?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Remove a "set but unused" variable
[Samba.git] / source3 / smbd / reply.c
blobce1a127eb9999299b246504f9b43b101cd2f66c7
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const char *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
535 {
536 int msg_type = CVAL(inbuf,0);
537 int msg_flags = CVAL(inbuf,1);
538 /*
539 * We only really use 4 bytes of the outbuf, but for the smb_setlen
540 * calculation & friends (srv_send_smb uses that) we need the full smb
541 * header.
542 */
543 char outbuf[smb_size];
544
545 memset(outbuf, '\0', sizeof(outbuf));
546
547 smb_setlen(outbuf,0);
548
549 switch (msg_type) {
550 case NBSSrequest: /* session request */
551 {
552 /* inbuf_size is guarenteed to be at least 4. */
553 fstring name1,name2;
554 int name_type1, name_type2;
555 int name_len1, name_len2;
556
557 *name1 = *name2 = 0;
558
559 if (sconn->nbt.got_session) {
560 exit_server_cleanly("multiple session request not permitted");
561 }
562
563 SCVAL(outbuf,0,NBSSpositive);
564 SCVAL(outbuf,3,0);
565
566 /* inbuf_size is guaranteed to be at least 4. */
567 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
568 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
569 DEBUG(0,("Invalid name length in session request\n"));
570 reply_called_name_not_present(outbuf);
571 break;
572 }
573 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
574 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
575 DEBUG(0,("Invalid name length in session request\n"));
576 reply_called_name_not_present(outbuf);
577 break;
578 }
579
580 name_type1 = name_extract((unsigned char *)inbuf,
581 inbuf_size,(unsigned int)4,name1);
582 name_type2 = name_extract((unsigned char *)inbuf,
583 inbuf_size,(unsigned int)(4 + name_len1),name2);
584
585 if (name_type1 == -1 || name_type2 == -1) {
586 DEBUG(0,("Invalid name type in session request\n"));
587 reply_called_name_not_present(outbuf);
588 break;
589 }
590
591 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
592 name1, name_type1, name2, name_type2));
593
594 if (netbios_session_retarget(sconn, name1, name_type1)) {
595 exit_server_cleanly("retargeted client");
596 }
597
598 /*
599 * Windows NT/2k uses "*SMBSERVER" and XP uses
600 * "*SMBSERV" arrggg!!!
601 */
602 if (strequal(name1, "*SMBSERVER ")
603 || strequal(name1, "*SMBSERV ")) {
604 char *raddr;
605
606 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
607 talloc_tos());
608 if (raddr == NULL) {
609 exit_server_cleanly("could not allocate raddr");
610 }
611
612 fstrcpy(name1, raddr);
613 }
614
615 set_local_machine_name(name1, True);
616 set_remote_machine_name(name2, True);
617
618 if (is_ipaddress(sconn->remote_hostname)) {
619 char *p = discard_const_p(char, sconn->remote_hostname);
620
621 talloc_free(p);
622
623 sconn->remote_hostname = talloc_strdup(sconn,
624 get_remote_machine_name());
625 if (sconn->remote_hostname == NULL) {
626 exit_server_cleanly("could not copy remote name");
627 }
628 sconn->conn->remote_hostname = sconn->remote_hostname;
629 }
630
631 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
632 get_local_machine_name(), get_remote_machine_name(),
633 name_type2));
634
635 if (name_type2 == 'R') {
636 /* We are being asked for a pathworks session ---
637 no thanks! */
638 reply_called_name_not_present(outbuf);
639 break;
640 }
641
642 reload_services(sconn, conn_snum_used, true);
643 reopen_logs();
644
645 sconn->nbt.got_session = true;
646 break;
647 }
648
649 case 0x89: /* session keepalive request
650 (some old clients produce this?) */
651 SCVAL(outbuf,0,NBSSkeepalive);
652 SCVAL(outbuf,3,0);
653 break;
654
655 case NBSSpositive: /* positive session response */
656 case NBSSnegative: /* negative session response */
657 case NBSSretarget: /* retarget session response */
658 DEBUG(0,("Unexpected session response\n"));
659 break;
660
661 case NBSSkeepalive: /* session keepalive */
662 default:
663 return;
664 }
665
666 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
667 msg_type, msg_flags));
668
669 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
670
671 if (CVAL(outbuf, 0) != 0x82) {
672 exit_server_cleanly("invalid netbios session");
673 }
674 return;
675 }
676
677 /****************************************************************************
678 Reply to a tcon.
679 conn POINTER CAN BE NULL HERE !
680 ****************************************************************************/
681
682 void reply_tcon(struct smb_request *req)
683 {
684 connection_struct *conn = req->conn;
685 const char *service;
686 char *service_buf = NULL;
687 char *password = NULL;
688 char *dev = NULL;
689 int pwlen=0;
690 NTSTATUS nt_status;
691 const char *p;
692 TALLOC_CTX *ctx = talloc_tos();
693 struct smbd_server_connection *sconn = req->sconn;
694 NTTIME now = timeval_to_nttime(&req->request_time);
695
696 START_PROFILE(SMBtcon);
697
698 if (req->buflen < 4) {
699 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
700 END_PROFILE(SMBtcon);
701 return;
702 }
703
704 p = (const char *)req->buf + 1;
705 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
706 p += 1;
707 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
708 p += pwlen+1;
709 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
710 p += 1;
711
712 if (service_buf == NULL || password == NULL || dev == NULL) {
713 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
714 END_PROFILE(SMBtcon);
715 return;
716 }
717 p = strrchr_m(service_buf,'\\');
718 if (p) {
719 service = p+1;
720 } else {
721 service = service_buf;
722 }
723
724 conn = make_connection(sconn, now, service, dev,
725 req->vuid,&nt_status);
726 req->conn = conn;
727
728 if (!conn) {
729 reply_nterror(req, nt_status);
730 END_PROFILE(SMBtcon);
731 return;
732 }
733
734 reply_outbuf(req, 2, 0);
735 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
736 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
737 SSVAL(req->outbuf,smb_tid,conn->cnum);
738
739 DEBUG(3,("tcon service=%s cnum=%d\n",
740 service, conn->cnum));
741
742 END_PROFILE(SMBtcon);
743 return;
744 }
745
746 /****************************************************************************
747 Reply to a tcon and X.
748 conn POINTER CAN BE NULL HERE !
749 ****************************************************************************/
750
751 void reply_tcon_and_X(struct smb_request *req)
752 {
753 connection_struct *conn = req->conn;
754 const char *service = NULL;
755 TALLOC_CTX *ctx = talloc_tos();
756 /* what the cleint thinks the device is */
757 char *client_devicetype = NULL;
758 /* what the server tells the client the share represents */
759 const char *server_devicetype;
760 NTSTATUS nt_status;
761 int passlen;
762 char *path = NULL;
763 const char *p, *q;
764 uint16_t tcon_flags;
765 struct smbXsrv_session *session = NULL;
766 NTTIME now = timeval_to_nttime(&req->request_time);
767 bool session_key_updated = false;
768 uint16_t optional_support = 0;
769 struct smbd_server_connection *sconn = req->sconn;
770
771 START_PROFILE(SMBtconX);
772
773 if (req->wct < 4) {
774 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
775 END_PROFILE(SMBtconX);
776 return;
777 }
778
779 passlen = SVAL(req->vwv+3, 0);
780 tcon_flags = SVAL(req->vwv+2, 0);
781
782 /* we might have to close an old one */
783 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
784 struct smbXsrv_tcon *tcon;
785 NTSTATUS status;
786
787 tcon = conn->tcon;
788 req->conn = NULL;
789 conn = NULL;
790
791 /*
792 * TODO: cancel all outstanding requests on the tcon
793 */
794 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
795 if (!NT_STATUS_IS_OK(status)) {
796 DEBUG(0, ("reply_tcon_and_X: "
797 "smbXsrv_tcon_disconnect() failed: %s\n",
798 nt_errstr(status)));
799 /*
800 * If we hit this case, there is something completely
801 * wrong, so we better disconnect the transport connection.
802 */
803 END_PROFILE(SMBtconX);
804 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
805 return;
806 }
807
808 TALLOC_FREE(tcon);
809 }
810
811 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
812 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
813 END_PROFILE(SMBtconX);
814 return;
815 }
816
817 if (sconn->smb1.negprot.encrypted_passwords) {
818 p = (const char *)req->buf + passlen;
819 } else {
820 p = (const char *)req->buf + passlen + 1;
821 }
822
823 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
824
825 if (path == NULL) {
826 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
827 END_PROFILE(SMBtconX);
828 return;
829 }
830
831 /*
832 * the service name can be either: \\server\share
833 * or share directly like on the DELL PowerVault 705
834 */
835 if (*path=='\\') {
836 q = strchr_m(path+2,'\\');
837 if (!q) {
838 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
839 END_PROFILE(SMBtconX);
840 return;
841 }
842 service = q+1;
843 } else {
844 service = path;
845 }
846
847 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
848 &client_devicetype, p,
849 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
850
851 if (client_devicetype == NULL) {
852 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
853 END_PROFILE(SMBtconX);
854 return;
855 }
856
857 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
858
859 nt_status = smb1srv_session_lookup(req->sconn->conn,
860 req->vuid, now, &session);
861 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
862 reply_force_doserror(req, ERRSRV, ERRbaduid);
863 END_PROFILE(SMBtconX);
864 return;
865 }
866 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
867 reply_nterror(req, nt_status);
868 END_PROFILE(SMBtconX);
869 return;
870 }
871 if (!NT_STATUS_IS_OK(nt_status)) {
872 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
873 END_PROFILE(SMBtconX);
874 return;
875 }
876
877 if (session->global->auth_session_info == NULL) {
878 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
879 END_PROFILE(SMBtconX);
880 return;
881 }
882
883 /*
884 * If there is no application key defined yet
885 * we create one.
886 *
887 * This means we setup the application key on the
888 * first tcon that happens via the given session.
889 *
890 * Once the application key is defined, it does not
891 * change any more.
892 */
893 if (session->global->application_key.length == 0 &&
894 session->global->signing_key.length > 0)
895 {
896 struct smbXsrv_session *x = session;
897 struct auth_session_info *session_info =
898 session->global->auth_session_info;
899 uint8_t session_key[16];
900
901 ZERO_STRUCT(session_key);
902 memcpy(session_key, x->global->signing_key.data,
903 MIN(x->global->signing_key.length, sizeof(session_key)));
904
905 /*
906 * The application key is truncated/padded to 16 bytes
907 */
908 x->global->application_key = data_blob_talloc(x->global,
909 session_key,
910 sizeof(session_key));
911 ZERO_STRUCT(session_key);
912 if (x->global->application_key.data == NULL) {
913 reply_nterror(req, NT_STATUS_NO_MEMORY);
914 END_PROFILE(SMBtconX);
915 return;
916 }
917
918 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
919 smb_key_derivation(x->global->application_key.data,
920 x->global->application_key.length,
921 x->global->application_key.data);
922 optional_support |= SMB_EXTENDED_SIGNATURES;
923 }
924
925 /*
926 * Place the application key into the session_info
927 */
928 data_blob_clear_free(&session_info->session_key);
929 session_info->session_key = data_blob_dup_talloc(session_info,
930 x->global->application_key);
931 if (session_info->session_key.data == NULL) {
932 data_blob_clear_free(&x->global->application_key);
933 reply_nterror(req, NT_STATUS_NO_MEMORY);
934 END_PROFILE(SMBtconX);
935 return;
936 }
937 session_key_updated = true;
938 }
939
940 conn = make_connection(sconn, now, service, client_devicetype,
941 req->vuid, &nt_status);
942 req->conn =conn;
943
944 if (!conn) {
945 if (session_key_updated) {
946 struct smbXsrv_session *x = session;
947 struct auth_session_info *session_info =
948 session->global->auth_session_info;
949 data_blob_clear_free(&x->global->application_key);
950 data_blob_clear_free(&session_info->session_key);
951 }
952 reply_nterror(req, nt_status);
953 END_PROFILE(SMBtconX);
954 return;
955 }
956
957 if ( IS_IPC(conn) )
958 server_devicetype = "IPC";
959 else if ( IS_PRINT(conn) )
960 server_devicetype = "LPT1:";
961 else
962 server_devicetype = "A:";
963
964 if (get_Protocol() < PROTOCOL_NT1) {
965 reply_outbuf(req, 2, 0);
966 if (message_push_string(&req->outbuf, server_devicetype,
967 STR_TERMINATE|STR_ASCII) == -1) {
968 reply_nterror(req, NT_STATUS_NO_MEMORY);
969 END_PROFILE(SMBtconX);
970 return;
971 }
972 } else {
973 /* NT sets the fstype of IPC$ to the null string */
974 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
975
976 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
977 /* Return permissions. */
978 uint32 perm1 = 0;
979 uint32 perm2 = 0;
980
981 reply_outbuf(req, 7, 0);
982
983 if (IS_IPC(conn)) {
984 perm1 = FILE_ALL_ACCESS;
985 perm2 = FILE_ALL_ACCESS;
986 } else {
987 perm1 = conn->share_access;
988 }
989
990 SIVAL(req->outbuf, smb_vwv3, perm1);
991 SIVAL(req->outbuf, smb_vwv5, perm2);
992 } else {
993 reply_outbuf(req, 3, 0);
994 }
995
996 if ((message_push_string(&req->outbuf, server_devicetype,
997 STR_TERMINATE|STR_ASCII) == -1)
998 || (message_push_string(&req->outbuf, fstype,
999 STR_TERMINATE) == -1)) {
1000 reply_nterror(req, NT_STATUS_NO_MEMORY);
1001 END_PROFILE(SMBtconX);
1002 return;
1003 }
1004
1005 /* what does setting this bit do? It is set by NT4 and
1006 may affect the ability to autorun mounted cdroms */
1007 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008 optional_support |=
1009 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012 DEBUG(2,("Serving %s as a Dfs root\n",
1013 lp_servicename(ctx, SNUM(conn)) ));
1014 optional_support |= SMB_SHARE_IN_DFS;
1015 }
1016
1017 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018 }
1019
1020 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1022
1023 DEBUG(3,("tconX service=%s \n",
1024 service));
1025
1026 /* set the incoming and outgoing tid to the just created one */
1027 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028 SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030 END_PROFILE(SMBtconX);
1031
1032 req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036 Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042 smb_fn_name(type), type, type));
1043 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044 return;
1045 }
1046
1047 /****************************************************************************
1048 Reply to an ioctl.
1049 conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054 connection_struct *conn = req->conn;
1055 uint16 device;
1056 uint16 function;
1057 uint32 ioctl_code;
1058 int replysize;
1059 char *p;
1060
1061 START_PROFILE(SMBioctl);
1062
1063 if (req->wct < 3) {
1064 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065 END_PROFILE(SMBioctl);
1066 return;
1067 }
1068
1069 device = SVAL(req->vwv+1, 0);
1070 function = SVAL(req->vwv+2, 0);
1071 ioctl_code = (device << 16) + function;
1072
1073 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075 switch (ioctl_code) {
1076 case IOCTL_QUERY_JOB_INFO:
1077 replysize = 32;
1078 break;
1079 default:
1080 reply_force_doserror(req, ERRSRV, ERRnosupport);
1081 END_PROFILE(SMBioctl);
1082 return;
1083 }
1084
1085 reply_outbuf(req, 8, replysize+1);
1086 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1089 p = smb_buf(req->outbuf);
1090 memset(p, '\0', replysize+1); /* valgrind-safe. */
1091 p += 1; /* Allow for alignment */
1092
1093 switch (ioctl_code) {
1094 case IOCTL_QUERY_JOB_INFO:
1095 {
1096 files_struct *fsp = file_fsp(
1097 req, SVAL(req->vwv+0, 0));
1098 if (!fsp) {
1099 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100 END_PROFILE(SMBioctl);
1101 return;
1102 }
1103 /* Job number */
1104 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107 lp_netbios_name(), 15,
1108 STR_TERMINATE|STR_ASCII);
1109 if (conn) {
1110 srvstr_push((char *)req->outbuf, req->flags2,
1111 p+18,
1112 lp_servicename(talloc_tos(),
1113 SNUM(conn)),
1114 13, STR_TERMINATE|STR_ASCII);
1115 } else {
1116 memset(p+18, 0, 13);
1117 }
1118 break;
1119 }
1120 }
1121
1122 END_PROFILE(SMBioctl);
1123 return;
1124 }
1125
1126 /****************************************************************************
1127 Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132 /* Strange DOS error code semantics only for checkpath... */
1133 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135 /* We need to map to ERRbadpath */
1136 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137 }
1138 }
1139 return status;
1140 }
1141
1142 /****************************************************************************
1143 Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148 connection_struct *conn = req->conn;
1149 struct smb_filename *smb_fname = NULL;
1150 char *name = NULL;
1151 NTSTATUS status;
1152 TALLOC_CTX *ctx = talloc_tos();
1153
1154 START_PROFILE(SMBcheckpath);
1155
1156 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157 STR_TERMINATE, &status);
1158
1159 if (!NT_STATUS_IS_OK(status)) {
1160 status = map_checkpath_error(req->flags2, status);
1161 reply_nterror(req, status);
1162 END_PROFILE(SMBcheckpath);
1163 return;
1164 }
1165
1166 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168 status = filename_convert(ctx,
1169 conn,
1170 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171 name,
1172 0,
1173 NULL,
1174 &smb_fname);
1175
1176 if (!NT_STATUS_IS_OK(status)) {
1177 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179 ERRSRV, ERRbadpath);
1180 END_PROFILE(SMBcheckpath);
1181 return;
1182 }
1183 goto path_err;
1184 }
1185
1186 if (!VALID_STAT(smb_fname->st) &&
1187 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189 smb_fname_str_dbg(smb_fname), strerror(errno)));
1190 status = map_nt_error_from_unix(errno);
1191 goto path_err;
1192 }
1193
1194 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196 ERRDOS, ERRbadpath);
1197 goto out;
1198 }
1199
1200 reply_outbuf(req, 0, 0);
1201
1202 path_err:
1203 /* We special case this - as when a Windows machine
1204 is parsing a path is steps through the components
1205 one at a time - if a component fails it expects
1206 ERRbadpath, not ERRbadfile.
1207 */
1208 status = map_checkpath_error(req->flags2, status);
1209 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210 /*
1211 * Windows returns different error codes if
1212 * the parent directory is valid but not the
1213 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215 * if the path is invalid.
1216 */
1217 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218 ERRDOS, ERRbadpath);
1219 goto out;
1220 }
1221
1222 reply_nterror(req, status);
1223
1224 out:
1225 TALLOC_FREE(smb_fname);
1226 END_PROFILE(SMBcheckpath);
1227 return;
1228 }
1229
1230 /****************************************************************************
1231 Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236 connection_struct *conn = req->conn;
1237 struct smb_filename *smb_fname = NULL;
1238 char *fname = NULL;
1239 int mode=0;
1240 off_t size=0;
1241 time_t mtime=0;
1242 const char *p;
1243 NTSTATUS status;
1244 TALLOC_CTX *ctx = talloc_tos();
1245 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247 START_PROFILE(SMBgetatr);
1248
1249 p = (const char *)req->buf + 1;
1250 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251 if (!NT_STATUS_IS_OK(status)) {
1252 reply_nterror(req, status);
1253 goto out;
1254 }
1255
1256 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257 under WfWg - weird! */
1258 if (*fname == '\0') {
1259 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260 if (!CAN_WRITE(conn)) {
1261 mode |= FILE_ATTRIBUTE_READONLY;
1262 }
1263 size = 0;
1264 mtime = 0;
1265 } else {
1266 status = filename_convert(ctx,
1267 conn,
1268 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269 fname,
1270 0,
1271 NULL,
1272 &smb_fname);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276 ERRSRV, ERRbadpath);
1277 goto out;
1278 }
1279 reply_nterror(req, status);
1280 goto out;
1281 }
1282 if (!VALID_STAT(smb_fname->st) &&
1283 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285 smb_fname_str_dbg(smb_fname),
1286 strerror(errno)));
1287 reply_nterror(req, map_nt_error_from_unix(errno));
1288 goto out;
1289 }
1290
1291 mode = dos_mode(conn, smb_fname);
1292 size = smb_fname->st.st_ex_size;
1293
1294 if (ask_sharemode) {
1295 struct timespec write_time_ts;
1296 struct file_id fileid;
1297
1298 ZERO_STRUCT(write_time_ts);
1299 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300 get_file_infos(fileid, 0, NULL, &write_time_ts);
1301 if (!null_timespec(write_time_ts)) {
1302 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303 }
1304 }
1305
1306 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308 size = 0;
1309 }
1310 }
1311
1312 reply_outbuf(req, 10, 0);
1313
1314 SSVAL(req->outbuf,smb_vwv0,mode);
1315 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317 } else {
1318 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319 }
1320 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322 if (get_Protocol() >= PROTOCOL_NT1) {
1323 SSVAL(req->outbuf, smb_flg2,
1324 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325 }
1326
1327 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330 out:
1331 TALLOC_FREE(smb_fname);
1332 TALLOC_FREE(fname);
1333 END_PROFILE(SMBgetatr);
1334 return;
1335 }
1336
1337 /****************************************************************************
1338 Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343 struct smb_file_time ft;
1344 connection_struct *conn = req->conn;
1345 struct smb_filename *smb_fname = NULL;
1346 char *fname = NULL;
1347 int mode;
1348 time_t mtime;
1349 const char *p;
1350 NTSTATUS status;
1351 TALLOC_CTX *ctx = talloc_tos();
1352
1353 START_PROFILE(SMBsetatr);
1354
1355 ZERO_STRUCT(ft);
1356
1357 if (req->wct < 2) {
1358 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359 goto out;
1360 }
1361
1362 p = (const char *)req->buf + 1;
1363 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 reply_nterror(req, status);
1366 goto out;
1367 }
1368
1369 status = filename_convert(ctx,
1370 conn,
1371 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372 fname,
1373 0,
1374 NULL,
1375 &smb_fname);
1376 if (!NT_STATUS_IS_OK(status)) {
1377 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379 ERRSRV, ERRbadpath);
1380 goto out;
1381 }
1382 reply_nterror(req, status);
1383 goto out;
1384 }
1385
1386 if (smb_fname->base_name[0] == '.' &&
1387 smb_fname->base_name[1] == '\0') {
1388 /*
1389 * Not sure here is the right place to catch this
1390 * condition. Might be moved to somewhere else later -- vl
1391 */
1392 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393 goto out;
1394 }
1395
1396 mode = SVAL(req->vwv+0, 0);
1397 mtime = srv_make_unix_date3(req->vwv+1);
1398
1399 if (mode != FILE_ATTRIBUTE_NORMAL) {
1400 if (VALID_STAT_OF_DIR(smb_fname->st))
1401 mode |= FILE_ATTRIBUTE_DIRECTORY;
1402 else
1403 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405 status = check_access(conn, NULL, smb_fname,
1406 FILE_WRITE_ATTRIBUTES);
1407 if (!NT_STATUS_IS_OK(status)) {
1408 reply_nterror(req, status);
1409 goto out;
1410 }
1411
1412 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413 false) != 0) {
1414 reply_nterror(req, map_nt_error_from_unix(errno));
1415 goto out;
1416 }
1417 }
1418
1419 ft.mtime = convert_time_t_to_timespec(mtime);
1420 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421 if (!NT_STATUS_IS_OK(status)) {
1422 reply_nterror(req, status);
1423 goto out;
1424 }
1425
1426 reply_outbuf(req, 0, 0);
1427
1428 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429 mode));
1430 out:
1431 TALLOC_FREE(smb_fname);
1432 END_PROFILE(SMBsetatr);
1433 return;
1434 }
1435
1436 /****************************************************************************
1437 Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442 connection_struct *conn = req->conn;
1443 uint64_t dfree,dsize,bsize;
1444 START_PROFILE(SMBdskattr);
1445
1446 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447 reply_nterror(req, map_nt_error_from_unix(errno));
1448 END_PROFILE(SMBdskattr);
1449 return;
1450 }
1451
1452 reply_outbuf(req, 5, 0);
1453
1454 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455 double total_space, free_space;
1456 /* we need to scale this to a number that DOS6 can handle. We
1457 use floating point so we can handle large drives on systems
1458 that don't have 64 bit integers
1459
1460 we end up displaying a maximum of 2G to DOS systems
1461 */
1462 total_space = dsize * (double)bsize;
1463 free_space = dfree * (double)bsize;
1464
1465 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471 SSVAL(req->outbuf,smb_vwv0,dsize);
1472 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474 SSVAL(req->outbuf,smb_vwv3,dfree);
1475 } else {
1476 SSVAL(req->outbuf,smb_vwv0,dsize);
1477 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478 SSVAL(req->outbuf,smb_vwv2,512);
1479 SSVAL(req->outbuf,smb_vwv3,dfree);
1480 }
1481
1482 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484 END_PROFILE(SMBdskattr);
1485 return;
1486 }
1487
1488 /*
1489 * Utility function to split the filename from the directory.
1490 */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492 char **fname_dir_out,
1493 char **fname_mask_out)
1494 {
1495 const char *p = NULL;
1496 char *fname_dir = NULL;
1497 char *fname_mask = NULL;
1498
1499 p = strrchr_m(fname_in, '/');
1500 if (!p) {
1501 fname_dir = talloc_strdup(ctx, ".");
1502 fname_mask = talloc_strdup(ctx, fname_in);
1503 } else {
1504 fname_dir = talloc_strndup(ctx, fname_in,
1505 PTR_DIFF(p, fname_in));
1506 fname_mask = talloc_strdup(ctx, p+1);
1507 }
1508
1509 if (!fname_dir || !fname_mask) {
1510 TALLOC_FREE(fname_dir);
1511 TALLOC_FREE(fname_mask);
1512 return NT_STATUS_NO_MEMORY;
1513 }
1514
1515 *fname_dir_out = fname_dir;
1516 *fname_mask_out = fname_mask;
1517 return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521 Reply to a search.
1522 Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527 connection_struct *conn = req->conn;
1528 char *path = NULL;
1529 const char *mask = NULL;
1530 char *directory = NULL;
1531 struct smb_filename *smb_fname = NULL;
1532 char *fname = NULL;
1533 off_t size;
1534 uint32 mode;
1535 struct timespec date;
1536 uint32 dirtype;
1537 unsigned int numentries = 0;
1538 unsigned int maxentries = 0;
1539 bool finished = False;
1540 const char *p;
1541 int status_len;
1542 char status[21];
1543 int dptr_num= -1;
1544 bool check_descend = False;
1545 bool expect_close = False;
1546 NTSTATUS nt_status;
1547 bool mask_contains_wcard = False;
1548 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549 TALLOC_CTX *ctx = talloc_tos();
1550 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551 struct dptr_struct *dirptr = NULL;
1552 struct smbd_server_connection *sconn = req->sconn;
1553
1554 START_PROFILE(SMBsearch);
1555
1556 if (req->wct < 2) {
1557 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558 goto out;
1559 }
1560
1561 if (lp_posix_pathnames()) {
1562 reply_unknown_new(req, req->cmd);
1563 goto out;
1564 }
1565
1566 /* If we were called as SMBffirst then we must expect close. */
1567 if(req->cmd == SMBffirst) {
1568 expect_close = True;
1569 }
1570
1571 reply_outbuf(req, 1, 3);
1572 maxentries = SVAL(req->vwv+0, 0);
1573 dirtype = SVAL(req->vwv+1, 0);
1574 p = (const char *)req->buf + 1;
1575 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576 &nt_status, &mask_contains_wcard);
1577 if (!NT_STATUS_IS_OK(nt_status)) {
1578 reply_nterror(req, nt_status);
1579 goto out;
1580 }
1581
1582 p++;
1583 status_len = SVAL(p, 0);
1584 p += 2;
1585
1586 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588 if (status_len == 0) {
1589 nt_status = filename_convert(ctx, conn,
1590 req->flags2 & FLAGS2_DFS_PATHNAMES,
1591 path,
1592 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593 &mask_contains_wcard,
1594 &smb_fname);
1595 if (!NT_STATUS_IS_OK(nt_status)) {
1596 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598 ERRSRV, ERRbadpath);
1599 goto out;
1600 }
1601 reply_nterror(req, nt_status);
1602 goto out;
1603 }
1604
1605 directory = smb_fname->base_name;
1606
1607 p = strrchr_m(directory,'/');
1608 if ((p != NULL) && (*directory != '/')) {
1609 mask = p + 1;
1610 directory = talloc_strndup(ctx, directory,
1611 PTR_DIFF(p, directory));
1612 } else {
1613 mask = directory;
1614 directory = talloc_strdup(ctx,".");
1615 }
1616
1617 if (!directory) {
1618 reply_nterror(req, NT_STATUS_NO_MEMORY);
1619 goto out;
1620 }
1621
1622 memset((char *)status,'\0',21);
1623 SCVAL(status,0,(dirtype & 0x1F));
1624
1625 nt_status = dptr_create(conn,
1626 NULL, /* req */
1627 NULL, /* fsp */
1628 directory,
1629 True,
1630 expect_close,
1631 req->smbpid,
1632 mask,
1633 mask_contains_wcard,
1634 dirtype,
1635 &dirptr);
1636 if (!NT_STATUS_IS_OK(nt_status)) {
1637 reply_nterror(req, nt_status);
1638 goto out;
1639 }
1640 dptr_num = dptr_dnum(dirptr);
1641 } else {
1642 int status_dirtype;
1643 const char *dirpath;
1644
1645 memcpy(status,p,21);
1646 status_dirtype = CVAL(status,0) & 0x1F;
1647 if (status_dirtype != (dirtype & 0x1F)) {
1648 dirtype = status_dirtype;
1649 }
1650
1651 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652 if (!dirptr) {
1653 goto SearchEmpty;
1654 }
1655 dirpath = dptr_path(sconn, dptr_num);
1656 directory = talloc_strdup(ctx, dirpath);
1657 if (!directory) {
1658 reply_nterror(req, NT_STATUS_NO_MEMORY);
1659 goto out;
1660 }
1661
1662 mask = dptr_wcard(sconn, dptr_num);
1663 if (!mask) {
1664 goto SearchEmpty;
1665 }
1666 /*
1667 * For a 'continue' search we have no string. So
1668 * check from the initial saved string.
1669 */
1670 mask_contains_wcard = ms_has_wild(mask);
1671 dirtype = dptr_attr(sconn, dptr_num);
1672 }
1673
1674 DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677 dptr_init_search_op(dirptr);
1678
1679 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680 char buf[DIR_STRUCT_SIZE];
1681 memcpy(buf,status,21);
1682 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684 reply_nterror(req, NT_STATUS_NO_MEMORY);
1685 goto out;
1686 }
1687 dptr_fill(sconn, buf+12,dptr_num);
1688 if (dptr_zero(buf+12) && (status_len==0)) {
1689 numentries = 1;
1690 } else {
1691 numentries = 0;
1692 }
1693 if (message_push_blob(&req->outbuf,
1694 data_blob_const(buf, sizeof(buf)))
1695 == -1) {
1696 reply_nterror(req, NT_STATUS_NO_MEMORY);
1697 goto out;
1698 }
1699 } else {
1700 unsigned int i;
1701 maxentries = MIN(
1702 maxentries,
1703 ((BUFFER_SIZE -
1704 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1705 /DIR_STRUCT_SIZE));
1706
1707 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1708 directory,lp_dontdescend(ctx, SNUM(conn))));
1709 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1710 check_descend = True;
1711 }
1712
1713 for (i=numentries;(i<maxentries) && !finished;i++) {
1714 finished = !get_dir_entry(ctx,
1715 dirptr,
1716 mask,
1717 dirtype,
1718 &fname,
1719 &size,
1720 &mode,
1721 &date,
1722 check_descend,
1723 ask_sharemode);
1724 if (!finished) {
1725 char buf[DIR_STRUCT_SIZE];
1726 memcpy(buf,status,21);
1727 if (!make_dir_struct(ctx,
1728 buf,
1729 mask,
1730 fname,
1731 size,
1732 mode,
1733 convert_timespec_to_time_t(date),
1734 !allow_long_path_components)) {
1735 reply_nterror(req, NT_STATUS_NO_MEMORY);
1736 goto out;
1737 }
1738 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1739 break;
1740 }
1741 if (message_push_blob(&req->outbuf,
1742 data_blob_const(buf, sizeof(buf)))
1743 == -1) {
1744 reply_nterror(req, NT_STATUS_NO_MEMORY);
1745 goto out;
1746 }
1747 numentries++;
1748 }
1749 }
1750 }
1751
1752 SearchEmpty:
1753
1754 /* If we were called as SMBffirst with smb_search_id == NULL
1755 and no entries were found then return error and close dirptr
1756 (X/Open spec) */
1757
1758 if (numentries == 0) {
1759 dptr_close(sconn, &dptr_num);
1760 } else if(expect_close && status_len == 0) {
1761 /* Close the dptr - we know it's gone */
1762 dptr_close(sconn, &dptr_num);
1763 }
1764
1765 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1766 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1767 dptr_close(sconn, &dptr_num);
1768 }
1769
1770 if ((numentries == 0) && !mask_contains_wcard) {
1771 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1772 goto out;
1773 }
1774
1775 SSVAL(req->outbuf,smb_vwv0,numentries);
1776 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1777 SCVAL(smb_buf(req->outbuf),0,5);
1778 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1779
1780 /* The replies here are never long name. */
1781 SSVAL(req->outbuf, smb_flg2,
1782 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1783 if (!allow_long_path_components) {
1784 SSVAL(req->outbuf, smb_flg2,
1785 SVAL(req->outbuf, smb_flg2)
1786 & (~FLAGS2_LONG_PATH_COMPONENTS));
1787 }
1788
1789 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1790 SSVAL(req->outbuf, smb_flg2,
1791 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1792
1793 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1794 smb_fn_name(req->cmd),
1795 mask,
1796 directory,
1797 dirtype,
1798 numentries,
1799 maxentries ));
1800 out:
1801 TALLOC_FREE(directory);
1802 TALLOC_FREE(smb_fname);
1803 END_PROFILE(SMBsearch);
1804 return;
1805 }
1806
1807 /****************************************************************************
1808 Reply to a fclose (stop directory search).
1809 ****************************************************************************/
1810
1811 void reply_fclose(struct smb_request *req)
1812 {
1813 int status_len;
1814 char status[21];
1815 int dptr_num= -2;
1816 const char *p;
1817 char *path = NULL;
1818 NTSTATUS err;
1819 bool path_contains_wcard = False;
1820 TALLOC_CTX *ctx = talloc_tos();
1821 struct smbd_server_connection *sconn = req->sconn;
1822
1823 START_PROFILE(SMBfclose);
1824
1825 if (lp_posix_pathnames()) {
1826 reply_unknown_new(req, req->cmd);
1827 END_PROFILE(SMBfclose);
1828 return;
1829 }
1830
1831 p = (const char *)req->buf + 1;
1832 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1833 &err, &path_contains_wcard);
1834 if (!NT_STATUS_IS_OK(err)) {
1835 reply_nterror(req, err);
1836 END_PROFILE(SMBfclose);
1837 return;
1838 }
1839 p++;
1840 status_len = SVAL(p,0);
1841 p += 2;
1842
1843 if (status_len == 0) {
1844 reply_force_doserror(req, ERRSRV, ERRsrverror);
1845 END_PROFILE(SMBfclose);
1846 return;
1847 }
1848
1849 memcpy(status,p,21);
1850
1851 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1852 /* Close the dptr - we know it's gone */
1853 dptr_close(sconn, &dptr_num);
1854 }
1855
1856 reply_outbuf(req, 1, 0);
1857 SSVAL(req->outbuf,smb_vwv0,0);
1858
1859 DEBUG(3,("search close\n"));
1860
1861 END_PROFILE(SMBfclose);
1862 return;
1863 }
1864
1865 /****************************************************************************
1866 Reply to an open.
1867 ****************************************************************************/
1868
1869 void reply_open(struct smb_request *req)
1870 {
1871 connection_struct *conn = req->conn;
1872 struct smb_filename *smb_fname = NULL;
1873 char *fname = NULL;
1874 uint32 fattr=0;
1875 off_t size = 0;
1876 time_t mtime=0;
1877 int info;
1878 files_struct *fsp;
1879 int oplock_request;
1880 int deny_mode;
1881 uint32 dos_attr;
1882 uint32 access_mask;
1883 uint32 share_mode;
1884 uint32 create_disposition;
1885 uint32 create_options = 0;
1886 uint32_t private_flags = 0;
1887 NTSTATUS status;
1888 TALLOC_CTX *ctx = talloc_tos();
1889
1890 START_PROFILE(SMBopen);
1891
1892 if (req->wct < 2) {
1893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1894 goto out;
1895 }
1896
1897 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1898 deny_mode = SVAL(req->vwv+0, 0);
1899 dos_attr = SVAL(req->vwv+1, 0);
1900
1901 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1902 STR_TERMINATE, &status);
1903 if (!NT_STATUS_IS_OK(status)) {
1904 reply_nterror(req, status);
1905 goto out;
1906 }
1907
1908 if (!map_open_params_to_ntcreate(fname, deny_mode,
1909 OPENX_FILE_EXISTS_OPEN, &access_mask,
1910 &share_mode, &create_disposition,
1911 &create_options, &private_flags)) {
1912 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1913 goto out;
1914 }
1915
1916 status = filename_convert(ctx,
1917 conn,
1918 req->flags2 & FLAGS2_DFS_PATHNAMES,
1919 fname,
1920 (create_disposition == FILE_CREATE)
1921 ? UCF_CREATING_FILE : 0,
1922 NULL,
1923 &smb_fname);
1924 if (!NT_STATUS_IS_OK(status)) {
1925 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1926 reply_botherror(req,
1927 NT_STATUS_PATH_NOT_COVERED,
1928 ERRSRV, ERRbadpath);
1929 goto out;
1930 }
1931 reply_nterror(req, status);
1932 goto out;
1933 }
1934
1935 status = SMB_VFS_CREATE_FILE(
1936 conn, /* conn */
1937 req, /* req */
1938 0, /* root_dir_fid */
1939 smb_fname, /* fname */
1940 access_mask, /* access_mask */
1941 share_mode, /* share_access */
1942 create_disposition, /* create_disposition*/
1943 create_options, /* create_options */
1944 dos_attr, /* file_attributes */
1945 oplock_request, /* oplock_request */
1946 0, /* allocation_size */
1947 private_flags,
1948 NULL, /* sd */
1949 NULL, /* ea_list */
1950 &fsp, /* result */
1951 &info); /* pinfo */
1952
1953 if (!NT_STATUS_IS_OK(status)) {
1954 if (open_was_deferred(req->sconn, req->mid)) {
1955 /* We have re-scheduled this call. */
1956 goto out;
1957 }
1958 reply_openerror(req, status);
1959 goto out;
1960 }
1961
1962 /* Ensure we're pointing at the correct stat struct. */
1963 TALLOC_FREE(smb_fname);
1964 smb_fname = fsp->fsp_name;
1965
1966 size = smb_fname->st.st_ex_size;
1967 fattr = dos_mode(conn, smb_fname);
1968
1969 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1970
1971 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1972 DEBUG(3,("attempt to open a directory %s\n",
1973 fsp_str_dbg(fsp)));
1974 close_file(req, fsp, ERROR_CLOSE);
1975 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1976 ERRDOS, ERRnoaccess);
1977 goto out;
1978 }
1979
1980 reply_outbuf(req, 7, 0);
1981 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1982 SSVAL(req->outbuf,smb_vwv1,fattr);
1983 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1984 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1985 } else {
1986 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1987 }
1988 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1989 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1990
1991 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1992 SCVAL(req->outbuf,smb_flg,
1993 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1994 }
1995
1996 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1997 SCVAL(req->outbuf,smb_flg,
1998 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1999 }
2000 out:
2001 END_PROFILE(SMBopen);
2002 return;
2003 }
2004
2005 /****************************************************************************
2006 Reply to an open and X.
2007 ****************************************************************************/
2008
2009 void reply_open_and_X(struct smb_request *req)
2010 {
2011 connection_struct *conn = req->conn;
2012 struct smb_filename *smb_fname = NULL;
2013 char *fname = NULL;
2014 uint16 open_flags;
2015 int deny_mode;
2016 uint32 smb_attr;
2017 /* Breakout the oplock request bits so we can set the
2018 reply bits separately. */
2019 int ex_oplock_request;
2020 int core_oplock_request;
2021 int oplock_request;
2022 #if 0
2023 int smb_sattr = SVAL(req->vwv+4, 0);
2024 uint32 smb_time = make_unix_date3(req->vwv+6);
2025 #endif
2026 int smb_ofun;
2027 uint32 fattr=0;
2028 int mtime=0;
2029 int smb_action = 0;
2030 files_struct *fsp;
2031 NTSTATUS status;
2032 uint64_t allocation_size;
2033 ssize_t retval = -1;
2034 uint32 access_mask;
2035 uint32 share_mode;
2036 uint32 create_disposition;
2037 uint32 create_options = 0;
2038 uint32_t private_flags = 0;
2039 TALLOC_CTX *ctx = talloc_tos();
2040
2041 START_PROFILE(SMBopenX);
2042
2043 if (req->wct < 15) {
2044 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2045 goto out;
2046 }
2047
2048 open_flags = SVAL(req->vwv+2, 0);
2049 deny_mode = SVAL(req->vwv+3, 0);
2050 smb_attr = SVAL(req->vwv+5, 0);
2051 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2052 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2053 oplock_request = ex_oplock_request | core_oplock_request;
2054 smb_ofun = SVAL(req->vwv+8, 0);
2055 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2056
2057 /* If it's an IPC, pass off the pipe handler. */
2058 if (IS_IPC(conn)) {
2059 if (lp_nt_pipe_support()) {
2060 reply_open_pipe_and_X(conn, req);
2061 } else {
2062 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2063 }
2064 goto out;
2065 }
2066
2067 /* XXXX we need to handle passed times, sattr and flags */
2068 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2069 STR_TERMINATE, &status);
2070 if (!NT_STATUS_IS_OK(status)) {
2071 reply_nterror(req, status);
2072 goto out;
2073 }
2074
2075 if (!map_open_params_to_ntcreate(fname, deny_mode,
2076 smb_ofun,
2077 &access_mask, &share_mode,
2078 &create_disposition,
2079 &create_options,
2080 &private_flags)) {
2081 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2082 goto out;
2083 }
2084
2085 status = filename_convert(ctx,
2086 conn,
2087 req->flags2 & FLAGS2_DFS_PATHNAMES,
2088 fname,
2089 (create_disposition == FILE_CREATE)
2090 ? UCF_CREATING_FILE : 0,
2091 NULL,
2092 &smb_fname);
2093 if (!NT_STATUS_IS_OK(status)) {
2094 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2095 reply_botherror(req,
2096 NT_STATUS_PATH_NOT_COVERED,
2097 ERRSRV, ERRbadpath);
2098 goto out;
2099 }
2100 reply_nterror(req, status);
2101 goto out;
2102 }
2103
2104 status = SMB_VFS_CREATE_FILE(
2105 conn, /* conn */
2106 req, /* req */
2107 0, /* root_dir_fid */
2108 smb_fname, /* fname */
2109 access_mask, /* access_mask */
2110 share_mode, /* share_access */
2111 create_disposition, /* create_disposition*/
2112 create_options, /* create_options */
2113 smb_attr, /* file_attributes */
2114 oplock_request, /* oplock_request */
2115 0, /* allocation_size */
2116 private_flags,
2117 NULL, /* sd */
2118 NULL, /* ea_list */
2119 &fsp, /* result */
2120 &smb_action); /* pinfo */
2121
2122 if (!NT_STATUS_IS_OK(status)) {
2123 if (open_was_deferred(req->sconn, req->mid)) {
2124 /* We have re-scheduled this call. */
2125 goto out;
2126 }
2127 reply_openerror(req, status);
2128 goto out;
2129 }
2130
2131 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2132 if the file is truncated or created. */
2133 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2134 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2135 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2136 close_file(req, fsp, ERROR_CLOSE);
2137 reply_nterror(req, NT_STATUS_DISK_FULL);
2138 goto out;
2139 }
2140 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2141 if (retval < 0) {
2142 close_file(req, fsp, ERROR_CLOSE);
2143 reply_nterror(req, NT_STATUS_DISK_FULL);
2144 goto out;
2145 }
2146 status = vfs_stat_fsp(fsp);
2147 if (!NT_STATUS_IS_OK(status)) {
2148 close_file(req, fsp, ERROR_CLOSE);
2149 reply_nterror(req, status);
2150 goto out;
2151 }
2152 }
2153
2154 fattr = dos_mode(conn, fsp->fsp_name);
2155 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2156 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2157 close_file(req, fsp, ERROR_CLOSE);
2158 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2159 goto out;
2160 }
2161
2162 /* If the caller set the extended oplock request bit
2163 and we granted one (by whatever means) - set the
2164 correct bit for extended oplock reply.
2165 */
2166
2167 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2168 smb_action |= EXTENDED_OPLOCK_GRANTED;
2169 }
2170
2171 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2172 smb_action |= EXTENDED_OPLOCK_GRANTED;
2173 }
2174
2175 /* If the caller set the core oplock request bit
2176 and we granted one (by whatever means) - set the
2177 correct bit for core oplock reply.
2178 */
2179
2180 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2181 reply_outbuf(req, 19, 0);
2182 } else {
2183 reply_outbuf(req, 15, 0);
2184 }
2185
2186 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2187 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2188
2189 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2190 SCVAL(req->outbuf, smb_flg,
2191 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2192 }
2193
2194 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2195 SCVAL(req->outbuf, smb_flg,
2196 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2197 }
2198
2199 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2200 SSVAL(req->outbuf,smb_vwv3,fattr);
2201 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2202 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2203 } else {
2204 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2205 }
2206 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2207 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2208 SSVAL(req->outbuf,smb_vwv11,smb_action);
2209
2210 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2211 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2212 }
2213
2214 out:
2215 TALLOC_FREE(smb_fname);
2216 END_PROFILE(SMBopenX);
2217 return;
2218 }
2219
2220 /****************************************************************************
2221 Reply to a SMBulogoffX.
2222 ****************************************************************************/
2223
2224 void reply_ulogoffX(struct smb_request *req)
2225 {
2226 struct smbd_server_connection *sconn = req->sconn;
2227 struct user_struct *vuser;
2228 struct smbXsrv_session *session = NULL;
2229 NTSTATUS status;
2230
2231 START_PROFILE(SMBulogoffX);
2232
2233 vuser = get_valid_user_struct(sconn, req->vuid);
2234
2235 if(vuser == NULL) {
2236 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2237 (unsigned long long)req->vuid));
2238
2239 req->vuid = UID_FIELD_INVALID;
2240 reply_force_doserror(req, ERRSRV, ERRbaduid);
2241 END_PROFILE(SMBulogoffX);
2242 return;
2243 }
2244
2245 session = vuser->session;
2246 vuser = NULL;
2247
2248 /*
2249 * TODO: cancel all outstanding requests on the session
2250 */
2251 status = smbXsrv_session_logoff(session);
2252 if (!NT_STATUS_IS_OK(status)) {
2253 DEBUG(0, ("reply_ulogoff: "
2254 "smbXsrv_session_logoff() failed: %s\n",
2255 nt_errstr(status)));
2256 /*
2257 * If we hit this case, there is something completely
2258 * wrong, so we better disconnect the transport connection.
2259 */
2260 END_PROFILE(SMBulogoffX);
2261 exit_server(__location__ ": smbXsrv_session_logoff failed");
2262 return;
2263 }
2264
2265 TALLOC_FREE(session);
2266
2267 reply_outbuf(req, 2, 0);
2268 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2269 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2270
2271 DEBUG(3, ("ulogoffX vuid=%llu\n",
2272 (unsigned long long)req->vuid));
2273
2274 END_PROFILE(SMBulogoffX);
2275 req->vuid = UID_FIELD_INVALID;
2276 }
2277
2278 /****************************************************************************
2279 Reply to a mknew or a create.
2280 ****************************************************************************/
2281
2282 void reply_mknew(struct smb_request *req)
2283 {
2284 connection_struct *conn = req->conn;
2285 struct smb_filename *smb_fname = NULL;
2286 char *fname = NULL;
2287 uint32 fattr = 0;
2288 struct smb_file_time ft;
2289 files_struct *fsp;
2290 int oplock_request = 0;
2291 NTSTATUS status;
2292 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2293 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2294 uint32 create_disposition;
2295 uint32 create_options = 0;
2296 TALLOC_CTX *ctx = talloc_tos();
2297
2298 START_PROFILE(SMBcreate);
2299 ZERO_STRUCT(ft);
2300
2301 if (req->wct < 3) {
2302 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2303 goto out;
2304 }
2305
2306 fattr = SVAL(req->vwv+0, 0);
2307 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2308
2309 /* mtime. */
2310 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2311
2312 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2313 STR_TERMINATE, &status);
2314 if (!NT_STATUS_IS_OK(status)) {
2315 reply_nterror(req, status);
2316 goto out;
2317 }
2318
2319 status = filename_convert(ctx,
2320 conn,
2321 req->flags2 & FLAGS2_DFS_PATHNAMES,
2322 fname,
2323 UCF_CREATING_FILE,
2324 NULL,
2325 &smb_fname);
2326 if (!NT_STATUS_IS_OK(status)) {
2327 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2328 reply_botherror(req,
2329 NT_STATUS_PATH_NOT_COVERED,
2330 ERRSRV, ERRbadpath);
2331 goto out;
2332 }
2333 reply_nterror(req, status);
2334 goto out;
2335 }
2336
2337 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2338 DEBUG(0,("Attempt to create file (%s) with volid set - "
2339 "please report this\n",
2340 smb_fname_str_dbg(smb_fname)));
2341 }
2342
2343 if(req->cmd == SMBmknew) {
2344 /* We should fail if file exists. */
2345 create_disposition = FILE_CREATE;
2346 } else {
2347 /* Create if file doesn't exist, truncate if it does. */
2348 create_disposition = FILE_OVERWRITE_IF;
2349 }
2350
2351 status = SMB_VFS_CREATE_FILE(
2352 conn, /* conn */
2353 req, /* req */
2354 0, /* root_dir_fid */
2355 smb_fname, /* fname */
2356 access_mask, /* access_mask */
2357 share_mode, /* share_access */
2358 create_disposition, /* create_disposition*/
2359 create_options, /* create_options */
2360 fattr, /* file_attributes */
2361 oplock_request, /* oplock_request */
2362 0, /* allocation_size */
2363 0, /* private_flags */
2364 NULL, /* sd */
2365 NULL, /* ea_list */
2366 &fsp, /* result */
2367 NULL); /* pinfo */
2368
2369 if (!NT_STATUS_IS_OK(status)) {
2370 if (open_was_deferred(req->sconn, req->mid)) {
2371 /* We have re-scheduled this call. */
2372 goto out;
2373 }
2374 reply_openerror(req, status);
2375 goto out;
2376 }
2377
2378 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2379 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2380 if (!NT_STATUS_IS_OK(status)) {
2381 END_PROFILE(SMBcreate);
2382 goto out;
2383 }
2384
2385 reply_outbuf(req, 1, 0);
2386 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2387
2388 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2389 SCVAL(req->outbuf,smb_flg,
2390 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2391 }
2392
2393 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2394 SCVAL(req->outbuf,smb_flg,
2395 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2396 }
2397
2398 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2399 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2400 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2401 (unsigned int)fattr));
2402
2403 out:
2404 TALLOC_FREE(smb_fname);
2405 END_PROFILE(SMBcreate);
2406 return;
2407 }
2408
2409 /****************************************************************************
2410 Reply to a create temporary file.
2411 ****************************************************************************/
2412
2413 void reply_ctemp(struct smb_request *req)
2414 {
2415 connection_struct *conn = req->conn;
2416 struct smb_filename *smb_fname = NULL;
2417 char *wire_name = NULL;
2418 char *fname = NULL;
2419 uint32 fattr;
2420 files_struct *fsp;
2421 int oplock_request;
2422 char *s;
2423 NTSTATUS status;
2424 int i;
2425 TALLOC_CTX *ctx = talloc_tos();
2426
2427 START_PROFILE(SMBctemp);
2428
2429 if (req->wct < 3) {
2430 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2431 goto out;
2432 }
2433
2434 fattr = SVAL(req->vwv+0, 0);
2435 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2436
2437 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2438 STR_TERMINATE, &status);
2439 if (!NT_STATUS_IS_OK(status)) {
2440 reply_nterror(req, status);
2441 goto out;
2442 }
2443
2444 for (i = 0; i < 10; i++) {
2445 if (*wire_name) {
2446 fname = talloc_asprintf(ctx,
2447 "%s/TMP%s",
2448 wire_name,
2449 generate_random_str_list(ctx, 5, "0123456789"));
2450 } else {
2451 fname = talloc_asprintf(ctx,
2452 "TMP%s",
2453 generate_random_str_list(ctx, 5, "0123456789"));
2454 }
2455
2456 if (!fname) {
2457 reply_nterror(req, NT_STATUS_NO_MEMORY);
2458 goto out;
2459 }
2460
2461 status = filename_convert(ctx, conn,
2462 req->flags2 & FLAGS2_DFS_PATHNAMES,
2463 fname,
2464 UCF_CREATING_FILE,
2465 NULL,
2466 &smb_fname);
2467 if (!NT_STATUS_IS_OK(status)) {
2468 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2469 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2470 ERRSRV, ERRbadpath);
2471 goto out;
2472 }
2473 reply_nterror(req, status);
2474 goto out;
2475 }
2476
2477 /* Create the file. */
2478 status = SMB_VFS_CREATE_FILE(
2479 conn, /* conn */
2480 req, /* req */
2481 0, /* root_dir_fid */
2482 smb_fname, /* fname */
2483 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2484 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2485 FILE_CREATE, /* create_disposition*/
2486 0, /* create_options */
2487 fattr, /* file_attributes */
2488 oplock_request, /* oplock_request */
2489 0, /* allocation_size */
2490 0, /* private_flags */
2491 NULL, /* sd */
2492 NULL, /* ea_list */
2493 &fsp, /* result */
2494 NULL); /* pinfo */
2495
2496 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2497 TALLOC_FREE(fname);
2498 TALLOC_FREE(smb_fname);
2499 continue;
2500 }
2501
2502 if (!NT_STATUS_IS_OK(status)) {
2503 if (open_was_deferred(req->sconn, req->mid)) {
2504 /* We have re-scheduled this call. */
2505 goto out;
2506 }
2507 reply_openerror(req, status);
2508 goto out;
2509 }
2510
2511 break;
2512 }
2513
2514 if (i == 10) {
2515 /* Collision after 10 times... */
2516 reply_nterror(req, status);
2517 goto out;
2518 }
2519
2520 reply_outbuf(req, 1, 0);
2521 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2522
2523 /* the returned filename is relative to the directory */
2524 s = strrchr_m(fsp->fsp_name->base_name, '/');
2525 if (!s) {
2526 s = fsp->fsp_name->base_name;
2527 } else {
2528 s++;
2529 }
2530
2531 #if 0
2532 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2533 thing in the byte section. JRA */
2534 SSVALS(p, 0, -1); /* what is this? not in spec */
2535 #endif
2536 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2537 == -1) {
2538 reply_nterror(req, NT_STATUS_NO_MEMORY);
2539 goto out;
2540 }
2541
2542 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2543 SCVAL(req->outbuf, smb_flg,
2544 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2545 }
2546
2547 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2548 SCVAL(req->outbuf, smb_flg,
2549 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2550 }
2551
2552 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2553 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2554 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2555 out:
2556 TALLOC_FREE(smb_fname);
2557 TALLOC_FREE(wire_name);
2558 END_PROFILE(SMBctemp);
2559 return;
2560 }
2561
2562 /*******************************************************************
2563 Check if a user is allowed to rename a file.
2564 ********************************************************************/
2565
2566 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2567 uint16 dirtype)
2568 {
2569 if (!CAN_WRITE(conn)) {
2570 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2571 }
2572
2573 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2574 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2575 /* Only bother to read the DOS attribute if we might deny the
2576 rename on the grounds of attribute missmatch. */
2577 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2578 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2579 return NT_STATUS_NO_SUCH_FILE;
2580 }
2581 }
2582
2583 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2584 if (fsp->posix_open) {
2585 return NT_STATUS_OK;
2586 }
2587
2588 /* If no pathnames are open below this
2589 directory, allow the rename. */
2590
2591 if (file_find_subpath(fsp)) {
2592 return NT_STATUS_ACCESS_DENIED;
2593 }
2594 return NT_STATUS_OK;
2595 }
2596
2597 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2598 return NT_STATUS_OK;
2599 }
2600
2601 return NT_STATUS_ACCESS_DENIED;
2602 }
2603
2604 /*******************************************************************
2605 * unlink a file with all relevant access checks
2606 *******************************************************************/
2607
2608 static NTSTATUS do_unlink(connection_struct *conn,
2609 struct smb_request *req,
2610 struct smb_filename *smb_fname,
2611 uint32 dirtype)
2612 {
2613 uint32 fattr;
2614 files_struct *fsp;
2615 uint32 dirtype_orig = dirtype;
2616 NTSTATUS status;
2617 int ret;
2618 bool posix_paths = lp_posix_pathnames();
2619
2620 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2621 smb_fname_str_dbg(smb_fname),
2622 dirtype));
2623
2624 if (!CAN_WRITE(conn)) {
2625 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2626 }
2627
2628 if (posix_paths) {
2629 ret = SMB_VFS_LSTAT(conn, smb_fname);
2630 } else {
2631 ret = SMB_VFS_STAT(conn, smb_fname);
2632 }
2633 if (ret != 0) {
2634 return map_nt_error_from_unix(errno);
2635 }
2636
2637 fattr = dos_mode(conn, smb_fname);
2638
2639 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2640 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2641 }
2642
2643 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2644 if (!dirtype) {
2645 return NT_STATUS_NO_SUCH_FILE;
2646 }
2647
2648 if (!dir_check_ftype(fattr, dirtype)) {
2649 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2650 return NT_STATUS_FILE_IS_A_DIRECTORY;
2651 }
2652 return NT_STATUS_NO_SUCH_FILE;
2653 }
2654
2655 if (dirtype_orig & 0x8000) {
2656 /* These will never be set for POSIX. */
2657 return NT_STATUS_NO_SUCH_FILE;
2658 }
2659
2660 #if 0
2661 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2662 return NT_STATUS_FILE_IS_A_DIRECTORY;
2663 }
2664
2665 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2666 return NT_STATUS_NO_SUCH_FILE;
2667 }
2668
2669 if (dirtype & 0xFF00) {
2670 /* These will never be set for POSIX. */
2671 return NT_STATUS_NO_SUCH_FILE;
2672 }
2673
2674 dirtype &= 0xFF;
2675 if (!dirtype) {
2676 return NT_STATUS_NO_SUCH_FILE;
2677 }
2678
2679 /* Can't delete a directory. */
2680 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2681 return NT_STATUS_FILE_IS_A_DIRECTORY;
2682 }
2683 #endif
2684
2685 #if 0 /* JRATEST */
2686 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2687 return NT_STATUS_OBJECT_NAME_INVALID;
2688 #endif /* JRATEST */
2689
2690 /* On open checks the open itself will check the share mode, so
2691 don't do it here as we'll get it wrong. */
2692
2693 status = SMB_VFS_CREATE_FILE
2694 (conn, /* conn */
2695 req, /* req */
2696 0, /* root_dir_fid */
2697 smb_fname, /* fname */
2698 DELETE_ACCESS, /* access_mask */
2699 FILE_SHARE_NONE, /* share_access */
2700 FILE_OPEN, /* create_disposition*/
2701 FILE_NON_DIRECTORY_FILE, /* create_options */
2702 /* file_attributes */
2703 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2704 FILE_ATTRIBUTE_NORMAL,
2705 0, /* oplock_request */
2706 0, /* allocation_size */
2707 0, /* private_flags */
2708 NULL, /* sd */
2709 NULL, /* ea_list */
2710 &fsp, /* result */
2711 NULL); /* pinfo */
2712
2713 if (!NT_STATUS_IS_OK(status)) {
2714 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2715 nt_errstr(status)));
2716 return status;
2717 }
2718
2719 status = can_set_delete_on_close(fsp, fattr);
2720 if (!NT_STATUS_IS_OK(status)) {
2721 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2722 "(%s)\n",
2723 smb_fname_str_dbg(smb_fname),
2724 nt_errstr(status)));
2725 close_file(req, fsp, NORMAL_CLOSE);
2726 return status;
2727 }
2728
2729 /* The set is across all open files on this dev/inode pair. */
2730 if (!set_delete_on_close(fsp, True,
2731 conn->session_info->security_token,
2732 conn->session_info->unix_token)) {
2733 close_file(req, fsp, NORMAL_CLOSE);
2734 return NT_STATUS_ACCESS_DENIED;
2735 }
2736
2737 return close_file(req, fsp, NORMAL_CLOSE);
2738 }
2739
2740 /****************************************************************************
2741 The guts of the unlink command, split out so it may be called by the NT SMB
2742 code.
2743 ****************************************************************************/
2744
2745 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2746 uint32 dirtype, struct smb_filename *smb_fname,
2747 bool has_wild)
2748 {
2749 char *fname_dir = NULL;
2750 char *fname_mask = NULL;
2751 int count=0;
2752 NTSTATUS status = NT_STATUS_OK;
2753 TALLOC_CTX *ctx = talloc_tos();
2754
2755 /* Split up the directory from the filename/mask. */
2756 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2757 &fname_dir, &fname_mask);
2758 if (!NT_STATUS_IS_OK(status)) {
2759 goto out;
2760 }
2761
2762 /*
2763 * We should only check the mangled cache
2764 * here if unix_convert failed. This means
2765 * that the path in 'mask' doesn't exist
2766 * on the file system and so we need to look
2767 * for a possible mangle. This patch from
2768 * Tine Smukavec <valentin.smukavec@hermes.si>.
2769 */
2770
2771 if (!VALID_STAT(smb_fname->st) &&
2772 mangle_is_mangled(fname_mask, conn->params)) {
2773 char *new_mask = NULL;
2774 mangle_lookup_name_from_8_3(ctx, fname_mask,
2775 &new_mask, conn->params);
2776 if (new_mask) {
2777 TALLOC_FREE(fname_mask);
2778 fname_mask = new_mask;
2779 }
2780 }
2781
2782 if (!has_wild) {
2783
2784 /*
2785 * Only one file needs to be unlinked. Append the mask back
2786 * onto the directory.
2787 */
2788 TALLOC_FREE(smb_fname->base_name);
2789 if (ISDOT(fname_dir)) {
2790 /* Ensure we use canonical names on open. */
2791 smb_fname->base_name = talloc_asprintf(smb_fname,
2792 "%s",
2793 fname_mask);
2794 } else {
2795 smb_fname->base_name = talloc_asprintf(smb_fname,
2796 "%s/%s",
2797 fname_dir,
2798 fname_mask);
2799 }
2800 if (!smb_fname->base_name) {
2801 status = NT_STATUS_NO_MEMORY;
2802 goto out;
2803 }
2804 if (dirtype == 0) {
2805 dirtype = FILE_ATTRIBUTE_NORMAL;
2806 }
2807
2808 status = check_name(conn, smb_fname->base_name);
2809 if (!NT_STATUS_IS_OK(status)) {
2810 goto out;
2811 }
2812
2813 status = do_unlink(conn, req, smb_fname, dirtype);
2814 if (!NT_STATUS_IS_OK(status)) {
2815 goto out;
2816 }
2817
2818 count++;
2819 } else {
2820 struct smb_Dir *dir_hnd = NULL;
2821 long offset = 0;
2822 const char *dname = NULL;
2823 char *talloced = NULL;
2824
2825 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2826 status = NT_STATUS_OBJECT_NAME_INVALID;
2827 goto out;
2828 }
2829
2830 if (strequal(fname_mask,"????????.???")) {
2831 TALLOC_FREE(fname_mask);
2832 fname_mask = talloc_strdup(ctx, "*");
2833 if (!fname_mask) {
2834 status = NT_STATUS_NO_MEMORY;
2835 goto out;
2836 }
2837 }
2838
2839 status = check_name(conn, fname_dir);
2840 if (!NT_STATUS_IS_OK(status)) {
2841 goto out;
2842 }
2843
2844 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2845 dirtype);
2846 if (dir_hnd == NULL) {
2847 status = map_nt_error_from_unix(errno);
2848 goto out;
2849 }
2850
2851 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2852 the pattern matches against the long name, otherwise the short name
2853 We don't implement this yet XXXX
2854 */
2855
2856 status = NT_STATUS_NO_SUCH_FILE;
2857
2858 while ((dname = ReadDirName(dir_hnd, &offset,
2859 &smb_fname->st, &talloced))) {
2860 TALLOC_CTX *frame = talloc_stackframe();
2861
2862 if (!is_visible_file(conn, fname_dir, dname,
2863 &smb_fname->st, true)) {
2864 TALLOC_FREE(frame);
2865 TALLOC_FREE(talloced);
2866 continue;
2867 }
2868
2869 /* Quick check for "." and ".." */
2870 if (ISDOT(dname) || ISDOTDOT(dname)) {
2871 TALLOC_FREE(frame);
2872 TALLOC_FREE(talloced);
2873 continue;
2874 }
2875
2876 if(!mask_match(dname, fname_mask,
2877 conn->case_sensitive)) {
2878 TALLOC_FREE(frame);
2879 TALLOC_FREE(talloced);
2880 continue;
2881 }
2882
2883 TALLOC_FREE(smb_fname->base_name);
2884 if (ISDOT(fname_dir)) {
2885 /* Ensure we use canonical names on open. */
2886 smb_fname->base_name =
2887 talloc_asprintf(smb_fname, "%s",
2888 dname);
2889 } else {
2890 smb_fname->base_name =
2891 talloc_asprintf(smb_fname, "%s/%s",
2892 fname_dir, dname);
2893 }
2894
2895 if (!smb_fname->base_name) {
2896 TALLOC_FREE(dir_hnd);
2897 status = NT_STATUS_NO_MEMORY;
2898 TALLOC_FREE(frame);
2899 TALLOC_FREE(talloced);
2900 goto out;
2901 }
2902
2903 status = check_name(conn, smb_fname->base_name);
2904 if (!NT_STATUS_IS_OK(status)) {
2905 TALLOC_FREE(dir_hnd);
2906 TALLOC_FREE(frame);
2907 TALLOC_FREE(talloced);
2908 goto out;
2909 }
2910
2911 status = do_unlink(conn, req, smb_fname, dirtype);
2912 if (!NT_STATUS_IS_OK(status)) {
2913 TALLOC_FREE(frame);
2914 TALLOC_FREE(talloced);
2915 continue;
2916 }
2917
2918 count++;
2919 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2920 smb_fname->base_name));
2921
2922 TALLOC_FREE(frame);
2923 TALLOC_FREE(talloced);
2924 }
2925 TALLOC_FREE(dir_hnd);
2926 }
2927
2928 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2929 status = map_nt_error_from_unix(errno);
2930 }
2931
2932 out:
2933 TALLOC_FREE(fname_dir);
2934 TALLOC_FREE(fname_mask);
2935 return status;
2936 }
2937
2938 /****************************************************************************
2939 Reply to a unlink
2940 ****************************************************************************/
2941
2942 void reply_unlink(struct smb_request *req)
2943 {
2944 connection_struct *conn = req->conn;
2945 char *name = NULL;
2946 struct smb_filename *smb_fname = NULL;
2947 uint32 dirtype;
2948 NTSTATUS status;
2949 bool path_contains_wcard = False;
2950 TALLOC_CTX *ctx = talloc_tos();
2951
2952 START_PROFILE(SMBunlink);
2953
2954 if (req->wct < 1) {
2955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2956 goto out;
2957 }
2958
2959 dirtype = SVAL(req->vwv+0, 0);
2960
2961 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2962 STR_TERMINATE, &status,
2963 &path_contains_wcard);
2964 if (!NT_STATUS_IS_OK(status)) {
2965 reply_nterror(req, status);
2966 goto out;
2967 }
2968
2969 status = filename_convert(ctx, conn,
2970 req->flags2 & FLAGS2_DFS_PATHNAMES,
2971 name,
2972 UCF_COND_ALLOW_WCARD_LCOMP,
2973 &path_contains_wcard,
2974 &smb_fname);
2975 if (!NT_STATUS_IS_OK(status)) {
2976 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2977 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2978 ERRSRV, ERRbadpath);
2979 goto out;
2980 }
2981 reply_nterror(req, status);
2982 goto out;
2983 }
2984
2985 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2986
2987 status = unlink_internals(conn, req, dirtype, smb_fname,
2988 path_contains_wcard);
2989 if (!NT_STATUS_IS_OK(status)) {
2990 if (open_was_deferred(req->sconn, req->mid)) {
2991 /* We have re-scheduled this call. */
2992 goto out;
2993 }
2994 reply_nterror(req, status);
2995 goto out;
2996 }
2997
2998 reply_outbuf(req, 0, 0);
2999 out:
3000 TALLOC_FREE(smb_fname);
3001 END_PROFILE(SMBunlink);
3002 return;
3003 }
3004
3005 /****************************************************************************
3006 Fail for readbraw.
3007 ****************************************************************************/
3008
3009 static void fail_readraw(void)
3010 {
3011 const char *errstr = talloc_asprintf(talloc_tos(),
3012 "FAIL ! reply_readbraw: socket write fail (%s)",
3013 strerror(errno));
3014 if (!errstr) {
3015 errstr = "";
3016 }
3017 exit_server_cleanly(errstr);
3018 }
3019
3020 /****************************************************************************
3021 Fake (read/write) sendfile. Returns -1 on read or write fail.
3022 ****************************************************************************/
3023
3024 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3025 {
3026 size_t bufsize;
3027 size_t tosend = nread;
3028 char *buf;
3029
3030 if (nread == 0) {
3031 return 0;
3032 }
3033
3034 bufsize = MIN(nread, 65536);
3035
3036 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3037 return -1;
3038 }
3039
3040 while (tosend > 0) {
3041 ssize_t ret;
3042 size_t cur_read;
3043
3044 if (tosend > bufsize) {
3045 cur_read = bufsize;
3046 } else {
3047 cur_read = tosend;
3048 }
3049 ret = read_file(fsp,buf,startpos,cur_read);
3050 if (ret == -1) {
3051 SAFE_FREE(buf);
3052 return -1;
3053 }
3054
3055 /* If we had a short read, fill with zeros. */
3056 if (ret < cur_read) {
3057 memset(buf + ret, '\0', cur_read - ret);
3058 }
3059
3060 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3061 != cur_read) {
3062 char addr[INET6_ADDRSTRLEN];
3063 /*
3064 * Try and give an error message saying what
3065 * client failed.
3066 */
3067 DEBUG(0, ("write_data failed for client %s. "
3068 "Error %s\n",
3069 get_peer_addr(fsp->conn->sconn->sock, addr,
3070 sizeof(addr)),
3071 strerror(errno)));
3072 SAFE_FREE(buf);
3073 return -1;
3074 }
3075 tosend -= cur_read;
3076 startpos += cur_read;
3077 }
3078
3079 SAFE_FREE(buf);
3080 return (ssize_t)nread;
3081 }
3082
3083 /****************************************************************************
3084 Deal with the case of sendfile reading less bytes from the file than
3085 requested. Fill with zeros (all we can do).
3086 ****************************************************************************/
3087
3088 void sendfile_short_send(files_struct *fsp,
3089 ssize_t nread,
3090 size_t headersize,
3091 size_t smb_maxcnt)
3092 {
3093 #define SHORT_SEND_BUFSIZE 1024
3094 if (nread < headersize) {
3095 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3096 "header for file %s (%s). Terminating\n",
3097 fsp_str_dbg(fsp), strerror(errno)));
3098 exit_server_cleanly("sendfile_short_send failed");
3099 }
3100
3101 nread -= headersize;
3102
3103 if (nread < smb_maxcnt) {
3104 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3105 if (!buf) {
3106 exit_server_cleanly("sendfile_short_send: "
3107 "malloc failed");
3108 }
3109
3110 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3111 "with zeros !\n", fsp_str_dbg(fsp)));
3112
3113 while (nread < smb_maxcnt) {
3114 /*
3115 * We asked for the real file size and told sendfile
3116 * to not go beyond the end of the file. But it can
3117 * happen that in between our fstat call and the
3118 * sendfile call the file was truncated. This is very
3119 * bad because we have already announced the larger
3120 * number of bytes to the client.
3121 *
3122 * The best we can do now is to send 0-bytes, just as
3123 * a read from a hole in a sparse file would do.
3124 *
3125 * This should happen rarely enough that I don't care
3126 * about efficiency here :-)
3127 */
3128 size_t to_write;
3129
3130 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3131 if (write_data(fsp->conn->sconn->sock, buf, to_write)
3132 != to_write) {
3133 char addr[INET6_ADDRSTRLEN];
3134 /*
3135 * Try and give an error message saying what
3136 * client failed.
3137 */
3138 DEBUG(0, ("write_data failed for client %s. "
3139 "Error %s\n",
3140 get_peer_addr(
3141 fsp->conn->sconn->sock, addr,
3142 sizeof(addr)),
3143 strerror(errno)));
3144 exit_server_cleanly("sendfile_short_send: "
3145 "write_data failed");
3146 }
3147 nread += to_write;
3148 }
3149 SAFE_FREE(buf);
3150 }
3151 }
3152
3153 /****************************************************************************
3154 Return a readbraw error (4 bytes of zero).
3155 ****************************************************************************/
3156
3157 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3158 {
3159 char header[4];
3160
3161 SIVAL(header,0,0);
3162
3163 smbd_lock_socket(sconn);
3164 if (write_data(sconn->sock,header,4) != 4) {
3165 char addr[INET6_ADDRSTRLEN];
3166 /*
3167 * Try and give an error message saying what
3168 * client failed.
3169 */
3170 DEBUG(0, ("write_data failed for client %s. "
3171 "Error %s\n",
3172 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3173 strerror(errno)));
3174
3175 fail_readraw();
3176 }
3177 smbd_unlock_socket(sconn);
3178 }
3179
3180 /****************************************************************************
3181 Use sendfile in readbraw.
3182 ****************************************************************************/
3183
3184 static void send_file_readbraw(connection_struct *conn,
3185 struct smb_request *req,
3186 files_struct *fsp,
3187 off_t startpos,
3188 size_t nread,
3189 ssize_t mincount)
3190 {
3191 struct smbd_server_connection *sconn = req->sconn;
3192 char *outbuf = NULL;
3193 ssize_t ret=0;
3194
3195 /*
3196 * We can only use sendfile on a non-chained packet
3197 * but we can use on a non-oplocked file. tridge proved this
3198 * on a train in Germany :-). JRA.
3199 * reply_readbraw has already checked the length.
3200 */
3201
3202 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3203 (fsp->wcp == NULL) &&
3204 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3205 ssize_t sendfile_read = -1;
3206 char header[4];
3207 DATA_BLOB header_blob;
3208
3209 _smb_setlen(header,nread);
3210 header_blob = data_blob_const(header, 4);
3211
3212 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3213 &header_blob, startpos,
3214 nread);
3215 if (sendfile_read == -1) {
3216 /* Returning ENOSYS means no data at all was sent.
3217 * Do this as a normal read. */
3218 if (errno == ENOSYS) {
3219 goto normal_readbraw;
3220 }
3221
3222 /*
3223 * Special hack for broken Linux with no working sendfile. If we
3224 * return EINTR we sent the header but not the rest of the data.
3225 * Fake this up by doing read/write calls.
3226 */
3227 if (errno == EINTR) {
3228 /* Ensure we don't do this again. */
3229 set_use_sendfile(SNUM(conn), False);
3230 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3231
3232 if (fake_sendfile(fsp, startpos, nread) == -1) {
3233 DEBUG(0,("send_file_readbraw: "
3234 "fake_sendfile failed for "
3235 "file %s (%s).\n",
3236 fsp_str_dbg(fsp),
3237 strerror(errno)));
3238 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3239 }
3240 return;
3241 }
3242
3243 DEBUG(0,("send_file_readbraw: sendfile failed for "
3244 "file %s (%s). Terminating\n",
3245 fsp_str_dbg(fsp), strerror(errno)));
3246 exit_server_cleanly("send_file_readbraw sendfile failed");
3247 } else if (sendfile_read == 0) {
3248 /*
3249 * Some sendfile implementations return 0 to indicate
3250 * that there was a short read, but nothing was
3251 * actually written to the socket. In this case,
3252 * fallback to the normal read path so the header gets
3253 * the correct byte count.
3254 */
3255 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3256 "bytes falling back to the normal read: "
3257 "%s\n", fsp_str_dbg(fsp)));
3258 goto normal_readbraw;
3259 }
3260
3261 /* Deal with possible short send. */
3262 if (sendfile_read != 4+nread) {
3263 sendfile_short_send(fsp, sendfile_read, 4, nread);
3264 }
3265 return;
3266 }
3267
3268 normal_readbraw:
3269
3270 outbuf = talloc_array(NULL, char, nread+4);
3271 if (!outbuf) {
3272 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3273 (unsigned)(nread+4)));
3274 reply_readbraw_error(sconn);
3275 return;
3276 }
3277
3278 if (nread > 0) {
3279 ret = read_file(fsp,outbuf+4,startpos,nread);
3280 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3281 if (ret < mincount)
3282 ret = 0;
3283 #else
3284 if (ret < nread)
3285 ret = 0;
3286 #endif
3287 }
3288
3289 _smb_setlen(outbuf,ret);
3290 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3291 char addr[INET6_ADDRSTRLEN];
3292 /*
3293 * Try and give an error message saying what
3294 * client failed.
3295 */
3296 DEBUG(0, ("write_data failed for client %s. "
3297 "Error %s\n",
3298 get_peer_addr(fsp->conn->sconn->sock, addr,
3299 sizeof(addr)),
3300 strerror(errno)));
3301
3302 fail_readraw();
3303 }
3304
3305 TALLOC_FREE(outbuf);
3306 }
3307
3308 /****************************************************************************
3309 Reply to a readbraw (core+ protocol).
3310 ****************************************************************************/
3311
3312 void reply_readbraw(struct smb_request *req)
3313 {
3314 connection_struct *conn = req->conn;
3315 struct smbd_server_connection *sconn = req->sconn;
3316 ssize_t maxcount,mincount;
3317 size_t nread = 0;
3318 off_t startpos;
3319 files_struct *fsp;
3320 struct lock_struct lock;
3321 off_t size = 0;
3322
3323 START_PROFILE(SMBreadbraw);
3324
3325 if (srv_is_signing_active(sconn) || req->encrypted) {
3326 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3327 "raw reads/writes are disallowed.");
3328 }
3329
3330 if (req->wct < 8) {
3331 reply_readbraw_error(sconn);
3332 END_PROFILE(SMBreadbraw);
3333 return;
3334 }
3335
3336 if (sconn->smb1.echo_handler.trusted_fde) {
3337 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3338 "'async smb echo handler = yes'\n"));
3339 reply_readbraw_error(sconn);
3340 END_PROFILE(SMBreadbraw);
3341 return;
3342 }
3343
3344 /*
3345 * Special check if an oplock break has been issued
3346 * and the readraw request croses on the wire, we must
3347 * return a zero length response here.
3348 */
3349
3350 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3351
3352 /*
3353 * We have to do a check_fsp by hand here, as
3354 * we must always return 4 zero bytes on error,
3355 * not a NTSTATUS.
3356 */
3357
3358 if (!fsp || !conn || conn != fsp->conn ||
3359 req->vuid != fsp->vuid ||
3360 fsp->is_directory || fsp->fh->fd == -1) {
3361 /*
3362 * fsp could be NULL here so use the value from the packet. JRA.
3363 */
3364 DEBUG(3,("reply_readbraw: fnum %d not valid "
3365 "- cache prime?\n",
3366 (int)SVAL(req->vwv+0, 0)));
3367 reply_readbraw_error(sconn);
3368 END_PROFILE(SMBreadbraw);
3369 return;
3370 }
3371
3372 /* Do a "by hand" version of CHECK_READ. */
3373 if (!(fsp->can_read ||
3374 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3375 (fsp->access_mask & FILE_EXECUTE)))) {
3376 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3377 (int)SVAL(req->vwv+0, 0)));
3378 reply_readbraw_error(sconn);
3379 END_PROFILE(SMBreadbraw);
3380 return;
3381 }
3382
3383 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3384
3385 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3386 if(req->wct == 10) {
3387 /*
3388 * This is a large offset (64 bit) read.
3389 */
3390
3391 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3392
3393 if(startpos < 0) {
3394 DEBUG(0,("reply_readbraw: negative 64 bit "
3395 "readraw offset (%.0f) !\n",
3396 (double)startpos ));
3397 reply_readbraw_error(sconn);
3398 END_PROFILE(SMBreadbraw);
3399 return;
3400 }
3401 }
3402
3403 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3404 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3405
3406 /* ensure we don't overrun the packet size */
3407 maxcount = MIN(65535,maxcount);
3408
3409 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3410 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3411 &lock);
3412
3413 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3414 reply_readbraw_error(sconn);
3415 END_PROFILE(SMBreadbraw);
3416 return;
3417 }
3418
3419 if (fsp_stat(fsp) == 0) {
3420 size = fsp->fsp_name->st.st_ex_size;
3421 }
3422
3423 if (startpos >= size) {
3424 nread = 0;
3425 } else {
3426 nread = MIN(maxcount,(size - startpos));
3427 }
3428
3429 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3430 if (nread < mincount)
3431 nread = 0;
3432 #endif
3433
3434 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3435 "min=%lu nread=%lu\n",
3436 fsp_fnum_dbg(fsp), (double)startpos,
3437 (unsigned long)maxcount,
3438 (unsigned long)mincount,
3439 (unsigned long)nread ) );
3440
3441 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3442
3443 DEBUG(5,("reply_readbraw finished\n"));
3444
3445 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3446
3447 END_PROFILE(SMBreadbraw);
3448 return;
3449 }
3450
3451 #undef DBGC_CLASS
3452 #define DBGC_CLASS DBGC_LOCKING
3453
3454 /****************************************************************************
3455 Reply to a lockread (core+ protocol).
3456 ****************************************************************************/
3457
3458 void reply_lockread(struct smb_request *req)
3459 {
3460 connection_struct *conn = req->conn;
3461 ssize_t nread = -1;
3462 char *data;
3463 off_t startpos;
3464 size_t numtoread;
3465 NTSTATUS status;
3466 files_struct *fsp;
3467 struct byte_range_lock *br_lck = NULL;
3468 char *p = NULL;
3469 struct smbd_server_connection *sconn = req->sconn;
3470
3471 START_PROFILE(SMBlockread);
3472
3473 if (req->wct < 5) {
3474 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3475 END_PROFILE(SMBlockread);
3476 return;
3477 }
3478
3479 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3480
3481 if (!check_fsp(conn, req, fsp)) {
3482 END_PROFILE(SMBlockread);
3483 return;
3484 }
3485
3486 if (!CHECK_READ(fsp,req)) {
3487 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3488 END_PROFILE(SMBlockread);
3489 return;
3490 }
3491
3492 numtoread = SVAL(req->vwv+1, 0);
3493 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3494
3495 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3496
3497 reply_outbuf(req, 5, numtoread + 3);
3498
3499 data = smb_buf(req->outbuf) + 3;
3500
3501 /*
3502 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3503 * protocol request that predates the read/write lock concept.
3504 * Thus instead of asking for a read lock here we need to ask
3505 * for a write lock. JRA.
3506 * Note that the requested lock size is unaffected by max_recv.
3507 */
3508
3509 br_lck = do_lock(req->sconn->msg_ctx,
3510 fsp,
3511 (uint64_t)req->smbpid,
3512 (uint64_t)numtoread,
3513 (uint64_t)startpos,
3514 WRITE_LOCK,
3515 WINDOWS_LOCK,
3516 False, /* Non-blocking lock. */
3517 &status,
3518 NULL,
3519 NULL);
3520 TALLOC_FREE(br_lck);
3521
3522 if (NT_STATUS_V(status)) {
3523 reply_nterror(req, status);
3524 END_PROFILE(SMBlockread);
3525 return;
3526 }
3527
3528 /*
3529 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3530 */
3531
3532 if (numtoread > sconn->smb1.negprot.max_recv) {
3533 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3534 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3535 (unsigned int)numtoread,
3536 (unsigned int)sconn->smb1.negprot.max_recv));
3537 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3538 }
3539 nread = read_file(fsp,data,startpos,numtoread);
3540
3541 if (nread < 0) {
3542 reply_nterror(req, map_nt_error_from_unix(errno));
3543 END_PROFILE(SMBlockread);
3544 return;
3545 }
3546
3547 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3548
3549 SSVAL(req->outbuf,smb_vwv0,nread);
3550 SSVAL(req->outbuf,smb_vwv5,nread+3);
3551 p = smb_buf(req->outbuf);
3552 SCVAL(p,0,0); /* pad byte. */
3553 SSVAL(p,1,nread);
3554
3555 DEBUG(3,("lockread %s num=%d nread=%d\n",
3556 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3557
3558 END_PROFILE(SMBlockread);
3559 return;
3560 }
3561
3562 #undef DBGC_CLASS
3563 #define DBGC_CLASS DBGC_ALL
3564
3565 /****************************************************************************
3566 Reply to a read.
3567 ****************************************************************************/
3568
3569 void reply_read(struct smb_request *req)
3570 {
3571 connection_struct *conn = req->conn;
3572 size_t numtoread;
3573 ssize_t nread = 0;
3574 char *data;
3575 off_t startpos;
3576 int outsize = 0;
3577 files_struct *fsp;
3578 struct lock_struct lock;
3579 struct smbd_server_connection *sconn = req->sconn;
3580
3581 START_PROFILE(SMBread);
3582
3583 if (req->wct < 3) {
3584 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3585 END_PROFILE(SMBread);
3586 return;
3587 }
3588
3589 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3590
3591 if (!check_fsp(conn, req, fsp)) {
3592 END_PROFILE(SMBread);
3593 return;
3594 }
3595
3596 if (!CHECK_READ(fsp,req)) {
3597 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3598 END_PROFILE(SMBread);
3599 return;
3600 }
3601
3602 numtoread = SVAL(req->vwv+1, 0);
3603 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3604
3605 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3606
3607 /*
3608 * The requested read size cannot be greater than max_recv. JRA.
3609 */
3610 if (numtoread > sconn->smb1.negprot.max_recv) {
3611 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3612 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3613 (unsigned int)numtoread,
3614 (unsigned int)sconn->smb1.negprot.max_recv));
3615 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3616 }
3617
3618 reply_outbuf(req, 5, numtoread+3);
3619
3620 data = smb_buf(req->outbuf) + 3;
3621
3622 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3623 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3624 &lock);
3625
3626 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3627 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3628 END_PROFILE(SMBread);
3629 return;
3630 }
3631
3632 if (numtoread > 0)
3633 nread = read_file(fsp,data,startpos,numtoread);
3634
3635 if (nread < 0) {
3636 reply_nterror(req, map_nt_error_from_unix(errno));
3637 goto strict_unlock;
3638 }
3639
3640 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3641
3642 SSVAL(req->outbuf,smb_vwv0,nread);
3643 SSVAL(req->outbuf,smb_vwv5,nread+3);
3644 SCVAL(smb_buf(req->outbuf),0,1);
3645 SSVAL(smb_buf(req->outbuf),1,nread);
3646
3647 DEBUG(3, ("read %s num=%d nread=%d\n",
3648 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3649
3650 strict_unlock:
3651 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3652
3653 END_PROFILE(SMBread);
3654 return;
3655 }
3656
3657 /****************************************************************************
3658 Setup readX header.
3659 ****************************************************************************/
3660
3661 static int setup_readX_header(struct smb_request *req, char *outbuf,
3662 size_t smb_maxcnt)
3663 {
3664 int outsize;
3665
3666 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3667
3668 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3669
3670 SCVAL(outbuf,smb_vwv0,0xFF);
3671 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3672 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3673 SSVAL(outbuf,smb_vwv6,
3674 (smb_wct - 4) /* offset from smb header to wct */
3675 + 1 /* the wct field */
3676 + 12 * sizeof(uint16_t) /* vwv */
3677 + 2); /* the buflen field */
3678 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3679 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3680 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3681 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3682 return outsize;
3683 }
3684
3685 /****************************************************************************
3686 Reply to a read and X - possibly using sendfile.
3687 ****************************************************************************/
3688
3689 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3690 files_struct *fsp, off_t startpos,
3691 size_t smb_maxcnt)
3692 {
3693 ssize_t nread = -1;
3694 struct lock_struct lock;
3695 int saved_errno = 0;
3696
3697 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3698 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3699 &lock);
3700
3701 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3702 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3703 return;
3704 }
3705
3706 /*
3707 * We can only use sendfile on a non-chained packet
3708 * but we can use on a non-oplocked file. tridge proved this
3709 * on a train in Germany :-). JRA.
3710 */
3711
3712 if (!req_is_in_chain(req) &&
3713 !req->encrypted &&
3714 (fsp->base_fsp == NULL) &&
3715 (fsp->wcp == NULL) &&
3716 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3717 uint8 headerbuf[smb_size + 12 * 2];
3718 DATA_BLOB header;
3719
3720 if(fsp_stat(fsp) == -1) {
3721 reply_nterror(req, map_nt_error_from_unix(errno));
3722 goto strict_unlock;
3723 }
3724
3725 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3726 (startpos > fsp->fsp_name->st.st_ex_size) ||
3727 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3728 /*
3729 * We already know that we would do a short read, so don't
3730 * try the sendfile() path.
3731 */
3732 goto nosendfile_read;
3733 }
3734
3735 /*
3736 * Set up the packet header before send. We
3737 * assume here the sendfile will work (get the
3738 * correct amount of data).
3739 */
3740
3741 header = data_blob_const(headerbuf, sizeof(headerbuf));
3742
3743 construct_reply_common_req(req, (char *)headerbuf);
3744 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3745
3746 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3747 startpos, smb_maxcnt);
3748 if (nread == -1) {
3749 /* Returning ENOSYS means no data at all was sent.
3750 Do this as a normal read. */
3751 if (errno == ENOSYS) {
3752 goto normal_read;
3753 }
3754
3755 /*
3756 * Special hack for broken Linux with no working sendfile. If we
3757 * return EINTR we sent the header but not the rest of the data.
3758 * Fake this up by doing read/write calls.
3759 */
3760
3761 if (errno == EINTR) {
3762 /* Ensure we don't do this again. */
3763 set_use_sendfile(SNUM(conn), False);
3764 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3765 nread = fake_sendfile(fsp, startpos,
3766 smb_maxcnt);
3767 if (nread == -1) {
3768 DEBUG(0,("send_file_readX: "
3769 "fake_sendfile failed for "
3770 "file %s (%s).\n",
3771 fsp_str_dbg(fsp),
3772 strerror(errno)));
3773 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3774 }
3775 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3776 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3777 /* No outbuf here means successful sendfile. */
3778 goto strict_unlock;
3779 }
3780
3781 DEBUG(0,("send_file_readX: sendfile failed for file "
3782 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3783 strerror(errno)));
3784 exit_server_cleanly("send_file_readX sendfile failed");
3785 } else if (nread == 0) {
3786 /*
3787 * Some sendfile implementations return 0 to indicate
3788 * that there was a short read, but nothing was
3789 * actually written to the socket. In this case,
3790 * fallback to the normal read path so the header gets
3791 * the correct byte count.
3792 */
3793 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3794 "falling back to the normal read: %s\n",
3795 fsp_str_dbg(fsp)));
3796 goto normal_read;
3797 }
3798
3799 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3800 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3801
3802 /* Deal with possible short send. */
3803 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3804 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3805 }
3806 /* No outbuf here means successful sendfile. */
3807 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3808 SMB_PERFCOUNT_END(&req->pcd);
3809 goto strict_unlock;
3810 }
3811
3812 normal_read:
3813
3814 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3815 uint8 headerbuf[smb_size + 2*12];
3816
3817 construct_reply_common_req(req, (char *)headerbuf);
3818 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3819
3820 /* Send out the header. */
3821 if (write_data(req->sconn->sock, (char *)headerbuf,
3822 sizeof(headerbuf)) != sizeof(headerbuf)) {
3823
3824 char addr[INET6_ADDRSTRLEN];
3825 /*
3826 * Try and give an error message saying what
3827 * client failed.
3828 */
3829 DEBUG(0, ("write_data failed for client %s. "
3830 "Error %s\n",
3831 get_peer_addr(req->sconn->sock, addr,
3832 sizeof(addr)),
3833 strerror(errno)));
3834
3835 DEBUG(0,("send_file_readX: write_data failed for file "
3836 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3837 strerror(errno)));
3838 exit_server_cleanly("send_file_readX sendfile failed");
3839 }
3840 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3841 if (nread == -1) {
3842 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3843 "file %s (%s).\n", fsp_str_dbg(fsp),
3844 strerror(errno)));
3845 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3846 }
3847 goto strict_unlock;
3848 }
3849
3850 nosendfile_read:
3851
3852 reply_outbuf(req, 12, smb_maxcnt);
3853 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3854 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3855
3856 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3857 saved_errno = errno;
3858
3859 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3860
3861 if (nread < 0) {
3862 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3863 return;
3864 }
3865
3866 setup_readX_header(req, (char *)req->outbuf, nread);
3867
3868 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3869 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3870 return;
3871
3872 strict_unlock:
3873 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3874 TALLOC_FREE(req->outbuf);
3875 return;
3876 }
3877
3878 /****************************************************************************
3879 Work out how much space we have for a read return.
3880 ****************************************************************************/
3881
3882 static size_t calc_max_read_pdu(const struct smb_request *req)
3883 {
3884 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3885 return req->sconn->smb1.sessions.max_send;
3886 }
3887
3888 if (!lp_large_readwrite()) {
3889 return req->sconn->smb1.sessions.max_send;
3890 }
3891
3892 if (req_is_in_chain(req)) {
3893 return req->sconn->smb1.sessions.max_send;
3894 }
3895
3896 if (req->encrypted) {
3897 /*
3898 * Don't take encrypted traffic up to the
3899 * limit. There are padding considerations
3900 * that make that tricky.
3901 */
3902 return req->sconn->smb1.sessions.max_send;
3903 }
3904
3905 if (srv_is_signing_active(req->sconn)) {
3906 return 0x1FFFF;
3907 }
3908
3909 if (!lp_unix_extensions()) {
3910 return 0x1FFFF;
3911 }
3912
3913 /*
3914 * We can do ultra-large POSIX reads.
3915 */
3916 return 0xFFFFFF;
3917 }
3918
3919 /****************************************************************************
3920 Calculate how big a read can be. Copes with all clients. It's always
3921 safe to return a short read - Windows does this.
3922 ****************************************************************************/
3923
3924 static size_t calc_read_size(const struct smb_request *req,
3925 size_t upper_size,
3926 size_t lower_size)
3927 {
3928 size_t max_pdu = calc_max_read_pdu(req);
3929 size_t total_size = 0;
3930 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3931 size_t max_len = max_pdu - hdr_len;
3932
3933 /*
3934 * Windows explicitly ignores upper size of 0xFFFF.
3935 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3936 * We must do the same as these will never fit even in
3937 * an extended size NetBIOS packet.
3938 */
3939 if (upper_size == 0xFFFF) {
3940 upper_size = 0;
3941 }
3942
3943 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3944 upper_size = 0;
3945 }
3946
3947 total_size = ((upper_size<<16) | lower_size);
3948
3949 /*
3950 * LARGE_READX test shows it's always safe to return
3951 * a short read. Windows does so.
3952 */
3953 return MIN(total_size, max_len);
3954 }
3955
3956 /****************************************************************************
3957 Reply to a read and X.
3958 ****************************************************************************/
3959
3960 void reply_read_and_X(struct smb_request *req)
3961 {
3962 connection_struct *conn = req->conn;
3963 files_struct *fsp;
3964 off_t startpos;
3965 size_t smb_maxcnt;
3966 size_t upper_size;
3967 bool big_readX = False;
3968 #if 0
3969 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3970 #endif
3971
3972 START_PROFILE(SMBreadX);
3973
3974 if ((req->wct != 10) && (req->wct != 12)) {
3975 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3976 return;
3977 }
3978
3979 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3980 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3981 smb_maxcnt = SVAL(req->vwv+5, 0);
3982
3983 /* If it's an IPC, pass off the pipe handler. */
3984 if (IS_IPC(conn)) {
3985 reply_pipe_read_and_X(req);
3986 END_PROFILE(SMBreadX);
3987 return;
3988 }
3989
3990 if (!check_fsp(conn, req, fsp)) {
3991 END_PROFILE(SMBreadX);
3992 return;
3993 }
3994
3995 if (!CHECK_READ(fsp,req)) {
3996 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3997 END_PROFILE(SMBreadX);
3998 return;
3999 }
4000
4001 upper_size = SVAL(req->vwv+7, 0);
4002 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4003 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4004 /*
4005 * This is a heuristic to avoid keeping large
4006 * outgoing buffers around over long-lived aio
4007 * requests.
4008 */
4009 big_readX = True;
4010 }
4011
4012 if (req->wct == 12) {
4013 /*
4014 * This is a large offset (64 bit) read.
4015 */
4016 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4017
4018 }
4019
4020 if (!big_readX) {
4021 NTSTATUS status = schedule_aio_read_and_X(conn,
4022 req,
4023 fsp,
4024 startpos,
4025 smb_maxcnt);
4026 if (NT_STATUS_IS_OK(status)) {
4027 /* Read scheduled - we're done. */
4028 goto out;
4029 }
4030 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4031 /* Real error - report to client. */
4032 END_PROFILE(SMBreadX);
4033 reply_nterror(req, status);
4034 return;
4035 }
4036 /* NT_STATUS_RETRY - fall back to sync read. */
4037 }
4038
4039 smbd_lock_socket(req->sconn);
4040 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4041 smbd_unlock_socket(req->sconn);
4042
4043 out:
4044 END_PROFILE(SMBreadX);
4045 return;
4046 }
4047
4048 /****************************************************************************
4049 Error replies to writebraw must have smb_wct == 1. Fix this up.
4050 ****************************************************************************/
4051
4052 void error_to_writebrawerr(struct smb_request *req)
4053 {
4054 uint8 *old_outbuf = req->outbuf;
4055
4056 reply_outbuf(req, 1, 0);
4057
4058 memcpy(req->outbuf, old_outbuf, smb_size);
4059 TALLOC_FREE(old_outbuf);
4060 }
4061
4062 /****************************************************************************
4063 Read 4 bytes of a smb packet and return the smb length of the packet.
4064 Store the result in the buffer. This version of the function will
4065 never return a session keepalive (length of zero).
4066 Timeout is in milliseconds.
4067 ****************************************************************************/
4068
4069 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4070 size_t *len)
4071 {
4072 uint8_t msgtype = NBSSkeepalive;
4073
4074 while (msgtype == NBSSkeepalive) {
4075 NTSTATUS status;
4076
4077 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4078 len);
4079 if (!NT_STATUS_IS_OK(status)) {
4080 char addr[INET6_ADDRSTRLEN];
4081 /* Try and give an error message
4082 * saying what client failed. */
4083 DEBUG(0, ("read_fd_with_timeout failed for "
4084 "client %s read error = %s.\n",
4085 get_peer_addr(fd,addr,sizeof(addr)),
4086 nt_errstr(status)));
4087 return status;
4088 }
4089
4090 msgtype = CVAL(inbuf, 0);
4091 }
4092
4093 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4094 (unsigned long)len));
4095
4096 return NT_STATUS_OK;
4097 }
4098
4099 /****************************************************************************
4100 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4101 ****************************************************************************/
4102
4103 void reply_writebraw(struct smb_request *req)
4104 {
4105 connection_struct *conn = req->conn;
4106 char *buf = NULL;
4107 ssize_t nwritten=0;
4108 ssize_t total_written=0;
4109 size_t numtowrite=0;
4110 size_t tcount;
4111 off_t startpos;
4112 const char *data=NULL;
4113 bool write_through;
4114 files_struct *fsp;
4115 struct lock_struct lock;
4116 NTSTATUS status;
4117
4118 START_PROFILE(SMBwritebraw);
4119
4120 /*
4121 * If we ever reply with an error, it must have the SMB command
4122 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4123 * we're finished.
4124 */
4125 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4126
4127 if (srv_is_signing_active(req->sconn)) {
4128 END_PROFILE(SMBwritebraw);
4129 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4130 "raw reads/writes are disallowed.");
4131 }
4132
4133 if (req->wct < 12) {
4134 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4135 error_to_writebrawerr(req);
4136 END_PROFILE(SMBwritebraw);
4137 return;
4138 }
4139
4140 if (req->sconn->smb1.echo_handler.trusted_fde) {
4141 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4142 "'async smb echo handler = yes'\n"));
4143 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4144 error_to_writebrawerr(req);
4145 END_PROFILE(SMBwritebraw);
4146 return;
4147 }
4148
4149 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4150 if (!check_fsp(conn, req, fsp)) {
4151 error_to_writebrawerr(req);
4152 END_PROFILE(SMBwritebraw);
4153 return;
4154 }
4155
4156 if (!CHECK_WRITE(fsp)) {
4157 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4158 error_to_writebrawerr(req);
4159 END_PROFILE(SMBwritebraw);
4160 return;
4161 }
4162
4163 tcount = IVAL(req->vwv+1, 0);
4164 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4165 write_through = BITSETW(req->vwv+7,0);
4166
4167 /* We have to deal with slightly different formats depending
4168 on whether we are using the core+ or lanman1.0 protocol */
4169
4170 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4171 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4172 data = smb_buf_const(req->inbuf);
4173 } else {
4174 numtowrite = SVAL(req->vwv+10, 0);
4175 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4176 }
4177
4178 /* Ensure we don't write bytes past the end of this packet. */
4179 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4181 error_to_writebrawerr(req);
4182 END_PROFILE(SMBwritebraw);
4183 return;
4184 }
4185
4186 if (!fsp->print_file) {
4187 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4188 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4189 &lock);
4190
4191 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4192 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4193 error_to_writebrawerr(req);
4194 END_PROFILE(SMBwritebraw);
4195 return;
4196 }
4197 }
4198
4199 if (numtowrite>0) {
4200 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4201 }
4202
4203 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4204 "wrote=%d sync=%d\n",
4205 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4206 (int)nwritten, (int)write_through));
4207
4208 if (nwritten < (ssize_t)numtowrite) {
4209 reply_nterror(req, NT_STATUS_DISK_FULL);
4210 error_to_writebrawerr(req);
4211 goto strict_unlock;
4212 }
4213
4214 total_written = nwritten;
4215
4216 /* Allocate a buffer of 64k + length. */
4217 buf = talloc_array(NULL, char, 65540);
4218 if (!buf) {
4219 reply_nterror(req, NT_STATUS_NO_MEMORY);
4220 error_to_writebrawerr(req);
4221 goto strict_unlock;
4222 }
4223
4224 /* Return a SMBwritebraw message to the redirector to tell
4225 * it to send more bytes */
4226
4227 memcpy(buf, req->inbuf, smb_size);
4228 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4229 SCVAL(buf,smb_com,SMBwritebraw);
4230 SSVALS(buf,smb_vwv0,0xFFFF);
4231 show_msg(buf);
4232 if (!srv_send_smb(req->sconn,
4233 buf,
4234 false, 0, /* no signing */
4235 IS_CONN_ENCRYPTED(conn),
4236 &req->pcd)) {
4237 exit_server_cleanly("reply_writebraw: srv_send_smb "
4238 "failed.");
4239 }
4240
4241 /* Now read the raw data into the buffer and write it */
4242 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4243 &numtowrite);
4244 if (!NT_STATUS_IS_OK(status)) {
4245 exit_server_cleanly("secondary writebraw failed");
4246 }
4247
4248 /* Set up outbuf to return the correct size */
4249 reply_outbuf(req, 1, 0);
4250
4251 if (numtowrite != 0) {
4252
4253 if (numtowrite > 0xFFFF) {
4254 DEBUG(0,("reply_writebraw: Oversize secondary write "
4255 "raw requested (%u). Terminating\n",
4256 (unsigned int)numtowrite ));
4257 exit_server_cleanly("secondary writebraw failed");
4258 }
4259
4260 if (tcount > nwritten+numtowrite) {
4261 DEBUG(3,("reply_writebraw: Client overestimated the "
4262 "write %d %d %d\n",
4263 (int)tcount,(int)nwritten,(int)numtowrite));
4264 }
4265
4266 status = read_data(req->sconn->sock, buf+4, numtowrite);
4267
4268 if (!NT_STATUS_IS_OK(status)) {
4269 char addr[INET6_ADDRSTRLEN];
4270 /* Try and give an error message
4271 * saying what client failed. */
4272 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4273 "raw read failed (%s) for client %s. "
4274 "Terminating\n", nt_errstr(status),
4275 get_peer_addr(req->sconn->sock, addr,
4276 sizeof(addr))));
4277 exit_server_cleanly("secondary writebraw failed");
4278 }
4279
4280 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4281 if (nwritten == -1) {
4282 TALLOC_FREE(buf);
4283 reply_nterror(req, map_nt_error_from_unix(errno));
4284 error_to_writebrawerr(req);
4285 goto strict_unlock;
4286 }
4287
4288 if (nwritten < (ssize_t)numtowrite) {
4289 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4290 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4291 }
4292
4293 if (nwritten > 0) {
4294 total_written += nwritten;
4295 }
4296 }
4297
4298 TALLOC_FREE(buf);
4299 SSVAL(req->outbuf,smb_vwv0,total_written);
4300
4301 status = sync_file(conn, fsp, write_through);
4302 if (!NT_STATUS_IS_OK(status)) {
4303 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4304 fsp_str_dbg(fsp), nt_errstr(status)));
4305 reply_nterror(req, status);
4306 error_to_writebrawerr(req);
4307 goto strict_unlock;
4308 }
4309
4310 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4311 "wrote=%d\n",
4312 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4313 (int)total_written));
4314
4315 if (!fsp->print_file) {
4316 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4317 }
4318
4319 /* We won't return a status if write through is not selected - this
4320 * follows what WfWg does */
4321 END_PROFILE(SMBwritebraw);
4322
4323 if (!write_through && total_written==tcount) {
4324
4325 #if RABBIT_PELLET_FIX
4326 /*
4327 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4328 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4329 * JRA.
4330 */
4331 if (!send_keepalive(req->sconn->sock)) {
4332 exit_server_cleanly("reply_writebraw: send of "
4333 "keepalive failed");
4334 }
4335 #endif
4336 TALLOC_FREE(req->outbuf);
4337 }
4338 return;
4339
4340 strict_unlock:
4341 if (!fsp->print_file) {
4342 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4343 }
4344
4345 END_PROFILE(SMBwritebraw);
4346 return;
4347 }
4348
4349 #undef DBGC_CLASS
4350 #define DBGC_CLASS DBGC_LOCKING
4351
4352 /****************************************************************************
4353 Reply to a writeunlock (core+).
4354 ****************************************************************************/
4355
4356 void reply_writeunlock(struct smb_request *req)
4357 {
4358 connection_struct *conn = req->conn;
4359 ssize_t nwritten = -1;
4360 size_t numtowrite;
4361 off_t startpos;
4362 const char *data;
4363 NTSTATUS status = NT_STATUS_OK;
4364 files_struct *fsp;
4365 struct lock_struct lock;
4366 int saved_errno = 0;
4367
4368 START_PROFILE(SMBwriteunlock);
4369
4370 if (req->wct < 5) {
4371 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4372 END_PROFILE(SMBwriteunlock);
4373 return;
4374 }
4375
4376 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4377
4378 if (!check_fsp(conn, req, fsp)) {
4379 END_PROFILE(SMBwriteunlock);
4380 return;
4381 }
4382
4383 if (!CHECK_WRITE(fsp)) {
4384 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4385 END_PROFILE(SMBwriteunlock);
4386 return;
4387 }
4388
4389 numtowrite = SVAL(req->vwv+1, 0);
4390 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4391 data = (const char *)req->buf + 3;
4392
4393 if (!fsp->print_file && numtowrite > 0) {
4394 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4395 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4396 &lock);
4397
4398 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4399 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4400 END_PROFILE(SMBwriteunlock);
4401 return;
4402 }
4403 }
4404
4405 /* The special X/Open SMB protocol handling of
4406 zero length writes is *NOT* done for
4407 this call */
4408 if(numtowrite == 0) {
4409 nwritten = 0;
4410 } else {
4411 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4412 saved_errno = errno;
4413 }
4414
4415 status = sync_file(conn, fsp, False /* write through */);
4416 if (!NT_STATUS_IS_OK(status)) {
4417 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4418 fsp_str_dbg(fsp), nt_errstr(status)));
4419 reply_nterror(req, status);
4420 goto strict_unlock;
4421 }
4422
4423 if(nwritten < 0) {
4424 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4425 goto strict_unlock;
4426 }
4427
4428 if((nwritten < numtowrite) && (numtowrite != 0)) {
4429 reply_nterror(req, NT_STATUS_DISK_FULL);
4430 goto strict_unlock;
4431 }
4432
4433 if (numtowrite && !fsp->print_file) {
4434 status = do_unlock(req->sconn->msg_ctx,
4435 fsp,
4436 (uint64_t)req->smbpid,
4437 (uint64_t)numtowrite,
4438 (uint64_t)startpos,
4439 WINDOWS_LOCK);
4440
4441 if (NT_STATUS_V(status)) {
4442 reply_nterror(req, status);
4443 goto strict_unlock;
4444 }
4445 }
4446
4447 reply_outbuf(req, 1, 0);
4448
4449 SSVAL(req->outbuf,smb_vwv0,nwritten);
4450
4451 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4452 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4453
4454 strict_unlock:
4455 if (numtowrite && !fsp->print_file) {
4456 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4457 }
4458
4459 END_PROFILE(SMBwriteunlock);
4460 return;
4461 }
4462
4463 #undef DBGC_CLASS
4464 #define DBGC_CLASS DBGC_ALL
4465
4466 /****************************************************************************
4467 Reply to a write.
4468 ****************************************************************************/
4469
4470 void reply_write(struct smb_request *req)
4471 {
4472 connection_struct *conn = req->conn;
4473 size_t numtowrite;
4474 ssize_t nwritten = -1;
4475 off_t startpos;
4476 const char *data;
4477 files_struct *fsp;
4478 struct lock_struct lock;
4479 NTSTATUS status;
4480 int saved_errno = 0;
4481
4482 START_PROFILE(SMBwrite);
4483
4484 if (req->wct < 5) {
4485 END_PROFILE(SMBwrite);
4486 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4487 return;
4488 }
4489
4490 /* If it's an IPC, pass off the pipe handler. */
4491 if (IS_IPC(conn)) {
4492 reply_pipe_write(req);
4493 END_PROFILE(SMBwrite);
4494 return;
4495 }
4496
4497 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4498
4499 if (!check_fsp(conn, req, fsp)) {
4500 END_PROFILE(SMBwrite);
4501 return;
4502 }
4503
4504 if (!CHECK_WRITE(fsp)) {
4505 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4506 END_PROFILE(SMBwrite);
4507 return;
4508 }
4509
4510 numtowrite = SVAL(req->vwv+1, 0);
4511 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4512 data = (const char *)req->buf + 3;
4513
4514 if (!fsp->print_file) {
4515 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4516 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4517 &lock);
4518
4519 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4520 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4521 END_PROFILE(SMBwrite);
4522 return;
4523 }
4524 }
4525
4526 /*
4527 * X/Open SMB protocol says that if smb_vwv1 is
4528 * zero then the file size should be extended or
4529 * truncated to the size given in smb_vwv[2-3].
4530 */
4531
4532 if(numtowrite == 0) {
4533 /*
4534 * This is actually an allocate call, and set EOF. JRA.
4535 */
4536 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4537 if (nwritten < 0) {
4538 reply_nterror(req, NT_STATUS_DISK_FULL);
4539 goto strict_unlock;
4540 }
4541 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4542 if (nwritten < 0) {
4543 reply_nterror(req, NT_STATUS_DISK_FULL);
4544 goto strict_unlock;
4545 }
4546 trigger_write_time_update_immediate(fsp);
4547 } else {
4548 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4549 }
4550
4551 status = sync_file(conn, fsp, False);
4552 if (!NT_STATUS_IS_OK(status)) {
4553 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4554 fsp_str_dbg(fsp), nt_errstr(status)));
4555 reply_nterror(req, status);
4556 goto strict_unlock;
4557 }
4558
4559 if(nwritten < 0) {
4560 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4561 goto strict_unlock;
4562 }
4563
4564 if((nwritten == 0) && (numtowrite != 0)) {
4565 reply_nterror(req, NT_STATUS_DISK_FULL);
4566 goto strict_unlock;
4567 }
4568
4569 reply_outbuf(req, 1, 0);
4570
4571 SSVAL(req->outbuf,smb_vwv0,nwritten);
4572
4573 if (nwritten < (ssize_t)numtowrite) {
4574 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4575 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4576 }
4577
4578 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4579
4580 strict_unlock:
4581 if (!fsp->print_file) {
4582 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4583 }
4584
4585 END_PROFILE(SMBwrite);
4586 return;
4587 }
4588
4589 /****************************************************************************
4590 Ensure a buffer is a valid writeX for recvfile purposes.
4591 ****************************************************************************/
4592
4593 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4594 (2*14) + /* word count (including bcc) */ \
4595 1 /* pad byte */)
4596
4597 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4598 const uint8_t *inbuf)
4599 {
4600 size_t numtowrite;
4601 connection_struct *conn = NULL;
4602 unsigned int doff = 0;
4603 size_t len = smb_len_large(inbuf);
4604 struct smbXsrv_tcon *tcon;
4605 NTSTATUS status;
4606 NTTIME now = 0;
4607
4608 if (is_encrypted_packet(sconn, inbuf)) {
4609 /* Can't do this on encrypted
4610 * connections. */
4611 return false;
4612 }
4613
4614 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4615 return false;
4616 }
4617
4618 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4619 CVAL(inbuf,smb_wct) != 14) {
4620 DEBUG(10,("is_valid_writeX_buffer: chained or "
4621 "invalid word length.\n"));
4622 return false;
4623 }
4624
4625 status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4626 now, &tcon);
4627 if (!NT_STATUS_IS_OK(status)) {
4628 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4629 return false;
4630 }
4631 conn = tcon->compat;
4632
4633 if (IS_IPC(conn)) {
4634 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4635 return false;
4636 }
4637 if (IS_PRINT(conn)) {
4638 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4639 return false;
4640 }
4641 doff = SVAL(inbuf,smb_vwv11);
4642
4643 numtowrite = SVAL(inbuf,smb_vwv10);
4644
4645 if (len > doff && len - doff > 0xFFFF) {
4646 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4647 }
4648
4649 if (numtowrite == 0) {
4650 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4651 return false;
4652 }
4653
4654 /* Ensure the sizes match up. */
4655 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4656 /* no pad byte...old smbclient :-( */
4657 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4658 (unsigned int)doff,
4659 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4660 return false;
4661 }
4662
4663 if (len - doff != numtowrite) {
4664 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4665 "len = %u, doff = %u, numtowrite = %u\n",
4666 (unsigned int)len,
4667 (unsigned int)doff,
4668 (unsigned int)numtowrite ));
4669 return false;
4670 }
4671
4672 DEBUG(10,("is_valid_writeX_buffer: true "
4673 "len = %u, doff = %u, numtowrite = %u\n",
4674 (unsigned int)len,
4675 (unsigned int)doff,
4676 (unsigned int)numtowrite ));
4677
4678 return true;
4679 }
4680
4681 /****************************************************************************
4682 Reply to a write and X.
4683 ****************************************************************************/
4684
4685 void reply_write_and_X(struct smb_request *req)
4686 {
4687 connection_struct *conn = req->conn;
4688 files_struct *fsp;
4689 struct lock_struct lock;
4690 off_t startpos;
4691 size_t numtowrite;
4692 bool write_through;
4693 ssize_t nwritten;
4694 unsigned int smb_doff;
4695 unsigned int smblen;
4696 const char *data;
4697 NTSTATUS status;
4698 int saved_errno = 0;
4699
4700 START_PROFILE(SMBwriteX);
4701
4702 if ((req->wct != 12) && (req->wct != 14)) {
4703 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4704 goto out;
4705 }
4706
4707 numtowrite = SVAL(req->vwv+10, 0);
4708 smb_doff = SVAL(req->vwv+11, 0);
4709 smblen = smb_len(req->inbuf);
4710
4711 if (req->unread_bytes > 0xFFFF ||
4712 (smblen > smb_doff &&
4713 smblen - smb_doff > 0xFFFF)) {
4714 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4715 }
4716
4717 if (req->unread_bytes) {
4718 /* Can't do a recvfile write on IPC$ */
4719 if (IS_IPC(conn)) {
4720 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4721 goto out;
4722 }
4723 if (numtowrite != req->unread_bytes) {
4724 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4725 goto out;
4726 }
4727 } else {
4728 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4729 smb_doff + numtowrite > smblen) {
4730 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4731 goto out;
4732 }
4733 }
4734
4735 /* If it's an IPC, pass off the pipe handler. */
4736 if (IS_IPC(conn)) {
4737 if (req->unread_bytes) {
4738 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4739 goto out;
4740 }
4741 reply_pipe_write_and_X(req);
4742 goto out;
4743 }
4744
4745 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4746 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4747 write_through = BITSETW(req->vwv+7,0);
4748
4749 if (!check_fsp(conn, req, fsp)) {
4750 goto out;
4751 }
4752
4753 if (!CHECK_WRITE(fsp)) {
4754 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4755 goto out;
4756 }
4757
4758 data = smb_base(req->inbuf) + smb_doff;
4759
4760 if(req->wct == 14) {
4761 /*
4762 * This is a large offset (64 bit) write.
4763 */
4764 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4765
4766 }
4767
4768 /* X/Open SMB protocol says that, unlike SMBwrite
4769 if the length is zero then NO truncation is
4770 done, just a write of zero. To truncate a file,
4771 use SMBwrite. */
4772
4773 if(numtowrite == 0) {
4774 nwritten = 0;
4775 } else {
4776 if (req->unread_bytes == 0) {
4777 status = schedule_aio_write_and_X(conn,
4778 req,
4779 fsp,
4780 data,
4781 startpos,
4782 numtowrite);
4783
4784 if (NT_STATUS_IS_OK(status)) {
4785 /* write scheduled - we're done. */
4786 goto out;
4787 }
4788 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4789 /* Real error - report to client. */
4790 reply_nterror(req, status);
4791 goto out;
4792 }
4793 /* NT_STATUS_RETRY - fall through to sync write. */
4794 }
4795
4796 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4797 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4798 &lock);
4799
4800 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4801 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4802 goto out;
4803 }
4804
4805 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4806 saved_errno = errno;
4807
4808 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4809 }
4810
4811 if(nwritten < 0) {
4812 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4813 goto out;
4814 }
4815
4816 if((nwritten == 0) && (numtowrite != 0)) {
4817 reply_nterror(req, NT_STATUS_DISK_FULL);
4818 goto out;
4819 }
4820
4821 reply_outbuf(req, 6, 0);
4822 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4823 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4824 SSVAL(req->outbuf,smb_vwv2,nwritten);
4825 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4826
4827 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4828 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4829
4830 status = sync_file(conn, fsp, write_through);
4831 if (!NT_STATUS_IS_OK(status)) {
4832 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4833 fsp_str_dbg(fsp), nt_errstr(status)));
4834 reply_nterror(req, status);
4835 goto out;
4836 }
4837
4838 END_PROFILE(SMBwriteX);
4839 return;
4840
4841 out:
4842 if (req->unread_bytes) {
4843 /* writeX failed. drain socket. */
4844 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4845 req->unread_bytes) {
4846 smb_panic("failed to drain pending bytes");
4847 }
4848 req->unread_bytes = 0;
4849 }
4850
4851 END_PROFILE(SMBwriteX);
4852 return;
4853 }
4854
4855 /****************************************************************************
4856 Reply to a lseek.
4857 ****************************************************************************/
4858
4859 void reply_lseek(struct smb_request *req)
4860 {
4861 connection_struct *conn = req->conn;
4862 off_t startpos;
4863 off_t res= -1;
4864 int mode,umode;
4865 files_struct *fsp;
4866
4867 START_PROFILE(SMBlseek);
4868
4869 if (req->wct < 4) {
4870 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4871 END_PROFILE(SMBlseek);
4872 return;
4873 }
4874
4875 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4876
4877 if (!check_fsp(conn, req, fsp)) {
4878 return;
4879 }
4880
4881 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4882
4883 mode = SVAL(req->vwv+1, 0) & 3;
4884 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4885 startpos = (off_t)IVALS(req->vwv+2, 0);
4886
4887 switch (mode) {
4888 case 0:
4889 umode = SEEK_SET;
4890 res = startpos;
4891 break;
4892 case 1:
4893 umode = SEEK_CUR;
4894 res = fsp->fh->pos + startpos;
4895 break;
4896 case 2:
4897 umode = SEEK_END;
4898 break;
4899 default:
4900 umode = SEEK_SET;
4901 res = startpos;
4902 break;
4903 }
4904
4905 if (umode == SEEK_END) {
4906 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4907 if(errno == EINVAL) {
4908 off_t current_pos = startpos;
4909
4910 if(fsp_stat(fsp) == -1) {
4911 reply_nterror(req,
4912 map_nt_error_from_unix(errno));
4913 END_PROFILE(SMBlseek);
4914 return;
4915 }
4916
4917 current_pos += fsp->fsp_name->st.st_ex_size;
4918 if(current_pos < 0)
4919 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4920 }
4921 }
4922
4923 if(res == -1) {
4924 reply_nterror(req, map_nt_error_from_unix(errno));
4925 END_PROFILE(SMBlseek);
4926 return;
4927 }
4928 }
4929
4930 fsp->fh->pos = res;
4931
4932 reply_outbuf(req, 2, 0);
4933 SIVAL(req->outbuf,smb_vwv0,res);
4934
4935 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4936 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4937
4938 END_PROFILE(SMBlseek);
4939 return;
4940 }
4941
4942 /****************************************************************************
4943 Reply to a flush.
4944 ****************************************************************************/
4945
4946 void reply_flush(struct smb_request *req)
4947 {
4948 connection_struct *conn = req->conn;
4949 uint16 fnum;
4950 files_struct *fsp;
4951
4952 START_PROFILE(SMBflush);
4953
4954 if (req->wct < 1) {
4955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4956 return;
4957 }
4958
4959 fnum = SVAL(req->vwv+0, 0);
4960 fsp = file_fsp(req, fnum);
4961
4962 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4963 return;
4964 }
4965
4966 if (!fsp) {
4967 file_sync_all(conn);
4968 } else {
4969 NTSTATUS status = sync_file(conn, fsp, True);
4970 if (!NT_STATUS_IS_OK(status)) {
4971 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4972 fsp_str_dbg(fsp), nt_errstr(status)));
4973 reply_nterror(req, status);
4974 END_PROFILE(SMBflush);
4975 return;
4976 }
4977 }
4978
4979 reply_outbuf(req, 0, 0);
4980
4981 DEBUG(3,("flush\n"));
4982 END_PROFILE(SMBflush);
4983 return;
4984 }
4985
4986 /****************************************************************************
4987 Reply to a exit.
4988 conn POINTER CAN BE NULL HERE !
4989 ****************************************************************************/
4990
4991 void reply_exit(struct smb_request *req)
4992 {
4993 START_PROFILE(SMBexit);
4994
4995 file_close_pid(req->sconn, req->smbpid, req->vuid);
4996
4997 reply_outbuf(req, 0, 0);
4998
4999 DEBUG(3,("exit\n"));
5000
5001 END_PROFILE(SMBexit);
5002 return;
5003 }
5004
5005 struct reply_close_state {
5006 files_struct *fsp;
5007 struct smb_request *smbreq;
5008 };
5009
5010 static void do_smb1_close(struct tevent_req *req);
5011
5012 void reply_close(struct smb_request *req)
5013 {
5014 connection_struct *conn = req->conn;
5015 NTSTATUS status = NT_STATUS_OK;
5016 files_struct *fsp = NULL;
5017 START_PROFILE(SMBclose);
5018
5019 if (req->wct < 3) {
5020 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5021 END_PROFILE(SMBclose);
5022 return;
5023 }
5024
5025 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5026
5027 /*
5028 * We can only use check_fsp if we know it's not a directory.
5029 */
5030
5031 if (!check_fsp_open(conn, req, fsp)) {
5032 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5033 END_PROFILE(SMBclose);
5034 return;
5035 }
5036
5037 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5038 fsp->is_directory ? "directory" : "file",
5039 fsp->fh->fd, fsp_fnum_dbg(fsp),
5040 conn->num_files_open));
5041
5042 if (!fsp->is_directory) {
5043 time_t t;
5044
5045 /*
5046 * Take care of any time sent in the close.
5047 */
5048
5049 t = srv_make_unix_date3(req->vwv+1);
5050 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5051 }
5052
5053 if (fsp->num_aio_requests != 0) {
5054
5055 struct reply_close_state *state;
5056
5057 DEBUG(10, ("closing with aio %u requests pending\n",
5058 fsp->num_aio_requests));
5059
5060 /*
5061 * We depend on the aio_extra destructor to take care of this
5062 * close request once fsp->num_aio_request drops to 0.
5063 */
5064
5065 fsp->deferred_close = tevent_wait_send(
5066 fsp, fsp->conn->sconn->ev_ctx);
5067 if (fsp->deferred_close == NULL) {
5068 status = NT_STATUS_NO_MEMORY;
5069 goto done;
5070 }
5071
5072 state = talloc(fsp, struct reply_close_state);
5073 if (state == NULL) {
5074 TALLOC_FREE(fsp->deferred_close);
5075 status = NT_STATUS_NO_MEMORY;
5076 goto done;
5077 }
5078 state->fsp = fsp;
5079 state->smbreq = talloc_move(fsp, &req);
5080 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5081 state);
5082 END_PROFILE(SMBclose);
5083 return;
5084 }
5085
5086 /*
5087 * close_file() returns the unix errno if an error was detected on
5088 * close - normally this is due to a disk full error. If not then it
5089 * was probably an I/O error.
5090 */
5091
5092 status = close_file(req, fsp, NORMAL_CLOSE);
5093 done:
5094 if (!NT_STATUS_IS_OK(status)) {
5095 reply_nterror(req, status);
5096 END_PROFILE(SMBclose);
5097 return;
5098 }
5099
5100 reply_outbuf(req, 0, 0);
5101 END_PROFILE(SMBclose);
5102 return;
5103 }
5104
5105 static void do_smb1_close(struct tevent_req *req)
5106 {
5107 struct reply_close_state *state = tevent_req_callback_data(
5108 req, struct reply_close_state);
5109 struct smb_request *smbreq;
5110 NTSTATUS status;
5111 int ret;
5112
5113 ret = tevent_wait_recv(req);
5114 TALLOC_FREE(req);
5115 if (ret != 0) {
5116 DEBUG(10, ("tevent_wait_recv returned %s\n",
5117 strerror(ret)));
5118 /*
5119 * Continue anyway, this should never happen
5120 */
5121 }
5122
5123 /*
5124 * fsp->smb2_close_request right now is a talloc grandchild of
5125 * fsp. When we close_file(fsp), it would go with it. No chance to
5126 * reply...
5127 */
5128 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5129
5130 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5131 if (NT_STATUS_IS_OK(status)) {
5132 reply_outbuf(smbreq, 0, 0);
5133 } else {
5134 reply_nterror(smbreq, status);
5135 }
5136 if (!srv_send_smb(smbreq->sconn,
5137 (char *)smbreq->outbuf,
5138 true,
5139 smbreq->seqnum+1,
5140 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5141 NULL)) {
5142 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5143 "failed.");
5144 }
5145 TALLOC_FREE(smbreq);
5146 }
5147
5148 /****************************************************************************
5149 Reply to a writeclose (Core+ protocol).
5150 ****************************************************************************/
5151
5152 void reply_writeclose(struct smb_request *req)
5153 {
5154 connection_struct *conn = req->conn;
5155 size_t numtowrite;
5156 ssize_t nwritten = -1;
5157 NTSTATUS close_status = NT_STATUS_OK;
5158 off_t startpos;
5159 const char *data;
5160 struct timespec mtime;
5161 files_struct *fsp;
5162 struct lock_struct lock;
5163
5164 START_PROFILE(SMBwriteclose);
5165
5166 if (req->wct < 6) {
5167 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5168 END_PROFILE(SMBwriteclose);
5169 return;
5170 }
5171
5172 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5173
5174 if (!check_fsp(conn, req, fsp)) {
5175 END_PROFILE(SMBwriteclose);
5176 return;
5177 }
5178 if (!CHECK_WRITE(fsp)) {
5179 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5180 END_PROFILE(SMBwriteclose);
5181 return;
5182 }
5183
5184 numtowrite = SVAL(req->vwv+1, 0);
5185 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5186 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5187 data = (const char *)req->buf + 1;
5188
5189 if (!fsp->print_file) {
5190 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5191 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5192 &lock);
5193
5194 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5195 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5196 END_PROFILE(SMBwriteclose);
5197 return;
5198 }
5199 }
5200
5201 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5202
5203 set_close_write_time(fsp, mtime);
5204
5205 /*
5206 * More insanity. W2K only closes the file if writelen > 0.
5207 * JRA.
5208 */
5209
5210 if (numtowrite) {
5211 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5212 "file %s\n", fsp_str_dbg(fsp)));
5213 close_status = close_file(req, fsp, NORMAL_CLOSE);
5214 }
5215
5216 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5217 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5218 conn->num_files_open));
5219
5220 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5221 reply_nterror(req, NT_STATUS_DISK_FULL);
5222 goto strict_unlock;
5223 }
5224
5225 if(!NT_STATUS_IS_OK(close_status)) {
5226 reply_nterror(req, close_status);
5227 goto strict_unlock;
5228 }
5229
5230 reply_outbuf(req, 1, 0);
5231
5232 SSVAL(req->outbuf,smb_vwv0,nwritten);
5233
5234 strict_unlock:
5235 if (numtowrite && !fsp->print_file) {
5236 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5237 }
5238
5239 END_PROFILE(SMBwriteclose);
5240 return;
5241 }
5242
5243 #undef DBGC_CLASS
5244 #define DBGC_CLASS DBGC_LOCKING
5245
5246 /****************************************************************************
5247 Reply to a lock.
5248 ****************************************************************************/
5249
5250 void reply_lock(struct smb_request *req)
5251 {
5252 connection_struct *conn = req->conn;
5253 uint64_t count,offset;
5254 NTSTATUS status;
5255 files_struct *fsp;
5256 struct byte_range_lock *br_lck = NULL;
5257
5258 START_PROFILE(SMBlock);
5259
5260 if (req->wct < 5) {
5261 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5262 END_PROFILE(SMBlock);
5263 return;
5264 }
5265
5266 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5267
5268 if (!check_fsp(conn, req, fsp)) {
5269 END_PROFILE(SMBlock);
5270 return;
5271 }
5272
5273 count = (uint64_t)IVAL(req->vwv+1, 0);
5274 offset = (uint64_t)IVAL(req->vwv+3, 0);
5275
5276 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5277 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5278
5279 br_lck = do_lock(req->sconn->msg_ctx,
5280 fsp,
5281 (uint64_t)req->smbpid,
5282 count,
5283 offset,
5284 WRITE_LOCK,
5285 WINDOWS_LOCK,
5286 False, /* Non-blocking lock. */
5287 &status,
5288 NULL,
5289 NULL);
5290
5291 TALLOC_FREE(br_lck);
5292
5293 if (NT_STATUS_V(status)) {
5294 reply_nterror(req, status);
5295 END_PROFILE(SMBlock);
5296 return;
5297 }
5298
5299 reply_outbuf(req, 0, 0);
5300
5301 END_PROFILE(SMBlock);
5302 return;
5303 }
5304
5305 /****************************************************************************
5306 Reply to a unlock.
5307 ****************************************************************************/
5308
5309 void reply_unlock(struct smb_request *req)
5310 {
5311 connection_struct *conn = req->conn;
5312 uint64_t count,offset;
5313 NTSTATUS status;
5314 files_struct *fsp;
5315
5316 START_PROFILE(SMBunlock);
5317
5318 if (req->wct < 5) {
5319 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5320 END_PROFILE(SMBunlock);
5321 return;
5322 }
5323
5324 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5325
5326 if (!check_fsp(conn, req, fsp)) {
5327 END_PROFILE(SMBunlock);
5328 return;
5329 }
5330
5331 count = (uint64_t)IVAL(req->vwv+1, 0);
5332 offset = (uint64_t)IVAL(req->vwv+3, 0);
5333
5334 status = do_unlock(req->sconn->msg_ctx,
5335 fsp,
5336 (uint64_t)req->smbpid,
5337 count,
5338 offset,
5339 WINDOWS_LOCK);
5340
5341 if (NT_STATUS_V(status)) {
5342 reply_nterror(req, status);
5343 END_PROFILE(SMBunlock);
5344 return;
5345 }
5346
5347 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5348 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5349
5350 reply_outbuf(req, 0, 0);
5351
5352 END_PROFILE(SMBunlock);
5353 return;
5354 }
5355
5356 #undef DBGC_CLASS
5357 #define DBGC_CLASS DBGC_ALL
5358
5359 /****************************************************************************
5360 Reply to a tdis.
5361 conn POINTER CAN BE NULL HERE !
5362 ****************************************************************************/
5363
5364 void reply_tdis(struct smb_request *req)
5365 {
5366 NTSTATUS status;
5367 connection_struct *conn = req->conn;
5368 struct smbXsrv_tcon *tcon;
5369
5370 START_PROFILE(SMBtdis);
5371
5372 if (!conn) {
5373 DEBUG(4,("Invalid connection in tdis\n"));
5374 reply_force_doserror(req, ERRSRV, ERRinvnid);
5375 END_PROFILE(SMBtdis);
5376 return;
5377 }
5378
5379 tcon = conn->tcon;
5380 req->conn = NULL;
5381
5382 /*
5383 * TODO: cancel all outstanding requests on the tcon
5384 */
5385 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5386 if (!NT_STATUS_IS_OK(status)) {
5387 DEBUG(0, ("reply_tdis: "
5388 "smbXsrv_tcon_disconnect() failed: %s\n",
5389 nt_errstr(status)));
5390 /*
5391 * If we hit this case, there is something completely
5392 * wrong, so we better disconnect the transport connection.
5393 */
5394 END_PROFILE(SMBtdis);
5395 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5396 return;
5397 }
5398
5399 TALLOC_FREE(tcon);
5400
5401 reply_outbuf(req, 0, 0);
5402 END_PROFILE(SMBtdis);
5403 return;
5404 }
5405
5406 /****************************************************************************
5407 Reply to a echo.
5408 conn POINTER CAN BE NULL HERE !
5409 ****************************************************************************/
5410
5411 void reply_echo(struct smb_request *req)
5412 {
5413 connection_struct *conn = req->conn;
5414 struct smb_perfcount_data local_pcd;
5415 struct smb_perfcount_data *cur_pcd;
5416 int smb_reverb;
5417 int seq_num;
5418
5419 START_PROFILE(SMBecho);
5420
5421 smb_init_perfcount_data(&local_pcd);
5422
5423 if (req->wct < 1) {
5424 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5425 END_PROFILE(SMBecho);
5426 return;
5427 }
5428
5429 smb_reverb = SVAL(req->vwv+0, 0);
5430
5431 reply_outbuf(req, 1, req->buflen);
5432
5433 /* copy any incoming data back out */
5434 if (req->buflen > 0) {
5435 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5436 }
5437
5438 if (smb_reverb > 100) {
5439 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5440 smb_reverb = 100;
5441 }
5442
5443 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5444
5445 /* this makes sure we catch the request pcd */
5446 if (seq_num == smb_reverb) {
5447 cur_pcd = &req->pcd;
5448 } else {
5449 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5450 cur_pcd = &local_pcd;
5451 }
5452
5453 SSVAL(req->outbuf,smb_vwv0,seq_num);
5454
5455 show_msg((char *)req->outbuf);
5456 if (!srv_send_smb(req->sconn,
5457 (char *)req->outbuf,
5458 true, req->seqnum+1,
5459 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5460 cur_pcd))
5461 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5462 }
5463
5464 DEBUG(3,("echo %d times\n", smb_reverb));
5465
5466 TALLOC_FREE(req->outbuf);
5467
5468 END_PROFILE(SMBecho);
5469 return;
5470 }
5471
5472 /****************************************************************************
5473 Reply to a printopen.
5474 ****************************************************************************/
5475
5476 void reply_printopen(struct smb_request *req)
5477 {
5478 connection_struct *conn = req->conn;
5479 files_struct *fsp;
5480 NTSTATUS status;
5481
5482 START_PROFILE(SMBsplopen);
5483
5484 if (req->wct < 2) {
5485 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5486 END_PROFILE(SMBsplopen);
5487 return;
5488 }
5489
5490 if (!CAN_PRINT(conn)) {
5491 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5492 END_PROFILE(SMBsplopen);
5493 return;
5494 }
5495
5496 status = file_new(req, conn, &fsp);
5497 if(!NT_STATUS_IS_OK(status)) {
5498 reply_nterror(req, status);
5499 END_PROFILE(SMBsplopen);
5500 return;
5501 }
5502
5503 /* Open for exclusive use, write only. */
5504 status = print_spool_open(fsp, NULL, req->vuid);
5505
5506 if (!NT_STATUS_IS_OK(status)) {
5507 file_free(req, fsp);
5508 reply_nterror(req, status);
5509 END_PROFILE(SMBsplopen);
5510 return;
5511 }
5512
5513 reply_outbuf(req, 1, 0);
5514 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5515
5516 DEBUG(3,("openprint fd=%d %s\n",
5517 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5518
5519 END_PROFILE(SMBsplopen);
5520 return;
5521 }
5522
5523 /****************************************************************************
5524 Reply to a printclose.
5525 ****************************************************************************/
5526
5527 void reply_printclose(struct smb_request *req)
5528 {
5529 connection_struct *conn = req->conn;
5530 files_struct *fsp;
5531 NTSTATUS status;
5532
5533 START_PROFILE(SMBsplclose);
5534
5535 if (req->wct < 1) {
5536 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5537 END_PROFILE(SMBsplclose);
5538 return;
5539 }
5540
5541 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5542
5543 if (!check_fsp(conn, req, fsp)) {
5544 END_PROFILE(SMBsplclose);
5545 return;
5546 }
5547
5548 if (!CAN_PRINT(conn)) {
5549 reply_force_doserror(req, ERRSRV, ERRerror);
5550 END_PROFILE(SMBsplclose);
5551 return;
5552 }
5553
5554 DEBUG(3,("printclose fd=%d %s\n",
5555 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5556
5557 status = close_file(req, fsp, NORMAL_CLOSE);
5558
5559 if(!NT_STATUS_IS_OK(status)) {
5560 reply_nterror(req, status);
5561 END_PROFILE(SMBsplclose);
5562 return;
5563 }
5564
5565 reply_outbuf(req, 0, 0);
5566
5567 END_PROFILE(SMBsplclose);
5568 return;
5569 }
5570
5571 /****************************************************************************
5572 Reply to a printqueue.
5573 ****************************************************************************/
5574
5575 void reply_printqueue(struct smb_request *req)
5576 {
5577 connection_struct *conn = req->conn;
5578 int max_count;
5579 int start_index;
5580
5581 START_PROFILE(SMBsplretq);
5582
5583 if (req->wct < 2) {
5584 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5585 END_PROFILE(SMBsplretq);
5586 return;
5587 }
5588
5589 max_count = SVAL(req->vwv+0, 0);
5590 start_index = SVAL(req->vwv+1, 0);
5591
5592 /* we used to allow the client to get the cnum wrong, but that
5593 is really quite gross and only worked when there was only
5594 one printer - I think we should now only accept it if they
5595 get it right (tridge) */
5596 if (!CAN_PRINT(conn)) {
5597 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5598 END_PROFILE(SMBsplretq);
5599 return;
5600 }
5601
5602 reply_outbuf(req, 2, 3);
5603 SSVAL(req->outbuf,smb_vwv0,0);
5604 SSVAL(req->outbuf,smb_vwv1,0);
5605 SCVAL(smb_buf(req->outbuf),0,1);
5606 SSVAL(smb_buf(req->outbuf),1,0);
5607
5608 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5609 start_index, max_count));
5610
5611 {
5612 TALLOC_CTX *mem_ctx = talloc_tos();
5613 NTSTATUS status;
5614 WERROR werr;
5615 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5616 struct rpc_pipe_client *cli = NULL;
5617 struct dcerpc_binding_handle *b = NULL;
5618 struct policy_handle handle;
5619 struct spoolss_DevmodeContainer devmode_ctr;
5620 union spoolss_JobInfo *info;
5621 uint32_t count;
5622 uint32_t num_to_get;
5623 uint32_t first;
5624 uint32_t i;
5625
5626 ZERO_STRUCT(handle);
5627
5628 status = rpc_pipe_open_interface(conn,
5629 &ndr_table_spoolss,
5630 conn->session_info,
5631 conn->sconn->remote_address,
5632 conn->sconn->msg_ctx,
5633 &cli);
5634 if (!NT_STATUS_IS_OK(status)) {
5635 DEBUG(0, ("reply_printqueue: "
5636 "could not connect to spoolss: %s\n",
5637 nt_errstr(status)));
5638 reply_nterror(req, status);
5639 goto out;
5640 }
5641 b = cli->binding_handle;
5642
5643 ZERO_STRUCT(devmode_ctr);
5644
5645 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5646 sharename,
5647 NULL, devmode_ctr,
5648 SEC_FLAG_MAXIMUM_ALLOWED,
5649 &handle,
5650 &werr);
5651 if (!NT_STATUS_IS_OK(status)) {
5652 reply_nterror(req, status);
5653 goto out;
5654 }
5655 if (!W_ERROR_IS_OK(werr)) {
5656 reply_nterror(req, werror_to_ntstatus(werr));
5657 goto out;
5658 }
5659
5660 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5661 &handle,
5662 0, /* firstjob */
5663 0xff, /* numjobs */
5664 2, /* level */
5665 0, /* offered */
5666 &count,
5667 &info);
5668 if (!W_ERROR_IS_OK(werr)) {
5669 reply_nterror(req, werror_to_ntstatus(werr));
5670 goto out;
5671 }
5672
5673 if (max_count > 0) {
5674 first = start_index;
5675 } else {
5676 first = start_index + max_count + 1;
5677 }
5678
5679 if (first >= count) {
5680 num_to_get = first;
5681 } else {
5682 num_to_get = first + MIN(ABS(max_count), count - first);
5683 }
5684
5685 for (i = first; i < num_to_get; i++) {
5686 char blob[28];
5687 char *p = blob;
5688 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5689 int qstatus;
5690 uint16_t qrapjobid = pjobid_to_rap(sharename,
5691 info[i].info2.job_id);
5692
5693 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5694 qstatus = 2;
5695 } else {
5696 qstatus = 3;
5697 }
5698
5699 srv_put_dos_date2(p, 0, qtime);
5700 SCVAL(p, 4, qstatus);
5701 SSVAL(p, 5, qrapjobid);
5702 SIVAL(p, 7, info[i].info2.size);
5703 SCVAL(p, 11, 0);
5704 srvstr_push(blob, req->flags2, p+12,
5705 info[i].info2.notify_name, 16, STR_ASCII);
5706
5707 if (message_push_blob(
5708 &req->outbuf,
5709 data_blob_const(
5710 blob, sizeof(blob))) == -1) {
5711 reply_nterror(req, NT_STATUS_NO_MEMORY);
5712 goto out;
5713 }
5714 }
5715
5716 if (count > 0) {
5717 SSVAL(req->outbuf,smb_vwv0,count);
5718 SSVAL(req->outbuf,smb_vwv1,
5719 (max_count>0?first+count:first-1));
5720 SCVAL(smb_buf(req->outbuf),0,1);
5721 SSVAL(smb_buf(req->outbuf),1,28*count);
5722 }
5723
5724
5725 DEBUG(3, ("%u entries returned in queue\n",
5726 (unsigned)count));
5727
5728 out:
5729 if (b && is_valid_policy_hnd(&handle)) {
5730 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5731 }
5732
5733 }
5734
5735 END_PROFILE(SMBsplretq);
5736 return;
5737 }
5738
5739 /****************************************************************************
5740 Reply to a printwrite.
5741 ****************************************************************************/
5742
5743 void reply_printwrite(struct smb_request *req)
5744 {
5745 connection_struct *conn = req->conn;
5746 int numtowrite;
5747 const char *data;
5748 files_struct *fsp;
5749
5750 START_PROFILE(SMBsplwr);
5751
5752 if (req->wct < 1) {
5753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5754 END_PROFILE(SMBsplwr);
5755 return;
5756 }
5757
5758 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5759
5760 if (!check_fsp(conn, req, fsp)) {
5761 END_PROFILE(SMBsplwr);
5762 return;
5763 }
5764
5765 if (!fsp->print_file) {
5766 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5767 END_PROFILE(SMBsplwr);
5768 return;
5769 }
5770
5771 if (!CHECK_WRITE(fsp)) {
5772 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5773 END_PROFILE(SMBsplwr);
5774 return;
5775 }
5776
5777 numtowrite = SVAL(req->buf, 1);
5778
5779 if (req->buflen < numtowrite + 3) {
5780 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5781 END_PROFILE(SMBsplwr);
5782 return;
5783 }
5784
5785 data = (const char *)req->buf + 3;
5786
5787 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5788 reply_nterror(req, map_nt_error_from_unix(errno));
5789 END_PROFILE(SMBsplwr);
5790 return;
5791 }
5792
5793 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5794
5795 END_PROFILE(SMBsplwr);
5796 return;
5797 }
5798
5799 /****************************************************************************
5800 Reply to a mkdir.
5801 ****************************************************************************/
5802
5803 void reply_mkdir(struct smb_request *req)
5804 {
5805 connection_struct *conn = req->conn;
5806 struct smb_filename *smb_dname = NULL;
5807 char *directory = NULL;
5808 NTSTATUS status;
5809 TALLOC_CTX *ctx = talloc_tos();
5810
5811 START_PROFILE(SMBmkdir);
5812
5813 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5814 STR_TERMINATE, &status);
5815 if (!NT_STATUS_IS_OK(status)) {
5816 reply_nterror(req, status);
5817 goto out;
5818 }
5819
5820 status = filename_convert(ctx, conn,
5821 req->flags2 & FLAGS2_DFS_PATHNAMES,
5822 directory,
5823 UCF_CREATING_FILE,
5824 NULL,
5825 &smb_dname);
5826 if (!NT_STATUS_IS_OK(status)) {
5827 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5828 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5829 ERRSRV, ERRbadpath);
5830 goto out;
5831 }
5832 reply_nterror(req, status);
5833 goto out;
5834 }
5835
5836 status = create_directory(conn, req, smb_dname);
5837
5838 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5839
5840 if (!NT_STATUS_IS_OK(status)) {
5841
5842 if (!use_nt_status()
5843 && NT_STATUS_EQUAL(status,
5844 NT_STATUS_OBJECT_NAME_COLLISION)) {
5845 /*
5846 * Yes, in the DOS error code case we get a
5847 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5848 * samba4 torture test.
5849 */
5850 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5851 }
5852
5853 reply_nterror(req, status);
5854 goto out;
5855 }
5856
5857 reply_outbuf(req, 0, 0);
5858
5859 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5860 out:
5861 TALLOC_FREE(smb_dname);
5862 END_PROFILE(SMBmkdir);
5863 return;
5864 }
5865
5866 /****************************************************************************
5867 Reply to a rmdir.
5868 ****************************************************************************/
5869
5870 void reply_rmdir(struct smb_request *req)
5871 {
5872 connection_struct *conn = req->conn;
5873 struct smb_filename *smb_dname = NULL;
5874 char *directory = NULL;
5875 NTSTATUS status;
5876 TALLOC_CTX *ctx = talloc_tos();
5877 files_struct *fsp = NULL;
5878 int info = 0;
5879 struct smbd_server_connection *sconn = req->sconn;
5880
5881 START_PROFILE(SMBrmdir);
5882
5883 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5884 STR_TERMINATE, &status);
5885 if (!NT_STATUS_IS_OK(status)) {
5886 reply_nterror(req, status);
5887 goto out;
5888 }
5889
5890 status = filename_convert(ctx, conn,
5891 req->flags2 & FLAGS2_DFS_PATHNAMES,
5892 directory,
5893 0,
5894 NULL,
5895 &smb_dname);
5896 if (!NT_STATUS_IS_OK(status)) {
5897 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5898 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5899 ERRSRV, ERRbadpath);
5900 goto out;
5901 }
5902 reply_nterror(req, status);
5903 goto out;
5904 }
5905
5906 if (is_ntfs_stream_smb_fname(smb_dname)) {
5907 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5908 goto out;
5909 }
5910
5911 status = SMB_VFS_CREATE_FILE(
5912 conn, /* conn */
5913 req, /* req */
5914 0, /* root_dir_fid */
5915 smb_dname, /* fname */
5916 DELETE_ACCESS, /* access_mask */
5917 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5918 FILE_SHARE_DELETE),
5919 FILE_OPEN, /* create_disposition*/
5920 FILE_DIRECTORY_FILE, /* create_options */
5921 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5922 0, /* oplock_request */
5923 0, /* allocation_size */
5924 0, /* private_flags */
5925 NULL, /* sd */
5926 NULL, /* ea_list */
5927 &fsp, /* result */
5928 &info); /* pinfo */
5929
5930 if (!NT_STATUS_IS_OK(status)) {
5931 if (open_was_deferred(req->sconn, req->mid)) {
5932 /* We have re-scheduled this call. */
5933 goto out;
5934 }
5935 reply_nterror(req, status);
5936 goto out;
5937 }
5938
5939 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5940 if (!NT_STATUS_IS_OK(status)) {
5941 close_file(req, fsp, ERROR_CLOSE);
5942 reply_nterror(req, status);
5943 goto out;
5944 }
5945
5946 if (!set_delete_on_close(fsp, true,
5947 conn->session_info->security_token,
5948 conn->session_info->unix_token)) {
5949 close_file(req, fsp, ERROR_CLOSE);
5950 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5951 goto out;
5952 }
5953
5954 status = close_file(req, fsp, NORMAL_CLOSE);
5955 if (!NT_STATUS_IS_OK(status)) {
5956 reply_nterror(req, status);
5957 } else {
5958 reply_outbuf(req, 0, 0);
5959 }
5960
5961 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5962
5963 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5964 out:
5965 TALLOC_FREE(smb_dname);
5966 END_PROFILE(SMBrmdir);
5967 return;
5968 }
5969
5970 /*******************************************************************
5971 Resolve wildcards in a filename rename.
5972 ********************************************************************/
5973
5974 static bool resolve_wildcards(TALLOC_CTX *ctx,
5975 const char *name1,
5976 const char *name2,
5977 char **pp_newname)
5978 {
5979 char *name2_copy = NULL;
5980 char *root1 = NULL;
5981 char *root2 = NULL;
5982 char *ext1 = NULL;
5983 char *ext2 = NULL;
5984 char *p,*p2, *pname1, *pname2;
5985
5986 name2_copy = talloc_strdup(ctx, name2);
5987 if (!name2_copy) {
5988 return False;
5989 }
5990
5991 pname1 = strrchr_m(name1,'/');
5992 pname2 = strrchr_m(name2_copy,'/');
5993
5994 if (!pname1 || !pname2) {
5995 return False;
5996 }
5997
5998 /* Truncate the copy of name2 at the last '/' */
5999 *pname2 = '\0';
6000
6001 /* Now go past the '/' */
6002 pname1++;
6003 pname2++;
6004
6005 root1 = talloc_strdup(ctx, pname1);
6006 root2 = talloc_strdup(ctx, pname2);
6007
6008 if (!root1 || !root2) {
6009 return False;
6010 }
6011
6012 p = strrchr_m(root1,'.');
6013 if (p) {
6014 *p = 0;
6015 ext1 = talloc_strdup(ctx, p+1);
6016 } else {
6017 ext1 = talloc_strdup(ctx, "");
6018 }
6019 p = strrchr_m(root2,'.');
6020 if (p) {
6021 *p = 0;
6022 ext2 = talloc_strdup(ctx, p+1);
6023 } else {
6024 ext2 = talloc_strdup(ctx, "");
6025 }
6026
6027 if (!ext1 || !ext2) {
6028 return False;
6029 }
6030
6031 p = root1;
6032 p2 = root2;
6033 while (*p2) {
6034 if (*p2 == '?') {
6035 /* Hmmm. Should this be mb-aware ? */
6036 *p2 = *p;
6037 p2++;
6038 } else if (*p2 == '*') {
6039 *p2 = '\0';
6040 root2 = talloc_asprintf(ctx, "%s%s",
6041 root2,
6042 p);
6043 if (!root2) {
6044 return False;
6045 }
6046 break;
6047 } else {
6048 p2++;
6049 }
6050 if (*p) {
6051 p++;
6052 }
6053 }
6054
6055 p = ext1;
6056 p2 = ext2;
6057 while (*p2) {
6058 if (*p2 == '?') {
6059 /* Hmmm. Should this be mb-aware ? */
6060 *p2 = *p;
6061 p2++;
6062 } else if (*p2 == '*') {
6063 *p2 = '\0';
6064 ext2 = talloc_asprintf(ctx, "%s%s",
6065 ext2,
6066 p);
6067 if (!ext2) {
6068 return False;
6069 }
6070 break;
6071 } else {
6072 p2++;
6073 }
6074 if (*p) {
6075 p++;
6076 }
6077 }
6078
6079 if (*ext2) {
6080 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6081 name2_copy,
6082 root2,
6083 ext2);
6084 } else {
6085 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6086 name2_copy,
6087 root2);
6088 }
6089
6090 if (!*pp_newname) {
6091 return False;
6092 }
6093
6094 return True;
6095 }
6096
6097 /****************************************************************************
6098 Ensure open files have their names updated. Updated to notify other smbd's
6099 asynchronously.
6100 ****************************************************************************/
6101
6102 static void rename_open_files(connection_struct *conn,
6103 struct share_mode_lock *lck,
6104 uint32_t orig_name_hash,
6105 const struct smb_filename *smb_fname_dst)
6106 {
6107 files_struct *fsp;
6108 bool did_rename = False;
6109 NTSTATUS status;
6110 uint32_t new_name_hash = 0;
6111
6112 for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6113 fsp = file_find_di_next(fsp)) {
6114 /* fsp_name is a relative path under the fsp. To change this for other
6115 sharepaths we need to manipulate relative paths. */
6116 /* TODO - create the absolute path and manipulate the newname
6117 relative to the sharepath. */
6118 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6119 continue;
6120 }
6121 if (fsp->name_hash != orig_name_hash) {
6122 continue;
6123 }
6124 DEBUG(10, ("rename_open_files: renaming file %s "
6125 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6126 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6127 smb_fname_str_dbg(smb_fname_dst)));
6128
6129 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6130 if (NT_STATUS_IS_OK(status)) {
6131 did_rename = True;
6132 new_name_hash = fsp->name_hash;
6133 }
6134 }
6135
6136 if (!did_rename) {
6137 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6138 "for %s\n", file_id_string_tos(&lck->data->id),
6139 smb_fname_str_dbg(smb_fname_dst)));
6140 }
6141
6142 /* Send messages to all smbd's (not ourself) that the name has changed. */
6143 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6144 orig_name_hash, new_name_hash,
6145 smb_fname_dst);
6146
6147 }
6148
6149 /****************************************************************************
6150 We need to check if the source path is a parent directory of the destination
6151 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6152 refuse the rename with a sharing violation. Under UNIX the above call can
6153 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6154 probably need to check that the client is a Windows one before disallowing
6155 this as a UNIX client (one with UNIX extensions) can know the source is a
6156 symlink and make this decision intelligently. Found by an excellent bug
6157 report from <AndyLiebman@aol.com>.
6158 ****************************************************************************/
6159
6160 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6161 const struct smb_filename *smb_fname_dst)
6162 {
6163 const char *psrc = smb_fname_src->base_name;
6164 const char *pdst = smb_fname_dst->base_name;
6165 size_t slen;
6166
6167 if (psrc[0] == '.' && psrc[1] == '/') {
6168 psrc += 2;
6169 }
6170 if (pdst[0] == '.' && pdst[1] == '/') {
6171 pdst += 2;
6172 }
6173 if ((slen = strlen(psrc)) > strlen(pdst)) {
6174 return False;
6175 }
6176 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6177 }
6178
6179 /*
6180 * Do the notify calls from a rename
6181 */
6182
6183 static void notify_rename(connection_struct *conn, bool is_dir,
6184 const struct smb_filename *smb_fname_src,
6185 const struct smb_filename *smb_fname_dst)
6186 {
6187 char *parent_dir_src = NULL;
6188 char *parent_dir_dst = NULL;
6189 uint32 mask;
6190
6191 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6192 : FILE_NOTIFY_CHANGE_FILE_NAME;
6193
6194 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6195 &parent_dir_src, NULL) ||
6196 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6197 &parent_dir_dst, NULL)) {
6198 goto out;
6199 }
6200
6201 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6202 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6203 smb_fname_src->base_name);
6204 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6205 smb_fname_dst->base_name);
6206 }
6207 else {
6208 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6209 smb_fname_src->base_name);
6210 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6211 smb_fname_dst->base_name);
6212 }
6213
6214 /* this is a strange one. w2k3 gives an additional event for
6215 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6216 files, but not directories */
6217 if (!is_dir) {
6218 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6219 FILE_NOTIFY_CHANGE_ATTRIBUTES
6220 |FILE_NOTIFY_CHANGE_CREATION,
6221 smb_fname_dst->base_name);
6222 }
6223 out:
6224 TALLOC_FREE(parent_dir_src);
6225 TALLOC_FREE(parent_dir_dst);
6226 }
6227
6228 /****************************************************************************
6229 Returns an error if the parent directory for a filename is open in an
6230 incompatible way.
6231 ****************************************************************************/
6232
6233 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6234 const struct smb_filename *smb_fname_dst_in)
6235 {
6236 char *parent_dir = NULL;
6237 struct smb_filename smb_fname_parent;
6238 struct file_id id;
6239 files_struct *fsp = NULL;
6240 int ret;
6241
6242 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6243 &parent_dir, NULL)) {
6244 return NT_STATUS_NO_MEMORY;
6245 }
6246 ZERO_STRUCT(smb_fname_parent);
6247 smb_fname_parent.base_name = parent_dir;
6248
6249 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6250 if (ret == -1) {
6251 return map_nt_error_from_unix(errno);
6252 }
6253
6254 /*
6255 * We're only checking on this smbd here, mostly good
6256 * enough.. and will pass tests.
6257 */
6258
6259 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6260 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6261 fsp = file_find_di_next(fsp)) {
6262 if (fsp->access_mask & DELETE_ACCESS) {
6263 return NT_STATUS_SHARING_VIOLATION;
6264 }
6265 }
6266 return NT_STATUS_OK;
6267 }
6268
6269 /****************************************************************************
6270 Rename an open file - given an fsp.
6271 ****************************************************************************/
6272
6273 NTSTATUS rename_internals_fsp(connection_struct *conn,
6274 files_struct *fsp,
6275 const struct smb_filename *smb_fname_dst_in,
6276 uint32 attrs,
6277 bool replace_if_exists)
6278 {
6279 TALLOC_CTX *ctx = talloc_tos();
6280 struct smb_filename *smb_fname_dst = NULL;
6281 NTSTATUS status = NT_STATUS_OK;
6282 struct share_mode_lock *lck = NULL;
6283 bool dst_exists, old_is_stream, new_is_stream;
6284
6285 status = check_name(conn, smb_fname_dst_in->base_name);
6286 if (!NT_STATUS_IS_OK(status)) {
6287 return status;
6288 }
6289
6290 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6291 if (!NT_STATUS_IS_OK(status)) {
6292 return status;
6293 }
6294
6295 /* Make a copy of the dst smb_fname structs */
6296
6297 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6298 if (smb_fname_dst == NULL) {
6299 status = NT_STATUS_NO_MEMORY;
6300 goto out;
6301 }
6302
6303 /*
6304 * Check for special case with case preserving and not
6305 * case sensitive. If the old last component differs from the original
6306 * last component only by case, then we should allow
6307 * the rename (user is trying to change the case of the
6308 * filename).
6309 */
6310 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6311 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6312 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6313 char *last_slash;
6314 char *fname_dst_lcomp_base_mod = NULL;
6315 struct smb_filename *smb_fname_orig_lcomp = NULL;
6316
6317 /*
6318 * Get the last component of the destination name.
6319 */
6320 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6321 if (last_slash) {
6322 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6323 } else {
6324 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6325 }
6326 if (!fname_dst_lcomp_base_mod) {
6327 status = NT_STATUS_NO_MEMORY;
6328 goto out;
6329 }
6330
6331 /*
6332 * Create an smb_filename struct using the original last
6333 * component of the destination.
6334 */
6335 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6336 ctx, smb_fname_dst->original_lcomp, NULL);
6337 if (smb_fname_orig_lcomp == NULL) {
6338 status = NT_STATUS_NO_MEMORY;
6339 TALLOC_FREE(fname_dst_lcomp_base_mod);
6340 goto out;
6341 }
6342
6343 /* If the base names only differ by case, use original. */
6344 if(!strcsequal(fname_dst_lcomp_base_mod,
6345 smb_fname_orig_lcomp->base_name)) {
6346 char *tmp;
6347 /*
6348 * Replace the modified last component with the
6349 * original.
6350 */
6351 if (last_slash) {
6352 *last_slash = '\0'; /* Truncate at the '/' */
6353 tmp = talloc_asprintf(smb_fname_dst,
6354 "%s/%s",
6355 smb_fname_dst->base_name,
6356 smb_fname_orig_lcomp->base_name);
6357 } else {
6358 tmp = talloc_asprintf(smb_fname_dst,
6359 "%s",
6360 smb_fname_orig_lcomp->base_name);
6361 }
6362 if (tmp == NULL) {
6363 status = NT_STATUS_NO_MEMORY;
6364 TALLOC_FREE(fname_dst_lcomp_base_mod);
6365 TALLOC_FREE(smb_fname_orig_lcomp);
6366 goto out;
6367 }
6368 TALLOC_FREE(smb_fname_dst->base_name);
6369 smb_fname_dst->base_name = tmp;
6370 }
6371
6372 /* If the stream_names only differ by case, use original. */
6373 if(!strcsequal(smb_fname_dst->stream_name,
6374 smb_fname_orig_lcomp->stream_name)) {
6375 char *tmp = NULL;
6376 /* Use the original stream. */
6377 tmp = talloc_strdup(smb_fname_dst,
6378 smb_fname_orig_lcomp->stream_name);
6379 if (tmp == NULL) {
6380 status = NT_STATUS_NO_MEMORY;
6381 TALLOC_FREE(fname_dst_lcomp_base_mod);
6382 TALLOC_FREE(smb_fname_orig_lcomp);
6383 goto out;
6384 }
6385 TALLOC_FREE(smb_fname_dst->stream_name);
6386 smb_fname_dst->stream_name = tmp;
6387 }
6388 TALLOC_FREE(fname_dst_lcomp_base_mod);
6389 TALLOC_FREE(smb_fname_orig_lcomp);
6390 }
6391
6392 /*
6393 * If the src and dest names are identical - including case,
6394 * don't do the rename, just return success.
6395 */
6396
6397 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6398 strcsequal(fsp->fsp_name->stream_name,
6399 smb_fname_dst->stream_name)) {
6400 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6401 "- returning success\n",
6402 smb_fname_str_dbg(smb_fname_dst)));
6403 status = NT_STATUS_OK;
6404 goto out;
6405 }
6406
6407 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6408 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6409
6410 /* Return the correct error code if both names aren't streams. */
6411 if (!old_is_stream && new_is_stream) {
6412 status = NT_STATUS_OBJECT_NAME_INVALID;
6413 goto out;
6414 }
6415
6416 if (old_is_stream && !new_is_stream) {
6417 status = NT_STATUS_INVALID_PARAMETER;
6418 goto out;
6419 }
6420
6421 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6422
6423 if(!replace_if_exists && dst_exists) {
6424 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6425 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6426 smb_fname_str_dbg(smb_fname_dst)));
6427 status = NT_STATUS_OBJECT_NAME_COLLISION;
6428 goto out;
6429 }
6430
6431 if (dst_exists) {
6432 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6433 &smb_fname_dst->st);
6434 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6435 fileid);
6436 /* The file can be open when renaming a stream */
6437 if (dst_fsp && !new_is_stream) {
6438 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6439 status = NT_STATUS_ACCESS_DENIED;
6440 goto out;
6441 }
6442 }
6443
6444 /* Ensure we have a valid stat struct for the source. */
6445 status = vfs_stat_fsp(fsp);
6446 if (!NT_STATUS_IS_OK(status)) {
6447 goto out;
6448 }
6449
6450 status = can_rename(conn, fsp, attrs);
6451
6452 if (!NT_STATUS_IS_OK(status)) {
6453 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6454 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6455 smb_fname_str_dbg(smb_fname_dst)));
6456 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6457 status = NT_STATUS_ACCESS_DENIED;
6458 goto out;
6459 }
6460
6461 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6462 status = NT_STATUS_ACCESS_DENIED;
6463 }
6464
6465 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6466
6467 /*
6468 * We have the file open ourselves, so not being able to get the
6469 * corresponding share mode lock is a fatal error.
6470 */
6471
6472 SMB_ASSERT(lck != NULL);
6473
6474 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6475 uint32 create_options = fsp->fh->private_options;
6476
6477 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6478 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6479 smb_fname_str_dbg(smb_fname_dst)));
6480
6481 if (!fsp->is_directory &&
6482 !lp_posix_pathnames() &&
6483 (lp_map_archive(SNUM(conn)) ||
6484 lp_store_dos_attributes(SNUM(conn)))) {
6485 /* We must set the archive bit on the newly
6486 renamed file. */
6487 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6488 uint32_t old_dosmode = dos_mode(conn,
6489 smb_fname_dst);
6490 file_set_dosmode(conn,
6491 smb_fname_dst,
6492 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6493 NULL,
6494 true);
6495 }
6496 }
6497
6498 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6499 smb_fname_dst);
6500
6501 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6502
6503 /*
6504 * A rename acts as a new file create w.r.t. allowing an initial delete
6505 * on close, probably because in Windows there is a new handle to the
6506 * new file. If initial delete on close was requested but not
6507 * originally set, we need to set it here. This is probably not 100% correct,
6508 * but will work for the CIFSFS client which in non-posix mode
6509 * depends on these semantics. JRA.
6510 */
6511
6512 if (create_options & FILE_DELETE_ON_CLOSE) {
6513 status = can_set_delete_on_close(fsp, 0);
6514
6515 if (NT_STATUS_IS_OK(status)) {
6516 /* Note that here we set the *inital* delete on close flag,
6517 * not the regular one. The magic gets handled in close. */
6518 fsp->initial_delete_on_close = True;
6519 }
6520 }
6521 TALLOC_FREE(lck);
6522 status = NT_STATUS_OK;
6523 goto out;
6524 }
6525
6526 TALLOC_FREE(lck);
6527
6528 if (errno == ENOTDIR || errno == EISDIR) {
6529 status = NT_STATUS_OBJECT_NAME_COLLISION;
6530 } else {
6531 status = map_nt_error_from_unix(errno);
6532 }
6533
6534 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6535 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6536 smb_fname_str_dbg(smb_fname_dst)));
6537
6538 out:
6539 TALLOC_FREE(smb_fname_dst);
6540
6541 return status;
6542 }
6543
6544 /****************************************************************************
6545 The guts of the rename command, split out so it may be called by the NT SMB
6546 code.
6547 ****************************************************************************/
6548
6549 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6550 connection_struct *conn,
6551 struct smb_request *req,
6552 struct smb_filename *smb_fname_src,
6553 struct smb_filename *smb_fname_dst,
6554 uint32 attrs,
6555 bool replace_if_exists,
6556 bool src_has_wild,
6557 bool dest_has_wild,
6558 uint32_t access_mask)
6559 {
6560 char *fname_src_dir = NULL;
6561 char *fname_src_mask = NULL;
6562 int count=0;
6563 NTSTATUS status = NT_STATUS_OK;
6564 struct smb_Dir *dir_hnd = NULL;
6565 const char *dname = NULL;
6566 char *talloced = NULL;
6567 long offset = 0;
6568 int create_options = 0;
6569 bool posix_pathnames = lp_posix_pathnames();
6570 int rc;
6571
6572 /*
6573 * Split the old name into directory and last component
6574 * strings. Note that unix_convert may have stripped off a
6575 * leading ./ from both name and newname if the rename is
6576 * at the root of the share. We need to make sure either both
6577 * name and newname contain a / character or neither of them do
6578 * as this is checked in resolve_wildcards().
6579 */
6580
6581 /* Split up the directory from the filename/mask. */
6582 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6583 &fname_src_dir, &fname_src_mask);
6584 if (!NT_STATUS_IS_OK(status)) {
6585 status = NT_STATUS_NO_MEMORY;
6586 goto out;
6587 }
6588
6589 /*
6590 * We should only check the mangled cache
6591 * here if unix_convert failed. This means
6592 * that the path in 'mask' doesn't exist
6593 * on the file system and so we need to look
6594 * for a possible mangle. This patch from
6595 * Tine Smukavec <valentin.smukavec@hermes.si>.
6596 */
6597
6598 if (!VALID_STAT(smb_fname_src->st) &&
6599 mangle_is_mangled(fname_src_mask, conn->params)) {
6600 char *new_mask = NULL;
6601 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6602 conn->params);
6603 if (new_mask) {
6604 TALLOC_FREE(fname_src_mask);
6605 fname_src_mask = new_mask;
6606 }
6607 }
6608
6609 if (!src_has_wild) {
6610 files_struct *fsp;
6611
6612 /*
6613 * Only one file needs to be renamed. Append the mask back
6614 * onto the directory.
6615 */
6616 TALLOC_FREE(smb_fname_src->base_name);
6617 if (ISDOT(fname_src_dir)) {
6618 /* Ensure we use canonical names on open. */
6619 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6620 "%s",
6621 fname_src_mask);
6622 } else {
6623 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6624 "%s/%s",
6625 fname_src_dir,
6626 fname_src_mask);
6627 }
6628 if (!smb_fname_src->base_name) {
6629 status = NT_STATUS_NO_MEMORY;
6630 goto out;
6631 }
6632
6633 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6634 "case_preserve = %d, short case preserve = %d, "
6635 "directory = %s, newname = %s, "
6636 "last_component_dest = %s\n",
6637 conn->case_sensitive, conn->case_preserve,
6638 conn->short_case_preserve,
6639 smb_fname_str_dbg(smb_fname_src),
6640 smb_fname_str_dbg(smb_fname_dst),
6641 smb_fname_dst->original_lcomp));
6642
6643 /* The dest name still may have wildcards. */
6644 if (dest_has_wild) {
6645 char *fname_dst_mod = NULL;
6646 if (!resolve_wildcards(smb_fname_dst,
6647 smb_fname_src->base_name,
6648 smb_fname_dst->base_name,
6649 &fname_dst_mod)) {
6650 DEBUG(6, ("rename_internals: resolve_wildcards "
6651 "%s %s failed\n",
6652 smb_fname_src->base_name,
6653 smb_fname_dst->base_name));
6654 status = NT_STATUS_NO_MEMORY;
6655 goto out;
6656 }
6657 TALLOC_FREE(smb_fname_dst->base_name);
6658 smb_fname_dst->base_name = fname_dst_mod;
6659 }
6660
6661 ZERO_STRUCT(smb_fname_src->st);
6662 if (posix_pathnames) {
6663 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6664 } else {
6665 rc = SMB_VFS_STAT(conn, smb_fname_src);
6666 }
6667 if (rc == -1) {
6668 status = map_nt_error_from_unix_common(errno);
6669 goto out;
6670 }
6671
6672 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6673 create_options |= FILE_DIRECTORY_FILE;
6674 }
6675
6676 status = SMB_VFS_CREATE_FILE(
6677 conn, /* conn */
6678 req, /* req */
6679 0, /* root_dir_fid */
6680 smb_fname_src, /* fname */
6681 access_mask, /* access_mask */
6682 (FILE_SHARE_READ | /* share_access */
6683 FILE_SHARE_WRITE),
6684 FILE_OPEN, /* create_disposition*/
6685 create_options, /* create_options */
6686 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6687 0, /* oplock_request */
6688 0, /* allocation_size */
6689 0, /* private_flags */
6690 NULL, /* sd */
6691 NULL, /* ea_list */
6692 &fsp, /* result */
6693 NULL); /* pinfo */
6694
6695 if (!NT_STATUS_IS_OK(status)) {
6696 DEBUG(3, ("Could not open rename source %s: %s\n",
6697 smb_fname_str_dbg(smb_fname_src),
6698 nt_errstr(status)));
6699 goto out;
6700 }
6701
6702 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6703 attrs, replace_if_exists);
6704
6705 close_file(req, fsp, NORMAL_CLOSE);
6706
6707 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6708 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6709 smb_fname_str_dbg(smb_fname_dst)));
6710
6711 goto out;
6712 }
6713
6714 /*
6715 * Wildcards - process each file that matches.
6716 */
6717 if (strequal(fname_src_mask, "????????.???")) {
6718 TALLOC_FREE(fname_src_mask);
6719 fname_src_mask = talloc_strdup(ctx, "*");
6720 if (!fname_src_mask) {
6721 status = NT_STATUS_NO_MEMORY;
6722 goto out;
6723 }
6724 }
6725
6726 status = check_name(conn, fname_src_dir);
6727 if (!NT_STATUS_IS_OK(status)) {
6728 goto out;
6729 }
6730
6731 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6732 attrs);
6733 if (dir_hnd == NULL) {
6734 status = map_nt_error_from_unix(errno);
6735 goto out;
6736 }
6737
6738 status = NT_STATUS_NO_SUCH_FILE;
6739 /*
6740 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6741 * - gentest fix. JRA
6742 */
6743
6744 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6745 &talloced))) {
6746 files_struct *fsp = NULL;
6747 char *destname = NULL;
6748 bool sysdir_entry = False;
6749
6750 /* Quick check for "." and ".." */
6751 if (ISDOT(dname) || ISDOTDOT(dname)) {
6752 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6753 sysdir_entry = True;
6754 } else {
6755 TALLOC_FREE(talloced);
6756 continue;
6757 }
6758 }
6759
6760 if (!is_visible_file(conn, fname_src_dir, dname,
6761 &smb_fname_src->st, false)) {
6762 TALLOC_FREE(talloced);
6763 continue;
6764 }
6765
6766 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6767 TALLOC_FREE(talloced);
6768 continue;
6769 }
6770
6771 if (sysdir_entry) {
6772 status = NT_STATUS_OBJECT_NAME_INVALID;
6773 break;
6774 }
6775
6776 TALLOC_FREE(smb_fname_src->base_name);
6777 if (ISDOT(fname_src_dir)) {
6778 /* Ensure we use canonical names on open. */
6779 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6780 "%s",
6781 dname);
6782 } else {
6783 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6784 "%s/%s",
6785 fname_src_dir,
6786 dname);
6787 }
6788 if (!smb_fname_src->base_name) {
6789 status = NT_STATUS_NO_MEMORY;
6790 goto out;
6791 }
6792
6793 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6794 smb_fname_dst->base_name,
6795 &destname)) {
6796 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6797 smb_fname_src->base_name, destname));
6798 TALLOC_FREE(talloced);
6799 continue;
6800 }
6801 if (!destname) {
6802 status = NT_STATUS_NO_MEMORY;
6803 goto out;
6804 }
6805
6806 TALLOC_FREE(smb_fname_dst->base_name);
6807 smb_fname_dst->base_name = destname;
6808
6809 ZERO_STRUCT(smb_fname_src->st);
6810 if (posix_pathnames) {
6811 SMB_VFS_LSTAT(conn, smb_fname_src);
6812 } else {
6813 SMB_VFS_STAT(conn, smb_fname_src);
6814 }
6815
6816 create_options = 0;
6817
6818 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6819 create_options |= FILE_DIRECTORY_FILE;
6820 }
6821
6822 status = SMB_VFS_CREATE_FILE(
6823 conn, /* conn */
6824 req, /* req */
6825 0, /* root_dir_fid */
6826 smb_fname_src, /* fname */
6827 access_mask, /* access_mask */
6828 (FILE_SHARE_READ | /* share_access */
6829 FILE_SHARE_WRITE),
6830 FILE_OPEN, /* create_disposition*/
6831 create_options, /* create_options */
6832 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6833 0, /* oplock_request */
6834 0, /* allocation_size */
6835 0, /* private_flags */
6836 NULL, /* sd */
6837 NULL, /* ea_list */
6838 &fsp, /* result */
6839 NULL); /* pinfo */
6840
6841 if (!NT_STATUS_IS_OK(status)) {
6842 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6843 "returned %s rename %s -> %s\n",
6844 nt_errstr(status),
6845 smb_fname_str_dbg(smb_fname_src),
6846 smb_fname_str_dbg(smb_fname_dst)));
6847 break;
6848 }
6849
6850 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6851 dname);
6852 if (!smb_fname_dst->original_lcomp) {
6853 status = NT_STATUS_NO_MEMORY;
6854 goto out;
6855 }
6856
6857 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6858 attrs, replace_if_exists);
6859
6860 close_file(req, fsp, NORMAL_CLOSE);
6861
6862 if (!NT_STATUS_IS_OK(status)) {
6863 DEBUG(3, ("rename_internals_fsp returned %s for "
6864 "rename %s -> %s\n", nt_errstr(status),
6865 smb_fname_str_dbg(smb_fname_src),
6866 smb_fname_str_dbg(smb_fname_dst)));
6867 break;
6868 }
6869
6870 count++;
6871
6872 DEBUG(3,("rename_internals: doing rename on %s -> "
6873 "%s\n", smb_fname_str_dbg(smb_fname_src),
6874 smb_fname_str_dbg(smb_fname_src)));
6875 TALLOC_FREE(talloced);
6876 }
6877 TALLOC_FREE(dir_hnd);
6878
6879 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6880 status = map_nt_error_from_unix(errno);
6881 }
6882
6883 out:
6884 TALLOC_FREE(talloced);
6885 TALLOC_FREE(fname_src_dir);
6886 TALLOC_FREE(fname_src_mask);
6887 return status;
6888 }
6889
6890 /****************************************************************************
6891 Reply to a mv.
6892 ****************************************************************************/
6893
6894 void reply_mv(struct smb_request *req)
6895 {
6896 connection_struct *conn = req->conn;
6897 char *name = NULL;
6898 char *newname = NULL;
6899 const char *p;
6900 uint32 attrs;
6901 NTSTATUS status;
6902 bool src_has_wcard = False;
6903 bool dest_has_wcard = False;
6904 TALLOC_CTX *ctx = talloc_tos();
6905 struct smb_filename *smb_fname_src = NULL;
6906 struct smb_filename *smb_fname_dst = NULL;
6907 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6908 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6909 bool stream_rename = false;
6910
6911 START_PROFILE(SMBmv);
6912
6913 if (req->wct < 1) {
6914 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6915 goto out;
6916 }
6917
6918 attrs = SVAL(req->vwv+0, 0);
6919
6920 p = (const char *)req->buf + 1;
6921 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6922 &status, &src_has_wcard);
6923 if (!NT_STATUS_IS_OK(status)) {
6924 reply_nterror(req, status);
6925 goto out;
6926 }
6927 p++;
6928 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6929 &status, &dest_has_wcard);
6930 if (!NT_STATUS_IS_OK(status)) {
6931 reply_nterror(req, status);
6932 goto out;
6933 }
6934
6935 if (!lp_posix_pathnames()) {
6936 /* The newname must begin with a ':' if the
6937 name contains a ':'. */
6938 if (strchr_m(name, ':')) {
6939 if (newname[0] != ':') {
6940 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6941 goto out;
6942 }
6943 stream_rename = true;
6944 }
6945 }
6946
6947 status = filename_convert(ctx,
6948 conn,
6949 req->flags2 & FLAGS2_DFS_PATHNAMES,
6950 name,
6951 src_ucf_flags,
6952 &src_has_wcard,
6953 &smb_fname_src);
6954
6955 if (!NT_STATUS_IS_OK(status)) {
6956 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6957 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6958 ERRSRV, ERRbadpath);
6959 goto out;
6960 }
6961 reply_nterror(req, status);
6962 goto out;
6963 }
6964
6965 status = filename_convert(ctx,
6966 conn,
6967 req->flags2 & FLAGS2_DFS_PATHNAMES,
6968 newname,
6969 dst_ucf_flags,
6970 &dest_has_wcard,
6971 &smb_fname_dst);
6972
6973 if (!NT_STATUS_IS_OK(status)) {
6974 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6975 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6976 ERRSRV, ERRbadpath);
6977 goto out;
6978 }
6979 reply_nterror(req, status);
6980 goto out;
6981 }
6982
6983 if (stream_rename) {
6984 /* smb_fname_dst->base_name must be the same as
6985 smb_fname_src->base_name. */
6986 TALLOC_FREE(smb_fname_dst->base_name);
6987 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6988 smb_fname_src->base_name);
6989 if (!smb_fname_dst->base_name) {
6990 reply_nterror(req, NT_STATUS_NO_MEMORY);
6991 goto out;
6992 }
6993 }
6994
6995 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6996 smb_fname_str_dbg(smb_fname_dst)));
6997
6998 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6999 attrs, False, src_has_wcard, dest_has_wcard,
7000 DELETE_ACCESS);
7001 if (!NT_STATUS_IS_OK(status)) {
7002 if (open_was_deferred(req->sconn, req->mid)) {
7003 /* We have re-scheduled this call. */
7004 goto out;
7005 }
7006 reply_nterror(req, status);
7007 goto out;
7008 }
7009
7010 reply_outbuf(req, 0, 0);
7011 out:
7012 TALLOC_FREE(smb_fname_src);
7013 TALLOC_FREE(smb_fname_dst);
7014 END_PROFILE(SMBmv);
7015 return;
7016 }
7017
7018 /*******************************************************************
7019 Copy a file as part of a reply_copy.
7020 ******************************************************************/
7021
7022 /*
7023 * TODO: check error codes on all callers
7024 */
7025
7026 NTSTATUS copy_file(TALLOC_CTX *ctx,
7027 connection_struct *conn,
7028 struct smb_filename *smb_fname_src,
7029 struct smb_filename *smb_fname_dst,
7030 int ofun,
7031 int count,
7032 bool target_is_directory)
7033 {
7034 struct smb_filename *smb_fname_dst_tmp = NULL;
7035 off_t ret=-1;
7036 files_struct *fsp1,*fsp2;
7037 uint32 dosattrs;
7038 uint32 new_create_disposition;
7039 NTSTATUS status;
7040
7041
7042 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7043 if (smb_fname_dst_tmp == NULL) {
7044 return NT_STATUS_NO_MEMORY;
7045 }
7046
7047 /*
7048 * If the target is a directory, extract the last component from the
7049 * src filename and append it to the dst filename
7050 */
7051 if (target_is_directory) {
7052 const char *p;
7053
7054 /* dest/target can't be a stream if it's a directory. */
7055 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7056
7057 p = strrchr_m(smb_fname_src->base_name,'/');
7058 if (p) {
7059 p++;
7060 } else {
7061 p = smb_fname_src->base_name;
7062 }
7063 smb_fname_dst_tmp->base_name =
7064 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7065 p);
7066 if (!smb_fname_dst_tmp->base_name) {
7067 status = NT_STATUS_NO_MEMORY;
7068 goto out;
7069 }
7070 }
7071
7072 status = vfs_file_exist(conn, smb_fname_src);
7073 if (!NT_STATUS_IS_OK(status)) {
7074 goto out;
7075 }
7076
7077 if (!target_is_directory && count) {
7078 new_create_disposition = FILE_OPEN;
7079 } else {
7080 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7081 0, ofun,
7082 NULL, NULL,
7083 &new_create_disposition,
7084 NULL,
7085 NULL)) {
7086 status = NT_STATUS_INVALID_PARAMETER;
7087 goto out;
7088 }
7089 }
7090
7091 /* Open the src file for reading. */
7092 status = SMB_VFS_CREATE_FILE(
7093 conn, /* conn */
7094 NULL, /* req */
7095 0, /* root_dir_fid */
7096 smb_fname_src, /* fname */
7097 FILE_GENERIC_READ, /* access_mask */
7098 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7099 FILE_OPEN, /* create_disposition*/
7100 0, /* create_options */
7101 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7102 INTERNAL_OPEN_ONLY, /* oplock_request */
7103 0, /* allocation_size */
7104 0, /* private_flags */
7105 NULL, /* sd */
7106 NULL, /* ea_list */
7107 &fsp1, /* result */
7108 NULL); /* psbuf */
7109
7110 if (!NT_STATUS_IS_OK(status)) {
7111 goto out;
7112 }
7113
7114 dosattrs = dos_mode(conn, smb_fname_src);
7115
7116 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7117 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7118 }
7119
7120 /* Open the dst file for writing. */
7121 status = SMB_VFS_CREATE_FILE(
7122 conn, /* conn */
7123 NULL, /* req */
7124 0, /* root_dir_fid */
7125 smb_fname_dst, /* fname */
7126 FILE_GENERIC_WRITE, /* access_mask */
7127 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7128 new_create_disposition, /* create_disposition*/
7129 0, /* create_options */
7130 dosattrs, /* file_attributes */
7131 INTERNAL_OPEN_ONLY, /* oplock_request */
7132 0, /* allocation_size */
7133 0, /* private_flags */
7134 NULL, /* sd */
7135 NULL, /* ea_list */
7136 &fsp2, /* result */
7137 NULL); /* psbuf */
7138
7139 if (!NT_STATUS_IS_OK(status)) {
7140 close_file(NULL, fsp1, ERROR_CLOSE);
7141 goto out;
7142 }
7143
7144 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7145 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7146 if (ret == -1) {
7147 DEBUG(0, ("error - vfs lseek returned error %s\n",
7148 strerror(errno)));
7149 status = map_nt_error_from_unix(errno);
7150 close_file(NULL, fsp1, ERROR_CLOSE);
7151 close_file(NULL, fsp2, ERROR_CLOSE);
7152 goto out;
7153 }
7154 }
7155
7156 /* Do the actual copy. */
7157 if (smb_fname_src->st.st_ex_size) {
7158 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7159 } else {
7160 ret = 0;
7161 }
7162
7163 close_file(NULL, fsp1, NORMAL_CLOSE);
7164
7165 /* Ensure the modtime is set correctly on the destination file. */
7166 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7167
7168 /*
7169 * As we are opening fsp1 read-only we only expect
7170 * an error on close on fsp2 if we are out of space.
7171 * Thus we don't look at the error return from the
7172 * close of fsp1.
7173 */
7174 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7175
7176 if (!NT_STATUS_IS_OK(status)) {
7177 goto out;
7178 }
7179
7180 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7181 status = NT_STATUS_DISK_FULL;
7182 goto out;
7183 }
7184
7185 status = NT_STATUS_OK;
7186
7187 out:
7188 TALLOC_FREE(smb_fname_dst_tmp);
7189 return status;
7190 }
7191
7192 /****************************************************************************
7193 Reply to a file copy.
7194 ****************************************************************************/
7195
7196 void reply_copy(struct smb_request *req)
7197 {
7198 connection_struct *conn = req->conn;
7199 struct smb_filename *smb_fname_src = NULL;
7200 struct smb_filename *smb_fname_dst = NULL;
7201 char *fname_src = NULL;
7202 char *fname_dst = NULL;
7203 char *fname_src_mask = NULL;
7204 char *fname_src_dir = NULL;
7205 const char *p;
7206 int count=0;
7207 int error = ERRnoaccess;
7208 int tid2;
7209 int ofun;
7210 int flags;
7211 bool target_is_directory=False;
7212 bool source_has_wild = False;
7213 bool dest_has_wild = False;
7214 NTSTATUS status;
7215 TALLOC_CTX *ctx = talloc_tos();
7216
7217 START_PROFILE(SMBcopy);
7218
7219 if (req->wct < 3) {
7220 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7221 goto out;
7222 }
7223
7224 tid2 = SVAL(req->vwv+0, 0);
7225 ofun = SVAL(req->vwv+1, 0);
7226 flags = SVAL(req->vwv+2, 0);
7227
7228 p = (const char *)req->buf;
7229 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7230 &status, &source_has_wild);
7231 if (!NT_STATUS_IS_OK(status)) {
7232 reply_nterror(req, status);
7233 goto out;
7234 }
7235 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7236 &status, &dest_has_wild);
7237 if (!NT_STATUS_IS_OK(status)) {
7238 reply_nterror(req, status);
7239 goto out;
7240 }
7241
7242 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7243
7244 if (tid2 != conn->cnum) {
7245 /* can't currently handle inter share copies XXXX */
7246 DEBUG(3,("Rejecting inter-share copy\n"));
7247 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7248 goto out;
7249 }
7250
7251 status = filename_convert(ctx, conn,
7252 req->flags2 & FLAGS2_DFS_PATHNAMES,
7253 fname_src,
7254 UCF_COND_ALLOW_WCARD_LCOMP,
7255 &source_has_wild,
7256 &smb_fname_src);
7257 if (!NT_STATUS_IS_OK(status)) {
7258 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7259 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7260 ERRSRV, ERRbadpath);
7261 goto out;
7262 }
7263 reply_nterror(req, status);
7264 goto out;
7265 }
7266
7267 status = filename_convert(ctx, conn,
7268 req->flags2 & FLAGS2_DFS_PATHNAMES,
7269 fname_dst,
7270 UCF_COND_ALLOW_WCARD_LCOMP,
7271 &dest_has_wild,
7272 &smb_fname_dst);
7273 if (!NT_STATUS_IS_OK(status)) {
7274 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7275 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7276 ERRSRV, ERRbadpath);
7277 goto out;
7278 }
7279 reply_nterror(req, status);
7280 goto out;
7281 }
7282
7283 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7284
7285 if ((flags&1) && target_is_directory) {
7286 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7287 goto out;
7288 }
7289
7290 if ((flags&2) && !target_is_directory) {
7291 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7292 goto out;
7293 }
7294
7295 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7296 /* wants a tree copy! XXXX */
7297 DEBUG(3,("Rejecting tree copy\n"));
7298 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7299 goto out;
7300 }
7301
7302 /* Split up the directory from the filename/mask. */
7303 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7304 &fname_src_dir, &fname_src_mask);
7305 if (!NT_STATUS_IS_OK(status)) {
7306 reply_nterror(req, NT_STATUS_NO_MEMORY);
7307 goto out;
7308 }
7309
7310 /*
7311 * We should only check the mangled cache
7312 * here if unix_convert failed. This means
7313 * that the path in 'mask' doesn't exist
7314 * on the file system and so we need to look
7315 * for a possible mangle. This patch from
7316 * Tine Smukavec <valentin.smukavec@hermes.si>.
7317 */
7318 if (!VALID_STAT(smb_fname_src->st) &&
7319 mangle_is_mangled(fname_src_mask, conn->params)) {
7320 char *new_mask = NULL;
7321 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7322 &new_mask, conn->params);
7323
7324 /* Use demangled name if one was successfully found. */
7325 if (new_mask) {
7326 TALLOC_FREE(fname_src_mask);
7327 fname_src_mask = new_mask;
7328 }
7329 }
7330
7331 if (!source_has_wild) {
7332
7333 /*
7334 * Only one file needs to be copied. Append the mask back onto
7335 * the directory.
7336 */
7337 TALLOC_FREE(smb_fname_src->base_name);
7338 if (ISDOT(fname_src_dir)) {
7339 /* Ensure we use canonical names on open. */
7340 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7341 "%s",
7342 fname_src_mask);
7343 } else {
7344 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7345 "%s/%s",
7346 fname_src_dir,
7347 fname_src_mask);
7348 }
7349 if (!smb_fname_src->base_name) {
7350 reply_nterror(req, NT_STATUS_NO_MEMORY);
7351 goto out;
7352 }
7353
7354 if (dest_has_wild) {
7355 char *fname_dst_mod = NULL;
7356 if (!resolve_wildcards(smb_fname_dst,
7357 smb_fname_src->base_name,
7358 smb_fname_dst->base_name,
7359 &fname_dst_mod)) {
7360 reply_nterror(req, NT_STATUS_NO_MEMORY);
7361 goto out;
7362 }
7363 TALLOC_FREE(smb_fname_dst->base_name);
7364 smb_fname_dst->base_name = fname_dst_mod;
7365 }
7366
7367 status = check_name(conn, smb_fname_src->base_name);
7368 if (!NT_STATUS_IS_OK(status)) {
7369 reply_nterror(req, status);
7370 goto out;
7371 }
7372
7373 status = check_name(conn, smb_fname_dst->base_name);
7374 if (!NT_STATUS_IS_OK(status)) {
7375 reply_nterror(req, status);
7376 goto out;
7377 }
7378
7379 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7380 ofun, count, target_is_directory);
7381
7382 if(!NT_STATUS_IS_OK(status)) {
7383 reply_nterror(req, status);
7384 goto out;
7385 } else {
7386 count++;
7387 }
7388 } else {
7389 struct smb_Dir *dir_hnd = NULL;
7390 const char *dname = NULL;
7391 char *talloced = NULL;
7392 long offset = 0;
7393
7394 /*
7395 * There is a wildcard that requires us to actually read the
7396 * src dir and copy each file matching the mask to the dst.
7397 * Right now streams won't be copied, but this could
7398 * presumably be added with a nested loop for reach dir entry.
7399 */
7400 SMB_ASSERT(!smb_fname_src->stream_name);
7401 SMB_ASSERT(!smb_fname_dst->stream_name);
7402
7403 smb_fname_src->stream_name = NULL;
7404 smb_fname_dst->stream_name = NULL;
7405
7406 if (strequal(fname_src_mask,"????????.???")) {
7407 TALLOC_FREE(fname_src_mask);
7408 fname_src_mask = talloc_strdup(ctx, "*");
7409 if (!fname_src_mask) {
7410 reply_nterror(req, NT_STATUS_NO_MEMORY);
7411 goto out;
7412 }
7413 }
7414
7415 status = check_name(conn, fname_src_dir);
7416 if (!NT_STATUS_IS_OK(status)) {
7417 reply_nterror(req, status);
7418 goto out;
7419 }
7420
7421 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7422 if (dir_hnd == NULL) {
7423 status = map_nt_error_from_unix(errno);
7424 reply_nterror(req, status);
7425 goto out;
7426 }
7427
7428 error = ERRbadfile;
7429
7430 /* Iterate over the src dir copying each entry to the dst. */
7431 while ((dname = ReadDirName(dir_hnd, &offset,
7432 &smb_fname_src->st, &talloced))) {
7433 char *destname = NULL;
7434
7435 if (ISDOT(dname) || ISDOTDOT(dname)) {
7436 TALLOC_FREE(talloced);
7437 continue;
7438 }
7439
7440 if (!is_visible_file(conn, fname_src_dir, dname,
7441 &smb_fname_src->st, false)) {
7442 TALLOC_FREE(talloced);
7443 continue;
7444 }
7445
7446 if(!mask_match(dname, fname_src_mask,
7447 conn->case_sensitive)) {
7448 TALLOC_FREE(talloced);
7449 continue;
7450 }
7451
7452 error = ERRnoaccess;
7453
7454 /* Get the src smb_fname struct setup. */
7455 TALLOC_FREE(smb_fname_src->base_name);
7456 if (ISDOT(fname_src_dir)) {
7457 /* Ensure we use canonical names on open. */
7458 smb_fname_src->base_name =
7459 talloc_asprintf(smb_fname_src, "%s",
7460 dname);
7461 } else {
7462 smb_fname_src->base_name =
7463 talloc_asprintf(smb_fname_src, "%s/%s",
7464 fname_src_dir, dname);
7465 }
7466
7467 if (!smb_fname_src->base_name) {
7468 TALLOC_FREE(dir_hnd);
7469 TALLOC_FREE(talloced);
7470 reply_nterror(req, NT_STATUS_NO_MEMORY);
7471 goto out;
7472 }
7473
7474 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7475 smb_fname_dst->base_name,
7476 &destname)) {
7477 TALLOC_FREE(talloced);
7478 continue;
7479 }
7480 if (!destname) {
7481 TALLOC_FREE(dir_hnd);
7482 TALLOC_FREE(talloced);
7483 reply_nterror(req, NT_STATUS_NO_MEMORY);
7484 goto out;
7485 }
7486
7487 TALLOC_FREE(smb_fname_dst->base_name);
7488 smb_fname_dst->base_name = destname;
7489
7490 status = check_name(conn, smb_fname_src->base_name);
7491 if (!NT_STATUS_IS_OK(status)) {
7492 TALLOC_FREE(dir_hnd);
7493 TALLOC_FREE(talloced);
7494 reply_nterror(req, status);
7495 goto out;
7496 }
7497
7498 status = check_name(conn, smb_fname_dst->base_name);
7499 if (!NT_STATUS_IS_OK(status)) {
7500 TALLOC_FREE(dir_hnd);
7501 TALLOC_FREE(talloced);
7502 reply_nterror(req, status);
7503 goto out;
7504 }
7505
7506 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7507 smb_fname_src->base_name,
7508 smb_fname_dst->base_name));
7509
7510 status = copy_file(ctx, conn, smb_fname_src,
7511 smb_fname_dst, ofun, count,
7512 target_is_directory);
7513 if (NT_STATUS_IS_OK(status)) {
7514 count++;
7515 }
7516
7517 TALLOC_FREE(talloced);
7518 }
7519 TALLOC_FREE(dir_hnd);
7520 }
7521
7522 if (count == 0) {
7523 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7524 goto out;
7525 }
7526
7527 reply_outbuf(req, 1, 0);
7528 SSVAL(req->outbuf,smb_vwv0,count);
7529 out:
7530 TALLOC_FREE(smb_fname_src);
7531 TALLOC_FREE(smb_fname_dst);
7532 TALLOC_FREE(fname_src);
7533 TALLOC_FREE(fname_dst);
7534 TALLOC_FREE(fname_src_mask);
7535 TALLOC_FREE(fname_src_dir);
7536
7537 END_PROFILE(SMBcopy);
7538 return;
7539 }
7540
7541 #undef DBGC_CLASS
7542 #define DBGC_CLASS DBGC_LOCKING
7543
7544 /****************************************************************************
7545 Get a lock pid, dealing with large count requests.
7546 ****************************************************************************/
7547
7548 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7549 bool large_file_format)
7550 {
7551 if(!large_file_format)
7552 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7553 else
7554 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7555 }
7556
7557 /****************************************************************************
7558 Get a lock count, dealing with large count requests.
7559 ****************************************************************************/
7560
7561 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7562 bool large_file_format)
7563 {
7564 uint64_t count = 0;
7565
7566 if(!large_file_format) {
7567 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7568 } else {
7569
7570 #if defined(HAVE_LONGLONG)
7571 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7572 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7573 #else /* HAVE_LONGLONG */
7574
7575 /*
7576 * NT4.x seems to be broken in that it sends large file (64 bit)
7577 * lockingX calls even if the CAP_LARGE_FILES was *not*
7578 * negotiated. For boxes without large unsigned ints truncate the
7579 * lock count by dropping the top 32 bits.
7580 */
7581
7582 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7583 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7584 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7585 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7586 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7587 }
7588
7589 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7590 #endif /* HAVE_LONGLONG */
7591 }
7592
7593 return count;
7594 }
7595
7596 #if !defined(HAVE_LONGLONG)
7597 /****************************************************************************
7598 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7599 ****************************************************************************/
7600
7601 static uint32 map_lock_offset(uint32 high, uint32 low)
7602 {
7603 unsigned int i;
7604 uint32 mask = 0;
7605 uint32 highcopy = high;
7606
7607 /*
7608 * Try and find out how many significant bits there are in high.
7609 */
7610
7611 for(i = 0; highcopy; i++)
7612 highcopy >>= 1;
7613
7614 /*
7615 * We use 31 bits not 32 here as POSIX
7616 * lock offsets may not be negative.
7617 */
7618
7619 mask = (~0) << (31 - i);
7620
7621 if(low & mask)
7622 return 0; /* Fail. */
7623
7624 high <<= (31 - i);
7625
7626 return (high|low);
7627 }
7628 #endif /* !defined(HAVE_LONGLONG) */
7629
7630 /****************************************************************************
7631 Get a lock offset, dealing with large offset requests.
7632 ****************************************************************************/
7633
7634 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7635 bool large_file_format, bool *err)
7636 {
7637 uint64_t offset = 0;
7638
7639 *err = False;
7640
7641 if(!large_file_format) {
7642 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7643 } else {
7644
7645 #if defined(HAVE_LONGLONG)
7646 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7647 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7648 #else /* HAVE_LONGLONG */
7649
7650 /*
7651 * NT4.x seems to be broken in that it sends large file (64 bit)
7652 * lockingX calls even if the CAP_LARGE_FILES was *not*
7653 * negotiated. For boxes without large unsigned ints mangle the
7654 * lock offset by mapping the top 32 bits onto the lower 32.
7655 */
7656
7657 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7658 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7659 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7660 uint32 new_low = 0;
7661
7662 if((new_low = map_lock_offset(high, low)) == 0) {
7663 *err = True;
7664 return (uint64_t)-1;
7665 }
7666
7667 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7668 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7669 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7670 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7671 }
7672
7673 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7674 #endif /* HAVE_LONGLONG */
7675 }
7676
7677 return offset;
7678 }
7679
7680 NTSTATUS smbd_do_locking(struct smb_request *req,
7681 files_struct *fsp,
7682 uint8_t type,
7683 int32_t timeout,
7684 uint16_t num_ulocks,
7685 struct smbd_lock_element *ulocks,
7686 uint16_t num_locks,
7687 struct smbd_lock_element *locks,
7688 bool *async)
7689 {
7690 connection_struct *conn = req->conn;
7691 int i;
7692 NTSTATUS status = NT_STATUS_OK;
7693
7694 *async = false;
7695
7696 /* Data now points at the beginning of the list
7697 of smb_unlkrng structs */
7698 for(i = 0; i < (int)num_ulocks; i++) {
7699 struct smbd_lock_element *e = &ulocks[i];
7700
7701 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7702 "pid %u, file %s\n",
7703 (double)e->offset,
7704 (double)e->count,
7705 (unsigned int)e->smblctx,
7706 fsp_str_dbg(fsp)));
7707
7708 if (e->brltype != UNLOCK_LOCK) {
7709 /* this can only happen with SMB2 */
7710 return NT_STATUS_INVALID_PARAMETER;
7711 }
7712
7713 status = do_unlock(req->sconn->msg_ctx,
7714 fsp,
7715 e->smblctx,
7716 e->count,
7717 e->offset,
7718 WINDOWS_LOCK);
7719
7720 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7721 nt_errstr(status)));
7722
7723 if (!NT_STATUS_IS_OK(status)) {
7724 return status;
7725 }
7726 }
7727
7728 /* Setup the timeout in seconds. */
7729
7730 if (!lp_blocking_locks(SNUM(conn))) {
7731 timeout = 0;
7732 }
7733
7734 /* Data now points at the beginning of the list
7735 of smb_lkrng structs */
7736
7737 for(i = 0; i < (int)num_locks; i++) {
7738 struct smbd_lock_element *e = &locks[i];
7739
7740 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7741 "%llu, file %s timeout = %d\n",
7742 (double)e->offset,
7743 (double)e->count,
7744 (unsigned long long)e->smblctx,
7745 fsp_str_dbg(fsp),
7746 (int)timeout));
7747
7748 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7749 struct blocking_lock_record *blr = NULL;
7750
7751 if (num_locks > 1) {
7752 /*
7753 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7754 * if the lock vector contains one entry. When given mutliple cancel
7755 * requests in a single PDU we expect the server to return an
7756 * error. Windows servers seem to accept the request but only
7757 * cancel the first lock.
7758 * JRA - Do what Windows does (tm) :-).
7759 */
7760
7761 #if 0
7762 /* MS-CIFS (2.2.4.32.1) behavior. */
7763 return NT_STATUS_DOS(ERRDOS,
7764 ERRcancelviolation);
7765 #else
7766 /* Windows behavior. */
7767 if (i != 0) {
7768 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7769 "cancel request\n"));
7770 continue;
7771 }
7772 #endif
7773 }
7774
7775 if (lp_blocking_locks(SNUM(conn))) {
7776
7777 /* Schedule a message to ourselves to
7778 remove the blocking lock record and
7779 return the right error. */
7780
7781 blr = blocking_lock_cancel_smb1(fsp,
7782 e->smblctx,
7783 e->offset,
7784 e->count,
7785 WINDOWS_LOCK,
7786 type,
7787 NT_STATUS_FILE_LOCK_CONFLICT);
7788 if (blr == NULL) {
7789 return NT_STATUS_DOS(
7790 ERRDOS,
7791 ERRcancelviolation);
7792 }
7793 }
7794 /* Remove a matching pending lock. */
7795 status = do_lock_cancel(fsp,
7796 e->smblctx,
7797 e->count,
7798 e->offset,
7799 WINDOWS_LOCK,
7800 blr);
7801 } else {
7802 bool blocking_lock = timeout ? true : false;
7803 bool defer_lock = false;
7804 struct byte_range_lock *br_lck;
7805 uint64_t block_smblctx;
7806
7807 br_lck = do_lock(req->sconn->msg_ctx,
7808 fsp,
7809 e->smblctx,
7810 e->count,
7811 e->offset,
7812 e->brltype,
7813 WINDOWS_LOCK,
7814 blocking_lock,
7815 &status,
7816 &block_smblctx,
7817 NULL);
7818
7819 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7820 /* Windows internal resolution for blocking locks seems
7821 to be about 200ms... Don't wait for less than that. JRA. */
7822 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7823 timeout = lp_lock_spin_time();
7824 }
7825 defer_lock = true;
7826 }
7827
7828 /* If a lock sent with timeout of zero would fail, and
7829 * this lock has been requested multiple times,
7830 * according to brl_lock_failed() we convert this
7831 * request to a blocking lock with a timeout of between
7832 * 150 - 300 milliseconds.
7833 *
7834 * If lp_lock_spin_time() has been set to 0, we skip
7835 * this blocking retry and fail immediately.
7836 *
7837 * Replacement for do_lock_spin(). JRA. */
7838
7839 if (!req->sconn->using_smb2 &&
7840 br_lck && lp_blocking_locks(SNUM(conn)) &&
7841 lp_lock_spin_time() && !blocking_lock &&
7842 NT_STATUS_EQUAL((status),
7843 NT_STATUS_FILE_LOCK_CONFLICT))
7844 {
7845 defer_lock = true;
7846 timeout = lp_lock_spin_time();
7847 }
7848
7849 if (br_lck && defer_lock) {
7850 /*
7851 * A blocking lock was requested. Package up
7852 * this smb into a queued request and push it
7853 * onto the blocking lock queue.
7854 */
7855 if(push_blocking_lock_request(br_lck,
7856 req,
7857 fsp,
7858 timeout,
7859 i,
7860 e->smblctx,
7861 e->brltype,
7862 WINDOWS_LOCK,
7863 e->offset,
7864 e->count,
7865 block_smblctx)) {
7866 TALLOC_FREE(br_lck);
7867 *async = true;
7868 return NT_STATUS_OK;
7869 }
7870 }
7871
7872 TALLOC_FREE(br_lck);
7873 }
7874
7875 if (!NT_STATUS_IS_OK(status)) {
7876 break;
7877 }
7878 }
7879
7880 /* If any of the above locks failed, then we must unlock
7881 all of the previous locks (X/Open spec). */
7882
7883 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7884
7885 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7886 i = -1; /* we want to skip the for loop */
7887 }
7888
7889 /*
7890 * Ensure we don't do a remove on the lock that just failed,
7891 * as under POSIX rules, if we have a lock already there, we
7892 * will delete it (and we shouldn't) .....
7893 */
7894 for(i--; i >= 0; i--) {
7895 struct smbd_lock_element *e = &locks[i];
7896
7897 do_unlock(req->sconn->msg_ctx,
7898 fsp,
7899 e->smblctx,
7900 e->count,
7901 e->offset,
7902 WINDOWS_LOCK);
7903 }
7904 return status;
7905 }
7906
7907 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7908 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7909
7910 return NT_STATUS_OK;
7911 }
7912
7913 /****************************************************************************
7914 Reply to a lockingX request.
7915 ****************************************************************************/
7916
7917 void reply_lockingX(struct smb_request *req)
7918 {
7919 connection_struct *conn = req->conn;
7920 files_struct *fsp;
7921 unsigned char locktype;
7922 unsigned char oplocklevel;
7923 uint16 num_ulocks;
7924 uint16 num_locks;
7925 int32 lock_timeout;
7926 int i;
7927 const uint8_t *data;
7928 bool large_file_format;
7929 bool err;
7930 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7931 struct smbd_lock_element *ulocks;
7932 struct smbd_lock_element *locks;
7933 bool async = false;
7934
7935 START_PROFILE(SMBlockingX);
7936
7937 if (req->wct < 8) {
7938 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7939 END_PROFILE(SMBlockingX);
7940 return;
7941 }
7942
7943 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7944 locktype = CVAL(req->vwv+3, 0);
7945 oplocklevel = CVAL(req->vwv+3, 1);
7946 num_ulocks = SVAL(req->vwv+6, 0);
7947 num_locks = SVAL(req->vwv+7, 0);
7948 lock_timeout = IVAL(req->vwv+4, 0);
7949 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7950
7951 if (!check_fsp(conn, req, fsp)) {
7952 END_PROFILE(SMBlockingX);
7953 return;
7954 }
7955
7956 data = req->buf;
7957
7958 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7959 /* we don't support these - and CANCEL_LOCK makes w2k
7960 and XP reboot so I don't really want to be
7961 compatible! (tridge) */
7962 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7963 END_PROFILE(SMBlockingX);
7964 return;
7965 }
7966
7967 /* Check if this is an oplock break on a file
7968 we have granted an oplock on.
7969 */
7970 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7971 /* Client can insist on breaking to none. */
7972 bool break_to_none = (oplocklevel == 0);
7973 bool result;
7974
7975 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7976 "for %s\n", (unsigned int)oplocklevel,
7977 fsp_fnum_dbg(fsp)));
7978
7979 /*
7980 * Make sure we have granted an exclusive or batch oplock on
7981 * this file.
7982 */
7983
7984 if (fsp->oplock_type == 0) {
7985
7986 /* The Samba4 nbench simulator doesn't understand
7987 the difference between break to level2 and break
7988 to none from level2 - it sends oplock break
7989 replies in both cases. Don't keep logging an error
7990 message here - just ignore it. JRA. */
7991
7992 DEBUG(5,("reply_lockingX: Error : oplock break from "
7993 "client for %s (oplock=%d) and no "
7994 "oplock granted on this file (%s).\n",
7995 fsp_fnum_dbg(fsp), fsp->oplock_type,
7996 fsp_str_dbg(fsp)));
7997
7998 /* if this is a pure oplock break request then don't
7999 * send a reply */
8000 if (num_locks == 0 && num_ulocks == 0) {
8001 END_PROFILE(SMBlockingX);
8002 return;
8003 } else {
8004 END_PROFILE(SMBlockingX);
8005 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8006 return;
8007 }
8008 }
8009
8010 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8011 (break_to_none)) {
8012 result = remove_oplock(fsp);
8013 } else {
8014 result = downgrade_oplock(fsp);
8015 }
8016
8017 if (!result) {
8018 DEBUG(0, ("reply_lockingX: error in removing "
8019 "oplock on file %s\n", fsp_str_dbg(fsp)));
8020 /* Hmmm. Is this panic justified? */
8021 smb_panic("internal tdb error");
8022 }
8023
8024 /* if this is a pure oplock break request then don't send a
8025 * reply */
8026 if (num_locks == 0 && num_ulocks == 0) {
8027 /* Sanity check - ensure a pure oplock break is not a
8028 chained request. */
8029 if(CVAL(req->vwv+0, 0) != 0xff)
8030 DEBUG(0,("reply_lockingX: Error : pure oplock "
8031 "break is a chained %d request !\n",
8032 (unsigned int)CVAL(req->vwv+0, 0)));
8033 END_PROFILE(SMBlockingX);
8034 return;
8035 }
8036 }
8037
8038 if (req->buflen <
8039 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8040 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8041 END_PROFILE(SMBlockingX);
8042 return;
8043 }
8044
8045 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8046 if (ulocks == NULL) {
8047 reply_nterror(req, NT_STATUS_NO_MEMORY);
8048 END_PROFILE(SMBlockingX);
8049 return;
8050 }
8051
8052 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8053 if (locks == NULL) {
8054 reply_nterror(req, NT_STATUS_NO_MEMORY);
8055 END_PROFILE(SMBlockingX);
8056 return;
8057 }
8058
8059 /* Data now points at the beginning of the list
8060 of smb_unlkrng structs */
8061 for(i = 0; i < (int)num_ulocks; i++) {
8062 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8063 ulocks[i].count = get_lock_count(data, i, large_file_format);
8064 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8065 ulocks[i].brltype = UNLOCK_LOCK;
8066
8067 /*
8068 * There is no error code marked "stupid client bug".... :-).
8069 */
8070 if(err) {
8071 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8072 END_PROFILE(SMBlockingX);
8073 return;
8074 }
8075 }
8076
8077 /* Now do any requested locks */
8078 data += ((large_file_format ? 20 : 10)*num_ulocks);
8079
8080 /* Data now points at the beginning of the list
8081 of smb_lkrng structs */
8082
8083 for(i = 0; i < (int)num_locks; i++) {
8084 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8085 locks[i].count = get_lock_count(data, i, large_file_format);
8086 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8087
8088 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8089 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8090 locks[i].brltype = PENDING_READ_LOCK;
8091 } else {
8092 locks[i].brltype = READ_LOCK;
8093 }
8094 } else {
8095 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8096 locks[i].brltype = PENDING_WRITE_LOCK;
8097 } else {
8098 locks[i].brltype = WRITE_LOCK;
8099 }
8100 }
8101
8102 /*
8103 * There is no error code marked "stupid client bug".... :-).
8104 */
8105 if(err) {
8106 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8107 END_PROFILE(SMBlockingX);
8108 return;
8109 }
8110 }
8111
8112 status = smbd_do_locking(req, fsp,
8113 locktype, lock_timeout,
8114 num_ulocks, ulocks,
8115 num_locks, locks,
8116 &async);
8117 if (!NT_STATUS_IS_OK(status)) {
8118 END_PROFILE(SMBlockingX);
8119 reply_nterror(req, status);
8120 return;
8121 }
8122 if (async) {
8123 END_PROFILE(SMBlockingX);
8124 return;
8125 }
8126
8127 reply_outbuf(req, 2, 0);
8128 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8129 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8130
8131 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8132 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8133
8134 END_PROFILE(SMBlockingX);
8135 }
8136
8137 #undef DBGC_CLASS
8138 #define DBGC_CLASS DBGC_ALL
8139
8140 /****************************************************************************
8141 Reply to a SMBreadbmpx (read block multiplex) request.
8142 Always reply with an error, if someone has a platform really needs this,
8143 please contact vl@samba.org
8144 ****************************************************************************/
8145
8146 void reply_readbmpx(struct smb_request *req)
8147 {
8148 START_PROFILE(SMBreadBmpx);
8149 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8150 END_PROFILE(SMBreadBmpx);
8151 return;
8152 }
8153
8154 /****************************************************************************
8155 Reply to a SMBreadbs (read block multiplex secondary) request.
8156 Always reply with an error, if someone has a platform really needs this,
8157 please contact vl@samba.org
8158 ****************************************************************************/
8159
8160 void reply_readbs(struct smb_request *req)
8161 {
8162 START_PROFILE(SMBreadBs);
8163 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8164 END_PROFILE(SMBreadBs);
8165 return;
8166 }
8167
8168 /****************************************************************************
8169 Reply to a SMBsetattrE.
8170 ****************************************************************************/
8171
8172 void reply_setattrE(struct smb_request *req)
8173 {
8174 connection_struct *conn = req->conn;
8175 struct smb_file_time ft;
8176 files_struct *fsp;
8177 NTSTATUS status;
8178
8179 START_PROFILE(SMBsetattrE);
8180 ZERO_STRUCT(ft);
8181
8182 if (req->wct < 7) {
8183 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8184 goto out;
8185 }
8186
8187 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8188
8189 if(!fsp || (fsp->conn != conn)) {
8190 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8191 goto out;
8192 }
8193
8194 /*
8195 * Convert the DOS times into unix times.
8196 */
8197
8198 ft.atime = convert_time_t_to_timespec(
8199 srv_make_unix_date2(req->vwv+3));
8200 ft.mtime = convert_time_t_to_timespec(
8201 srv_make_unix_date2(req->vwv+5));
8202 ft.create_time = convert_time_t_to_timespec(
8203 srv_make_unix_date2(req->vwv+1));
8204
8205 reply_outbuf(req, 0, 0);
8206
8207 /*
8208 * Patch from Ray Frush <frush@engr.colostate.edu>
8209 * Sometimes times are sent as zero - ignore them.
8210 */
8211
8212 /* Ensure we have a valid stat struct for the source. */
8213 status = vfs_stat_fsp(fsp);
8214 if (!NT_STATUS_IS_OK(status)) {
8215 reply_nterror(req, status);
8216 goto out;
8217 }
8218
8219 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8220 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8221 goto out;
8222 }
8223
8224 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8225 if (!NT_STATUS_IS_OK(status)) {
8226 reply_nterror(req, status);
8227 goto out;
8228 }
8229
8230 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8231 " createtime=%u\n",
8232 fsp_fnum_dbg(fsp),
8233 (unsigned int)ft.atime.tv_sec,
8234 (unsigned int)ft.mtime.tv_sec,
8235 (unsigned int)ft.create_time.tv_sec
8236 ));
8237 out:
8238 END_PROFILE(SMBsetattrE);
8239 return;
8240 }
8241
8242
8243 /* Back from the dead for OS/2..... JRA. */
8244
8245 /****************************************************************************
8246 Reply to a SMBwritebmpx (write block multiplex primary) request.
8247 Always reply with an error, if someone has a platform really needs this,
8248 please contact vl@samba.org
8249 ****************************************************************************/
8250
8251 void reply_writebmpx(struct smb_request *req)
8252 {
8253 START_PROFILE(SMBwriteBmpx);
8254 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8255 END_PROFILE(SMBwriteBmpx);
8256 return;
8257 }
8258
8259 /****************************************************************************
8260 Reply to a SMBwritebs (write block multiplex secondary) request.
8261 Always reply with an error, if someone has a platform really needs this,
8262 please contact vl@samba.org
8263 ****************************************************************************/
8264
8265 void reply_writebs(struct smb_request *req)
8266 {
8267 START_PROFILE(SMBwriteBs);
8268 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8269 END_PROFILE(SMBwriteBs);
8270 return;
8271 }
8272
8273 /****************************************************************************
8274 Reply to a SMBgetattrE.
8275 ****************************************************************************/
8276
8277 void reply_getattrE(struct smb_request *req)
8278 {
8279 connection_struct *conn = req->conn;
8280 int mode;
8281 files_struct *fsp;
8282 struct timespec create_ts;
8283
8284 START_PROFILE(SMBgetattrE);
8285
8286 if (req->wct < 1) {
8287 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8288 END_PROFILE(SMBgetattrE);
8289 return;
8290 }
8291
8292 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8293
8294 if(!fsp || (fsp->conn != conn)) {
8295 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8296 END_PROFILE(SMBgetattrE);
8297 return;
8298 }
8299
8300 /* Do an fstat on this file */
8301 if(fsp_stat(fsp)) {
8302 reply_nterror(req, map_nt_error_from_unix(errno));
8303 END_PROFILE(SMBgetattrE);
8304 return;
8305 }
8306
8307 mode = dos_mode(conn, fsp->fsp_name);
8308
8309 /*
8310 * Convert the times into dos times. Set create
8311 * date to be last modify date as UNIX doesn't save
8312 * this.
8313 */
8314
8315 reply_outbuf(req, 11, 0);
8316
8317 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8318 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8319 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8320 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8321 /* Should we check pending modtime here ? JRA */
8322 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8323 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8324
8325 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8326 SIVAL(req->outbuf, smb_vwv6, 0);
8327 SIVAL(req->outbuf, smb_vwv8, 0);
8328 } else {
8329 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8330 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8331 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8332 }
8333 SSVAL(req->outbuf,smb_vwv10, mode);
8334
8335 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8336
8337 END_PROFILE(SMBgetattrE);
8338 return;
8339 }
Samba GIT mirror