read: %s\n",
3793 fsp_str_dbg(fsp)));
3794 goto normal_read;
3795 }
3796
3797 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3798 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3799
3800 /* Deal with possible short send. */
3801 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3802 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3803 }
3804 /* No outbuf here means successful sendfile. */
3805 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3806 SMB_PERFCOUNT_END(&req->pcd);
3807 goto strict_unlock;
3808 }
3809
3810 normal_read:
3811
3812 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3813 uint8 headerbuf[smb_size + 2*12];
3814
3815 construct_reply_common_req(req, (char *)headerbuf);
3816 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3817
3818 /* Send out the header. */
3819 if (write_data(req->sconn->sock, (char *)headerbuf,
3820 sizeof(headerbuf)) != sizeof(headerbuf)) {
3821
3822 char addr[INET6_ADDRSTRLEN];
3823 /*
3824 * Try and give an error message saying what
3825 * client failed.
3826 */
3827 DEBUG(0, ("write_data failed for client %s. "
3828 "Error %s\n",
3829 get_peer_addr(req->sconn->sock, addr,
3830 sizeof(addr)),
3831 strerror(errno)));
3832
3833 DEBUG(0,("send_file_readX: write_data failed for file "
3834 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3835 strerror(errno)));
3836 exit_server_cleanly("send_file_readX sendfile failed");
3837 }
3838 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3839 if (nread == -1) {
3840 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3841 "file %s (%s).\n", fsp_str_dbg(fsp),
3842 strerror(errno)));
3843 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3844 }
3845 goto strict_unlock;
3846 }
3847
3848 nosendfile_read:
3849
3850 reply_outbuf(req, 12, smb_maxcnt);
3851 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3852 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3853
3854 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3855 saved_errno = errno;
3856
3857 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3858
3859 if (nread < 0) {
3860 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3861 return;
3862 }
3863
3864 setup_readX_header(req, (char *)req->outbuf, nread);
3865
3866 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3867 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3868 return;
3869
3870 strict_unlock:
3871 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3872 TALLOC_FREE(req->outbuf);
3873 return;
3874 }
3875
3876 /****************************************************************************
3877 Work out how much space we have for a read return.
3878 ****************************************************************************/
3879
3880 static size_t calc_max_read_pdu(const struct smb_request *req)
3881 {
3882 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3883 return req->sconn->smb1.sessions.max_send;
3884 }
3885
3886 if (!lp_large_readwrite()) {
3887 return req->sconn->smb1.sessions.max_send;
3888 }
3889
3890 if (req_is_in_chain(req)) {
3891 return req->sconn->smb1.sessions.max_send;
3892 }
3893
3894 if (req->encrypted) {
3895 /*
3896 * Don't take encrypted traffic up to the
3897 * limit. There are padding considerations
3898 * that make that tricky.
3899 */
3900 return req->sconn->smb1.sessions.max_send;
3901 }
3902
3903 if (srv_is_signing_active(req->sconn)) {
3904 return 0x1FFFF;
3905 }
3906
3907 if (!lp_unix_extensions()) {
3908 return 0x1FFFF;
3909 }
3910
3911 /*
3912 * We can do ultra-large POSIX reads.
3913 */
3914 return 0xFFFFFF;
3915 }
3916
3917 /****************************************************************************
3918 Calculate how big a read can be. Copes with all clients. It's always
3919 safe to return a short read - Windows does this.
3920 ****************************************************************************/
3921
3922 static size_t calc_read_size(const struct smb_request *req,
3923 size_t upper_size,
3924 size_t lower_size)
3925 {
3926 size_t max_pdu = calc_max_read_pdu(req);
3927 size_t total_size = 0;
3928 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3929 size_t max_len = max_pdu - hdr_len;
3930
3931 /*
3932 * Windows explicitly ignores upper size of 0xFFFF.
3933 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3934 * We must do the same as these will never fit even in
3935 * an extended size NetBIOS packet.
3936 */
3937 if (upper_size == 0xFFFF) {
3938 upper_size = 0;
3939 }
3940
3941 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3942 upper_size = 0;
3943 }
3944
3945 total_size = ((upper_size<<16) | lower_size);
3946
3947 /*
3948 * LARGE_READX test shows it's always safe to return
3949 * a short read. Windows does so.
3950 */
3951 return MIN(total_size, max_len);
3952 }
3953
3954 /****************************************************************************
3955 Reply to a read and X.
3956 ****************************************************************************/
3957
3958 void reply_read_and_X(struct smb_request *req)
3959 {
3960 connection_struct *conn = req->conn;
3961 files_struct *fsp;
3962 off_t startpos;
3963 size_t smb_maxcnt;
3964 size_t upper_size;
3965 bool big_readX = False;
3966 #if 0
3967 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3968 #endif
3969
3970 START_PROFILE(SMBreadX);
3971
3972 if ((req->wct != 10) && (req->wct != 12)) {
3973 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3974 return;
3975 }
3976
3977 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3978 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3979 smb_maxcnt = SVAL(req->vwv+5, 0);
3980
3981 /* If it's an IPC, pass off the pipe handler. */
3982 if (IS_IPC(conn)) {
3983 reply_pipe_read_and_X(req);
3984 END_PROFILE(SMBreadX);
3985 return;
3986 }
3987
3988 if (!check_fsp(conn, req, fsp)) {
3989 END_PROFILE(SMBreadX);
3990 return;
3991 }
3992
3993 if (!CHECK_READ(fsp,req)) {
3994 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3995 END_PROFILE(SMBreadX);
3996 return;
3997 }
3998
3999 upper_size = SVAL(req->vwv+7, 0);
4000 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4001 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4002 /*
4003 * This is a heuristic to avoid keeping large
4004 * outgoing buffers around over long-lived aio
4005 * requests.
4006 */
4007 big_readX = True;
4008 }
4009
4010 if (req->wct == 12) {
4011 /*
4012 * This is a large offset (64 bit) read.
4013 */
4014 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4015
4016 }
4017
4018 if (!big_readX) {
4019 NTSTATUS status = schedule_aio_read_and_X(conn,
4020 req,
4021 fsp,
4022 startpos,
4023 smb_maxcnt);
4024 if (NT_STATUS_IS_OK(status)) {
4025 /* Read scheduled - we're done. */
4026 goto out;
4027 }
4028 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4029 /* Real error - report to client. */
4030 END_PROFILE(SMBreadX);
4031 reply_nterror(req, status);
4032 return;
4033 }
4034 /* NT_STATUS_RETRY - fall back to sync read. */
4035 }
4036
4037 smbd_lock_socket(req->sconn);
4038 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4039 smbd_unlock_socket(req->sconn);
4040
4041 out:
4042 END_PROFILE(SMBreadX);
4043 return;
4044 }
4045
4046 /****************************************************************************
4047 Error replies to writebraw must have smb_wct == 1. Fix this up.
4048 ****************************************************************************/
4049
4050 void error_to_writebrawerr(struct smb_request *req)
4051 {
4052 uint8 *old_outbuf = req->outbuf;
4053
4054 reply_outbuf(req, 1, 0);
4055
4056 memcpy(req->outbuf, old_outbuf, smb_size);
4057 TALLOC_FREE(old_outbuf);
4058 }
4059
4060 /****************************************************************************
4061 Read 4 bytes of a smb packet and return the smb length of the packet.
4062 Store the result in the buffer. This version of the function will
4063 never return a session keepalive (length of zero).
4064 Timeout is in milliseconds.
4065 ****************************************************************************/
4066
4067 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4068 size_t *len)
4069 {
4070 uint8_t msgtype = NBSSkeepalive;
4071
4072 while (msgtype == NBSSkeepalive) {
4073 NTSTATUS status;
4074
4075 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4076 len);
4077 if (!NT_STATUS_IS_OK(status)) {
4078 char addr[INET6_ADDRSTRLEN];
4079 /* Try and give an error message
4080 * saying what client failed. */
4081 DEBUG(0, ("read_fd_with_timeout failed for "
4082 "client %s read error = %s.\n",
4083 get_peer_addr(fd,addr,sizeof(addr)),
4084 nt_errstr(status)));
4085 return status;
4086 }
4087
4088 msgtype = CVAL(inbuf, 0);
4089 }
4090
4091 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4092 (unsigned long)len));
4093
4094 return NT_STATUS_OK;
4095 }
4096
4097 /****************************************************************************
4098 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4099 ****************************************************************************/
4100
4101 void reply_writebraw(struct smb_request *req)
4102 {
4103 connection_struct *conn = req->conn;
4104 char *buf = NULL;
4105 ssize_t nwritten=0;
4106 ssize_t total_written=0;
4107 size_t numtowrite=0;
4108 size_t tcount;
4109 off_t startpos;
4110 const char *data=NULL;
4111 bool write_through;
4112 files_struct *fsp;
4113 struct lock_struct lock;
4114 NTSTATUS status;
4115
4116 START_PROFILE(SMBwritebraw);
4117
4118 /*
4119 * If we ever reply with an error, it must have the SMB command
4120 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4121 * we're finished.
4122 */
4123 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4124
4125 if (srv_is_signing_active(req->sconn)) {
4126 END_PROFILE(SMBwritebraw);
4127 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4128 "raw reads/writes are disallowed.");
4129 }
4130
4131 if (req->wct < 12) {
4132 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4133 error_to_writebrawerr(req);
4134 END_PROFILE(SMBwritebraw);
4135 return;
4136 }
4137
4138 if (req->sconn->smb1.echo_handler.trusted_fde) {
4139 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4140 "'async smb echo handler = yes'\n"));
4141 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4142 error_to_writebrawerr(req);
4143 END_PROFILE(SMBwritebraw);
4144 return;
4145 }
4146
4147 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4148 if (!check_fsp(conn, req, fsp)) {
4149 error_to_writebrawerr(req);
4150 END_PROFILE(SMBwritebraw);
4151 return;
4152 }
4153
4154 if (!CHECK_WRITE(fsp)) {
4155 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4156 error_to_writebrawerr(req);
4157 END_PROFILE(SMBwritebraw);
4158 return;
4159 }
4160
4161 tcount = IVAL(req->vwv+1, 0);
4162 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4163 write_through = BITSETW(req->vwv+7,0);
4164
4165 /* We have to deal with slightly different formats depending
4166 on whether we are using the core+ or lanman1.0 protocol */
4167
4168 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4169 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4170 data = smb_buf_const(req->inbuf);
4171 } else {
4172 numtowrite = SVAL(req->vwv+10, 0);
4173 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4174 }
4175
4176 /* Ensure we don't write bytes past the end of this packet. */
4177 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4178 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4179 error_to_writebrawerr(req);
4180 END_PROFILE(SMBwritebraw);
4181 return;
4182 }
4183
4184 if (!fsp->print_file) {
4185 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4186 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4187 &lock);
4188
4189 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4190 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4191 error_to_writebrawerr(req);
4192 END_PROFILE(SMBwritebraw);
4193 return;
4194 }
4195 }
4196
4197 if (numtowrite>0) {
4198 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4199 }
4200
4201 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4202 "wrote=%d sync=%d\n",
4203 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4204 (int)nwritten, (int)write_through));
4205
4206 if (nwritten < (ssize_t)numtowrite) {
4207 reply_nterror(req, NT_STATUS_DISK_FULL);
4208 error_to_writebrawerr(req);
4209 goto strict_unlock;
4210 }
4211
4212 total_written = nwritten;
4213
4214 /* Allocate a buffer of 64k + length. */
4215 buf = talloc_array(NULL, char, 65540);
4216 if (!buf) {
4217 reply_nterror(req, NT_STATUS_NO_MEMORY);
4218 error_to_writebrawerr(req);
4219 goto strict_unlock;
4220 }
4221
4222 /* Return a SMBwritebraw message to the redirector to tell
4223 * it to send more bytes */
4224
4225 memcpy(buf, req->inbuf, smb_size);
4226 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4227 SCVAL(buf,smb_com,SMBwritebraw);
4228 SSVALS(buf,smb_vwv0,0xFFFF);
4229 show_msg(buf);
4230 if (!srv_send_smb(req->sconn,
4231 buf,
4232 false, 0, /* no signing */
4233 IS_CONN_ENCRYPTED(conn),
4234 &req->pcd)) {
4235 exit_server_cleanly("reply_writebraw: srv_send_smb "
4236 "failed.");
4237 }
4238
4239 /* Now read the raw data into the buffer and write it */
4240 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4241 &numtowrite);
4242 if (!NT_STATUS_IS_OK(status)) {
4243 exit_server_cleanly("secondary writebraw failed");
4244 }
4245
4246 /* Set up outbuf to return the correct size */
4247 reply_outbuf(req, 1, 0);
4248
4249 if (numtowrite != 0) {
4250
4251 if (numtowrite > 0xFFFF) {
4252 DEBUG(0,("reply_writebraw: Oversize secondary write "
4253 "raw requested (%u). Terminating\n",
4254 (unsigned int)numtowrite ));
4255 exit_server_cleanly("secondary writebraw failed");
4256 }
4257
4258 if (tcount > nwritten+numtowrite) {
4259 DEBUG(3,("reply_writebraw: Client overestimated the "
4260 "write %d %d %d\n",
4261 (int)tcount,(int)nwritten,(int)numtowrite));
4262 }
4263
4264 status = read_data(req->sconn->sock, buf+4, numtowrite);
4265
4266 if (!NT_STATUS_IS_OK(status)) {
4267 char addr[INET6_ADDRSTRLEN];
4268 /* Try and give an error message
4269 * saying what client failed. */
4270 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4271 "raw read failed (%s) for client %s. "
4272 "Terminating\n", nt_errstr(status),
4273 get_peer_addr(req->sconn->sock, addr,
4274 sizeof(addr))));
4275 exit_server_cleanly("secondary writebraw failed");
4276 }
4277
4278 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4279 if (nwritten == -1) {
4280 TALLOC_FREE(buf);
4281 reply_nterror(req, map_nt_error_from_unix(errno));
4282 error_to_writebrawerr(req);
4283 goto strict_unlock;
4284 }
4285
4286 if (nwritten < (ssize_t)numtowrite) {
4287 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4288 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4289 }
4290
4291 if (nwritten > 0) {
4292 total_written += nwritten;
4293 }
4294 }
4295
4296 TALLOC_FREE(buf);
4297 SSVAL(req->outbuf,smb_vwv0,total_written);
4298
4299 status = sync_file(conn, fsp, write_through);
4300 if (!NT_STATUS_IS_OK(status)) {
4301 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4302 fsp_str_dbg(fsp), nt_errstr(status)));
4303 reply_nterror(req, status);
4304 error_to_writebrawerr(req);
4305 goto strict_unlock;
4306 }
4307
4308 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4309 "wrote=%d\n",
4310 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4311 (int)total_written));
4312
4313 if (!fsp->print_file) {
4314 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4315 }
4316
4317 /* We won't return a status if write through is not selected - this
4318 * follows what WfWg does */
4319 END_PROFILE(SMBwritebraw);
4320
4321 if (!write_through && total_written==tcount) {
4322
4323 #if RABBIT_PELLET_FIX
4324 /*
4325 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4326 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4327 * JRA.
4328 */
4329 if (!send_keepalive(req->sconn->sock)) {
4330 exit_server_cleanly("reply_writebraw: send of "
4331 "keepalive failed");
4332 }
4333 #endif
4334 TALLOC_FREE(req->outbuf);
4335 }
4336 return;
4337
4338 strict_unlock:
4339 if (!fsp->print_file) {
4340 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4341 }
4342
4343 END_PROFILE(SMBwritebraw);
4344 return;
4345 }
4346
4347 #undef DBGC_CLASS
4348 #define DBGC_CLASS DBGC_LOCKING
4349
4350 /****************************************************************************
4351 Reply to a writeunlock (core+).
4352 ****************************************************************************/
4353
4354 void reply_writeunlock(struct smb_request *req)
4355 {
4356 connection_struct *conn = req->conn;
4357 ssize_t nwritten = -1;
4358 size_t numtowrite;
4359 off_t startpos;
4360 const char *data;
4361 NTSTATUS status = NT_STATUS_OK;
4362 files_struct *fsp;
4363 struct lock_struct lock;
4364 int saved_errno = 0;
4365
4366 START_PROFILE(SMBwriteunlock);
4367
4368 if (req->wct < 5) {
4369 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4370 END_PROFILE(SMBwriteunlock);
4371 return;
4372 }
4373
4374 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4375
4376 if (!check_fsp(conn, req, fsp)) {
4377 END_PROFILE(SMBwriteunlock);
4378 return;
4379 }
4380
4381 if (!CHECK_WRITE(fsp)) {
4382 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4383 END_PROFILE(SMBwriteunlock);
4384 return;
4385 }
4386
4387 numtowrite = SVAL(req->vwv+1, 0);
4388 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4389 data = (const char *)req->buf + 3;
4390
4391 if (!fsp->print_file && numtowrite > 0) {
4392 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4393 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4394 &lock);
4395
4396 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4397 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4398 END_PROFILE(SMBwriteunlock);
4399 return;
4400 }
4401 }
4402
4403 /* The special X/Open SMB protocol handling of
4404 zero length writes is *NOT* done for
4405 this call */
4406 if(numtowrite == 0) {
4407 nwritten = 0;
4408 } else {
4409 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4410 saved_errno = errno;
4411 }
4412
4413 status = sync_file(conn, fsp, False /* write through */);
4414 if (!NT_STATUS_IS_OK(status)) {
4415 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4416 fsp_str_dbg(fsp), nt_errstr(status)));
4417 reply_nterror(req, status);
4418 goto strict_unlock;
4419 }
4420
4421 if(nwritten < 0) {
4422 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4423 goto strict_unlock;
4424 }
4425
4426 if((nwritten < numtowrite) && (numtowrite != 0)) {
4427 reply_nterror(req, NT_STATUS_DISK_FULL);
4428 goto strict_unlock;
4429 }
4430
4431 if (numtowrite && !fsp->print_file) {
4432 status = do_unlock(req->sconn->msg_ctx,
4433 fsp,
4434 (uint64_t)req->smbpid,
4435 (uint64_t)numtowrite,
4436 (uint64_t)startpos,
4437 WINDOWS_LOCK);
4438
4439 if (NT_STATUS_V(status)) {
4440 reply_nterror(req, status);
4441 goto strict_unlock;
4442 }
4443 }
4444
4445 reply_outbuf(req, 1, 0);
4446
4447 SSVAL(req->outbuf,smb_vwv0,nwritten);
4448
4449 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4450 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4451
4452 strict_unlock:
4453 if (numtowrite && !fsp->print_file) {
4454 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4455 }
4456
4457 END_PROFILE(SMBwriteunlock);
4458 return;
4459 }
4460
4461 #undef DBGC_CLASS
4462 #define DBGC_CLASS DBGC_ALL
4463
4464 /****************************************************************************
4465 Reply to a write.
4466 ****************************************************************************/
4467
4468 void reply_write(struct smb_request *req)
4469 {
4470 connection_struct *conn = req->conn;
4471 size_t numtowrite;
4472 ssize_t nwritten = -1;
4473 off_t startpos;
4474 const char *data;
4475 files_struct *fsp;
4476 struct lock_struct lock;
4477 NTSTATUS status;
4478 int saved_errno = 0;
4479
4480 START_PROFILE(SMBwrite);
4481
4482 if (req->wct < 5) {
4483 END_PROFILE(SMBwrite);
4484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485 return;
4486 }
4487
4488 /* If it's an IPC, pass off the pipe handler. */
4489 if (IS_IPC(conn)) {
4490 reply_pipe_write(req);
4491 END_PROFILE(SMBwrite);
4492 return;
4493 }
4494
4495 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4496
4497 if (!check_fsp(conn, req, fsp)) {
4498 END_PROFILE(SMBwrite);
4499 return;
4500 }
4501
4502 if (!CHECK_WRITE(fsp)) {
4503 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4504 END_PROFILE(SMBwrite);
4505 return;
4506 }
4507
4508 numtowrite = SVAL(req->vwv+1, 0);
4509 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4510 data = (const char *)req->buf + 3;
4511
4512 if (!fsp->print_file) {
4513 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4514 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4515 &lock);
4516
4517 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4518 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4519 END_PROFILE(SMBwrite);
4520 return;
4521 }
4522 }
4523
4524 /*
4525 * X/Open SMB protocol says that if smb_vwv1 is
4526 * zero then the file size should be extended or
4527 * truncated to the size given in smb_vwv[2-3].
4528 */
4529
4530 if(numtowrite == 0) {
4531 /*
4532 * This is actually an allocate call, and set EOF. JRA.
4533 */
4534 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4535 if (nwritten < 0) {
4536 reply_nterror(req, NT_STATUS_DISK_FULL);
4537 goto strict_unlock;
4538 }
4539 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4540 if (nwritten < 0) {
4541 reply_nterror(req, NT_STATUS_DISK_FULL);
4542 goto strict_unlock;
4543 }
4544 trigger_write_time_update_immediate(fsp);
4545 } else {
4546 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4547 }
4548
4549 status = sync_file(conn, fsp, False);
4550 if (!NT_STATUS_IS_OK(status)) {
4551 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4552 fsp_str_dbg(fsp), nt_errstr(status)));
4553 reply_nterror(req, status);
4554 goto strict_unlock;
4555 }
4556
4557 if(nwritten < 0) {
4558 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4559 goto strict_unlock;
4560 }
4561
4562 if((nwritten == 0) && (numtowrite != 0)) {
4563 reply_nterror(req, NT_STATUS_DISK_FULL);
4564 goto strict_unlock;
4565 }
4566
4567 reply_outbuf(req, 1, 0);
4568
4569 SSVAL(req->outbuf,smb_vwv0,nwritten);
4570
4571 if (nwritten < (ssize_t)numtowrite) {
4572 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4573 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4574 }
4575
4576 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4577
4578 strict_unlock:
4579 if (!fsp->print_file) {
4580 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4581 }
4582
4583 END_PROFILE(SMBwrite);
4584 return;
4585 }
4586
4587 /****************************************************************************
4588 Ensure a buffer is a valid writeX for recvfile purposes.
4589 ****************************************************************************/
4590
4591 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4592 (2*14) + /* word count (including bcc) */ \
4593 1 /* pad byte */)
4594
4595 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4596 const uint8_t *inbuf)
4597 {
4598 size_t numtowrite;
4599 connection_struct *conn = NULL;
4600 unsigned int doff = 0;
4601 size_t len = smb_len_large(inbuf);
4602 struct smbXsrv_tcon *tcon;
4603 NTSTATUS status;
4604 NTTIME now = 0;
4605
4606 if (is_encrypted_packet(sconn, inbuf)) {
4607 /* Can't do this on encrypted
4608 * connections. */
4609 return false;
4610 }
4611
4612 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4613 return false;
4614 }
4615
4616 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4617 CVAL(inbuf,smb_wct) != 14) {
4618 DEBUG(10,("is_valid_writeX_buffer: chained or "
4619 "invalid word length.\n"));
4620 return false;
4621 }
4622
4623 status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4624 now, &tcon);
4625 if (!NT_STATUS_IS_OK(status)) {
4626 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4627 return false;
4628 }
4629 conn = tcon->compat;
4630
4631 if (IS_IPC(conn)) {
4632 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4633 return false;
4634 }
4635 if (IS_PRINT(conn)) {
4636 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4637 return false;
4638 }
4639 doff = SVAL(inbuf,smb_vwv11);
4640
4641 numtowrite = SVAL(inbuf,smb_vwv10);
4642
4643 if (len > doff && len - doff > 0xFFFF) {
4644 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4645 }
4646
4647 if (numtowrite == 0) {
4648 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4649 return false;
4650 }
4651
4652 /* Ensure the sizes match up. */
4653 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4654 /* no pad byte...old smbclient :-( */
4655 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4656 (unsigned int)doff,
4657 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4658 return false;
4659 }
4660
4661 if (len - doff != numtowrite) {
4662 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4663 "len = %u, doff = %u, numtowrite = %u\n",
4664 (unsigned int)len,
4665 (unsigned int)doff,
4666 (unsigned int)numtowrite ));
4667 return false;
4668 }
4669
4670 DEBUG(10,("is_valid_writeX_buffer: true "
4671 "len = %u, doff = %u, numtowrite = %u\n",
4672 (unsigned int)len,
4673 (unsigned int)doff,
4674 (unsigned int)numtowrite ));
4675
4676 return true;
4677 }
4678
4679 /****************************************************************************
4680 Reply to a write and X.
4681 ****************************************************************************/
4682
4683 void reply_write_and_X(struct smb_request *req)
4684 {
4685 connection_struct *conn = req->conn;
4686 files_struct *fsp;
4687 struct lock_struct lock;
4688 off_t startpos;
4689 size_t numtowrite;
4690 bool write_through;
4691 ssize_t nwritten;
4692 unsigned int smb_doff;
4693 unsigned int smblen;
4694 const char *data;
4695 NTSTATUS status;
4696 int saved_errno = 0;
4697
4698 START_PROFILE(SMBwriteX);
4699
4700 if ((req->wct != 12) && (req->wct != 14)) {
4701 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4702 goto out;
4703 }
4704
4705 numtowrite = SVAL(req->vwv+10, 0);
4706 smb_doff = SVAL(req->vwv+11, 0);
4707 smblen = smb_len(req->inbuf);
4708
4709 if (req->unread_bytes > 0xFFFF ||
4710 (smblen > smb_doff &&
4711 smblen - smb_doff > 0xFFFF)) {
4712 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4713 }
4714
4715 if (req->unread_bytes) {
4716 /* Can't do a recvfile write on IPC$ */
4717 if (IS_IPC(conn)) {
4718 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4719 goto out;
4720 }
4721 if (numtowrite != req->unread_bytes) {
4722 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4723 goto out;
4724 }
4725 } else {
4726 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4727 smb_doff + numtowrite > smblen) {
4728 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4729 goto out;
4730 }
4731 }
4732
4733 /* If it's an IPC, pass off the pipe handler. */
4734 if (IS_IPC(conn)) {
4735 if (req->unread_bytes) {
4736 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4737 goto out;
4738 }
4739 reply_pipe_write_and_X(req);
4740 goto out;
4741 }
4742
4743 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4744 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4745 write_through = BITSETW(req->vwv+7,0);
4746
4747 if (!check_fsp(conn, req, fsp)) {
4748 goto out;
4749 }
4750
4751 if (!CHECK_WRITE(fsp)) {
4752 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4753 goto out;
4754 }
4755
4756 data = smb_base(req->inbuf) + smb_doff;
4757
4758 if(req->wct == 14) {
4759 /*
4760 * This is a large offset (64 bit) write.
4761 */
4762 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4763
4764 }
4765
4766 /* X/Open SMB protocol says that, unlike SMBwrite
4767 if the length is zero then NO truncation is
4768 done, just a write of zero. To truncate a file,
4769 use SMBwrite. */
4770
4771 if(numtowrite == 0) {
4772 nwritten = 0;
4773 } else {
4774 if (req->unread_bytes == 0) {
4775 status = schedule_aio_write_and_X(conn,
4776 req,
4777 fsp,
4778 data,
4779 startpos,
4780 numtowrite);
4781
4782 if (NT_STATUS_IS_OK(status)) {
4783 /* write scheduled - we're done. */
4784 goto out;
4785 }
4786 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4787 /* Real error - report to client. */
4788 reply_nterror(req, status);
4789 goto out;
4790 }
4791 /* NT_STATUS_RETRY - fall through to sync write. */
4792 }
4793
4794 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4795 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4796 &lock);
4797
4798 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4799 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4800 goto out;
4801 }
4802
4803 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4804 saved_errno = errno;
4805
4806 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4807 }
4808
4809 if(nwritten < 0) {
4810 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4811 goto out;
4812 }
4813
4814 if((nwritten == 0) && (numtowrite != 0)) {
4815 reply_nterror(req, NT_STATUS_DISK_FULL);
4816 goto out;
4817 }
4818
4819 reply_outbuf(req, 6, 0);
4820 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4821 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4822 SSVAL(req->outbuf,smb_vwv2,nwritten);
4823 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4824
4825 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4826 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4827
4828 status = sync_file(conn, fsp, write_through);
4829 if (!NT_STATUS_IS_OK(status)) {
4830 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4831 fsp_str_dbg(fsp), nt_errstr(status)));
4832 reply_nterror(req, status);
4833 goto out;
4834 }
4835
4836 END_PROFILE(SMBwriteX);
4837 return;
4838
4839 out:
4840 if (req->unread_bytes) {
4841 /* writeX failed. drain socket. */
4842 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4843 req->unread_bytes) {
4844 smb_panic("failed to drain pending bytes");
4845 }
4846 req->unread_bytes = 0;
4847 }
4848
4849 END_PROFILE(SMBwriteX);
4850 return;
4851 }
4852
4853 /****************************************************************************
4854 Reply to a lseek.
4855 ****************************************************************************/
4856
4857 void reply_lseek(struct smb_request *req)
4858 {
4859 connection_struct *conn = req->conn;
4860 off_t startpos;
4861 off_t res= -1;
4862 int mode,umode;
4863 files_struct *fsp;
4864
4865 START_PROFILE(SMBlseek);
4866
4867 if (req->wct < 4) {
4868 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4869 END_PROFILE(SMBlseek);
4870 return;
4871 }
4872
4873 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4874
4875 if (!check_fsp(conn, req, fsp)) {
4876 return;
4877 }
4878
4879 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4880
4881 mode = SVAL(req->vwv+1, 0) & 3;
4882 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4883 startpos = (off_t)IVALS(req->vwv+2, 0);
4884
4885 switch (mode) {
4886 case 0:
4887 umode = SEEK_SET;
4888 res = startpos;
4889 break;
4890 case 1:
4891 umode = SEEK_CUR;
4892 res = fsp->fh->pos + startpos;
4893 break;
4894 case 2:
4895 umode = SEEK_END;
4896 break;
4897 default:
4898 umode = SEEK_SET;
4899 res = startpos;
4900 break;
4901 }
4902
4903 if (umode == SEEK_END) {
4904 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4905 if(errno == EINVAL) {
4906 off_t current_pos = startpos;
4907
4908 if(fsp_stat(fsp) == -1) {
4909 reply_nterror(req,
4910 map_nt_error_from_unix(errno));
4911 END_PROFILE(SMBlseek);
4912 return;
4913 }
4914
4915 current_pos += fsp->fsp_name->st.st_ex_size;
4916 if(current_pos < 0)
4917 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4918 }
4919 }
4920
4921 if(res == -1) {
4922 reply_nterror(req, map_nt_error_from_unix(errno));
4923 END_PROFILE(SMBlseek);
4924 return;
4925 }
4926 }
4927
4928 fsp->fh->pos = res;
4929
4930 reply_outbuf(req, 2, 0);
4931 SIVAL(req->outbuf,smb_vwv0,res);
4932
4933 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4934 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4935
4936 END_PROFILE(SMBlseek);
4937 return;
4938 }
4939
4940 /****************************************************************************
4941 Reply to a flush.
4942 ****************************************************************************/
4943
4944 void reply_flush(struct smb_request *req)
4945 {
4946 connection_struct *conn = req->conn;
4947 uint16 fnum;
4948 files_struct *fsp;
4949
4950 START_PROFILE(SMBflush);
4951
4952 if (req->wct < 1) {
4953 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4954 return;
4955 }
4956
4957 fnum = SVAL(req->vwv+0, 0);
4958 fsp = file_fsp(req, fnum);
4959
4960 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4961 return;
4962 }
4963
4964 if (!fsp) {
4965 file_sync_all(conn);
4966 } else {
4967 NTSTATUS status = sync_file(conn, fsp, True);
4968 if (!NT_STATUS_IS_OK(status)) {
4969 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4970 fsp_str_dbg(fsp), nt_errstr(status)));
4971 reply_nterror(req, status);
4972 END_PROFILE(SMBflush);
4973 return;
4974 }
4975 }
4976
4977 reply_outbuf(req, 0, 0);
4978
4979 DEBUG(3,("flush\n"));
4980 END_PROFILE(SMBflush);
4981 return;
4982 }
4983
4984 /****************************************************************************
4985 Reply to a exit.
4986 conn POINTER CAN BE NULL HERE !
4987 ****************************************************************************/
4988
4989 void reply_exit(struct smb_request *req)
4990 {
4991 START_PROFILE(SMBexit);
4992
4993 file_close_pid(req->sconn, req->smbpid, req->vuid);
4994
4995 reply_outbuf(req, 0, 0);
4996
4997 DEBUG(3,("exit\n"));
4998
4999 END_PROFILE(SMBexit);
5000 return;
5001 }
5002
5003 struct reply_close_state {
5004 files_struct *fsp;
5005 struct smb_request *smbreq;
5006 };
5007
5008 static void do_smb1_close(struct tevent_req *req);
5009
5010 void reply_close(struct smb_request *req)
5011 {
5012 connection_struct *conn = req->conn;
5013 NTSTATUS status = NT_STATUS_OK;
5014 files_struct *fsp = NULL;
5015 START_PROFILE(SMBclose);
5016
5017 if (req->wct < 3) {
5018 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5019 END_PROFILE(SMBclose);
5020 return;
5021 }
5022
5023 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5024
5025 /*
5026 * We can only use check_fsp if we know it's not a directory.
5027 */
5028
5029 if (!check_fsp_open(conn, req, fsp)) {
5030 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5031 END_PROFILE(SMBclose);
5032 return;
5033 }
5034
5035 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5036 fsp->is_directory ? "directory" : "file",
5037 fsp->fh->fd, fsp_fnum_dbg(fsp),
5038 conn->num_files_open));
5039
5040 if (!fsp->is_directory) {
5041 time_t t;
5042
5043 /*
5044 * Take care of any time sent in the close.
5045 */
5046
5047 t = srv_make_unix_date3(req->vwv+1);
5048 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5049 }
5050
5051 if (fsp->num_aio_requests != 0) {
5052
5053 struct reply_close_state *state;
5054
5055 DEBUG(10, ("closing with aio %u requests pending\n",
5056 fsp->num_aio_requests));
5057
5058 /*
5059 * We depend on the aio_extra destructor to take care of this
5060 * close request once fsp->num_aio_request drops to 0.
5061 */
5062
5063 fsp->deferred_close = tevent_wait_send(
5064 fsp, fsp->conn->sconn->ev_ctx);
5065 if (fsp->deferred_close == NULL) {
5066 status = NT_STATUS_NO_MEMORY;
5067 goto done;
5068 }
5069
5070 state = talloc(fsp, struct reply_close_state);
5071 if (state == NULL) {
5072 TALLOC_FREE(fsp->deferred_close);
5073 status = NT_STATUS_NO_MEMORY;
5074 goto done;
5075 }
5076 state->fsp = fsp;
5077 state->smbreq = talloc_move(fsp, &req);
5078 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5079 state);
5080 END_PROFILE(SMBclose);
5081 return;
5082 }
5083
5084 /*
5085 * close_file() returns the unix errno if an error was detected on
5086 * close - normally this is due to a disk full error. If not then it
5087 * was probably an I/O error.
5088 */
5089
5090 status = close_file(req, fsp, NORMAL_CLOSE);
5091 done:
5092 if (!NT_STATUS_IS_OK(status)) {
5093 reply_nterror(req, status);
5094 END_PROFILE(SMBclose);
5095 return;
5096 }
5097
5098 reply_outbuf(req, 0, 0);
5099 END_PROFILE(SMBclose);
5100 return;
5101 }
5102
5103 static void do_smb1_close(struct tevent_req *req)
5104 {
5105 struct reply_close_state *state = tevent_req_callback_data(
5106 req, struct reply_close_state);
5107 struct smb_request *smbreq;
5108 NTSTATUS status;
5109 int ret;
5110
5111 ret = tevent_wait_recv(req);
5112 TALLOC_FREE(req);
5113 if (ret != 0) {
5114 DEBUG(10, ("tevent_wait_recv returned %s\n",
5115 strerror(ret)));
5116 /*
5117 * Continue anyway, this should never happen
5118 */
5119 }
5120
5121 /*
5122 * fsp->smb2_close_request right now is a talloc grandchild of
5123 * fsp. When we close_file(fsp), it would go with it. No chance to
5124 * reply...
5125 */
5126 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5127
5128 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5129 if (NT_STATUS_IS_OK(status)) {
5130 reply_outbuf(smbreq, 0, 0);
5131 } else {
5132 reply_nterror(smbreq, status);
5133 }
5134 if (!srv_send_smb(smbreq->sconn,
5135 (char *)smbreq->outbuf,
5136 true,
5137 smbreq->seqnum+1,
5138 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5139 NULL)) {
5140 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5141 "failed.");
5142 }
5143 TALLOC_FREE(smbreq);
5144 }
5145
5146 /****************************************************************************
5147 Reply to a writeclose (Core+ protocol).
5148 ****************************************************************************/
5149
5150 void reply_writeclose(struct smb_request *req)
5151 {
5152 connection_struct *conn = req->conn;
5153 size_t numtowrite;
5154 ssize_t nwritten = -1;
5155 NTSTATUS close_status = NT_STATUS_OK;
5156 off_t startpos;
5157 const char *data;
5158 struct timespec mtime;
5159 files_struct *fsp;
5160 struct lock_struct lock;
5161
5162 START_PROFILE(SMBwriteclose);
5163
5164 if (req->wct < 6) {
5165 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5166 END_PROFILE(SMBwriteclose);
5167 return;
5168 }
5169
5170 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5171
5172 if (!check_fsp(conn, req, fsp)) {
5173 END_PROFILE(SMBwriteclose);
5174 return;
5175 }
5176 if (!CHECK_WRITE(fsp)) {
5177 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5178 END_PROFILE(SMBwriteclose);
5179 return;
5180 }
5181
5182 numtowrite = SVAL(req->vwv+1, 0);
5183 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5184 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5185 data = (const char *)req->buf + 1;
5186
5187 if (!fsp->print_file) {
5188 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5189 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5190 &lock);
5191
5192 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5193 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5194 END_PROFILE(SMBwriteclose);
5195 return;
5196 }
5197 }
5198
5199 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5200
5201 set_close_write_time(fsp, mtime);
5202
5203 /*
5204 * More insanity. W2K only closes the file if writelen > 0.
5205 * JRA.
5206 */
5207
5208 if (numtowrite) {
5209 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5210 "file %s\n", fsp_str_dbg(fsp)));
5211 close_status = close_file(req, fsp, NORMAL_CLOSE);
5212 }
5213
5214 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5215 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5216 conn->num_files_open));
5217
5218 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5219 reply_nterror(req, NT_STATUS_DISK_FULL);
5220 goto strict_unlock;
5221 }
5222
5223 if(!NT_STATUS_IS_OK(close_status)) {
5224 reply_nterror(req, close_status);
5225 goto strict_unlock;
5226 }
5227
5228 reply_outbuf(req, 1, 0);
5229
5230 SSVAL(req->outbuf,smb_vwv0,nwritten);
5231
5232 strict_unlock:
5233 if (numtowrite && !fsp->print_file) {
5234 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5235 }
5236
5237 END_PROFILE(SMBwriteclose);
5238 return;
5239 }
5240
5241 #undef DBGC_CLASS
5242 #define DBGC_CLASS DBGC_LOCKING
5243
5244 /****************************************************************************
5245 Reply to a lock.
5246 ****************************************************************************/
5247
5248 void reply_lock(struct smb_request *req)
5249 {
5250 connection_struct *conn = req->conn;
5251 uint64_t count,offset;
5252 NTSTATUS status;
5253 files_struct *fsp;
5254 struct byte_range_lock *br_lck = NULL;
5255
5256 START_PROFILE(SMBlock);
5257
5258 if (req->wct < 5) {
5259 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5260 END_PROFILE(SMBlock);
5261 return;
5262 }
5263
5264 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5265
5266 if (!check_fsp(conn, req, fsp)) {
5267 END_PROFILE(SMBlock);
5268 return;
5269 }
5270
5271 count = (uint64_t)IVAL(req->vwv+1, 0);
5272 offset = (uint64_t)IVAL(req->vwv+3, 0);
5273
5274 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5275 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5276
5277 br_lck = do_lock(req->sconn->msg_ctx,
5278 fsp,
5279 (uint64_t)req->smbpid,
5280 count,
5281 offset,
5282 WRITE_LOCK,
5283 WINDOWS_LOCK,
5284 False, /* Non-blocking lock. */
5285 &status,
5286 NULL,
5287 NULL);
5288
5289 TALLOC_FREE(br_lck);
5290
5291 if (NT_STATUS_V(status)) {
5292 reply_nterror(req, status);
5293 END_PROFILE(SMBlock);
5294 return;
5295 }
5296
5297 reply_outbuf(req, 0, 0);
5298
5299 END_PROFILE(SMBlock);
5300 return;
5301 }
5302
5303 /****************************************************************************
5304 Reply to a unlock.
5305 ****************************************************************************/
5306
5307 void reply_unlock(struct smb_request *req)
5308 {
5309 connection_struct *conn = req->conn;
5310 uint64_t count,offset;
5311 NTSTATUS status;
5312 files_struct *fsp;
5313
5314 START_PROFILE(SMBunlock);
5315
5316 if (req->wct < 5) {
5317 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5318 END_PROFILE(SMBunlock);
5319 return;
5320 }
5321
5322 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5323
5324 if (!check_fsp(conn, req, fsp)) {
5325 END_PROFILE(SMBunlock);
5326 return;
5327 }
5328
5329 count = (uint64_t)IVAL(req->vwv+1, 0);
5330 offset = (uint64_t)IVAL(req->vwv+3, 0);
5331
5332 status = do_unlock(req->sconn->msg_ctx,
5333 fsp,
5334 (uint64_t)req->smbpid,
5335 count,
5336 offset,
5337 WINDOWS_LOCK);
5338
5339 if (NT_STATUS_V(status)) {
5340 reply_nterror(req, status);
5341 END_PROFILE(SMBunlock);
5342 return;
5343 }
5344
5345 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5346 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5347
5348 reply_outbuf(req, 0, 0);
5349
5350 END_PROFILE(SMBunlock);
5351 return;
5352 }
5353
5354 #undef DBGC_CLASS
5355 #define DBGC_CLASS DBGC_ALL
5356
5357 /****************************************************************************
5358 Reply to a tdis.
5359 conn POINTER CAN BE NULL HERE !
5360 ****************************************************************************/
5361
5362 void reply_tdis(struct smb_request *req)
5363 {
5364 NTSTATUS status;
5365 connection_struct *conn = req->conn;
5366 struct smbXsrv_tcon *tcon;
5367
5368 START_PROFILE(SMBtdis);
5369
5370 if (!conn) {
5371 DEBUG(4,("Invalid connection in tdis\n"));
5372 reply_force_doserror(req, ERRSRV, ERRinvnid);
5373 END_PROFILE(SMBtdis);
5374 return;
5375 }
5376
5377 tcon = conn->tcon;
5378 req->conn = NULL;
5379
5380 /*
5381 * TODO: cancel all outstanding requests on the tcon
5382 */
5383 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5384 if (!NT_STATUS_IS_OK(status)) {
5385 DEBUG(0, ("reply_tdis: "
5386 "smbXsrv_tcon_disconnect() failed: %s\n",
5387 nt_errstr(status)));
5388 /*
5389 * If we hit this case, there is something completely
5390 * wrong, so we better disconnect the transport connection.
5391 */
5392 END_PROFILE(SMBtdis);
5393 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5394 return;
5395 }
5396
5397 TALLOC_FREE(tcon);
5398
5399 reply_outbuf(req, 0, 0);
5400 END_PROFILE(SMBtdis);
5401 return;
5402 }
5403
5404 /****************************************************************************
5405 Reply to a echo.
5406 conn POINTER CAN BE NULL HERE !
5407 ****************************************************************************/
5408
5409 void reply_echo(struct smb_request *req)
5410 {
5411 connection_struct *conn = req->conn;
5412 struct smb_perfcount_data local_pcd;
5413 struct smb_perfcount_data *cur_pcd;
5414 int smb_reverb;
5415 int seq_num;
5416
5417 START_PROFILE(SMBecho);
5418
5419 smb_init_perfcount_data(&local_pcd);
5420
5421 if (req->wct < 1) {
5422 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5423 END_PROFILE(SMBecho);
5424 return;
5425 }
5426
5427 smb_reverb = SVAL(req->vwv+0, 0);
5428
5429 reply_outbuf(req, 1, req->buflen);
5430
5431 /* copy any incoming data back out */
5432 if (req->buflen > 0) {
5433 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5434 }
5435
5436 if (smb_reverb > 100) {
5437 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5438 smb_reverb = 100;
5439 }
5440
5441 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5442
5443 /* this makes sure we catch the request pcd */
5444 if (seq_num == smb_reverb) {
5445 cur_pcd = &req->pcd;
5446 } else {
5447 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5448 cur_pcd = &local_pcd;
5449 }
5450
5451 SSVAL(req->outbuf,smb_vwv0,seq_num);
5452
5453 show_msg((char *)req->outbuf);
5454 if (!srv_send_smb(req->sconn,
5455 (char *)req->outbuf,
5456 true, req->seqnum+1,
5457 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5458 cur_pcd))
5459 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5460 }
5461
5462 DEBUG(3,("echo %d times\n", smb_reverb));
5463
5464 TALLOC_FREE(req->outbuf);
5465
5466 END_PROFILE(SMBecho);
5467 return;
5468 }
5469
5470 /****************************************************************************
5471 Reply to a printopen.
5472 ****************************************************************************/
5473
5474 void reply_printopen(struct smb_request *req)
5475 {
5476 connection_struct *conn = req->conn;
5477 files_struct *fsp;
5478 NTSTATUS status;
5479
5480 START_PROFILE(SMBsplopen);
5481
5482 if (req->wct < 2) {
5483 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5484 END_PROFILE(SMBsplopen);
5485 return;
5486 }
5487
5488 if (!CAN_PRINT(conn)) {
5489 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5490 END_PROFILE(SMBsplopen);
5491 return;
5492 }
5493
5494 status = file_new(req, conn, &fsp);
5495 if(!NT_STATUS_IS_OK(status)) {
5496 reply_nterror(req, status);
5497 END_PROFILE(SMBsplopen);
5498 return;
5499 }
5500
5501 /* Open for exclusive use, write only. */
5502 status = print_spool_open(fsp, NULL, req->vuid);
5503
5504 if (!NT_STATUS_IS_OK(status)) {
5505 file_free(req, fsp);
5506 reply_nterror(req, status);
5507 END_PROFILE(SMBsplopen);
5508 return;
5509 }
5510
5511 reply_outbuf(req, 1, 0);
5512 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5513
5514 DEBUG(3,("openprint fd=%d %s\n",
5515 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5516
5517 END_PROFILE(SMBsplopen);
5518 return;
5519 }
5520
5521 /****************************************************************************
5522 Reply to a printclose.
5523 ****************************************************************************/
5524
5525 void reply_printclose(struct smb_request *req)
5526 {
5527 connection_struct *conn = req->conn;
5528 files_struct *fsp;
5529 NTSTATUS status;
5530
5531 START_PROFILE(SMBsplclose);
5532
5533 if (req->wct < 1) {
5534 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5535 END_PROFILE(SMBsplclose);
5536 return;
5537 }
5538
5539 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5540
5541 if (!check_fsp(conn, req, fsp)) {
5542 END_PROFILE(SMBsplclose);
5543 return;
5544 }
5545
5546 if (!CAN_PRINT(conn)) {
5547 reply_force_doserror(req, ERRSRV, ERRerror);
5548 END_PROFILE(SMBsplclose);
5549 return;
5550 }
5551
5552 DEBUG(3,("printclose fd=%d %s\n",
5553 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5554
5555 status = close_file(req, fsp, NORMAL_CLOSE);
5556
5557 if(!NT_STATUS_IS_OK(status)) {
5558 reply_nterror(req, status);
5559 END_PROFILE(SMBsplclose);
5560 return;
5561 }
5562
5563 reply_outbuf(req, 0, 0);
5564
5565 END_PROFILE(SMBsplclose);
5566 return;
5567 }
5568
5569 /****************************************************************************
5570 Reply to a printqueue.
5571 ****************************************************************************/
5572
5573 void reply_printqueue(struct smb_request *req)
5574 {
5575 connection_struct *conn = req->conn;
5576 int max_count;
5577 int start_index;
5578
5579 START_PROFILE(SMBsplretq);
5580
5581 if (req->wct < 2) {
5582 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5583 END_PROFILE(SMBsplretq);
5584 return;
5585 }
5586
5587 max_count = SVAL(req->vwv+0, 0);
5588 start_index = SVAL(req->vwv+1, 0);
5589
5590 /* we used to allow the client to get the cnum wrong, but that
5591 is really quite gross and only worked when there was only
5592 one printer - I think we should now only accept it if they
5593 get it right (tridge) */
5594 if (!CAN_PRINT(conn)) {
5595 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5596 END_PROFILE(SMBsplretq);
5597 return;
5598 }
5599
5600 reply_outbuf(req, 2, 3);
5601 SSVAL(req->outbuf,smb_vwv0,0);
5602 SSVAL(req->outbuf,smb_vwv1,0);
5603 SCVAL(smb_buf(req->outbuf),0,1);
5604 SSVAL(smb_buf(req->outbuf),1,0);
5605
5606 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5607 start_index, max_count));
5608
5609 {
5610 TALLOC_CTX *mem_ctx = talloc_tos();
5611 NTSTATUS status;
5612 WERROR werr;
5613 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5614 struct rpc_pipe_client *cli = NULL;
5615 struct dcerpc_binding_handle *b = NULL;
5616 struct policy_handle handle;
5617 struct spoolss_DevmodeContainer devmode_ctr;
5618 union spoolss_JobInfo *info;
5619 uint32_t count;
5620 uint32_t num_to_get;
5621 uint32_t first;
5622 uint32_t i;
5623
5624 ZERO_STRUCT(handle);
5625
5626 status = rpc_pipe_open_interface(conn,
5627 &ndr_table_spoolss,
5628 conn->session_info,
5629 conn->sconn->remote_address,
5630 conn->sconn->msg_ctx,
5631 &cli);
5632 if (!NT_STATUS_IS_OK(status)) {
5633 DEBUG(0, ("reply_printqueue: "
5634 "could not connect to spoolss: %s\n",
5635 nt_errstr(status)));
5636 reply_nterror(req, status);
5637 goto out;
5638 }
5639 b = cli->binding_handle;
5640
5641 ZERO_STRUCT(devmode_ctr);
5642
5643 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5644 sharename,
5645 NULL, devmode_ctr,
5646 SEC_FLAG_MAXIMUM_ALLOWED,
5647 &handle,
5648 &werr);
5649 if (!NT_STATUS_IS_OK(status)) {
5650 reply_nterror(req, status);
5651 goto out;
5652 }
5653 if (!W_ERROR_IS_OK(werr)) {
5654 reply_nterror(req, werror_to_ntstatus(werr));
5655 goto out;
5656 }
5657
5658 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5659 &handle,
5660 0, /* firstjob */
5661 0xff, /* numjobs */
5662 2, /* level */
5663 0, /* offered */
5664 &count,
5665 &info);
5666 if (!W_ERROR_IS_OK(werr)) {
5667 reply_nterror(req, werror_to_ntstatus(werr));
5668 goto out;
5669 }
5670
5671 if (max_count > 0) {
5672 first = start_index;
5673 } else {
5674 first = start_index + max_count + 1;
5675 }
5676
5677 if (first >= count) {
5678 num_to_get = first;
5679 } else {
5680 num_to_get = first + MIN(ABS(max_count), count - first);
5681 }
5682
5683 for (i = first; i < num_to_get; i++) {
5684 char blob[28];
5685 char *p = blob;
5686 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5687 int qstatus;
5688 uint16_t qrapjobid = pjobid_to_rap(sharename,
5689 info[i].info2.job_id);
5690
5691 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5692 qstatus = 2;
5693 } else {
5694 qstatus = 3;
5695 }
5696
5697 srv_put_dos_date2(p, 0, qtime);
5698 SCVAL(p, 4, qstatus);
5699 SSVAL(p, 5, qrapjobid);
5700 SIVAL(p, 7, info[i].info2.size);
5701 SCVAL(p, 11, 0);
5702 srvstr_push(blob, req->flags2, p+12,
5703 info[i].info2.notify_name, 16, STR_ASCII);
5704
5705 if (message_push_blob(
5706 &req->outbuf,
5707 data_blob_const(
5708 blob, sizeof(blob))) == -1) {
5709 reply_nterror(req, NT_STATUS_NO_MEMORY);
5710 goto out;
5711 }
5712 }
5713
5714 if (count > 0) {
5715 SSVAL(req->outbuf,smb_vwv0,count);
5716 SSVAL(req->outbuf,smb_vwv1,
5717 (max_count>0?first+count:first-1));
5718 SCVAL(smb_buf(req->outbuf),0,1);
5719 SSVAL(smb_buf(req->outbuf),1,28*count);
5720 }
5721
5722
5723 DEBUG(3, ("%u entries returned in queue\n",
5724 (unsigned)count));
5725
5726 out:
5727 if (b && is_valid_policy_hnd(&handle)) {
5728 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5729 }
5730
5731 }
5732
5733 END_PROFILE(SMBsplretq);
5734 return;
5735 }
5736
5737 /****************************************************************************
5738 Reply to a printwrite.
5739 ****************************************************************************/
5740
5741 void reply_printwrite(struct smb_request *req)
5742 {
5743 connection_struct *conn = req->conn;
5744 int numtowrite;
5745 const char *data;
5746 files_struct *fsp;
5747
5748 START_PROFILE(SMBsplwr);
5749
5750 if (req->wct < 1) {
5751 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5752 END_PROFILE(SMBsplwr);
5753 return;
5754 }
5755
5756 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5757
5758 if (!check_fsp(conn, req, fsp)) {
5759 END_PROFILE(SMBsplwr);
5760 return;
5761 }
5762
5763 if (!fsp->print_file) {
5764 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5765 END_PROFILE(SMBsplwr);
5766 return;
5767 }
5768
5769 if (!CHECK_WRITE(fsp)) {
5770 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5771 END_PROFILE(SMBsplwr);
5772 return;
5773 }
5774
5775 numtowrite = SVAL(req->buf, 1);
5776
5777 if (req->buflen < numtowrite + 3) {
5778 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5779 END_PROFILE(SMBsplwr);
5780 return;
5781 }
5782
5783 data = (const char *)req->buf + 3;
5784
5785 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5786 reply_nterror(req, map_nt_error_from_unix(errno));
5787 END_PROFILE(SMBsplwr);
5788 return;
5789 }
5790
5791 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5792
5793 END_PROFILE(SMBsplwr);
5794 return;
5795 }
5796
5797 /****************************************************************************
5798 Reply to a mkdir.
5799 ****************************************************************************/
5800
5801 void reply_mkdir(struct smb_request *req)
5802 {
5803 connection_struct *conn = req->conn;
5804 struct smb_filename *smb_dname = NULL;
5805 char *directory = NULL;
5806 NTSTATUS status;
5807 TALLOC_CTX *ctx = talloc_tos();
5808
5809 START_PROFILE(SMBmkdir);
5810
5811 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5812 STR_TERMINATE, &status);
5813 if (!NT_STATUS_IS_OK(status)) {
5814 reply_nterror(req, status);
5815 goto out;
5816 }
5817
5818 status = filename_convert(ctx, conn,
5819 req->flags2 & FLAGS2_DFS_PATHNAMES,
5820 directory,
5821 UCF_PREP_CREATEFILE,
5822 NULL,
5823 &smb_dname);
5824 if (!NT_STATUS_IS_OK(status)) {
5825 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5826 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5827 ERRSRV, ERRbadpath);
5828 goto out;
5829 }
5830 reply_nterror(req, status);
5831 goto out;
5832 }
5833
5834 status = create_directory(conn, req, smb_dname);
5835
5836 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5837
5838 if (!NT_STATUS_IS_OK(status)) {
5839
5840 if (!use_nt_status()
5841 && NT_STATUS_EQUAL(status,
5842 NT_STATUS_OBJECT_NAME_COLLISION)) {
5843 /*
5844 * Yes, in the DOS error code case we get a
5845 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5846 * samba4 torture test.
5847 */
5848 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5849 }
5850
5851 reply_nterror(req, status);
5852 goto out;
5853 }
5854
5855 reply_outbuf(req, 0, 0);
5856
5857 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5858 out:
5859 TALLOC_FREE(smb_dname);
5860 END_PROFILE(SMBmkdir);
5861 return;
5862 }
5863
5864 /****************************************************************************
5865 Reply to a rmdir.
5866 ****************************************************************************/
5867
5868 void reply_rmdir(struct smb_request *req)
5869 {
5870 connection_struct *conn = req->conn;
5871 struct smb_filename *smb_dname = NULL;
5872 char *directory = NULL;
5873 NTSTATUS status;
5874 TALLOC_CTX *ctx = talloc_tos();
5875 files_struct *fsp = NULL;
5876 int info = 0;
5877 struct smbd_server_connection *sconn = req->sconn;
5878
5879 START_PROFILE(SMBrmdir);
5880
5881 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5882 STR_TERMINATE, &status);
5883 if (!NT_STATUS_IS_OK(status)) {
5884 reply_nterror(req, status);
5885 goto out;
5886 }
5887
5888 status = filename_convert(ctx, conn,
5889 req->flags2 & FLAGS2_DFS_PATHNAMES,
5890 directory,
5891 0,
5892 NULL,
5893 &smb_dname);
5894 if (!NT_STATUS_IS_OK(status)) {
5895 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5896 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5897 ERRSRV, ERRbadpath);
5898 goto out;
5899 }
5900 reply_nterror(req, status);
5901 goto out;
5902 }
5903
5904 if (is_ntfs_stream_smb_fname(smb_dname)) {
5905 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5906 goto out;
5907 }
5908
5909 status = SMB_VFS_CREATE_FILE(
5910 conn, /* conn */
5911 req, /* req */
5912 0, /* root_dir_fid */
5913 smb_dname, /* fname */
5914 DELETE_ACCESS, /* access_mask */
5915 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5916 FILE_SHARE_DELETE),
5917 FILE_OPEN, /* create_disposition*/
5918 FILE_DIRECTORY_FILE, /* create_options */
5919 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5920 0, /* oplock_request */
5921 0, /* allocation_size */
5922 0, /* private_flags */
5923 NULL, /* sd */
5924 NULL, /* ea_list */
5925 &fsp, /* result */
5926 &info); /* pinfo */
5927
5928 if (!NT_STATUS_IS_OK(status)) {
5929 if (open_was_deferred(req->sconn, req->mid)) {
5930 /* We have re-scheduled this call. */
5931 goto out;
5932 }
5933 reply_nterror(req, status);
5934 goto out;
5935 }
5936
5937 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5938 if (!NT_STATUS_IS_OK(status)) {
5939 close_file(req, fsp, ERROR_CLOSE);
5940 reply_nterror(req, status);
5941 goto out;
5942 }
5943
5944 if (!set_delete_on_close(fsp, true,
5945 conn->session_info->security_token,
5946 conn->session_info->unix_token)) {
5947 close_file(req, fsp, ERROR_CLOSE);
5948 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5949 goto out;
5950 }
5951
5952 status = close_file(req, fsp, NORMAL_CLOSE);
5953 if (!NT_STATUS_IS_OK(status)) {
5954 reply_nterror(req, status);
5955 } else {
5956 reply_outbuf(req, 0, 0);
5957 }
5958
5959 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5960
5961 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5962 out:
5963 TALLOC_FREE(smb_dname);
5964 END_PROFILE(SMBrmdir);
5965 return;
5966 }
5967
5968 /*******************************************************************
5969 Resolve wildcards in a filename rename.
5970 ********************************************************************/
5971
5972 static bool resolve_wildcards(TALLOC_CTX *ctx,
5973 const char *name1,
5974 const char *name2,
5975 char **pp_newname)
5976 {
5977 char *name2_copy = NULL;
5978 char *root1 = NULL;
5979 char *root2 = NULL;
5980 char *ext1 = NULL;
5981 char *ext2 = NULL;
5982 char *p,*p2, *pname1, *pname2;
5983
5984 name2_copy = talloc_strdup(ctx, name2);
5985 if (!name2_copy) {
5986 return False;
5987 }
5988
5989 pname1 = strrchr_m(name1,'/');
5990 pname2 = strrchr_m(name2_copy,'/');
5991
5992 if (!pname1 || !pname2) {
5993 return False;
5994 }
5995
5996 /* Truncate the copy of name2 at the last '/' */
5997 *pname2 = '\0';
5998
5999 /* Now go past the '/' */
6000 pname1++;
6001 pname2++;
6002
6003 root1 = talloc_strdup(ctx, pname1);
6004 root2 = talloc_strdup(ctx, pname2);
6005
6006 if (!root1 || !root2) {
6007 return False;
6008 }
6009
6010 p = strrchr_m(root1,'.');
6011 if (p) {
6012 *p = 0;
6013 ext1 = talloc_strdup(ctx, p+1);
6014 } else {
6015 ext1 = talloc_strdup(ctx, "");
6016 }
6017 p = strrchr_m(root2,'.');
6018 if (p) {
6019 *p = 0;
6020 ext2 = talloc_strdup(ctx, p+1);
6021 } else {
6022 ext2 = talloc_strdup(ctx, "");
6023 }
6024
6025 if (!ext1 || !ext2) {
6026 return False;
6027 }
6028
6029 p = root1;
6030 p2 = root2;
6031 while (*p2) {
6032 if (*p2 == '?') {
6033 /* Hmmm. Should this be mb-aware ? */
6034 *p2 = *p;
6035 p2++;
6036 } else if (*p2 == '*') {
6037 *p2 = '\0';
6038 root2 = talloc_asprintf(ctx, "%s%s",
6039 root2,
6040 p);
6041 if (!root2) {
6042 return False;
6043 }
6044 break;
6045 } else {
6046 p2++;
6047 }
6048 if (*p) {
6049 p++;
6050 }
6051 }
6052
6053 p = ext1;
6054 p2 = ext2;
6055 while (*p2) {
6056 if (*p2 == '?') {
6057 /* Hmmm. Should this be mb-aware ? */
6058 *p2 = *p;
6059 p2++;
6060 } else if (*p2 == '*') {
6061 *p2 = '\0';
6062 ext2 = talloc_asprintf(ctx, "%s%s",
6063 ext2,
6064 p);
6065 if (!ext2) {
6066 return False;
6067 }
6068 break;
6069 } else {
6070 p2++;
6071 }
6072 if (*p) {
6073 p++;
6074 }
6075 }
6076
6077 if (*ext2) {
6078 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6079 name2_copy,
6080 root2,
6081 ext2);
6082 } else {
6083 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6084 name2_copy,
6085 root2);
6086 }
6087
6088 if (!*pp_newname) {
6089 return False;
6090 }
6091
6092 return True;
6093 }
6094
6095 /****************************************************************************
6096 Ensure open files have their names updated. Updated to notify other smbd's
6097 asynchronously.
6098 ****************************************************************************/
6099
6100 static void rename_open_files(connection_struct *conn,
6101 struct share_mode_lock *lck,
6102 uint32_t orig_name_hash,
6103 const struct smb_filename *smb_fname_dst)
6104 {
6105 files_struct *fsp;
6106 bool did_rename = False;
6107 NTSTATUS status;
6108 uint32_t new_name_hash = 0;
6109
6110 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6111 fsp = file_find_di_next(fsp)) {
6112 /* fsp_name is a relative path under the fsp. To change this for other
6113 sharepaths we need to manipulate relative paths. */
6114 /* TODO - create the absolute path and manipulate the newname
6115 relative to the sharepath. */
6116 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6117 continue;
6118 }
6119 if (fsp->name_hash != orig_name_hash) {
6120 continue;
6121 }
6122 DEBUG(10, ("rename_open_files: renaming file %s "
6123 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6124 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6125 smb_fname_str_dbg(smb_fname_dst)));
6126
6127 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6128 if (NT_STATUS_IS_OK(status)) {
6129 did_rename = True;
6130 new_name_hash = fsp->name_hash;
6131 }
6132 }
6133
6134 if (!did_rename) {
6135 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6136 "for %s\n", file_id_string_tos(&lck->data->id),
6137 smb_fname_str_dbg(smb_fname_dst)));
6138 }
6139
6140 /* Send messages to all smbd's (not ourself) that the name has changed. */
6141 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6142 orig_name_hash, new_name_hash,
6143 smb_fname_dst);
6144
6145 }
6146
6147 /****************************************************************************
6148 We need to check if the source path is a parent directory of the destination
6149 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6150 refuse the rename with a sharing violation. Under UNIX the above call can
6151 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6152 probably need to check that the client is a Windows one before disallowing
6153 this as a UNIX client (one with UNIX extensions) can know the source is a
6154 symlink and make this decision intelligently. Found by an excellent bug
6155 report from <AndyLiebman@aol.com>.
6156 ****************************************************************************/
6157
6158 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6159 const struct smb_filename *smb_fname_dst)
6160 {
6161 const char *psrc = smb_fname_src->base_name;
6162 const char *pdst = smb_fname_dst->base_name;
6163 size_t slen;
6164
6165 if (psrc[0] == '.' && psrc[1] == '/') {
6166 psrc += 2;
6167 }
6168 if (pdst[0] == '.' && pdst[1] == '/') {
6169 pdst += 2;
6170 }
6171 if ((slen = strlen(psrc)) > strlen(pdst)) {
6172 return False;
6173 }
6174 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6175 }
6176
6177 /*
6178 * Do the notify calls from a rename
6179 */
6180
6181 static void notify_rename(connection_struct *conn, bool is_dir,
6182 const struct smb_filename *smb_fname_src,
6183 const struct smb_filename *smb_fname_dst)
6184 {
6185 char *parent_dir_src = NULL;
6186 char *parent_dir_dst = NULL;
6187 uint32 mask;
6188
6189 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6190 : FILE_NOTIFY_CHANGE_FILE_NAME;
6191
6192 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6193 &parent_dir_src, NULL) ||
6194 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6195 &parent_dir_dst, NULL)) {
6196 goto out;
6197 }
6198
6199 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6200 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6201 smb_fname_src->base_name);
6202 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6203 smb_fname_dst->base_name);
6204 }
6205 else {
6206 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6207 smb_fname_src->base_name);
6208 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6209 smb_fname_dst->base_name);
6210 }
6211
6212 /* this is a strange one. w2k3 gives an additional event for
6213 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6214 files, but not directories */
6215 if (!is_dir) {
6216 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6217 FILE_NOTIFY_CHANGE_ATTRIBUTES
6218 |FILE_NOTIFY_CHANGE_CREATION,
6219 smb_fname_dst->base_name);
6220 }
6221 out:
6222 TALLOC_FREE(parent_dir_src);
6223 TALLOC_FREE(parent_dir_dst);
6224 }
6225
6226 /****************************************************************************
6227 Returns an error if the parent directory for a filename is open in an
6228 incompatible way.
6229 ****************************************************************************/
6230
6231 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6232 const struct smb_filename *smb_fname_dst_in)
6233 {
6234 char *parent_dir = NULL;
6235 struct smb_filename smb_fname_parent;
6236 struct file_id id;
6237 files_struct *fsp = NULL;
6238 int ret;
6239
6240 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6241 &parent_dir, NULL)) {
6242 return NT_STATUS_NO_MEMORY;
6243 }
6244 ZERO_STRUCT(smb_fname_parent);
6245 smb_fname_parent.base_name = parent_dir;
6246
6247 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6248 if (ret == -1) {
6249 return map_nt_error_from_unix(errno);
6250 }
6251
6252 /*
6253 * We're only checking on this smbd here, mostly good
6254 * enough.. and will pass tests.
6255 */
6256
6257 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6258 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6259 fsp = file_find_di_next(fsp)) {
6260 if (fsp->access_mask & DELETE_ACCESS) {
6261 return NT_STATUS_SHARING_VIOLATION;
6262 }
6263 }
6264 return NT_STATUS_OK;
6265 }
6266
6267 /****************************************************************************
6268 Rename an open file - given an fsp.
6269 ****************************************************************************/
6270
6271 NTSTATUS rename_internals_fsp(connection_struct *conn,
6272 files_struct *fsp,
6273 const struct smb_filename *smb_fname_dst_in,
6274 uint32 attrs,
6275 bool replace_if_exists)
6276 {
6277 TALLOC_CTX *ctx = talloc_tos();
6278 struct smb_filename *smb_fname_dst = NULL;
6279 NTSTATUS status = NT_STATUS_OK;
6280 struct share_mode_lock *lck = NULL;
6281 bool dst_exists, old_is_stream, new_is_stream;
6282
6283 status = check_name(conn, smb_fname_dst_in->base_name);
6284 if (!NT_STATUS_IS_OK(status)) {
6285 return status;
6286 }
6287
6288 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6289 if (!NT_STATUS_IS_OK(status)) {
6290 return status;
6291 }
6292
6293 /* Make a copy of the dst smb_fname structs */
6294
6295 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6296 if (smb_fname_dst == NULL) {
6297 status = NT_STATUS_NO_MEMORY;
6298 goto out;
6299 }
6300
6301 /*
6302 * Check for special case with case preserving and not
6303 * case sensitive. If the old last component differs from the original
6304 * last component only by case, then we should allow
6305 * the rename (user is trying to change the case of the
6306 * filename).
6307 */
6308 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6309 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6310 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6311 char *last_slash;
6312 char *fname_dst_lcomp_base_mod = NULL;
6313 struct smb_filename *smb_fname_orig_lcomp = NULL;
6314
6315 /*
6316 * Get the last component of the destination name.
6317 */
6318 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6319 if (last_slash) {
6320 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6321 } else {
6322 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6323 }
6324 if (!fname_dst_lcomp_base_mod) {
6325 status = NT_STATUS_NO_MEMORY;
6326 goto out;
6327 }
6328
6329 /*
6330 * Create an smb_filename struct using the original last
6331 * component of the destination.
6332 */
6333 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6334 ctx, smb_fname_dst->original_lcomp, NULL);
6335 if (smb_fname_orig_lcomp == NULL) {
6336 status = NT_STATUS_NO_MEMORY;
6337 TALLOC_FREE(fname_dst_lcomp_base_mod);
6338 goto out;
6339 }
6340
6341 /* If the base names only differ by case, use original. */
6342 if(!strcsequal(fname_dst_lcomp_base_mod,
6343 smb_fname_orig_lcomp->base_name)) {
6344 char *tmp;
6345 /*
6346 * Replace the modified last component with the
6347 * original.
6348 */
6349 if (last_slash) {
6350 *last_slash = '\0'; /* Truncate at the '/' */
6351 tmp = talloc_asprintf(smb_fname_dst,
6352 "%s/%s",
6353 smb_fname_dst->base_name,
6354 smb_fname_orig_lcomp->base_name);
6355 } else {
6356 tmp = talloc_asprintf(smb_fname_dst,
6357 "%s",
6358 smb_fname_orig_lcomp->base_name);
6359 }
6360 if (tmp == NULL) {
6361 status = NT_STATUS_NO_MEMORY;
6362 TALLOC_FREE(fname_dst_lcomp_base_mod);
6363 TALLOC_FREE(smb_fname_orig_lcomp);
6364 goto out;
6365 }
6366 TALLOC_FREE(smb_fname_dst->base_name);
6367 smb_fname_dst->base_name = tmp;
6368 }
6369
6370 /* If the stream_names only differ by case, use original. */
6371 if(!strcsequal(smb_fname_dst->stream_name,
6372 smb_fname_orig_lcomp->stream_name)) {
6373 char *tmp = NULL;
6374 /* Use the original stream. */
6375 tmp = talloc_strdup(smb_fname_dst,
6376 smb_fname_orig_lcomp->stream_name);
6377 if (tmp == NULL) {
6378 status = NT_STATUS_NO_MEMORY;
6379 TALLOC_FREE(fname_dst_lcomp_base_mod);
6380 TALLOC_FREE(smb_fname_orig_lcomp);
6381 goto out;
6382 }
6383 TALLOC_FREE(smb_fname_dst->stream_name);
6384 smb_fname_dst->stream_name = tmp;
6385 }
6386 TALLOC_FREE(fname_dst_lcomp_base_mod);
6387 TALLOC_FREE(smb_fname_orig_lcomp);
6388 }
6389
6390 /*
6391 * If the src and dest names are identical - including case,
6392 * don't do the rename, just return success.
6393 */
6394
6395 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6396 strcsequal(fsp->fsp_name->stream_name,
6397 smb_fname_dst->stream_name)) {
6398 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6399 "- returning success\n",
6400 smb_fname_str_dbg(smb_fname_dst)));
6401 status = NT_STATUS_OK;
6402 goto out;
6403 }
6404
6405 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6406 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6407
6408 /* Return the correct error code if both names aren't streams. */
6409 if (!old_is_stream && new_is_stream) {
6410 status = NT_STATUS_OBJECT_NAME_INVALID;
6411 goto out;
6412 }
6413
6414 if (old_is_stream && !new_is_stream) {
6415 status = NT_STATUS_INVALID_PARAMETER;
6416 goto out;
6417 }
6418
6419 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6420
6421 if(!replace_if_exists && dst_exists) {
6422 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6423 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6424 smb_fname_str_dbg(smb_fname_dst)));
6425 status = NT_STATUS_OBJECT_NAME_COLLISION;
6426 goto out;
6427 }
6428
6429 if (dst_exists) {
6430 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6431 &smb_fname_dst->st);
6432 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6433 fileid);
6434 /* The file can be open when renaming a stream */
6435 if (dst_fsp && !new_is_stream) {
6436 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6437 status = NT_STATUS_ACCESS_DENIED;
6438 goto out;
6439 }
6440 }
6441
6442 /* Ensure we have a valid stat struct for the source. */
6443 status = vfs_stat_fsp(fsp);
6444 if (!NT_STATUS_IS_OK(status)) {
6445 goto out;
6446 }
6447
6448 status = can_rename(conn, fsp, attrs);
6449
6450 if (!NT_STATUS_IS_OK(status)) {
6451 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6452 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6453 smb_fname_str_dbg(smb_fname_dst)));
6454 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6455 status = NT_STATUS_ACCESS_DENIED;
6456 goto out;
6457 }
6458
6459 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6460 status = NT_STATUS_ACCESS_DENIED;
6461 }
6462
6463 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6464
6465 /*
6466 * We have the file open ourselves, so not being able to get the
6467 * corresponding share mode lock is a fatal error.
6468 */
6469
6470 SMB_ASSERT(lck != NULL);
6471
6472 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6473 uint32 create_options = fsp->fh->private_options;
6474
6475 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6476 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6477 smb_fname_str_dbg(smb_fname_dst)));
6478
6479 if (!fsp->is_directory &&
6480 !lp_posix_pathnames() &&
6481 (lp_map_archive(SNUM(conn)) ||
6482 lp_store_dos_attributes(SNUM(conn)))) {
6483 /* We must set the archive bit on the newly
6484 renamed file. */
6485 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6486 uint32_t old_dosmode = dos_mode(conn,
6487 smb_fname_dst);
6488 file_set_dosmode(conn,
6489 smb_fname_dst,
6490 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6491 NULL,
6492 true);
6493 }
6494 }
6495
6496 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6497 smb_fname_dst);
6498
6499 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6500
6501 /*
6502 * A rename acts as a new file create w.r.t. allowing an initial delete
6503 * on close, probably because in Windows there is a new handle to the
6504 * new file. If initial delete on close was requested but not
6505 * originally set, we need to set it here. This is probably not 100% correct,
6506 * but will work for the CIFSFS client which in non-posix mode
6507 * depends on these semantics. JRA.
6508 */
6509
6510 if (create_options & FILE_DELETE_ON_CLOSE) {
6511 status = can_set_delete_on_close(fsp, 0);
6512
6513 if (NT_STATUS_IS_OK(status)) {
6514 /* Note that here we set the *inital* delete on close flag,
6515 * not the regular one. The magic gets handled in close. */
6516 fsp->initial_delete_on_close = True;
6517 }
6518 }
6519 TALLOC_FREE(lck);
6520 status = NT_STATUS_OK;
6521 goto out;
6522 }
6523
6524 TALLOC_FREE(lck);
6525
6526 if (errno == ENOTDIR || errno == EISDIR) {
6527 status = NT_STATUS_OBJECT_NAME_COLLISION;
6528 } else {
6529 status = map_nt_error_from_unix(errno);
6530 }
6531
6532 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6533 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6534 smb_fname_str_dbg(smb_fname_dst)));
6535
6536 out:
6537 TALLOC_FREE(smb_fname_dst);
6538
6539 return status;
6540 }
6541
6542 /****************************************************************************
6543 The guts of the rename command, split out so it may be called by the NT SMB
6544 code.
6545 ****************************************************************************/
6546
6547 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6548 connection_struct *conn,
6549 struct smb_request *req,
6550 struct smb_filename *smb_fname_src,
6551 struct smb_filename *smb_fname_dst,
6552 uint32 attrs,
6553 bool replace_if_exists,
6554 bool src_has_wild,
6555 bool dest_has_wild,
6556 uint32_t access_mask)
6557 {
6558 char *fname_src_dir = NULL;
6559 char *fname_src_mask = NULL;
6560 int count=0;
6561 NTSTATUS status = NT_STATUS_OK;
6562 struct smb_Dir *dir_hnd = NULL;
6563 const char *dname = NULL;
6564 char *talloced = NULL;
6565 long offset = 0;
6566 int create_options = 0;
6567 bool posix_pathnames = lp_posix_pathnames();
6568 int rc;
6569
6570 /*
6571 * Split the old name into directory and last component
6572 * strings. Note that unix_convert may have stripped off a
6573 * leading ./ from both name and newname if the rename is
6574 * at the root of the share. We need to make sure either both
6575 * name and newname contain a / character or neither of them do
6576 * as this is checked in resolve_wildcards().
6577 */
6578
6579 /* Split up the directory from the filename/mask. */
6580 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6581 &fname_src_dir, &fname_src_mask);
6582 if (!NT_STATUS_IS_OK(status)) {
6583 status = NT_STATUS_NO_MEMORY;
6584 goto out;
6585 }
6586
6587 /*
6588 * We should only check the mangled cache
6589 * here if unix_convert failed. This means
6590 * that the path in 'mask' doesn't exist
6591 * on the file system and so we need to look
6592 * for a possible mangle. This patch from
6593 * Tine Smukavec <valentin.smukavec@hermes.si>.
6594 */
6595
6596 if (!VALID_STAT(smb_fname_src->st) &&
6597 mangle_is_mangled(fname_src_mask, conn->params)) {
6598 char *new_mask = NULL;
6599 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6600 conn->params);
6601 if (new_mask) {
6602 TALLOC_FREE(fname_src_mask);
6603 fname_src_mask = new_mask;
6604 }
6605 }
6606
6607 if (!src_has_wild) {
6608 files_struct *fsp;
6609
6610 /*
6611 * Only one file needs to be renamed. Append the mask back
6612 * onto the directory.
6613 */
6614 TALLOC_FREE(smb_fname_src->base_name);
6615 if (ISDOT(fname_src_dir)) {
6616 /* Ensure we use canonical names on open. */
6617 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6618 "%s",
6619 fname_src_mask);
6620 } else {
6621 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6622 "%s/%s",
6623 fname_src_dir,
6624 fname_src_mask);
6625 }
6626 if (!smb_fname_src->base_name) {
6627 status = NT_STATUS_NO_MEMORY;
6628 goto out;
6629 }
6630
6631 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6632 "case_preserve = %d, short case preserve = %d, "
6633 "directory = %s, newname = %s, "
6634 "last_component_dest = %s\n",
6635 conn->case_sensitive, conn->case_preserve,
6636 conn->short_case_preserve,
6637 smb_fname_str_dbg(smb_fname_src),
6638 smb_fname_str_dbg(smb_fname_dst),
6639 smb_fname_dst->original_lcomp));
6640
6641 /* The dest name still may have wildcards. */
6642 if (dest_has_wild) {
6643 char *fname_dst_mod = NULL;
6644 if (!resolve_wildcards(smb_fname_dst,
6645 smb_fname_src->base_name,
6646 smb_fname_dst->base_name,
6647 &fname_dst_mod)) {
6648 DEBUG(6, ("rename_internals: resolve_wildcards "
6649 "%s %s failed\n",
6650 smb_fname_src->base_name,
6651 smb_fname_dst->base_name));
6652 status = NT_STATUS_NO_MEMORY;
6653 goto out;
6654 }
6655 TALLOC_FREE(smb_fname_dst->base_name);
6656 smb_fname_dst->base_name = fname_dst_mod;
6657 }
6658
6659 ZERO_STRUCT(smb_fname_src->st);
6660 if (posix_pathnames) {
6661 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6662 } else {
6663 rc = SMB_VFS_STAT(conn, smb_fname_src);
6664 }
6665 if (rc == -1) {
6666 status = map_nt_error_from_unix_common(errno);
6667 goto out;
6668 }
6669
6670 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6671 create_options |= FILE_DIRECTORY_FILE;
6672 }
6673
6674 status = SMB_VFS_CREATE_FILE(
6675 conn, /* conn */
6676 req, /* req */
6677 0, /* root_dir_fid */
6678 smb_fname_src, /* fname */
6679 access_mask, /* access_mask */
6680 (FILE_SHARE_READ | /* share_access */
6681 FILE_SHARE_WRITE),
6682 FILE_OPEN, /* create_disposition*/
6683 create_options, /* create_options */
6684 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6685 0, /* oplock_request */
6686 0, /* allocation_size */
6687 0, /* private_flags */
6688 NULL, /* sd */
6689 NULL, /* ea_list */
6690 &fsp, /* result */
6691 NULL); /* pinfo */
6692
6693 if (!NT_STATUS_IS_OK(status)) {
6694 DEBUG(3, ("Could not open rename source %s: %s\n",
6695 smb_fname_str_dbg(smb_fname_src),
6696 nt_errstr(status)));
6697 goto out;
6698 }
6699
6700 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6701 attrs, replace_if_exists);
6702
6703 close_file(req, fsp, NORMAL_CLOSE);
6704
6705 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6706 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6707 smb_fname_str_dbg(smb_fname_dst)));
6708
6709 goto out;
6710 }
6711
6712 /*
6713 * Wildcards - process each file that matches.
6714 */
6715 if (strequal(fname_src_mask, "????????.???")) {
6716 TALLOC_FREE(fname_src_mask);
6717 fname_src_mask = talloc_strdup(ctx, "*");
6718 if (!fname_src_mask) {
6719 status = NT_STATUS_NO_MEMORY;
6720 goto out;
6721 }
6722 }
6723
6724 status = check_name(conn, fname_src_dir);
6725 if (!NT_STATUS_IS_OK(status)) {
6726 goto out;
6727 }
6728
6729 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6730 attrs);
6731 if (dir_hnd == NULL) {
6732 status = map_nt_error_from_unix(errno);
6733 goto out;
6734 }
6735
6736 status = NT_STATUS_NO_SUCH_FILE;
6737 /*
6738 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6739 * - gentest fix. JRA
6740 */
6741
6742 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6743 &talloced))) {
6744 files_struct *fsp = NULL;
6745 char *destname = NULL;
6746 bool sysdir_entry = False;
6747
6748 /* Quick check for "." and ".." */
6749 if (ISDOT(dname) || ISDOTDOT(dname)) {
6750 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6751 sysdir_entry = True;
6752 } else {
6753 TALLOC_FREE(talloced);
6754 continue;
6755 }
6756 }
6757
6758 if (!is_visible_file(conn, fname_src_dir, dname,
6759 &smb_fname_src->st, false)) {
6760 TALLOC_FREE(talloced);
6761 continue;
6762 }
6763
6764 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6765 TALLOC_FREE(talloced);
6766 continue;
6767 }
6768
6769 if (sysdir_entry) {
6770 status = NT_STATUS_OBJECT_NAME_INVALID;
6771 break;
6772 }
6773
6774 TALLOC_FREE(smb_fname_src->base_name);
6775 if (ISDOT(fname_src_dir)) {
6776 /* Ensure we use canonical names on open. */
6777 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6778 "%s",
6779 dname);
6780 } else {
6781 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6782 "%s/%s",
6783 fname_src_dir,
6784 dname);
6785 }
6786 if (!smb_fname_src->base_name) {
6787 status = NT_STATUS_NO_MEMORY;
6788 goto out;
6789 }
6790
6791 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6792 smb_fname_dst->base_name,
6793 &destname)) {
6794 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6795 smb_fname_src->base_name, destname));
6796 TALLOC_FREE(talloced);
6797 continue;
6798 }
6799 if (!destname) {
6800 status = NT_STATUS_NO_MEMORY;
6801 goto out;
6802 }
6803
6804 TALLOC_FREE(smb_fname_dst->base_name);
6805 smb_fname_dst->base_name = destname;
6806
6807 ZERO_STRUCT(smb_fname_src->st);
6808 if (posix_pathnames) {
6809 SMB_VFS_LSTAT(conn, smb_fname_src);
6810 } else {
6811 SMB_VFS_STAT(conn, smb_fname_src);
6812 }
6813
6814 create_options = 0;
6815
6816 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6817 create_options |= FILE_DIRECTORY_FILE;
6818 }
6819
6820 status = SMB_VFS_CREATE_FILE(
6821 conn, /* conn */
6822 req, /* req */
6823 0, /* root_dir_fid */
6824 smb_fname_src, /* fname */
6825 access_mask, /* access_mask */
6826 (FILE_SHARE_READ | /* share_access */
6827 FILE_SHARE_WRITE),
6828 FILE_OPEN, /* create_disposition*/
6829 create_options, /* create_options */
6830 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6831 0, /* oplock_request */
6832 0, /* allocation_size */
6833 0, /* private_flags */
6834 NULL, /* sd */
6835 NULL, /* ea_list */
6836 &fsp, /* result */
6837 NULL); /* pinfo */
6838
6839 if (!NT_STATUS_IS_OK(status)) {
6840 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6841 "returned %s rename %s -> %s\n",
6842 nt_errstr(status),
6843 smb_fname_str_dbg(smb_fname_src),
6844 smb_fname_str_dbg(smb_fname_dst)));
6845 break;
6846 }
6847
6848 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6849 dname);
6850 if (!smb_fname_dst->original_lcomp) {
6851 status = NT_STATUS_NO_MEMORY;
6852 goto out;
6853 }
6854
6855 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6856 attrs, replace_if_exists);
6857
6858 close_file(req, fsp, NORMAL_CLOSE);
6859
6860 if (!NT_STATUS_IS_OK(status)) {
6861 DEBUG(3, ("rename_internals_fsp returned %s for "
6862 "rename %s -> %s\n", nt_errstr(status),
6863 smb_fname_str_dbg(smb_fname_src),
6864 smb_fname_str_dbg(smb_fname_dst)));
6865 break;
6866 }
6867
6868 count++;
6869
6870 DEBUG(3,("rename_internals: doing rename on %s -> "
6871 "%s\n", smb_fname_str_dbg(smb_fname_src),
6872 smb_fname_str_dbg(smb_fname_src)));
6873 TALLOC_FREE(talloced);
6874 }
6875 TALLOC_FREE(dir_hnd);
6876
6877 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6878 status = map_nt_error_from_unix(errno);
6879 }
6880
6881 out:
6882 TALLOC_FREE(talloced);
6883 TALLOC_FREE(fname_src_dir);
6884 TALLOC_FREE(fname_src_mask);
6885 return status;
6886 }
6887
6888 /****************************************************************************
6889 Reply to a mv.
6890 ****************************************************************************/
6891
6892 void reply_mv(struct smb_request *req)
6893 {
6894 connection_struct *conn = req->conn;
6895 char *name = NULL;
6896 char *newname = NULL;
6897 const char *p;
6898 uint32 attrs;
6899 NTSTATUS status;
6900 bool src_has_wcard = False;
6901 bool dest_has_wcard = False;
6902 TALLOC_CTX *ctx = talloc_tos();
6903 struct smb_filename *smb_fname_src = NULL;
6904 struct smb_filename *smb_fname_dst = NULL;
6905 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6906 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6907 bool stream_rename = false;
6908
6909 START_PROFILE(SMBmv);
6910
6911 if (req->wct < 1) {
6912 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6913 goto out;
6914 }
6915
6916 attrs = SVAL(req->vwv+0, 0);
6917
6918 p = (const char *)req->buf + 1;
6919 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6920 &status, &src_has_wcard);
6921 if (!NT_STATUS_IS_OK(status)) {
6922 reply_nterror(req, status);
6923 goto out;
6924 }
6925 p++;
6926 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6927 &status, &dest_has_wcard);
6928 if (!NT_STATUS_IS_OK(status)) {
6929 reply_nterror(req, status);
6930 goto out;
6931 }
6932
6933 if (!lp_posix_pathnames()) {
6934 /* The newname must begin with a ':' if the
6935 name contains a ':'. */
6936 if (strchr_m(name, ':')) {
6937 if (newname[0] != ':') {
6938 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6939 goto out;
6940 }
6941 stream_rename = true;
6942 }
6943 }
6944
6945 status = filename_convert(ctx,
6946 conn,
6947 req->flags2 & FLAGS2_DFS_PATHNAMES,
6948 name,
6949 src_ucf_flags,
6950 &src_has_wcard,
6951 &smb_fname_src);
6952
6953 if (!NT_STATUS_IS_OK(status)) {
6954 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6955 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6956 ERRSRV, ERRbadpath);
6957 goto out;
6958 }
6959 reply_nterror(req, status);
6960 goto out;
6961 }
6962
6963 status = filename_convert(ctx,
6964 conn,
6965 req->flags2 & FLAGS2_DFS_PATHNAMES,
6966 newname,
6967 dst_ucf_flags,
6968 &dest_has_wcard,
6969 &smb_fname_dst);
6970
6971 if (!NT_STATUS_IS_OK(status)) {
6972 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6973 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6974 ERRSRV, ERRbadpath);
6975 goto out;
6976 }
6977 reply_nterror(req, status);
6978 goto out;
6979 }
6980
6981 if (stream_rename) {
6982 /* smb_fname_dst->base_name must be the same as
6983 smb_fname_src->base_name. */
6984 TALLOC_FREE(smb_fname_dst->base_name);
6985 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6986 smb_fname_src->base_name);
6987 if (!smb_fname_dst->base_name) {
6988 reply_nterror(req, NT_STATUS_NO_MEMORY);
6989 goto out;
6990 }
6991 }
6992
6993 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6994 smb_fname_str_dbg(smb_fname_dst)));
6995
6996 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6997 attrs, False, src_has_wcard, dest_has_wcard,
6998 DELETE_ACCESS);
6999 if (!NT_STATUS_IS_OK(status)) {
7000 if (open_was_deferred(req->sconn, req->mid)) {
7001 /* We have re-scheduled this call. */
7002 goto out;
7003 }
7004 reply_nterror(req, status);
7005 goto out;
7006 }
7007
7008 reply_outbuf(req, 0, 0);
7009 out:
7010 TALLOC_FREE(smb_fname_src);
7011 TALLOC_FREE(smb_fname_dst);
7012 END_PROFILE(SMBmv);
7013 return;
7014 }
7015
7016 /*******************************************************************
7017 Copy a file as part of a reply_copy.
7018 ******************************************************************/
7019
7020 /*
7021 * TODO: check error codes on all callers
7022 */
7023
7024 NTSTATUS copy_file(TALLOC_CTX *ctx,
7025 connection_struct *conn,
7026 struct smb_filename *smb_fname_src,
7027 struct smb_filename *smb_fname_dst,
7028 int ofun,
7029 int count,
7030 bool target_is_directory)
7031 {
7032 struct smb_filename *smb_fname_dst_tmp = NULL;
7033 off_t ret=-1;
7034 files_struct *fsp1,*fsp2;
7035 uint32 dosattrs;
7036 uint32 new_create_disposition;
7037 NTSTATUS status;
7038
7039
7040 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7041 if (smb_fname_dst_tmp == NULL) {
7042 return NT_STATUS_NO_MEMORY;
7043 }
7044
7045 /*
7046 * If the target is a directory, extract the last component from the
7047 * src filename and append it to the dst filename
7048 */
7049 if (target_is_directory) {
7050 const char *p;
7051
7052 /* dest/target can't be a stream if it's a directory. */
7053 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7054
7055 p = strrchr_m(smb_fname_src->base_name,'/');
7056 if (p) {
7057 p++;
7058 } else {
7059 p = smb_fname_src->base_name;
7060 }
7061 smb_fname_dst_tmp->base_name =
7062 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7063 p);
7064 if (!smb_fname_dst_tmp->base_name) {
7065 status = NT_STATUS_NO_MEMORY;
7066 goto out;
7067 }
7068 }
7069
7070 status = vfs_file_exist(conn, smb_fname_src);
7071 if (!NT_STATUS_IS_OK(status)) {
7072 goto out;
7073 }
7074
7075 if (!target_is_directory && count) {
7076 new_create_disposition = FILE_OPEN;
7077 } else {
7078 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7079 0, ofun,
7080 NULL, NULL,
7081 &new_create_disposition,
7082 NULL,
7083 NULL)) {
7084 status = NT_STATUS_INVALID_PARAMETER;
7085 goto out;
7086 }
7087 }
7088
7089 /* Open the src file for reading. */
7090 status = SMB_VFS_CREATE_FILE(
7091 conn, /* conn */
7092 NULL, /* req */
7093 0, /* root_dir_fid */
7094 smb_fname_src, /* fname */
7095 FILE_GENERIC_READ, /* access_mask */
7096 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7097 FILE_OPEN, /* create_disposition*/
7098 0, /* create_options */
7099 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7100 INTERNAL_OPEN_ONLY, /* oplock_request */
7101 0, /* allocation_size */
7102 0, /* private_flags */
7103 NULL, /* sd */
7104 NULL, /* ea_list */
7105 &fsp1, /* result */
7106 NULL); /* psbuf */
7107
7108 if (!NT_STATUS_IS_OK(status)) {
7109 goto out;
7110 }
7111
7112 dosattrs = dos_mode(conn, smb_fname_src);
7113
7114 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7115 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7116 }
7117
7118 /* Open the dst file for writing. */
7119 status = SMB_VFS_CREATE_FILE(
7120 conn, /* conn */
7121 NULL, /* req */
7122 0, /* root_dir_fid */
7123 smb_fname_dst, /* fname */
7124 FILE_GENERIC_WRITE, /* access_mask */
7125 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7126 new_create_disposition, /* create_disposition*/
7127 0, /* create_options */
7128 dosattrs, /* file_attributes */
7129 INTERNAL_OPEN_ONLY, /* oplock_request */
7130 0, /* allocation_size */
7131 0, /* private_flags */
7132 NULL, /* sd */
7133 NULL, /* ea_list */
7134 &fsp2, /* result */
7135 NULL); /* psbuf */
7136
7137 if (!NT_STATUS_IS_OK(status)) {
7138 close_file(NULL, fsp1, ERROR_CLOSE);
7139 goto out;
7140 }
7141
7142 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7143 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7144 if (ret == -1) {
7145 DEBUG(0, ("error - vfs lseek returned error %s\n",
7146 strerror(errno)));
7147 status = map_nt_error_from_unix(errno);
7148 close_file(NULL, fsp1, ERROR_CLOSE);
7149 close_file(NULL, fsp2, ERROR_CLOSE);
7150 goto out;
7151 }
7152 }
7153
7154 /* Do the actual copy. */
7155 if (smb_fname_src->st.st_ex_size) {
7156 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7157 } else {
7158 ret = 0;
7159 }
7160
7161 close_file(NULL, fsp1, NORMAL_CLOSE);
7162
7163 /* Ensure the modtime is set correctly on the destination file. */
7164 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7165
7166 /*
7167 * As we are opening fsp1 read-only we only expect
7168 * an error on close on fsp2 if we are out of space.
7169 * Thus we don't look at the error return from the
7170 * close of fsp1.
7171 */
7172 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7173
7174 if (!NT_STATUS_IS_OK(status)) {
7175 goto out;
7176 }
7177
7178 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7179 status = NT_STATUS_DISK_FULL;
7180 goto out;
7181 }
7182
7183 status = NT_STATUS_OK;
7184
7185 out:
7186 TALLOC_FREE(smb_fname_dst_tmp);
7187 return status;
7188 }
7189
7190 /****************************************************************************
7191 Reply to a file copy.
7192 ****************************************************************************/
7193
7194 void reply_copy(struct smb_request *req)
7195 {
7196 connection_struct *conn = req->conn;
7197 struct smb_filename *smb_fname_src = NULL;
7198 struct smb_filename *smb_fname_dst = NULL;
7199 char *fname_src = NULL;
7200 char *fname_dst = NULL;
7201 char *fname_src_mask = NULL;
7202 char *fname_src_dir = NULL;
7203 const char *p;
7204 int count=0;
7205 int error = ERRnoaccess;
7206 int tid2;
7207 int ofun;
7208 int flags;
7209 bool target_is_directory=False;
7210 bool source_has_wild = False;
7211 bool dest_has_wild = False;
7212 NTSTATUS status;
7213 TALLOC_CTX *ctx = talloc_tos();
7214
7215 START_PROFILE(SMBcopy);
7216
7217 if (req->wct < 3) {
7218 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7219 goto out;
7220 }
7221
7222 tid2 = SVAL(req->vwv+0, 0);
7223 ofun = SVAL(req->vwv+1, 0);
7224 flags = SVAL(req->vwv+2, 0);
7225
7226 p = (const char *)req->buf;
7227 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7228 &status, &source_has_wild);
7229 if (!NT_STATUS_IS_OK(status)) {
7230 reply_nterror(req, status);
7231 goto out;
7232 }
7233 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7234 &status, &dest_has_wild);
7235 if (!NT_STATUS_IS_OK(status)) {
7236 reply_nterror(req, status);
7237 goto out;
7238 }
7239
7240 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7241
7242 if (tid2 != conn->cnum) {
7243 /* can't currently handle inter share copies XXXX */
7244 DEBUG(3,("Rejecting inter-share copy\n"));
7245 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7246 goto out;
7247 }
7248
7249 status = filename_convert(ctx, conn,
7250 req->flags2 & FLAGS2_DFS_PATHNAMES,
7251 fname_src,
7252 UCF_COND_ALLOW_WCARD_LCOMP,
7253 &source_has_wild,
7254 &smb_fname_src);
7255 if (!NT_STATUS_IS_OK(status)) {
7256 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7257 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7258 ERRSRV, ERRbadpath);
7259 goto out;
7260 }
7261 reply_nterror(req, status);
7262 goto out;
7263 }
7264
7265 status = filename_convert(ctx, conn,
7266 req->flags2 & FLAGS2_DFS_PATHNAMES,
7267 fname_dst,
7268 UCF_COND_ALLOW_WCARD_LCOMP,
7269 &dest_has_wild,
7270 &smb_fname_dst);
7271 if (!NT_STATUS_IS_OK(status)) {
7272 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7273 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7274 ERRSRV, ERRbadpath);
7275 goto out;
7276 }
7277 reply_nterror(req, status);
7278 goto out;
7279 }
7280
7281 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7282
7283 if ((flags&1) && target_is_directory) {
7284 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7285 goto out;
7286 }
7287
7288 if ((flags&2) && !target_is_directory) {
7289 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7290 goto out;
7291 }
7292
7293 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7294 /* wants a tree copy! XXXX */
7295 DEBUG(3,("Rejecting tree copy\n"));
7296 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7297 goto out;
7298 }
7299
7300 /* Split up the directory from the filename/mask. */
7301 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7302 &fname_src_dir, &fname_src_mask);
7303 if (!NT_STATUS_IS_OK(status)) {
7304 reply_nterror(req, NT_STATUS_NO_MEMORY);
7305 goto out;
7306 }
7307
7308 /*
7309 * We should only check the mangled cache
7310 * here if unix_convert failed. This means
7311 * that the path in 'mask' doesn't exist
7312 * on the file system and so we need to look
7313 * for a possible mangle. This patch from
7314 * Tine Smukavec <valentin.smukavec@hermes.si>.
7315 */
7316 if (!VALID_STAT(smb_fname_src->st) &&
7317 mangle_is_mangled(fname_src_mask, conn->params)) {
7318 char *new_mask = NULL;
7319 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7320 &new_mask, conn->params);
7321
7322 /* Use demangled name if one was successfully found. */
7323 if (new_mask) {
7324 TALLOC_FREE(fname_src_mask);
7325 fname_src_mask = new_mask;
7326 }
7327 }
7328
7329 if (!source_has_wild) {
7330
7331 /*
7332 * Only one file needs to be copied. Append the mask back onto
7333 * the directory.
7334 */
7335 TALLOC_FREE(smb_fname_src->base_name);
7336 if (ISDOT(fname_src_dir)) {
7337 /* Ensure we use canonical names on open. */
7338 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7339 "%s",
7340 fname_src_mask);
7341 } else {
7342 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7343 "%s/%s",
7344 fname_src_dir,
7345 fname_src_mask);
7346 }
7347 if (!smb_fname_src->base_name) {
7348 reply_nterror(req, NT_STATUS_NO_MEMORY);
7349 goto out;
7350 }
7351
7352 if (dest_has_wild) {
7353 char *fname_dst_mod = NULL;
7354 if (!resolve_wildcards(smb_fname_dst,
7355 smb_fname_src->base_name,
7356 smb_fname_dst->base_name,
7357 &fname_dst_mod)) {
7358 reply_nterror(req, NT_STATUS_NO_MEMORY);
7359 goto out;
7360 }
7361 TALLOC_FREE(smb_fname_dst->base_name);
7362 smb_fname_dst->base_name = fname_dst_mod;
7363 }
7364
7365 status = check_name(conn, smb_fname_src->base_name);
7366 if (!NT_STATUS_IS_OK(status)) {
7367 reply_nterror(req, status);
7368 goto out;
7369 }
7370
7371 status = check_name(conn, smb_fname_dst->base_name);
7372 if (!NT_STATUS_IS_OK(status)) {
7373 reply_nterror(req, status);
7374 goto out;
7375 }
7376
7377 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7378 ofun, count, target_is_directory);
7379
7380 if(!NT_STATUS_IS_OK(status)) {
7381 reply_nterror(req, status);
7382 goto out;
7383 } else {
7384 count++;
7385 }
7386 } else {
7387 struct smb_Dir *dir_hnd = NULL;
7388 const char *dname = NULL;
7389 char *talloced = NULL;
7390 long offset = 0;
7391
7392 /*
7393 * There is a wildcard that requires us to actually read the
7394 * src dir and copy each file matching the mask to the dst.
7395 * Right now streams won't be copied, but this could
7396 * presumably be added with a nested loop for reach dir entry.
7397 */
7398 SMB_ASSERT(!smb_fname_src->stream_name);
7399 SMB_ASSERT(!smb_fname_dst->stream_name);
7400
7401 smb_fname_src->stream_name = NULL;
7402 smb_fname_dst->stream_name = NULL;
7403
7404 if (strequal(fname_src_mask,"????????.???")) {
7405 TALLOC_FREE(fname_src_mask);
7406 fname_src_mask = talloc_strdup(ctx, "*");
7407 if (!fname_src_mask) {
7408 reply_nterror(req, NT_STATUS_NO_MEMORY);
7409 goto out;
7410 }
7411 }
7412
7413 status = check_name(conn, fname_src_dir);
7414 if (!NT_STATUS_IS_OK(status)) {
7415 reply_nterror(req, status);
7416 goto out;
7417 }
7418
7419 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7420 if (dir_hnd == NULL) {
7421 status = map_nt_error_from_unix(errno);
7422 reply_nterror(req, status);
7423 goto out;
7424 }
7425
7426 error = ERRbadfile;
7427
7428 /* Iterate over the src dir copying each entry to the dst. */
7429 while ((dname = ReadDirName(dir_hnd, &offset,
7430 &smb_fname_src->st, &talloced))) {
7431 char *destname = NULL;
7432
7433 if (ISDOT(dname) || ISDOTDOT(dname)) {
7434 TALLOC_FREE(talloced);
7435 continue;
7436 }
7437
7438 if (!is_visible_file(conn, fname_src_dir, dname,
7439 &smb_fname_src->st, false)) {
7440 TALLOC_FREE(talloced);
7441 continue;
7442 }
7443
7444 if(!mask_match(dname, fname_src_mask,
7445 conn->case_sensitive)) {
7446 TALLOC_FREE(talloced);
7447 continue;
7448 }
7449
7450 error = ERRnoaccess;
7451
7452 /* Get the src smb_fname struct setup. */
7453 TALLOC_FREE(smb_fname_src->base_name);
7454 if (ISDOT(fname_src_dir)) {
7455 /* Ensure we use canonical names on open. */
7456 smb_fname_src->base_name =
7457 talloc_asprintf(smb_fname_src, "%s",
7458 dname);
7459 } else {
7460 smb_fname_src->base_name =
7461 talloc_asprintf(smb_fname_src, "%s/%s",
7462 fname_src_dir, dname);
7463 }
7464
7465 if (!smb_fname_src->base_name) {
7466 TALLOC_FREE(dir_hnd);
7467 TALLOC_FREE(talloced);
7468 reply_nterror(req, NT_STATUS_NO_MEMORY);
7469 goto out;
7470 }
7471
7472 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7473 smb_fname_dst->base_name,
7474 &destname)) {
7475 TALLOC_FREE(talloced);
7476 continue;
7477 }
7478 if (!destname) {
7479 TALLOC_FREE(dir_hnd);
7480 TALLOC_FREE(talloced);
7481 reply_nterror(req, NT_STATUS_NO_MEMORY);
7482 goto out;
7483 }
7484
7485 TALLOC_FREE(smb_fname_dst->base_name);
7486 smb_fname_dst->base_name = destname;
7487
7488 status = check_name(conn, smb_fname_src->base_name);
7489 if (!NT_STATUS_IS_OK(status)) {
7490 TALLOC_FREE(dir_hnd);
7491 TALLOC_FREE(talloced);
7492 reply_nterror(req, status);
7493 goto out;
7494 }
7495
7496 status = check_name(conn, smb_fname_dst->base_name);
7497 if (!NT_STATUS_IS_OK(status)) {
7498 TALLOC_FREE(dir_hnd);
7499 TALLOC_FREE(talloced);
7500 reply_nterror(req, status);
7501 goto out;
7502 }
7503
7504 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7505 smb_fname_src->base_name,
7506 smb_fname_dst->base_name));
7507
7508 status = copy_file(ctx, conn, smb_fname_src,
7509 smb_fname_dst, ofun, count,
7510 target_is_directory);
7511 if (NT_STATUS_IS_OK(status)) {
7512 count++;
7513 }
7514
7515 TALLOC_FREE(talloced);
7516 }
7517 TALLOC_FREE(dir_hnd);
7518 }
7519
7520 if (count == 0) {
7521 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7522 goto out;
7523 }
7524
7525 reply_outbuf(req, 1, 0);
7526 SSVAL(req->outbuf,smb_vwv0,count);
7527 out:
7528 TALLOC_FREE(smb_fname_src);
7529 TALLOC_FREE(smb_fname_dst);
7530 TALLOC_FREE(fname_src);
7531 TALLOC_FREE(fname_dst);
7532 TALLOC_FREE(fname_src_mask);
7533 TALLOC_FREE(fname_src_dir);
7534
7535 END_PROFILE(SMBcopy);
7536 return;
7537 }
7538
7539 #undef DBGC_CLASS
7540 #define DBGC_CLASS DBGC_LOCKING
7541
7542 /****************************************************************************
7543 Get a lock pid, dealing with large count requests.
7544 ****************************************************************************/
7545
7546 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7547 bool large_file_format)
7548 {
7549 if(!large_file_format)
7550 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7551 else
7552 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7553 }
7554
7555 /****************************************************************************
7556 Get a lock count, dealing with large count requests.
7557 ****************************************************************************/
7558
7559 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7560 bool large_file_format)
7561 {
7562 uint64_t count = 0;
7563
7564 if(!large_file_format) {
7565 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7566 } else {
7567
7568 #if defined(HAVE_LONGLONG)
7569 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7570 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7571 #else /* HAVE_LONGLONG */
7572
7573 /*
7574 * NT4.x seems to be broken in that it sends large file (64 bit)
7575 * lockingX calls even if the CAP_LARGE_FILES was *not*
7576 * negotiated. For boxes without large unsigned ints truncate the
7577 * lock count by dropping the top 32 bits.
7578 */
7579
7580 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7581 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7582 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7583 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7584 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7585 }
7586
7587 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7588 #endif /* HAVE_LONGLONG */
7589 }
7590
7591 return count;
7592 }
7593
7594 #if !defined(HAVE_LONGLONG)
7595 /****************************************************************************
7596 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7597 ****************************************************************************/
7598
7599 static uint32 map_lock_offset(uint32 high, uint32 low)
7600 {
7601 unsigned int i;
7602 uint32 mask = 0;
7603 uint32 highcopy = high;
7604
7605 /*
7606 * Try and find out how many significant bits there are in high.
7607 */
7608
7609 for(i = 0; highcopy; i++)
7610 highcopy >>= 1;
7611
7612 /*
7613 * We use 31 bits not 32 here as POSIX
7614 * lock offsets may not be negative.
7615 */
7616
7617 mask = (~0) << (31 - i);
7618
7619 if(low & mask)
7620 return 0; /* Fail. */
7621
7622 high <<= (31 - i);
7623
7624 return (high|low);
7625 }
7626 #endif /* !defined(HAVE_LONGLONG) */
7627
7628 /****************************************************************************
7629 Get a lock offset, dealing with large offset requests.
7630 ****************************************************************************/
7631
7632 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7633 bool large_file_format, bool *err)
7634 {
7635 uint64_t offset = 0;
7636
7637 *err = False;
7638
7639 if(!large_file_format) {
7640 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7641 } else {
7642
7643 #if defined(HAVE_LONGLONG)
7644 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7645 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7646 #else /* HAVE_LONGLONG */
7647
7648 /*
7649 * NT4.x seems to be broken in that it sends large file (64 bit)
7650 * lockingX calls even if the CAP_LARGE_FILES was *not*
7651 * negotiated. For boxes without large unsigned ints mangle the
7652 * lock offset by mapping the top 32 bits onto the lower 32.
7653 */
7654
7655 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7656 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7657 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7658 uint32 new_low = 0;
7659
7660 if((new_low = map_lock_offset(high, low)) == 0) {
7661 *err = True;
7662 return (uint64_t)-1;
7663 }
7664
7665 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7666 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7667 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7668 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7669 }
7670
7671 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7672 #endif /* HAVE_LONGLONG */
7673 }
7674
7675 return offset;
7676 }
7677
7678 NTSTATUS smbd_do_locking(struct smb_request *req,
7679 files_struct *fsp,
7680 uint8_t type,
7681 int32_t timeout,
7682 uint16_t num_ulocks,
7683 struct smbd_lock_element *ulocks,
7684 uint16_t num_locks,
7685 struct smbd_lock_element *locks,
7686 bool *async)
7687 {
7688 connection_struct *conn = req->conn;
7689 int i;
7690 NTSTATUS status = NT_STATUS_OK;
7691
7692 *async = false;
7693
7694 /* Data now points at the beginning of the list
7695 of smb_unlkrng structs */
7696 for(i = 0; i < (int)num_ulocks; i++) {
7697 struct smbd_lock_element *e = &ulocks[i];
7698
7699 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7700 "pid %u, file %s\n",
7701 (double)e->offset,
7702 (double)e->count,
7703 (unsigned int)e->smblctx,
7704 fsp_str_dbg(fsp)));
7705
7706 if (e->brltype != UNLOCK_LOCK) {
7707 /* this can only happen with SMB2 */
7708 return NT_STATUS_INVALID_PARAMETER;
7709 }
7710
7711 status = do_unlock(req->sconn->msg_ctx,
7712 fsp,
7713 e->smblctx,
7714 e->count,
7715 e->offset,
7716 WINDOWS_LOCK);
7717
7718 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7719 nt_errstr(status)));
7720
7721 if (!NT_STATUS_IS_OK(status)) {
7722 return status;
7723 }
7724 }
7725
7726 /* Setup the timeout in seconds. */
7727
7728 if (!lp_blocking_locks(SNUM(conn))) {
7729 timeout = 0;
7730 }
7731
7732 /* Data now points at the beginning of the list
7733 of smb_lkrng structs */
7734
7735 for(i = 0; i < (int)num_locks; i++) {
7736 struct smbd_lock_element *e = &locks[i];
7737
7738 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7739 "%llu, file %s timeout = %d\n",
7740 (double)e->offset,
7741 (double)e->count,
7742 (unsigned long long)e->smblctx,
7743 fsp_str_dbg(fsp),
7744 (int)timeout));
7745
7746 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7747 struct blocking_lock_record *blr = NULL;
7748
7749 if (num_locks > 1) {
7750 /*
7751 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7752 * if the lock vector contains one entry. When given mutliple cancel
7753 * requests in a single PDU we expect the server to return an
7754 * error. Windows servers seem to accept the request but only
7755 * cancel the first lock.
7756 * JRA - Do what Windows does (tm) :-).
7757 */
7758
7759 #if 0
7760 /* MS-CIFS (2.2.4.32.1) behavior. */
7761 return NT_STATUS_DOS(ERRDOS,
7762 ERRcancelviolation);
7763 #else
7764 /* Windows behavior. */
7765 if (i != 0) {
7766 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7767 "cancel request\n"));
7768 continue;
7769 }
7770 #endif
7771 }
7772
7773 if (lp_blocking_locks(SNUM(conn))) {
7774
7775 /* Schedule a message to ourselves to
7776 remove the blocking lock record and
7777 return the right error. */
7778
7779 blr = blocking_lock_cancel_smb1(fsp,
7780 e->smblctx,
7781 e->offset,
7782 e->count,
7783 WINDOWS_LOCK,
7784 type,
7785 NT_STATUS_FILE_LOCK_CONFLICT);
7786 if (blr == NULL) {
7787 return NT_STATUS_DOS(
7788 ERRDOS,
7789 ERRcancelviolation);
7790 }
7791 }
7792 /* Remove a matching pending lock. */
7793 status = do_lock_cancel(fsp,
7794 e->smblctx,
7795 e->count,
7796 e->offset,
7797 WINDOWS_LOCK,
7798 blr);
7799 } else {
7800 bool blocking_lock = timeout ? true : false;
7801 bool defer_lock = false;
7802 struct byte_range_lock *br_lck;
7803 uint64_t block_smblctx;
7804
7805 br_lck = do_lock(req->sconn->msg_ctx,
7806 fsp,
7807 e->smblctx,
7808 e->count,
7809 e->offset,
7810 e->brltype,
7811 WINDOWS_LOCK,
7812 blocking_lock,
7813 &status,
7814 &block_smblctx,
7815 NULL);
7816
7817 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7818 /* Windows internal resolution for blocking locks seems
7819 to be about 200ms... Don't wait for less than that. JRA. */
7820 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7821 timeout = lp_lock_spin_time();
7822 }
7823 defer_lock = true;
7824 }
7825
7826 /* If a lock sent with timeout of zero would fail, and
7827 * this lock has been requested multiple times,
7828 * according to brl_lock_failed() we convert this
7829 * request to a blocking lock with a timeout of between
7830 * 150 - 300 milliseconds.
7831 *
7832 * If lp_lock_spin_time() has been set to 0, we skip
7833 * this blocking retry and fail immediately.
7834 *
7835 * Replacement for do_lock_spin(). JRA. */
7836
7837 if (!req->sconn->using_smb2 &&
7838 br_lck && lp_blocking_locks(SNUM(conn)) &&
7839 lp_lock_spin_time() && !blocking_lock &&
7840 NT_STATUS_EQUAL((status),
7841 NT_STATUS_FILE_LOCK_CONFLICT))
7842 {
7843 defer_lock = true;
7844 timeout = lp_lock_spin_time();
7845 }
7846
7847 if (br_lck && defer_lock) {
7848 /*
7849 * A blocking lock was requested. Package up
7850 * this smb into a queued request and push it
7851 * onto the blocking lock queue.
7852 */
7853 if(push_blocking_lock_request(br_lck,
7854 req,
7855 fsp,
7856 timeout,
7857 i,
7858 e->smblctx,
7859 e->brltype,
7860 WINDOWS_LOCK,
7861 e->offset,
7862 e->count,
7863 block_smblctx)) {
7864 TALLOC_FREE(br_lck);
7865 *async = true;
7866 return NT_STATUS_OK;
7867 }
7868 }
7869
7870 TALLOC_FREE(br_lck);
7871 }
7872
7873 if (!NT_STATUS_IS_OK(status)) {
7874 break;
7875 }
7876 }
7877
7878 /* If any of the above locks failed, then we must unlock
7879 all of the previous locks (X/Open spec). */
7880
7881 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7882
7883 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7884 i = -1; /* we want to skip the for loop */
7885 }
7886
7887 /*
7888 * Ensure we don't do a remove on the lock that just failed,
7889 * as under POSIX rules, if we have a lock already there, we
7890 * will delete it (and we shouldn't) .....
7891 */
7892 for(i--; i >= 0; i--) {
7893 struct smbd_lock_element *e = &locks[i];
7894
7895 do_unlock(req->sconn->msg_ctx,
7896 fsp,
7897 e->smblctx,
7898 e->count,
7899 e->offset,
7900 WINDOWS_LOCK);
7901 }
7902 return status;
7903 }
7904
7905 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7906 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7907
7908 return NT_STATUS_OK;
7909 }
7910
7911 /****************************************************************************
7912 Reply to a lockingX request.
7913 ****************************************************************************/
7914
7915 void reply_lockingX(struct smb_request *req)
7916 {
7917 connection_struct *conn = req->conn;
7918 files_struct *fsp;
7919 unsigned char locktype;
7920 unsigned char oplocklevel;
7921 uint16 num_ulocks;
7922 uint16 num_locks;
7923 int32 lock_timeout;
7924 int i;
7925 const uint8_t *data;
7926 bool large_file_format;
7927 bool err;
7928 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7929 struct smbd_lock_element *ulocks;
7930 struct smbd_lock_element *locks;
7931 bool async = false;
7932
7933 START_PROFILE(SMBlockingX);
7934
7935 if (req->wct < 8) {
7936 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7937 END_PROFILE(SMBlockingX);
7938 return;
7939 }
7940
7941 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7942 locktype = CVAL(req->vwv+3, 0);
7943 oplocklevel = CVAL(req->vwv+3, 1);
7944 num_ulocks = SVAL(req->vwv+6, 0);
7945 num_locks = SVAL(req->vwv+7, 0);
7946 lock_timeout = IVAL(req->vwv+4, 0);
7947 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7948
7949 if (!check_fsp(conn, req, fsp)) {
7950 END_PROFILE(SMBlockingX);
7951 return;
7952 }
7953
7954 data = req->buf;
7955
7956 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7957 /* we don't support these - and CANCEL_LOCK makes w2k
7958 and XP reboot so I don't really want to be
7959 compatible! (tridge) */
7960 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7961 END_PROFILE(SMBlockingX);
7962 return;
7963 }
7964
7965 /* Check if this is an oplock break on a file
7966 we have granted an oplock on.
7967 */
7968 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7969 /* Client can insist on breaking to none. */
7970 bool break_to_none = (oplocklevel == 0);
7971 bool result;
7972
7973 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7974 "for %s\n", (unsigned int)oplocklevel,
7975 fsp_fnum_dbg(fsp)));
7976
7977 /*
7978 * Make sure we have granted an exclusive or batch oplock on
7979 * this file.
7980 */
7981
7982 if (fsp->oplock_type == 0) {
7983
7984 /* The Samba4 nbench simulator doesn't understand
7985 the difference between break to level2 and break
7986 to none from level2 - it sends oplock break
7987 replies in both cases. Don't keep logging an error
7988 message here - just ignore it. JRA. */
7989
7990 DEBUG(5,("reply_lockingX: Error : oplock break from "
7991 "client for %s (oplock=%d) and no "
7992 "oplock granted on this file (%s).\n",
7993 fsp_fnum_dbg(fsp), fsp->oplock_type,
7994 fsp_str_dbg(fsp)));
7995
7996 /* if this is a pure oplock break request then don't
7997 * send a reply */
7998 if (num_locks == 0 && num_ulocks == 0) {
7999 END_PROFILE(SMBlockingX);
8000 return;
8001 } else {
8002 END_PROFILE(SMBlockingX);
8003 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8004 return;
8005 }
8006 }
8007
8008 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8009 (break_to_none)) {
8010 result = remove_oplock(fsp);
8011 } else {
8012 result = downgrade_oplock(fsp);
8013 }
8014
8015 if (!result) {
8016 DEBUG(0, ("reply_lockingX: error in removing "
8017 "oplock on file %s\n", fsp_str_dbg(fsp)));
8018 /* Hmmm. Is this panic justified? */
8019 smb_panic("internal tdb error");
8020 }
8021
8022 /* if this is a pure oplock break request then don't send a
8023 * reply */
8024 if (num_locks == 0 && num_ulocks == 0) {
8025 /* Sanity check - ensure a pure oplock break is not a
8026 chained request. */
8027 if(CVAL(req->vwv+0, 0) != 0xff)
8028 DEBUG(0,("reply_lockingX: Error : pure oplock "
8029 "break is a chained %d request !\n",
8030 (unsigned int)CVAL(req->vwv+0, 0)));
8031 END_PROFILE(SMBlockingX);
8032 return;
8033 }
8034 }
8035
8036 if (req->buflen <
8037 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8038 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8039 END_PROFILE(SMBlockingX);
8040 return;
8041 }
8042
8043 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8044 if (ulocks == NULL) {
8045 reply_nterror(req, NT_STATUS_NO_MEMORY);
8046 END_PROFILE(SMBlockingX);
8047 return;
8048 }
8049
8050 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8051 if (locks == NULL) {
8052 reply_nterror(req, NT_STATUS_NO_MEMORY);
8053 END_PROFILE(SMBlockingX);
8054 return;
8055 }
8056
8057 /* Data now points at the beginning of the list
8058 of smb_unlkrng structs */
8059 for(i = 0; i < (int)num_ulocks; i++) {
8060 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8061 ulocks[i].count = get_lock_count(data, i, large_file_format);
8062 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8063 ulocks[i].brltype = UNLOCK_LOCK;
8064
8065 /*
8066 * There is no error code marked "stupid client bug".... :-).
8067 */
8068 if(err) {
8069 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8070 END_PROFILE(SMBlockingX);
8071 return;
8072 }
8073 }
8074
8075 /* Now do any requested locks */
8076 data += ((large_file_format ? 20 : 10)*num_ulocks);
8077
8078 /* Data now points at the beginning of the list
8079 of smb_lkrng structs */
8080
8081 for(i = 0; i < (int)num_locks; i++) {
8082 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8083 locks[i].count = get_lock_count(data, i, large_file_format);
8084 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8085
8086 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8087 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8088 locks[i].brltype = PENDING_READ_LOCK;
8089 } else {
8090 locks[i].brltype = READ_LOCK;
8091 }
8092 } else {
8093 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8094 locks[i].brltype = PENDING_WRITE_LOCK;
8095 } else {
8096 locks[i].brltype = WRITE_LOCK;
8097 }
8098 }
8099
8100 /*
8101 * There is no error code marked "stupid client bug".... :-).
8102 */
8103 if(err) {
8104 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8105 END_PROFILE(SMBlockingX);
8106 return;
8107 }
8108 }
8109
8110 status = smbd_do_locking(req, fsp,
8111 locktype, lock_timeout,
8112 num_ulocks, ulocks,
8113 num_locks, locks,
8114 &async);
8115 if (!NT_STATUS_IS_OK(status)) {
8116 END_PROFILE(SMBlockingX);
8117 reply_nterror(req, status);
8118 return;
8119 }
8120 if (async) {
8121 END_PROFILE(SMBlockingX);
8122 return;
8123 }
8124
8125 reply_outbuf(req, 2, 0);
8126 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8127 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8128
8129 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8130 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8131
8132 END_PROFILE(SMBlockingX);
8133 }
8134
8135 #undef DBGC_CLASS
8136 #define DBGC_CLASS DBGC_ALL
8137
8138 /****************************************************************************
8139 Reply to a SMBreadbmpx (read block multiplex) request.
8140 Always reply with an error, if someone has a platform really needs this,
8141 please contact vl@samba.org
8142 ****************************************************************************/
8143
8144 void reply_readbmpx(struct smb_request *req)
8145 {
8146 START_PROFILE(SMBreadBmpx);
8147 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8148 END_PROFILE(SMBreadBmpx);
8149 return;
8150 }
8151
8152 /****************************************************************************
8153 Reply to a SMBreadbs (read block multiplex secondary) request.
8154 Always reply with an error, if someone has a platform really needs this,
8155 please contact vl@samba.org
8156 ****************************************************************************/
8157
8158 void reply_readbs(struct smb_request *req)
8159 {
8160 START_PROFILE(SMBreadBs);
8161 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8162 END_PROFILE(SMBreadBs);
8163 return;
8164 }
8165
8166 /****************************************************************************
8167 Reply to a SMBsetattrE.
8168 ****************************************************************************/
8169
8170 void reply_setattrE(struct smb_request *req)
8171 {
8172 connection_struct *conn = req->conn;
8173 struct smb_file_time ft;
8174 files_struct *fsp;
8175 NTSTATUS status;
8176
8177 START_PROFILE(SMBsetattrE);
8178 ZERO_STRUCT(ft);
8179
8180 if (req->wct < 7) {
8181 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8182 goto out;
8183 }
8184
8185 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8186
8187 if(!fsp || (fsp->conn != conn)) {
8188 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8189 goto out;
8190 }
8191
8192 /*
8193 * Convert the DOS times into unix times.
8194 */
8195
8196 ft.atime = convert_time_t_to_timespec(
8197 srv_make_unix_date2(req->vwv+3));
8198 ft.mtime = convert_time_t_to_timespec(
8199 srv_make_unix_date2(req->vwv+5));
8200 ft.create_time = convert_time_t_to_timespec(
8201 srv_make_unix_date2(req->vwv+1));
8202
8203 reply_outbuf(req, 0, 0);
8204
8205 /*
8206 * Patch from Ray Frush <frush@engr.colostate.edu>
8207 * Sometimes times are sent as zero - ignore them.
8208 */
8209
8210 /* Ensure we have a valid stat struct for the source. */
8211 status = vfs_stat_fsp(fsp);
8212 if (!NT_STATUS_IS_OK(status)) {
8213 reply_nterror(req, status);
8214 goto out;
8215 }
8216
8217 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8218 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8219 goto out;
8220 }
8221
8222 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8223 if (!NT_STATUS_IS_OK(status)) {
8224 reply_nterror(req, status);
8225 goto out;
8226 }
8227
8228 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8229 " createtime=%u\n",
8230 fsp_fnum_dbg(fsp),
8231 (unsigned int)ft.atime.tv_sec,
8232 (unsigned int)ft.mtime.tv_sec,
8233 (unsigned int)ft.create_time.tv_sec
8234 ));
8235 out:
8236 END_PROFILE(SMBsetattrE);
8237 return;
8238 }
8239
8240
8241 /* Back from the dead for OS/2..... JRA. */
8242
8243 /****************************************************************************
8244 Reply to a SMBwritebmpx (write block multiplex primary) request.
8245 Always reply with an error, if someone has a platform really needs this,
8246 please contact vl@samba.org
8247 ****************************************************************************/
8248
8249 void reply_writebmpx(struct smb_request *req)
8250 {
8251 START_PROFILE(SMBwriteBmpx);
8252 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8253 END_PROFILE(SMBwriteBmpx);
8254 return;
8255 }
8256
8257 /****************************************************************************
8258 Reply to a SMBwritebs (write block multiplex secondary) request.
8259 Always reply with an error, if someone has a platform really needs this,
8260 please contact vl@samba.org
8261 ****************************************************************************/
8262
8263 void reply_writebs(struct smb_request *req)
8264 {
8265 START_PROFILE(SMBwriteBs);
8266 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8267 END_PROFILE(SMBwriteBs);
8268 return;
8269 }
8270
8271 /****************************************************************************
8272 Reply to a SMBgetattrE.
8273 ****************************************************************************/
8274
8275 void reply_getattrE(struct smb_request *req)
8276 {
8277 connection_struct *conn = req->conn;
8278 int mode;
8279 files_struct *fsp;
8280 struct timespec create_ts;
8281
8282 START_PROFILE(SMBgetattrE);
8283
8284 if (req->wct < 1) {
8285 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8286 END_PROFILE(SMBgetattrE);
8287 return;
8288 }
8289
8290 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8291
8292 if(!fsp || (fsp->conn != conn)) {
8293 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8294 END_PROFILE(SMBgetattrE);
8295 return;
8296 }
8297
8298 /* Do an fstat on this file */
8299 if(fsp_stat(fsp)) {
8300 reply_nterror(req, map_nt_error_from_unix(errno));
8301 END_PROFILE(SMBgetattrE);
8302 return;
8303 }
8304
8305 mode = dos_mode(conn, fsp->fsp_name);
8306
8307 /*
8308 * Convert the times into dos times. Set create
8309 * date to be last modify date as UNIX doesn't save
8310 * this.
8311 */
8312
8313 reply_outbuf(req, 11, 0);
8314
8315 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8316 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8317 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8318 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8319 /* Should we check pending modtime here ? JRA */
8320 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8321 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8322
8323 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8324 SIVAL(req->outbuf, smb_vwv6, 0);
8325 SIVAL(req->outbuf, smb_vwv8, 0);
8326 } else {
8327 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8328 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8329 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8330 }
8331 SSVAL(req->outbuf,smb_vwv10, mode);
8332
8333 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8334
8335 END_PROFILE(SMBgetattrE);
8336 return;
8337 }
Samba GIT mirror