?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:password_hash LDB module - introduce a "userPassword" flag which enables/disables...
[Samba.git] / source3 / smbd / reply.c
blob5af5dacc9b1c56a24a12968af61e4ce7d91b7969
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "printing.h"
29 #include "smbd/globals.h"
30 #include "fake_file.h"
31 #include "../librpc/gen_ndr/cli_spoolss.h"
32 #include "rpc_client/cli_spoolss.h"
33 #include "rpc_client/init_spoolss.h"
34 #include "rpc_server/rpc_ncacn_np.h"
35 #include "libcli/security/security.h"
36
37 /****************************************************************************
38 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
39 path or anything including wildcards.
40 We're assuming here that '/' is not the second byte in any multibyte char
41 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
42 set.
43 ****************************************************************************/
44
45 /* Custom version for processing POSIX paths. */
46 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
47
48 static NTSTATUS check_path_syntax_internal(char *path,
49 bool posix_path,
50 bool *p_last_component_contains_wcard)
51 {
52 char *d = path;
53 const char *s = path;
54 NTSTATUS ret = NT_STATUS_OK;
55 bool start_of_name_component = True;
56 bool stream_started = false;
57
58 *p_last_component_contains_wcard = False;
59
60 while (*s) {
61 if (stream_started) {
62 switch (*s) {
63 case '/':
64 case '\\':
65 return NT_STATUS_OBJECT_NAME_INVALID;
66 case ':':
67 if (s[1] == '\0') {
68 return NT_STATUS_OBJECT_NAME_INVALID;
69 }
70 if (strchr_m(&s[1], ':')) {
71 return NT_STATUS_OBJECT_NAME_INVALID;
72 }
73 break;
74 }
75 }
76
77 if ((*s == ':') && !posix_path && !stream_started) {
78 if (*p_last_component_contains_wcard) {
79 return NT_STATUS_OBJECT_NAME_INVALID;
80 }
81 /* Stream names allow more characters than file names.
82 We're overloading posix_path here to allow a wider
83 range of characters. If stream_started is true this
84 is still a Windows path even if posix_path is true.
85 JRA.
86 */
87 stream_started = true;
88 start_of_name_component = false;
89 posix_path = true;
90
91 if (s[1] == '\0') {
92 return NT_STATUS_OBJECT_NAME_INVALID;
93 }
94 }
95
96 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
97 /*
98 * Safe to assume is not the second part of a mb char
99 * as this is handled below.
100 */
101 /* Eat multiple '/' or '\\' */
102 while (IS_PATH_SEP(*s,posix_path)) {
103 s++;
104 }
105 if ((d != path) && (*s != '\0')) {
106 /* We only care about non-leading or trailing '/' or '\\' */
107 *d++ = '/';
108 }
109
110 start_of_name_component = True;
111 /* New component. */
112 *p_last_component_contains_wcard = False;
113 continue;
114 }
115
116 if (start_of_name_component) {
117 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
118 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
119
120 /*
121 * No mb char starts with '.' so we're safe checking the directory separator here.
122 */
123
124 /* If we just added a '/' - delete it */
125 if ((d > path) && (*(d-1) == '/')) {
126 *(d-1) = '\0';
127 d--;
128 }
129
130 /* Are we at the start ? Can't go back further if so. */
131 if (d <= path) {
132 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
133 break;
134 }
135 /* Go back one level... */
136 /* We know this is safe as '/' cannot be part of a mb sequence. */
137 /* NOTE - if this assumption is invalid we are not in good shape... */
138 /* Decrement d first as d points to the *next* char to write into. */
139 for (d--; d > path; d--) {
140 if (*d == '/')
141 break;
142 }
143 s += 2; /* Else go past the .. */
144 /* We're still at the start of a name component, just the previous one. */
145 continue;
146
147 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
148 if (posix_path) {
149 /* Eat the '.' */
150 s++;
151 continue;
152 }
153 }
154
155 }
156
157 if (!(*s & 0x80)) {
158 if (!posix_path) {
159 if (*s <= 0x1f || *s == '|') {
160 return NT_STATUS_OBJECT_NAME_INVALID;
161 }
162 switch (*s) {
163 case '*':
164 case '?':
165 case '<':
166 case '>':
167 case '"':
168 *p_last_component_contains_wcard = True;
169 break;
170 default:
171 break;
172 }
173 }
174 *d++ = *s++;
175 } else {
176 size_t siz;
177 /* Get the size of the next MB character. */
178 next_codepoint(s,&siz);
179 switch(siz) {
180 case 5:
181 *d++ = *s++;
182 /*fall through*/
183 case 4:
184 *d++ = *s++;
185 /*fall through*/
186 case 3:
187 *d++ = *s++;
188 /*fall through*/
189 case 2:
190 *d++ = *s++;
191 /*fall through*/
192 case 1:
193 *d++ = *s++;
194 break;
195 default:
196 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
197 *d = '\0';
198 return NT_STATUS_INVALID_PARAMETER;
199 }
200 }
201 start_of_name_component = False;
202 }
203
204 *d = '\0';
205
206 return ret;
207 }
208
209 /****************************************************************************
210 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
211 No wildcards allowed.
212 ****************************************************************************/
213
214 NTSTATUS check_path_syntax(char *path)
215 {
216 bool ignore;
217 return check_path_syntax_internal(path, False, &ignore);
218 }
219
220 /****************************************************************************
221 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
222 Wildcards allowed - p_contains_wcard returns true if the last component contained
223 a wildcard.
224 ****************************************************************************/
225
226 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
227 {
228 return check_path_syntax_internal(path, False, p_contains_wcard);
229 }
230
231 /****************************************************************************
232 Check the path for a POSIX client.
233 We're assuming here that '/' is not the second byte in any multibyte char
234 set (a safe assumption).
235 ****************************************************************************/
236
237 NTSTATUS check_path_syntax_posix(char *path)
238 {
239 bool ignore;
240 return check_path_syntax_internal(path, True, &ignore);
241 }
242
243 /****************************************************************************
244 Pull a string and check the path allowing a wilcard - provide for error return.
245 ****************************************************************************/
246
247 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
248 const char *base_ptr,
249 uint16 smb_flags2,
250 char **pp_dest,
251 const char *src,
252 size_t src_len,
253 int flags,
254 NTSTATUS *err,
255 bool *contains_wcard)
256 {
257 size_t ret;
258
259 *pp_dest = NULL;
260
261 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
262 src_len, flags);
263
264 if (!*pp_dest) {
265 *err = NT_STATUS_INVALID_PARAMETER;
266 return ret;
267 }
268
269 *contains_wcard = False;
270
271 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
272 /*
273 * For a DFS path the function parse_dfs_path()
274 * will do the path processing, just make a copy.
275 */
276 *err = NT_STATUS_OK;
277 return ret;
278 }
279
280 if (lp_posix_pathnames()) {
281 *err = check_path_syntax_posix(*pp_dest);
282 } else {
283 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
284 }
285
286 return ret;
287 }
288
289 /****************************************************************************
290 Pull a string and check the path - provide for error return.
291 ****************************************************************************/
292
293 size_t srvstr_get_path(TALLOC_CTX *ctx,
294 const char *base_ptr,
295 uint16 smb_flags2,
296 char **pp_dest,
297 const char *src,
298 size_t src_len,
299 int flags,
300 NTSTATUS *err)
301 {
302 bool ignore;
303 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
304 src_len, flags, err, &ignore);
305 }
306
307 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
308 char **pp_dest, const char *src, int flags,
309 NTSTATUS *err, bool *contains_wcard)
310 {
311 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
312 pp_dest, src, smbreq_bufrem(req, src),
313 flags, err, contains_wcard);
314 }
315
316 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
317 char **pp_dest, const char *src, int flags,
318 NTSTATUS *err)
319 {
320 bool ignore;
321 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
322 flags, err, &ignore);
323 }
324
325 /****************************************************************************
326 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
327 ****************************************************************************/
328
329 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
330 files_struct *fsp)
331 {
332 if ((fsp == NULL) || (conn == NULL)) {
333 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
334 return False;
335 }
336 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
337 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
338 return False;
339 }
340 return True;
341 }
342
343 /****************************************************************************
344 Check if we have a correct fsp pointing to a file.
345 ****************************************************************************/
346
347 bool check_fsp(connection_struct *conn, struct smb_request *req,
348 files_struct *fsp)
349 {
350 if (!check_fsp_open(conn, req, fsp)) {
351 return False;
352 }
353 if (fsp->is_directory) {
354 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
355 return False;
356 }
357 if (fsp->fh->fd == -1) {
358 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
359 return False;
360 }
361 fsp->num_smb_operations++;
362 return True;
363 }
364
365 /****************************************************************************
366 Check if we have a correct fsp pointing to a quota fake file. Replacement for
367 the CHECK_NTQUOTA_HANDLE_OK macro.
368 ****************************************************************************/
369
370 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
371 files_struct *fsp)
372 {
373 if (!check_fsp_open(conn, req, fsp)) {
374 return false;
375 }
376
377 if (fsp->is_directory) {
378 return false;
379 }
380
381 if (fsp->fake_file_handle == NULL) {
382 return false;
383 }
384
385 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
386 return false;
387 }
388
389 if (fsp->fake_file_handle->private_data == NULL) {
390 return false;
391 }
392
393 return true;
394 }
395
396 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
397 const char *name, int name_type)
398 {
399 char *trim_name;
400 char *trim_name_type;
401 const char *retarget_parm;
402 char *retarget;
403 char *p;
404 int retarget_type = 0x20;
405 int retarget_port = 139;
406 struct sockaddr_storage retarget_addr;
407 struct sockaddr_in *in_addr;
408 bool ret = false;
409 uint8_t outbuf[10];
410
411 if (get_socket_port(sconn->sock) != 139) {
412 return false;
413 }
414
415 trim_name = talloc_strdup(talloc_tos(), name);
416 if (trim_name == NULL) {
417 goto fail;
418 }
419 trim_char(trim_name, ' ', ' ');
420
421 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
422 name_type);
423 if (trim_name_type == NULL) {
424 goto fail;
425 }
426
427 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
428 trim_name_type, NULL);
429 if (retarget_parm == NULL) {
430 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
431 trim_name, NULL);
432 }
433 if (retarget_parm == NULL) {
434 goto fail;
435 }
436
437 retarget = talloc_strdup(trim_name, retarget_parm);
438 if (retarget == NULL) {
439 goto fail;
440 }
441
442 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
443
444 p = strchr(retarget, ':');
445 if (p != NULL) {
446 *p++ = '\0';
447 retarget_port = atoi(p);
448 }
449
450 p = strchr_m(retarget, '#');
451 if (p != NULL) {
452 *p++ = '\0';
453 sscanf(p, "%x", &retarget_type);
454 }
455
456 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
457 if (!ret) {
458 DEBUG(10, ("could not resolve %s\n", retarget));
459 goto fail;
460 }
461
462 if (retarget_addr.ss_family != AF_INET) {
463 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
464 goto fail;
465 }
466
467 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
468
469 _smb_setlen(outbuf, 6);
470 SCVAL(outbuf, 0, 0x84);
471 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
472 *(uint16_t *)(outbuf+8) = htons(retarget_port);
473
474 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
475 NULL)) {
476 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
477 "failed.");
478 }
479
480 ret = true;
481 fail:
482 TALLOC_FREE(trim_name);
483 return ret;
484 }
485
486 /****************************************************************************
487 Reply to a (netbios-level) special message.
488 ****************************************************************************/
489
490 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
491 {
492 int msg_type = CVAL(inbuf,0);
493 int msg_flags = CVAL(inbuf,1);
494 /*
495 * We only really use 4 bytes of the outbuf, but for the smb_setlen
496 * calculation & friends (srv_send_smb uses that) we need the full smb
497 * header.
498 */
499 char outbuf[smb_size];
500
501 memset(outbuf, '\0', sizeof(outbuf));
502
503 smb_setlen(outbuf,0);
504
505 switch (msg_type) {
506 case 0x81: /* session request */
507 {
508 /* inbuf_size is guarenteed to be at least 4. */
509 fstring name1,name2;
510 int name_type1, name_type2;
511 int name_len1, name_len2;
512
513 *name1 = *name2 = 0;
514
515 if (sconn->nbt.got_session) {
516 exit_server_cleanly("multiple session request not permitted");
517 }
518
519 SCVAL(outbuf,0,0x82);
520 SCVAL(outbuf,3,0);
521
522 /* inbuf_size is guaranteed to be at least 4. */
523 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
524 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
525 DEBUG(0,("Invalid name length in session request\n"));
526 break;
527 }
528 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
529 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
530 DEBUG(0,("Invalid name length in session request\n"));
531 break;
532 }
533
534 name_type1 = name_extract((unsigned char *)inbuf,
535 inbuf_size,(unsigned int)4,name1);
536 name_type2 = name_extract((unsigned char *)inbuf,
537 inbuf_size,(unsigned int)(4 + name_len1),name2);
538
539 if (name_type1 == -1 || name_type2 == -1) {
540 DEBUG(0,("Invalid name type in session request\n"));
541 break;
542 }
543
544 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
545 name1, name_type1, name2, name_type2));
546
547 if (netbios_session_retarget(sconn, name1, name_type1)) {
548 exit_server_cleanly("retargeted client");
549 }
550
551 /*
552 * Windows NT/2k uses "*SMBSERVER" and XP uses
553 * "*SMBSERV" arrggg!!!
554 */
555 if (strequal(name1, "*SMBSERVER ")
556 || strequal(name1, "*SMBSERV ")) {
557 fstrcpy(name1, sconn->client_id.addr);
558 }
559
560 set_local_machine_name(name1, True);
561 set_remote_machine_name(name2, True);
562
563 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
564 get_local_machine_name(), get_remote_machine_name(),
565 name_type2));
566
567 if (name_type2 == 'R') {
568 /* We are being asked for a pathworks session ---
569 no thanks! */
570 SCVAL(outbuf, 0,0x83);
571 break;
572 }
573
574 /* only add the client's machine name to the list
575 of possibly valid usernames if we are operating
576 in share mode security */
577 if (lp_security() == SEC_SHARE) {
578 add_session_user(sconn, get_remote_machine_name());
579 }
580
581 reload_services(sconn->msg_ctx, sconn->sock, True);
582 reopen_logs();
583
584 sconn->nbt.got_session = true;
585 break;
586 }
587
588 case 0x89: /* session keepalive request
589 (some old clients produce this?) */
590 SCVAL(outbuf,0,SMBkeepalive);
591 SCVAL(outbuf,3,0);
592 break;
593
594 case 0x82: /* positive session response */
595 case 0x83: /* negative session response */
596 case 0x84: /* retarget session response */
597 DEBUG(0,("Unexpected session response\n"));
598 break;
599
600 case SMBkeepalive: /* session keepalive */
601 default:
602 return;
603 }
604
605 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
606 msg_type, msg_flags));
607
608 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
609 return;
610 }
611
612 /****************************************************************************
613 Reply to a tcon.
614 conn POINTER CAN BE NULL HERE !
615 ****************************************************************************/
616
617 void reply_tcon(struct smb_request *req)
618 {
619 connection_struct *conn = req->conn;
620 const char *service;
621 char *service_buf = NULL;
622 char *password = NULL;
623 char *dev = NULL;
624 int pwlen=0;
625 NTSTATUS nt_status;
626 const char *p;
627 DATA_BLOB password_blob;
628 TALLOC_CTX *ctx = talloc_tos();
629 struct smbd_server_connection *sconn = req->sconn;
630
631 START_PROFILE(SMBtcon);
632
633 if (req->buflen < 4) {
634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
635 END_PROFILE(SMBtcon);
636 return;
637 }
638
639 p = (const char *)req->buf + 1;
640 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
641 p += 1;
642 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
643 p += pwlen+1;
644 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
645 p += 1;
646
647 if (service_buf == NULL || password == NULL || dev == NULL) {
648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
649 END_PROFILE(SMBtcon);
650 return;
651 }
652 p = strrchr_m(service_buf,'\\');
653 if (p) {
654 service = p+1;
655 } else {
656 service = service_buf;
657 }
658
659 password_blob = data_blob(password, pwlen+1);
660
661 conn = make_connection(sconn,service,password_blob,dev,
662 req->vuid,&nt_status);
663 req->conn = conn;
664
665 data_blob_clear_free(&password_blob);
666
667 if (!conn) {
668 reply_nterror(req, nt_status);
669 END_PROFILE(SMBtcon);
670 return;
671 }
672
673 reply_outbuf(req, 2, 0);
674 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
675 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
676 SSVAL(req->outbuf,smb_tid,conn->cnum);
677
678 DEBUG(3,("tcon service=%s cnum=%d\n",
679 service, conn->cnum));
680
681 END_PROFILE(SMBtcon);
682 return;
683 }
684
685 /****************************************************************************
686 Reply to a tcon and X.
687 conn POINTER CAN BE NULL HERE !
688 ****************************************************************************/
689
690 void reply_tcon_and_X(struct smb_request *req)
691 {
692 connection_struct *conn = req->conn;
693 const char *service = NULL;
694 DATA_BLOB password;
695 TALLOC_CTX *ctx = talloc_tos();
696 /* what the cleint thinks the device is */
697 char *client_devicetype = NULL;
698 /* what the server tells the client the share represents */
699 const char *server_devicetype;
700 NTSTATUS nt_status;
701 int passlen;
702 char *path = NULL;
703 const char *p, *q;
704 uint16 tcon_flags;
705 struct smbd_server_connection *sconn = req->sconn;
706
707 START_PROFILE(SMBtconX);
708
709 if (req->wct < 4) {
710 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
711 END_PROFILE(SMBtconX);
712 return;
713 }
714
715 passlen = SVAL(req->vwv+3, 0);
716 tcon_flags = SVAL(req->vwv+2, 0);
717
718 /* we might have to close an old one */
719 if ((tcon_flags & 0x1) && conn) {
720 close_cnum(conn,req->vuid);
721 req->conn = NULL;
722 conn = NULL;
723 }
724
725 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
726 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
727 END_PROFILE(SMBtconX);
728 return;
729 }
730
731 if (sconn->smb1.negprot.encrypted_passwords) {
732 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
733 if (lp_security() == SEC_SHARE) {
734 /*
735 * Security = share always has a pad byte
736 * after the password.
737 */
738 p = (const char *)req->buf + passlen + 1;
739 } else {
740 p = (const char *)req->buf + passlen;
741 }
742 } else {
743 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
744 /* Ensure correct termination */
745 password.data[passlen]=0;
746 p = (const char *)req->buf + passlen + 1;
747 }
748
749 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
750
751 if (path == NULL) {
752 data_blob_clear_free(&password);
753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
754 END_PROFILE(SMBtconX);
755 return;
756 }
757
758 /*
759 * the service name can be either: \\server\share
760 * or share directly like on the DELL PowerVault 705
761 */
762 if (*path=='\\') {
763 q = strchr_m(path+2,'\\');
764 if (!q) {
765 data_blob_clear_free(&password);
766 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
767 END_PROFILE(SMBtconX);
768 return;
769 }
770 service = q+1;
771 } else {
772 service = path;
773 }
774
775 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
776 &client_devicetype, p,
777 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
778
779 if (client_devicetype == NULL) {
780 data_blob_clear_free(&password);
781 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
782 END_PROFILE(SMBtconX);
783 return;
784 }
785
786 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
787
788 conn = make_connection(sconn, service, password, client_devicetype,
789 req->vuid, &nt_status);
790 req->conn =conn;
791
792 data_blob_clear_free(&password);
793
794 if (!conn) {
795 reply_nterror(req, nt_status);
796 END_PROFILE(SMBtconX);
797 return;
798 }
799
800 if ( IS_IPC(conn) )
801 server_devicetype = "IPC";
802 else if ( IS_PRINT(conn) )
803 server_devicetype = "LPT1:";
804 else
805 server_devicetype = "A:";
806
807 if (get_Protocol() < PROTOCOL_NT1) {
808 reply_outbuf(req, 2, 0);
809 if (message_push_string(&req->outbuf, server_devicetype,
810 STR_TERMINATE|STR_ASCII) == -1) {
811 reply_nterror(req, NT_STATUS_NO_MEMORY);
812 END_PROFILE(SMBtconX);
813 return;
814 }
815 } else {
816 /* NT sets the fstype of IPC$ to the null string */
817 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
818
819 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
820 /* Return permissions. */
821 uint32 perm1 = 0;
822 uint32 perm2 = 0;
823
824 reply_outbuf(req, 7, 0);
825
826 if (IS_IPC(conn)) {
827 perm1 = FILE_ALL_ACCESS;
828 perm2 = FILE_ALL_ACCESS;
829 } else {
830 perm1 = CAN_WRITE(conn) ?
831 SHARE_ALL_ACCESS :
832 SHARE_READ_ONLY;
833 }
834
835 SIVAL(req->outbuf, smb_vwv3, perm1);
836 SIVAL(req->outbuf, smb_vwv5, perm2);
837 } else {
838 reply_outbuf(req, 3, 0);
839 }
840
841 if ((message_push_string(&req->outbuf, server_devicetype,
842 STR_TERMINATE|STR_ASCII) == -1)
843 || (message_push_string(&req->outbuf, fstype,
844 STR_TERMINATE) == -1)) {
845 reply_nterror(req, NT_STATUS_NO_MEMORY);
846 END_PROFILE(SMBtconX);
847 return;
848 }
849
850 /* what does setting this bit do? It is set by NT4 and
851 may affect the ability to autorun mounted cdroms */
852 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
853 (lp_csc_policy(SNUM(conn)) << 2));
854
855 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
856 DEBUG(2,("Serving %s as a Dfs root\n",
857 lp_servicename(SNUM(conn)) ));
858 SSVAL(req->outbuf, smb_vwv2,
859 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
860 }
861 }
862
863
864 DEBUG(3,("tconX service=%s \n",
865 service));
866
867 /* set the incoming and outgoing tid to the just created one */
868 SSVAL(req->inbuf,smb_tid,conn->cnum);
869 SSVAL(req->outbuf,smb_tid,conn->cnum);
870
871 END_PROFILE(SMBtconX);
872
873 req->tid = conn->cnum;
874 chain_reply(req);
875 return;
876 }
877
878 /****************************************************************************
879 Reply to an unknown type.
880 ****************************************************************************/
881
882 void reply_unknown_new(struct smb_request *req, uint8 type)
883 {
884 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
885 smb_fn_name(type), type, type));
886 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
887 return;
888 }
889
890 /****************************************************************************
891 Reply to an ioctl.
892 conn POINTER CAN BE NULL HERE !
893 ****************************************************************************/
894
895 void reply_ioctl(struct smb_request *req)
896 {
897 connection_struct *conn = req->conn;
898 uint16 device;
899 uint16 function;
900 uint32 ioctl_code;
901 int replysize;
902 char *p;
903
904 START_PROFILE(SMBioctl);
905
906 if (req->wct < 3) {
907 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
908 END_PROFILE(SMBioctl);
909 return;
910 }
911
912 device = SVAL(req->vwv+1, 0);
913 function = SVAL(req->vwv+2, 0);
914 ioctl_code = (device << 16) + function;
915
916 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
917
918 switch (ioctl_code) {
919 case IOCTL_QUERY_JOB_INFO:
920 replysize = 32;
921 break;
922 default:
923 reply_force_doserror(req, ERRSRV, ERRnosupport);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927
928 reply_outbuf(req, 8, replysize+1);
929 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
930 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
931 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
932 p = smb_buf(req->outbuf);
933 memset(p, '\0', replysize+1); /* valgrind-safe. */
934 p += 1; /* Allow for alignment */
935
936 switch (ioctl_code) {
937 case IOCTL_QUERY_JOB_INFO:
938 {
939 files_struct *fsp = file_fsp(
940 req, SVAL(req->vwv+0, 0));
941 if (!fsp) {
942 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
943 END_PROFILE(SMBioctl);
944 return;
945 }
946 /* Job number */
947 if (fsp->print_file) {
948 SSVAL(p, 0, fsp->print_file->rap_jobid);
949 } else {
950 SSVAL(p, 0, 0);
951 }
952 srvstr_push((char *)req->outbuf, req->flags2, p+2,
953 global_myname(), 15,
954 STR_TERMINATE|STR_ASCII);
955 if (conn) {
956 srvstr_push((char *)req->outbuf, req->flags2,
957 p+18, lp_servicename(SNUM(conn)),
958 13, STR_TERMINATE|STR_ASCII);
959 } else {
960 memset(p+18, 0, 13);
961 }
962 break;
963 }
964 }
965
966 END_PROFILE(SMBioctl);
967 return;
968 }
969
970 /****************************************************************************
971 Strange checkpath NTSTATUS mapping.
972 ****************************************************************************/
973
974 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
975 {
976 /* Strange DOS error code semantics only for checkpath... */
977 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
978 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
979 /* We need to map to ERRbadpath */
980 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
981 }
982 }
983 return status;
984 }
985
986 /****************************************************************************
987 Reply to a checkpath.
988 ****************************************************************************/
989
990 void reply_checkpath(struct smb_request *req)
991 {
992 connection_struct *conn = req->conn;
993 struct smb_filename *smb_fname = NULL;
994 char *name = NULL;
995 NTSTATUS status;
996 TALLOC_CTX *ctx = talloc_tos();
997
998 START_PROFILE(SMBcheckpath);
999
1000 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1001 STR_TERMINATE, &status);
1002
1003 if (!NT_STATUS_IS_OK(status)) {
1004 status = map_checkpath_error(req->flags2, status);
1005 reply_nterror(req, status);
1006 END_PROFILE(SMBcheckpath);
1007 return;
1008 }
1009
1010 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1011
1012 status = filename_convert(ctx,
1013 conn,
1014 req->flags2 & FLAGS2_DFS_PATHNAMES,
1015 name,
1016 0,
1017 NULL,
1018 &smb_fname);
1019
1020 if (!NT_STATUS_IS_OK(status)) {
1021 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1022 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1023 ERRSRV, ERRbadpath);
1024 END_PROFILE(SMBcheckpath);
1025 return;
1026 }
1027 goto path_err;
1028 }
1029
1030 if (!VALID_STAT(smb_fname->st) &&
1031 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1032 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1033 smb_fname_str_dbg(smb_fname), strerror(errno)));
1034 status = map_nt_error_from_unix(errno);
1035 goto path_err;
1036 }
1037
1038 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1039 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1040 ERRDOS, ERRbadpath);
1041 goto out;
1042 }
1043
1044 reply_outbuf(req, 0, 0);
1045
1046 path_err:
1047 /* We special case this - as when a Windows machine
1048 is parsing a path is steps through the components
1049 one at a time - if a component fails it expects
1050 ERRbadpath, not ERRbadfile.
1051 */
1052 status = map_checkpath_error(req->flags2, status);
1053 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1054 /*
1055 * Windows returns different error codes if
1056 * the parent directory is valid but not the
1057 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1058 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1059 * if the path is invalid.
1060 */
1061 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1062 ERRDOS, ERRbadpath);
1063 goto out;
1064 }
1065
1066 reply_nterror(req, status);
1067
1068 out:
1069 TALLOC_FREE(smb_fname);
1070 END_PROFILE(SMBcheckpath);
1071 return;
1072 }
1073
1074 /****************************************************************************
1075 Reply to a getatr.
1076 ****************************************************************************/
1077
1078 void reply_getatr(struct smb_request *req)
1079 {
1080 connection_struct *conn = req->conn;
1081 struct smb_filename *smb_fname = NULL;
1082 char *fname = NULL;
1083 int mode=0;
1084 SMB_OFF_T size=0;
1085 time_t mtime=0;
1086 const char *p;
1087 NTSTATUS status;
1088 TALLOC_CTX *ctx = talloc_tos();
1089 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1090
1091 START_PROFILE(SMBgetatr);
1092
1093 p = (const char *)req->buf + 1;
1094 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1095 if (!NT_STATUS_IS_OK(status)) {
1096 reply_nterror(req, status);
1097 goto out;
1098 }
1099
1100 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1101 under WfWg - weird! */
1102 if (*fname == '\0') {
1103 mode = aHIDDEN | aDIR;
1104 if (!CAN_WRITE(conn)) {
1105 mode |= aRONLY;
1106 }
1107 size = 0;
1108 mtime = 0;
1109 } else {
1110 status = filename_convert(ctx,
1111 conn,
1112 req->flags2 & FLAGS2_DFS_PATHNAMES,
1113 fname,
1114 0,
1115 NULL,
1116 &smb_fname);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1119 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1120 ERRSRV, ERRbadpath);
1121 goto out;
1122 }
1123 reply_nterror(req, status);
1124 goto out;
1125 }
1126 if (!VALID_STAT(smb_fname->st) &&
1127 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1128 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1129 smb_fname_str_dbg(smb_fname),
1130 strerror(errno)));
1131 reply_nterror(req, map_nt_error_from_unix(errno));
1132 goto out;
1133 }
1134
1135 mode = dos_mode(conn, smb_fname);
1136 size = smb_fname->st.st_ex_size;
1137
1138 if (ask_sharemode) {
1139 struct timespec write_time_ts;
1140 struct file_id fileid;
1141
1142 ZERO_STRUCT(write_time_ts);
1143 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1144 get_file_infos(fileid, NULL, &write_time_ts);
1145 if (!null_timespec(write_time_ts)) {
1146 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1147 }
1148 }
1149
1150 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1151 if (mode & aDIR) {
1152 size = 0;
1153 }
1154 }
1155
1156 reply_outbuf(req, 10, 0);
1157
1158 SSVAL(req->outbuf,smb_vwv0,mode);
1159 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1160 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1161 } else {
1162 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1163 }
1164 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1165
1166 if (get_Protocol() >= PROTOCOL_NT1) {
1167 SSVAL(req->outbuf, smb_flg2,
1168 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1169 }
1170
1171 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1172 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1173
1174 out:
1175 TALLOC_FREE(smb_fname);
1176 TALLOC_FREE(fname);
1177 END_PROFILE(SMBgetatr);
1178 return;
1179 }
1180
1181 /****************************************************************************
1182 Reply to a setatr.
1183 ****************************************************************************/
1184
1185 void reply_setatr(struct smb_request *req)
1186 {
1187 struct smb_file_time ft;
1188 connection_struct *conn = req->conn;
1189 struct smb_filename *smb_fname = NULL;
1190 char *fname = NULL;
1191 int mode;
1192 time_t mtime;
1193 const char *p;
1194 NTSTATUS status;
1195 TALLOC_CTX *ctx = talloc_tos();
1196
1197 START_PROFILE(SMBsetatr);
1198
1199 ZERO_STRUCT(ft);
1200
1201 if (req->wct < 2) {
1202 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1203 goto out;
1204 }
1205
1206 p = (const char *)req->buf + 1;
1207 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1208 if (!NT_STATUS_IS_OK(status)) {
1209 reply_nterror(req, status);
1210 goto out;
1211 }
1212
1213 status = filename_convert(ctx,
1214 conn,
1215 req->flags2 & FLAGS2_DFS_PATHNAMES,
1216 fname,
1217 0,
1218 NULL,
1219 &smb_fname);
1220 if (!NT_STATUS_IS_OK(status)) {
1221 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1222 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1223 ERRSRV, ERRbadpath);
1224 goto out;
1225 }
1226 reply_nterror(req, status);
1227 goto out;
1228 }
1229
1230 if (smb_fname->base_name[0] == '.' &&
1231 smb_fname->base_name[1] == '\0') {
1232 /*
1233 * Not sure here is the right place to catch this
1234 * condition. Might be moved to somewhere else later -- vl
1235 */
1236 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1237 goto out;
1238 }
1239
1240 mode = SVAL(req->vwv+0, 0);
1241 mtime = srv_make_unix_date3(req->vwv+1);
1242
1243 ft.mtime = convert_time_t_to_timespec(mtime);
1244 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1245 if (!NT_STATUS_IS_OK(status)) {
1246 reply_nterror(req, status);
1247 goto out;
1248 }
1249
1250 if (mode != FILE_ATTRIBUTE_NORMAL) {
1251 if (VALID_STAT_OF_DIR(smb_fname->st))
1252 mode |= aDIR;
1253 else
1254 mode &= ~aDIR;
1255
1256 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1257 false) != 0) {
1258 reply_nterror(req, map_nt_error_from_unix(errno));
1259 goto out;
1260 }
1261 }
1262
1263 reply_outbuf(req, 0, 0);
1264
1265 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1266 mode));
1267 out:
1268 TALLOC_FREE(smb_fname);
1269 END_PROFILE(SMBsetatr);
1270 return;
1271 }
1272
1273 /****************************************************************************
1274 Reply to a dskattr.
1275 ****************************************************************************/
1276
1277 void reply_dskattr(struct smb_request *req)
1278 {
1279 connection_struct *conn = req->conn;
1280 uint64_t dfree,dsize,bsize;
1281 START_PROFILE(SMBdskattr);
1282
1283 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1284 reply_nterror(req, map_nt_error_from_unix(errno));
1285 END_PROFILE(SMBdskattr);
1286 return;
1287 }
1288
1289 reply_outbuf(req, 5, 0);
1290
1291 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1292 double total_space, free_space;
1293 /* we need to scale this to a number that DOS6 can handle. We
1294 use floating point so we can handle large drives on systems
1295 that don't have 64 bit integers
1296
1297 we end up displaying a maximum of 2G to DOS systems
1298 */
1299 total_space = dsize * (double)bsize;
1300 free_space = dfree * (double)bsize;
1301
1302 dsize = (uint64_t)((total_space+63*512) / (64*512));
1303 dfree = (uint64_t)((free_space+63*512) / (64*512));
1304
1305 if (dsize > 0xFFFF) dsize = 0xFFFF;
1306 if (dfree > 0xFFFF) dfree = 0xFFFF;
1307
1308 SSVAL(req->outbuf,smb_vwv0,dsize);
1309 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1310 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1311 SSVAL(req->outbuf,smb_vwv3,dfree);
1312 } else {
1313 SSVAL(req->outbuf,smb_vwv0,dsize);
1314 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1315 SSVAL(req->outbuf,smb_vwv2,512);
1316 SSVAL(req->outbuf,smb_vwv3,dfree);
1317 }
1318
1319 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1320
1321 END_PROFILE(SMBdskattr);
1322 return;
1323 }
1324
1325 /*
1326 * Utility function to split the filename from the directory.
1327 */
1328 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1329 char **fname_dir_out,
1330 char **fname_mask_out)
1331 {
1332 const char *p = NULL;
1333 char *fname_dir = NULL;
1334 char *fname_mask = NULL;
1335
1336 p = strrchr_m(fname_in, '/');
1337 if (!p) {
1338 fname_dir = talloc_strdup(ctx, ".");
1339 fname_mask = talloc_strdup(ctx, fname_in);
1340 } else {
1341 fname_dir = talloc_strndup(ctx, fname_in,
1342 PTR_DIFF(p, fname_in));
1343 fname_mask = talloc_strdup(ctx, p+1);
1344 }
1345
1346 if (!fname_dir || !fname_mask) {
1347 TALLOC_FREE(fname_dir);
1348 TALLOC_FREE(fname_mask);
1349 return NT_STATUS_NO_MEMORY;
1350 }
1351
1352 *fname_dir_out = fname_dir;
1353 *fname_mask_out = fname_mask;
1354 return NT_STATUS_OK;
1355 }
1356
1357 /****************************************************************************
1358 Reply to a search.
1359 Can be called from SMBsearch, SMBffirst or SMBfunique.
1360 ****************************************************************************/
1361
1362 void reply_search(struct smb_request *req)
1363 {
1364 connection_struct *conn = req->conn;
1365 char *path = NULL;
1366 const char *mask = NULL;
1367 char *directory = NULL;
1368 struct smb_filename *smb_fname = NULL;
1369 char *fname = NULL;
1370 SMB_OFF_T size;
1371 uint32 mode;
1372 struct timespec date;
1373 uint32 dirtype;
1374 unsigned int numentries = 0;
1375 unsigned int maxentries = 0;
1376 bool finished = False;
1377 const char *p;
1378 int status_len;
1379 char status[21];
1380 int dptr_num= -1;
1381 bool check_descend = False;
1382 bool expect_close = False;
1383 NTSTATUS nt_status;
1384 bool mask_contains_wcard = False;
1385 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1386 TALLOC_CTX *ctx = talloc_tos();
1387 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1388 struct dptr_struct *dirptr = NULL;
1389 struct smbd_server_connection *sconn = req->sconn;
1390
1391 START_PROFILE(SMBsearch);
1392
1393 if (req->wct < 2) {
1394 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1395 goto out;
1396 }
1397
1398 if (lp_posix_pathnames()) {
1399 reply_unknown_new(req, req->cmd);
1400 goto out;
1401 }
1402
1403 /* If we were called as SMBffirst then we must expect close. */
1404 if(req->cmd == SMBffirst) {
1405 expect_close = True;
1406 }
1407
1408 reply_outbuf(req, 1, 3);
1409 maxentries = SVAL(req->vwv+0, 0);
1410 dirtype = SVAL(req->vwv+1, 0);
1411 p = (const char *)req->buf + 1;
1412 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1413 &nt_status, &mask_contains_wcard);
1414 if (!NT_STATUS_IS_OK(nt_status)) {
1415 reply_nterror(req, nt_status);
1416 goto out;
1417 }
1418
1419 p++;
1420 status_len = SVAL(p, 0);
1421 p += 2;
1422
1423 /* dirtype &= ~aDIR; */
1424
1425 if (status_len == 0) {
1426 nt_status = filename_convert(ctx, conn,
1427 req->flags2 & FLAGS2_DFS_PATHNAMES,
1428 path,
1429 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1430 &mask_contains_wcard,
1431 &smb_fname);
1432 if (!NT_STATUS_IS_OK(nt_status)) {
1433 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1434 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1435 ERRSRV, ERRbadpath);
1436 goto out;
1437 }
1438 reply_nterror(req, nt_status);
1439 goto out;
1440 }
1441
1442 directory = smb_fname->base_name;
1443
1444 p = strrchr_m(directory,'/');
1445 if ((p != NULL) && (*directory != '/')) {
1446 mask = p + 1;
1447 directory = talloc_strndup(ctx, directory,
1448 PTR_DIFF(p, directory));
1449 } else {
1450 mask = directory;
1451 directory = talloc_strdup(ctx,".");
1452 }
1453
1454 if (!directory) {
1455 reply_nterror(req, NT_STATUS_NO_MEMORY);
1456 goto out;
1457 }
1458
1459 memset((char *)status,'\0',21);
1460 SCVAL(status,0,(dirtype & 0x1F));
1461
1462 nt_status = dptr_create(conn,
1463 directory,
1464 True,
1465 expect_close,
1466 req->smbpid,
1467 mask,
1468 mask_contains_wcard,
1469 dirtype,
1470 &dirptr);
1471 if (!NT_STATUS_IS_OK(nt_status)) {
1472 reply_nterror(req, nt_status);
1473 goto out;
1474 }
1475 dptr_num = dptr_dnum(dirptr);
1476 } else {
1477 int status_dirtype;
1478 const char *dirpath;
1479
1480 memcpy(status,p,21);
1481 status_dirtype = CVAL(status,0) & 0x1F;
1482 if (status_dirtype != (dirtype & 0x1F)) {
1483 dirtype = status_dirtype;
1484 }
1485
1486 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1487 if (!dirptr) {
1488 goto SearchEmpty;
1489 }
1490 dirpath = dptr_path(sconn, dptr_num);
1491 directory = talloc_strdup(ctx, dirpath);
1492 if (!directory) {
1493 reply_nterror(req, NT_STATUS_NO_MEMORY);
1494 goto out;
1495 }
1496
1497 mask = dptr_wcard(sconn, dptr_num);
1498 if (!mask) {
1499 goto SearchEmpty;
1500 }
1501 /*
1502 * For a 'continue' search we have no string. So
1503 * check from the initial saved string.
1504 */
1505 mask_contains_wcard = ms_has_wild(mask);
1506 dirtype = dptr_attr(sconn, dptr_num);
1507 }
1508
1509 DEBUG(4,("dptr_num is %d\n",dptr_num));
1510
1511 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1512 dptr_init_search_op(dirptr);
1513
1514 if ((dirtype&0x1F) == aVOLID) {
1515 char buf[DIR_STRUCT_SIZE];
1516 memcpy(buf,status,21);
1517 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1518 0,aVOLID,0,!allow_long_path_components)) {
1519 reply_nterror(req, NT_STATUS_NO_MEMORY);
1520 goto out;
1521 }
1522 dptr_fill(sconn, buf+12,dptr_num);
1523 if (dptr_zero(buf+12) && (status_len==0)) {
1524 numentries = 1;
1525 } else {
1526 numentries = 0;
1527 }
1528 if (message_push_blob(&req->outbuf,
1529 data_blob_const(buf, sizeof(buf)))
1530 == -1) {
1531 reply_nterror(req, NT_STATUS_NO_MEMORY);
1532 goto out;
1533 }
1534 } else {
1535 unsigned int i;
1536 maxentries = MIN(
1537 maxentries,
1538 ((BUFFER_SIZE -
1539 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1540 /DIR_STRUCT_SIZE));
1541
1542 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1543 directory,lp_dontdescend(SNUM(conn))));
1544 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1545 check_descend = True;
1546 }
1547
1548 for (i=numentries;(i<maxentries) && !finished;i++) {
1549 finished = !get_dir_entry(ctx,
1550 dirptr,
1551 mask,
1552 dirtype,
1553 &fname,
1554 &size,
1555 &mode,
1556 &date,
1557 check_descend,
1558 ask_sharemode);
1559 if (!finished) {
1560 char buf[DIR_STRUCT_SIZE];
1561 memcpy(buf,status,21);
1562 if (!make_dir_struct(ctx,
1563 buf,
1564 mask,
1565 fname,
1566 size,
1567 mode,
1568 convert_timespec_to_time_t(date),
1569 !allow_long_path_components)) {
1570 reply_nterror(req, NT_STATUS_NO_MEMORY);
1571 goto out;
1572 }
1573 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1574 break;
1575 }
1576 if (message_push_blob(&req->outbuf,
1577 data_blob_const(buf, sizeof(buf)))
1578 == -1) {
1579 reply_nterror(req, NT_STATUS_NO_MEMORY);
1580 goto out;
1581 }
1582 numentries++;
1583 }
1584 }
1585 }
1586
1587 SearchEmpty:
1588
1589 /* If we were called as SMBffirst with smb_search_id == NULL
1590 and no entries were found then return error and close dirptr
1591 (X/Open spec) */
1592
1593 if (numentries == 0) {
1594 dptr_close(sconn, &dptr_num);
1595 } else if(expect_close && status_len == 0) {
1596 /* Close the dptr - we know it's gone */
1597 dptr_close(sconn, &dptr_num);
1598 }
1599
1600 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1601 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1602 dptr_close(sconn, &dptr_num);
1603 }
1604
1605 if ((numentries == 0) && !mask_contains_wcard) {
1606 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1607 goto out;
1608 }
1609
1610 SSVAL(req->outbuf,smb_vwv0,numentries);
1611 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1612 SCVAL(smb_buf(req->outbuf),0,5);
1613 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1614
1615 /* The replies here are never long name. */
1616 SSVAL(req->outbuf, smb_flg2,
1617 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1618 if (!allow_long_path_components) {
1619 SSVAL(req->outbuf, smb_flg2,
1620 SVAL(req->outbuf, smb_flg2)
1621 & (~FLAGS2_LONG_PATH_COMPONENTS));
1622 }
1623
1624 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1625 SSVAL(req->outbuf, smb_flg2,
1626 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1627
1628 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1629 smb_fn_name(req->cmd),
1630 mask,
1631 directory,
1632 dirtype,
1633 numentries,
1634 maxentries ));
1635 out:
1636 TALLOC_FREE(directory);
1637 TALLOC_FREE(smb_fname);
1638 END_PROFILE(SMBsearch);
1639 return;
1640 }
1641
1642 /****************************************************************************
1643 Reply to a fclose (stop directory search).
1644 ****************************************************************************/
1645
1646 void reply_fclose(struct smb_request *req)
1647 {
1648 int status_len;
1649 char status[21];
1650 int dptr_num= -2;
1651 const char *p;
1652 char *path = NULL;
1653 NTSTATUS err;
1654 bool path_contains_wcard = False;
1655 TALLOC_CTX *ctx = talloc_tos();
1656 struct smbd_server_connection *sconn = req->sconn;
1657
1658 START_PROFILE(SMBfclose);
1659
1660 if (lp_posix_pathnames()) {
1661 reply_unknown_new(req, req->cmd);
1662 END_PROFILE(SMBfclose);
1663 return;
1664 }
1665
1666 p = (const char *)req->buf + 1;
1667 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1668 &err, &path_contains_wcard);
1669 if (!NT_STATUS_IS_OK(err)) {
1670 reply_nterror(req, err);
1671 END_PROFILE(SMBfclose);
1672 return;
1673 }
1674 p++;
1675 status_len = SVAL(p,0);
1676 p += 2;
1677
1678 if (status_len == 0) {
1679 reply_force_doserror(req, ERRSRV, ERRsrverror);
1680 END_PROFILE(SMBfclose);
1681 return;
1682 }
1683
1684 memcpy(status,p,21);
1685
1686 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1687 /* Close the dptr - we know it's gone */
1688 dptr_close(sconn, &dptr_num);
1689 }
1690
1691 reply_outbuf(req, 1, 0);
1692 SSVAL(req->outbuf,smb_vwv0,0);
1693
1694 DEBUG(3,("search close\n"));
1695
1696 END_PROFILE(SMBfclose);
1697 return;
1698 }
1699
1700 /****************************************************************************
1701 Reply to an open.
1702 ****************************************************************************/
1703
1704 void reply_open(struct smb_request *req)
1705 {
1706 connection_struct *conn = req->conn;
1707 struct smb_filename *smb_fname = NULL;
1708 char *fname = NULL;
1709 uint32 fattr=0;
1710 SMB_OFF_T size = 0;
1711 time_t mtime=0;
1712 int info;
1713 files_struct *fsp;
1714 int oplock_request;
1715 int deny_mode;
1716 uint32 dos_attr;
1717 uint32 access_mask;
1718 uint32 share_mode;
1719 uint32 create_disposition;
1720 uint32 create_options = 0;
1721 uint32_t private_flags = 0;
1722 NTSTATUS status;
1723 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1724 TALLOC_CTX *ctx = talloc_tos();
1725
1726 START_PROFILE(SMBopen);
1727
1728 if (req->wct < 2) {
1729 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1730 goto out;
1731 }
1732
1733 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1734 deny_mode = SVAL(req->vwv+0, 0);
1735 dos_attr = SVAL(req->vwv+1, 0);
1736
1737 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1738 STR_TERMINATE, &status);
1739 if (!NT_STATUS_IS_OK(status)) {
1740 reply_nterror(req, status);
1741 goto out;
1742 }
1743
1744 status = filename_convert(ctx,
1745 conn,
1746 req->flags2 & FLAGS2_DFS_PATHNAMES,
1747 fname,
1748 0,
1749 NULL,
1750 &smb_fname);
1751 if (!NT_STATUS_IS_OK(status)) {
1752 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1753 reply_botherror(req,
1754 NT_STATUS_PATH_NOT_COVERED,
1755 ERRSRV, ERRbadpath);
1756 goto out;
1757 }
1758 reply_nterror(req, status);
1759 goto out;
1760 }
1761
1762 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1763 OPENX_FILE_EXISTS_OPEN, &access_mask,
1764 &share_mode, &create_disposition,
1765 &create_options, &private_flags)) {
1766 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1767 goto out;
1768 }
1769
1770 status = SMB_VFS_CREATE_FILE(
1771 conn, /* conn */
1772 req, /* req */
1773 0, /* root_dir_fid */
1774 smb_fname, /* fname */
1775 access_mask, /* access_mask */
1776 share_mode, /* share_access */
1777 create_disposition, /* create_disposition*/
1778 create_options, /* create_options */
1779 dos_attr, /* file_attributes */
1780 oplock_request, /* oplock_request */
1781 0, /* allocation_size */
1782 private_flags,
1783 NULL, /* sd */
1784 NULL, /* ea_list */
1785 &fsp, /* result */
1786 &info); /* pinfo */
1787
1788 if (!NT_STATUS_IS_OK(status)) {
1789 if (open_was_deferred(req->mid)) {
1790 /* We have re-scheduled this call. */
1791 goto out;
1792 }
1793 reply_openerror(req, status);
1794 goto out;
1795 }
1796
1797 size = smb_fname->st.st_ex_size;
1798 fattr = dos_mode(conn, smb_fname);
1799
1800 /* Deal with other possible opens having a modified
1801 write time. JRA. */
1802 if (ask_sharemode) {
1803 struct timespec write_time_ts;
1804
1805 ZERO_STRUCT(write_time_ts);
1806 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1807 if (!null_timespec(write_time_ts)) {
1808 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1809 }
1810 }
1811
1812 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1813
1814 if (fattr & aDIR) {
1815 DEBUG(3,("attempt to open a directory %s\n",
1816 fsp_str_dbg(fsp)));
1817 close_file(req, fsp, ERROR_CLOSE);
1818 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1819 ERRDOS, ERRnoaccess);
1820 goto out;
1821 }
1822
1823 reply_outbuf(req, 7, 0);
1824 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1825 SSVAL(req->outbuf,smb_vwv1,fattr);
1826 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1827 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1828 } else {
1829 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1830 }
1831 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1832 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1833
1834 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1835 SCVAL(req->outbuf,smb_flg,
1836 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1837 }
1838
1839 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1840 SCVAL(req->outbuf,smb_flg,
1841 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1842 }
1843 out:
1844 TALLOC_FREE(smb_fname);
1845 END_PROFILE(SMBopen);
1846 return;
1847 }
1848
1849 /****************************************************************************
1850 Reply to an open and X.
1851 ****************************************************************************/
1852
1853 void reply_open_and_X(struct smb_request *req)
1854 {
1855 connection_struct *conn = req->conn;
1856 struct smb_filename *smb_fname = NULL;
1857 char *fname = NULL;
1858 uint16 open_flags;
1859 int deny_mode;
1860 uint32 smb_attr;
1861 /* Breakout the oplock request bits so we can set the
1862 reply bits separately. */
1863 int ex_oplock_request;
1864 int core_oplock_request;
1865 int oplock_request;
1866 #if 0
1867 int smb_sattr = SVAL(req->vwv+4, 0);
1868 uint32 smb_time = make_unix_date3(req->vwv+6);
1869 #endif
1870 int smb_ofun;
1871 uint32 fattr=0;
1872 int mtime=0;
1873 int smb_action = 0;
1874 files_struct *fsp;
1875 NTSTATUS status;
1876 uint64_t allocation_size;
1877 ssize_t retval = -1;
1878 uint32 access_mask;
1879 uint32 share_mode;
1880 uint32 create_disposition;
1881 uint32 create_options = 0;
1882 uint32_t private_flags = 0;
1883 TALLOC_CTX *ctx = talloc_tos();
1884
1885 START_PROFILE(SMBopenX);
1886
1887 if (req->wct < 15) {
1888 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1889 goto out;
1890 }
1891
1892 open_flags = SVAL(req->vwv+2, 0);
1893 deny_mode = SVAL(req->vwv+3, 0);
1894 smb_attr = SVAL(req->vwv+5, 0);
1895 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1896 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1897 oplock_request = ex_oplock_request | core_oplock_request;
1898 smb_ofun = SVAL(req->vwv+8, 0);
1899 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1900
1901 /* If it's an IPC, pass off the pipe handler. */
1902 if (IS_IPC(conn)) {
1903 if (lp_nt_pipe_support()) {
1904 reply_open_pipe_and_X(conn, req);
1905 } else {
1906 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1907 }
1908 goto out;
1909 }
1910
1911 /* XXXX we need to handle passed times, sattr and flags */
1912 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1913 STR_TERMINATE, &status);
1914 if (!NT_STATUS_IS_OK(status)) {
1915 reply_nterror(req, status);
1916 goto out;
1917 }
1918
1919 status = filename_convert(ctx,
1920 conn,
1921 req->flags2 & FLAGS2_DFS_PATHNAMES,
1922 fname,
1923 0,
1924 NULL,
1925 &smb_fname);
1926 if (!NT_STATUS_IS_OK(status)) {
1927 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1928 reply_botherror(req,
1929 NT_STATUS_PATH_NOT_COVERED,
1930 ERRSRV, ERRbadpath);
1931 goto out;
1932 }
1933 reply_nterror(req, status);
1934 goto out;
1935 }
1936
1937 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1938 &access_mask, &share_mode,
1939 &create_disposition,
1940 &create_options,
1941 &private_flags)) {
1942 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1943 goto out;
1944 }
1945
1946 status = SMB_VFS_CREATE_FILE(
1947 conn, /* conn */
1948 req, /* req */
1949 0, /* root_dir_fid */
1950 smb_fname, /* fname */
1951 access_mask, /* access_mask */
1952 share_mode, /* share_access */
1953 create_disposition, /* create_disposition*/
1954 create_options, /* create_options */
1955 smb_attr, /* file_attributes */
1956 oplock_request, /* oplock_request */
1957 0, /* allocation_size */
1958 private_flags,
1959 NULL, /* sd */
1960 NULL, /* ea_list */
1961 &fsp, /* result */
1962 &smb_action); /* pinfo */
1963
1964 if (!NT_STATUS_IS_OK(status)) {
1965 if (open_was_deferred(req->mid)) {
1966 /* We have re-scheduled this call. */
1967 goto out;
1968 }
1969 reply_openerror(req, status);
1970 goto out;
1971 }
1972
1973 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1974 if the file is truncated or created. */
1975 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1976 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1977 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1978 close_file(req, fsp, ERROR_CLOSE);
1979 reply_nterror(req, NT_STATUS_DISK_FULL);
1980 goto out;
1981 }
1982 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1983 if (retval < 0) {
1984 close_file(req, fsp, ERROR_CLOSE);
1985 reply_nterror(req, NT_STATUS_DISK_FULL);
1986 goto out;
1987 }
1988 smb_fname->st.st_ex_size =
1989 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1990 }
1991
1992 fattr = dos_mode(conn, smb_fname);
1993 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1994 if (fattr & aDIR) {
1995 close_file(req, fsp, ERROR_CLOSE);
1996 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1997 goto out;
1998 }
1999
2000 /* If the caller set the extended oplock request bit
2001 and we granted one (by whatever means) - set the
2002 correct bit for extended oplock reply.
2003 */
2004
2005 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2006 smb_action |= EXTENDED_OPLOCK_GRANTED;
2007 }
2008
2009 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2010 smb_action |= EXTENDED_OPLOCK_GRANTED;
2011 }
2012
2013 /* If the caller set the core oplock request bit
2014 and we granted one (by whatever means) - set the
2015 correct bit for core oplock reply.
2016 */
2017
2018 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2019 reply_outbuf(req, 19, 0);
2020 } else {
2021 reply_outbuf(req, 15, 0);
2022 }
2023
2024 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2025 SCVAL(req->outbuf, smb_flg,
2026 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2027 }
2028
2029 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2030 SCVAL(req->outbuf, smb_flg,
2031 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2032 }
2033
2034 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2035 SSVAL(req->outbuf,smb_vwv3,fattr);
2036 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2037 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2038 } else {
2039 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2040 }
2041 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2042 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2043 SSVAL(req->outbuf,smb_vwv11,smb_action);
2044
2045 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2046 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2047 }
2048
2049 chain_reply(req);
2050 out:
2051 TALLOC_FREE(smb_fname);
2052 END_PROFILE(SMBopenX);
2053 return;
2054 }
2055
2056 /****************************************************************************
2057 Reply to a SMBulogoffX.
2058 ****************************************************************************/
2059
2060 void reply_ulogoffX(struct smb_request *req)
2061 {
2062 struct smbd_server_connection *sconn = req->sconn;
2063 user_struct *vuser;
2064
2065 START_PROFILE(SMBulogoffX);
2066
2067 vuser = get_valid_user_struct(sconn, req->vuid);
2068
2069 if(vuser == NULL) {
2070 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2071 req->vuid));
2072 }
2073
2074 /* in user level security we are supposed to close any files
2075 open by this user */
2076 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2077 file_close_user(sconn, req->vuid);
2078 }
2079
2080 invalidate_vuid(sconn, req->vuid);
2081
2082 reply_outbuf(req, 2, 0);
2083
2084 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2085
2086 END_PROFILE(SMBulogoffX);
2087 req->vuid = UID_FIELD_INVALID;
2088 chain_reply(req);
2089 }
2090
2091 /****************************************************************************
2092 Reply to a mknew or a create.
2093 ****************************************************************************/
2094
2095 void reply_mknew(struct smb_request *req)
2096 {
2097 connection_struct *conn = req->conn;
2098 struct smb_filename *smb_fname = NULL;
2099 char *fname = NULL;
2100 uint32 fattr = 0;
2101 struct smb_file_time ft;
2102 files_struct *fsp;
2103 int oplock_request = 0;
2104 NTSTATUS status;
2105 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2106 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2107 uint32 create_disposition;
2108 uint32 create_options = 0;
2109 TALLOC_CTX *ctx = talloc_tos();
2110
2111 START_PROFILE(SMBcreate);
2112 ZERO_STRUCT(ft);
2113
2114 if (req->wct < 3) {
2115 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2116 goto out;
2117 }
2118
2119 fattr = SVAL(req->vwv+0, 0);
2120 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2121
2122 /* mtime. */
2123 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2124
2125 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2126 STR_TERMINATE, &status);
2127 if (!NT_STATUS_IS_OK(status)) {
2128 reply_nterror(req, status);
2129 goto out;
2130 }
2131
2132 status = filename_convert(ctx,
2133 conn,
2134 req->flags2 & FLAGS2_DFS_PATHNAMES,
2135 fname,
2136 0,
2137 NULL,
2138 &smb_fname);
2139 if (!NT_STATUS_IS_OK(status)) {
2140 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2141 reply_botherror(req,
2142 NT_STATUS_PATH_NOT_COVERED,
2143 ERRSRV, ERRbadpath);
2144 goto out;
2145 }
2146 reply_nterror(req, status);
2147 goto out;
2148 }
2149
2150 if (fattr & aVOLID) {
2151 DEBUG(0,("Attempt to create file (%s) with volid set - "
2152 "please report this\n",
2153 smb_fname_str_dbg(smb_fname)));
2154 }
2155
2156 if(req->cmd == SMBmknew) {
2157 /* We should fail if file exists. */
2158 create_disposition = FILE_CREATE;
2159 } else {
2160 /* Create if file doesn't exist, truncate if it does. */
2161 create_disposition = FILE_OVERWRITE_IF;
2162 }
2163
2164 status = SMB_VFS_CREATE_FILE(
2165 conn, /* conn */
2166 req, /* req */
2167 0, /* root_dir_fid */
2168 smb_fname, /* fname */
2169 access_mask, /* access_mask */
2170 share_mode, /* share_access */
2171 create_disposition, /* create_disposition*/
2172 create_options, /* create_options */
2173 fattr, /* file_attributes */
2174 oplock_request, /* oplock_request */
2175 0, /* allocation_size */
2176 0, /* private_flags */
2177 NULL, /* sd */
2178 NULL, /* ea_list */
2179 &fsp, /* result */
2180 NULL); /* pinfo */
2181
2182 if (!NT_STATUS_IS_OK(status)) {
2183 if (open_was_deferred(req->mid)) {
2184 /* We have re-scheduled this call. */
2185 goto out;
2186 }
2187 reply_openerror(req, status);
2188 goto out;
2189 }
2190
2191 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2192 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2193 if (!NT_STATUS_IS_OK(status)) {
2194 END_PROFILE(SMBcreate);
2195 goto out;
2196 }
2197
2198 reply_outbuf(req, 1, 0);
2199 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2200
2201 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2202 SCVAL(req->outbuf,smb_flg,
2203 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2204 }
2205
2206 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2207 SCVAL(req->outbuf,smb_flg,
2208 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2209 }
2210
2211 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2212 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2213 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2214 (unsigned int)fattr));
2215
2216 out:
2217 TALLOC_FREE(smb_fname);
2218 END_PROFILE(SMBcreate);
2219 return;
2220 }
2221
2222 /****************************************************************************
2223 Reply to a create temporary file.
2224 ****************************************************************************/
2225
2226 void reply_ctemp(struct smb_request *req)
2227 {
2228 connection_struct *conn = req->conn;
2229 struct smb_filename *smb_fname = NULL;
2230 char *fname = NULL;
2231 uint32 fattr;
2232 files_struct *fsp;
2233 int oplock_request;
2234 int tmpfd;
2235 char *s;
2236 NTSTATUS status;
2237 TALLOC_CTX *ctx = talloc_tos();
2238
2239 START_PROFILE(SMBctemp);
2240
2241 if (req->wct < 3) {
2242 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2243 goto out;
2244 }
2245
2246 fattr = SVAL(req->vwv+0, 0);
2247 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2248
2249 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2250 STR_TERMINATE, &status);
2251 if (!NT_STATUS_IS_OK(status)) {
2252 reply_nterror(req, status);
2253 goto out;
2254 }
2255 if (*fname) {
2256 fname = talloc_asprintf(ctx,
2257 "%s/TMXXXXXX",
2258 fname);
2259 } else {
2260 fname = talloc_strdup(ctx, "TMXXXXXX");
2261 }
2262
2263 if (!fname) {
2264 reply_nterror(req, NT_STATUS_NO_MEMORY);
2265 goto out;
2266 }
2267
2268 status = filename_convert(ctx, conn,
2269 req->flags2 & FLAGS2_DFS_PATHNAMES,
2270 fname,
2271 0,
2272 NULL,
2273 &smb_fname);
2274 if (!NT_STATUS_IS_OK(status)) {
2275 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2276 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2277 ERRSRV, ERRbadpath);
2278 goto out;
2279 }
2280 reply_nterror(req, status);
2281 goto out;
2282 }
2283
2284 tmpfd = mkstemp(smb_fname->base_name);
2285 if (tmpfd == -1) {
2286 reply_nterror(req, map_nt_error_from_unix(errno));
2287 goto out;
2288 }
2289
2290 SMB_VFS_STAT(conn, smb_fname);
2291
2292 /* We should fail if file does not exist. */
2293 status = SMB_VFS_CREATE_FILE(
2294 conn, /* conn */
2295 req, /* req */
2296 0, /* root_dir_fid */
2297 smb_fname, /* fname */
2298 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2299 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2300 FILE_OPEN, /* create_disposition*/
2301 0, /* create_options */
2302 fattr, /* file_attributes */
2303 oplock_request, /* oplock_request */
2304 0, /* allocation_size */
2305 0, /* private_flags */
2306 NULL, /* sd */
2307 NULL, /* ea_list */
2308 &fsp, /* result */
2309 NULL); /* pinfo */
2310
2311 /* close fd from mkstemp() */
2312 close(tmpfd);
2313
2314 if (!NT_STATUS_IS_OK(status)) {
2315 if (open_was_deferred(req->mid)) {
2316 /* We have re-scheduled this call. */
2317 goto out;
2318 }
2319 reply_openerror(req, status);
2320 goto out;
2321 }
2322
2323 reply_outbuf(req, 1, 0);
2324 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2325
2326 /* the returned filename is relative to the directory */
2327 s = strrchr_m(fsp->fsp_name->base_name, '/');
2328 if (!s) {
2329 s = fsp->fsp_name->base_name;
2330 } else {
2331 s++;
2332 }
2333
2334 #if 0
2335 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2336 thing in the byte section. JRA */
2337 SSVALS(p, 0, -1); /* what is this? not in spec */
2338 #endif
2339 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2340 == -1) {
2341 reply_nterror(req, NT_STATUS_NO_MEMORY);
2342 goto out;
2343 }
2344
2345 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2346 SCVAL(req->outbuf, smb_flg,
2347 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2348 }
2349
2350 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2351 SCVAL(req->outbuf, smb_flg,
2352 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2353 }
2354
2355 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2356 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2357 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2358 out:
2359 TALLOC_FREE(smb_fname);
2360 END_PROFILE(SMBctemp);
2361 return;
2362 }
2363
2364 /*******************************************************************
2365 Check if a user is allowed to rename a file.
2366 ********************************************************************/
2367
2368 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2369 uint16 dirtype)
2370 {
2371 uint32 fmode;
2372
2373 if (!CAN_WRITE(conn)) {
2374 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2375 }
2376
2377 fmode = dos_mode(conn, fsp->fsp_name);
2378 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2379 return NT_STATUS_NO_SUCH_FILE;
2380 }
2381
2382 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2383 if (fsp->posix_open) {
2384 return NT_STATUS_OK;
2385 }
2386
2387 /* If no pathnames are open below this
2388 directory, allow the rename. */
2389
2390 if (file_find_subpath(fsp)) {
2391 return NT_STATUS_ACCESS_DENIED;
2392 }
2393 return NT_STATUS_OK;
2394 }
2395
2396 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2397 return NT_STATUS_OK;
2398 }
2399
2400 return NT_STATUS_ACCESS_DENIED;
2401 }
2402
2403 /*******************************************************************
2404 * unlink a file with all relevant access checks
2405 *******************************************************************/
2406
2407 static NTSTATUS do_unlink(connection_struct *conn,
2408 struct smb_request *req,
2409 struct smb_filename *smb_fname,
2410 uint32 dirtype)
2411 {
2412 uint32 fattr;
2413 files_struct *fsp;
2414 uint32 dirtype_orig = dirtype;
2415 NTSTATUS status;
2416 int ret;
2417 bool posix_paths = lp_posix_pathnames();
2418
2419 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2420 smb_fname_str_dbg(smb_fname),
2421 dirtype));
2422
2423 if (!CAN_WRITE(conn)) {
2424 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2425 }
2426
2427 if (posix_paths) {
2428 ret = SMB_VFS_LSTAT(conn, smb_fname);
2429 } else {
2430 ret = SMB_VFS_STAT(conn, smb_fname);
2431 }
2432 if (ret != 0) {
2433 return map_nt_error_from_unix(errno);
2434 }
2435
2436 fattr = dos_mode(conn, smb_fname);
2437
2438 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2439 dirtype = aDIR|aARCH|aRONLY;
2440 }
2441
2442 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2443 if (!dirtype) {
2444 return NT_STATUS_NO_SUCH_FILE;
2445 }
2446
2447 if (!dir_check_ftype(conn, fattr, dirtype)) {
2448 if (fattr & aDIR) {
2449 return NT_STATUS_FILE_IS_A_DIRECTORY;
2450 }
2451 return NT_STATUS_NO_SUCH_FILE;
2452 }
2453
2454 if (dirtype_orig & 0x8000) {
2455 /* These will never be set for POSIX. */
2456 return NT_STATUS_NO_SUCH_FILE;
2457 }
2458
2459 #if 0
2460 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2461 return NT_STATUS_FILE_IS_A_DIRECTORY;
2462 }
2463
2464 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2465 return NT_STATUS_NO_SUCH_FILE;
2466 }
2467
2468 if (dirtype & 0xFF00) {
2469 /* These will never be set for POSIX. */
2470 return NT_STATUS_NO_SUCH_FILE;
2471 }
2472
2473 dirtype &= 0xFF;
2474 if (!dirtype) {
2475 return NT_STATUS_NO_SUCH_FILE;
2476 }
2477
2478 /* Can't delete a directory. */
2479 if (fattr & aDIR) {
2480 return NT_STATUS_FILE_IS_A_DIRECTORY;
2481 }
2482 #endif
2483
2484 #if 0 /* JRATEST */
2485 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2486 return NT_STATUS_OBJECT_NAME_INVALID;
2487 #endif /* JRATEST */
2488
2489 /* On open checks the open itself will check the share mode, so
2490 don't do it here as we'll get it wrong. */
2491
2492 status = SMB_VFS_CREATE_FILE
2493 (conn, /* conn */
2494 req, /* req */
2495 0, /* root_dir_fid */
2496 smb_fname, /* fname */
2497 DELETE_ACCESS, /* access_mask */
2498 FILE_SHARE_NONE, /* share_access */
2499 FILE_OPEN, /* create_disposition*/
2500 FILE_NON_DIRECTORY_FILE, /* create_options */
2501 /* file_attributes */
2502 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2503 FILE_ATTRIBUTE_NORMAL,
2504 0, /* oplock_request */
2505 0, /* allocation_size */
2506 0, /* private_flags */
2507 NULL, /* sd */
2508 NULL, /* ea_list */
2509 &fsp, /* result */
2510 NULL); /* pinfo */
2511
2512 if (!NT_STATUS_IS_OK(status)) {
2513 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2514 nt_errstr(status)));
2515 return status;
2516 }
2517
2518 status = can_set_delete_on_close(fsp, fattr);
2519 if (!NT_STATUS_IS_OK(status)) {
2520 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2521 "(%s)\n",
2522 smb_fname_str_dbg(smb_fname),
2523 nt_errstr(status)));
2524 close_file(req, fsp, NORMAL_CLOSE);
2525 return status;
2526 }
2527
2528 /* The set is across all open files on this dev/inode pair. */
2529 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2530 close_file(req, fsp, NORMAL_CLOSE);
2531 return NT_STATUS_ACCESS_DENIED;
2532 }
2533
2534 return close_file(req, fsp, NORMAL_CLOSE);
2535 }
2536
2537 /****************************************************************************
2538 The guts of the unlink command, split out so it may be called by the NT SMB
2539 code.
2540 ****************************************************************************/
2541
2542 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2543 uint32 dirtype, struct smb_filename *smb_fname,
2544 bool has_wild)
2545 {
2546 char *fname_dir = NULL;
2547 char *fname_mask = NULL;
2548 int count=0;
2549 NTSTATUS status = NT_STATUS_OK;
2550 TALLOC_CTX *ctx = talloc_tos();
2551
2552 /* Split up the directory from the filename/mask. */
2553 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2554 &fname_dir, &fname_mask);
2555 if (!NT_STATUS_IS_OK(status)) {
2556 goto out;
2557 }
2558
2559 /*
2560 * We should only check the mangled cache
2561 * here if unix_convert failed. This means
2562 * that the path in 'mask' doesn't exist
2563 * on the file system and so we need to look
2564 * for a possible mangle. This patch from
2565 * Tine Smukavec <valentin.smukavec@hermes.si>.
2566 */
2567
2568 if (!VALID_STAT(smb_fname->st) &&
2569 mangle_is_mangled(fname_mask, conn->params)) {
2570 char *new_mask = NULL;
2571 mangle_lookup_name_from_8_3(ctx, fname_mask,
2572 &new_mask, conn->params);
2573 if (new_mask) {
2574 TALLOC_FREE(fname_mask);
2575 fname_mask = new_mask;
2576 }
2577 }
2578
2579 if (!has_wild) {
2580
2581 /*
2582 * Only one file needs to be unlinked. Append the mask back
2583 * onto the directory.
2584 */
2585 TALLOC_FREE(smb_fname->base_name);
2586 smb_fname->base_name = talloc_asprintf(smb_fname,
2587 "%s/%s",
2588 fname_dir,
2589 fname_mask);
2590 if (!smb_fname->base_name) {
2591 status = NT_STATUS_NO_MEMORY;
2592 goto out;
2593 }
2594 if (dirtype == 0) {
2595 dirtype = FILE_ATTRIBUTE_NORMAL;
2596 }
2597
2598 status = check_name(conn, smb_fname->base_name);
2599 if (!NT_STATUS_IS_OK(status)) {
2600 goto out;
2601 }
2602
2603 status = do_unlink(conn, req, smb_fname, dirtype);
2604 if (!NT_STATUS_IS_OK(status)) {
2605 goto out;
2606 }
2607
2608 count++;
2609 } else {
2610 struct smb_Dir *dir_hnd = NULL;
2611 long offset = 0;
2612 const char *dname = NULL;
2613 char *talloced = NULL;
2614
2615 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2616 status = NT_STATUS_OBJECT_NAME_INVALID;
2617 goto out;
2618 }
2619
2620 if (strequal(fname_mask,"????????.???")) {
2621 TALLOC_FREE(fname_mask);
2622 fname_mask = talloc_strdup(ctx, "*");
2623 if (!fname_mask) {
2624 status = NT_STATUS_NO_MEMORY;
2625 goto out;
2626 }
2627 }
2628
2629 status = check_name(conn, fname_dir);
2630 if (!NT_STATUS_IS_OK(status)) {
2631 goto out;
2632 }
2633
2634 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2635 dirtype);
2636 if (dir_hnd == NULL) {
2637 status = map_nt_error_from_unix(errno);
2638 goto out;
2639 }
2640
2641 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2642 the pattern matches against the long name, otherwise the short name
2643 We don't implement this yet XXXX
2644 */
2645
2646 status = NT_STATUS_NO_SUCH_FILE;
2647
2648 while ((dname = ReadDirName(dir_hnd, &offset,
2649 &smb_fname->st, &talloced))) {
2650 TALLOC_CTX *frame = talloc_stackframe();
2651
2652 if (!is_visible_file(conn, fname_dir, dname,
2653 &smb_fname->st, true)) {
2654 TALLOC_FREE(frame);
2655 TALLOC_FREE(talloced);
2656 continue;
2657 }
2658
2659 /* Quick check for "." and ".." */
2660 if (ISDOT(dname) || ISDOTDOT(dname)) {
2661 TALLOC_FREE(frame);
2662 TALLOC_FREE(talloced);
2663 continue;
2664 }
2665
2666 if(!mask_match(dname, fname_mask,
2667 conn->case_sensitive)) {
2668 TALLOC_FREE(frame);
2669 TALLOC_FREE(talloced);
2670 continue;
2671 }
2672
2673 TALLOC_FREE(smb_fname->base_name);
2674 smb_fname->base_name =
2675 talloc_asprintf(smb_fname, "%s/%s",
2676 fname_dir, dname);
2677
2678 if (!smb_fname->base_name) {
2679 TALLOC_FREE(dir_hnd);
2680 status = NT_STATUS_NO_MEMORY;
2681 TALLOC_FREE(frame);
2682 TALLOC_FREE(talloced);
2683 goto out;
2684 }
2685
2686 status = check_name(conn, smb_fname->base_name);
2687 if (!NT_STATUS_IS_OK(status)) {
2688 TALLOC_FREE(dir_hnd);
2689 TALLOC_FREE(frame);
2690 TALLOC_FREE(talloced);
2691 goto out;
2692 }
2693
2694 status = do_unlink(conn, req, smb_fname, dirtype);
2695 if (!NT_STATUS_IS_OK(status)) {
2696 TALLOC_FREE(frame);
2697 TALLOC_FREE(talloced);
2698 continue;
2699 }
2700
2701 count++;
2702 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2703 smb_fname->base_name));
2704
2705 TALLOC_FREE(frame);
2706 TALLOC_FREE(talloced);
2707 }
2708 TALLOC_FREE(dir_hnd);
2709 }
2710
2711 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2712 status = map_nt_error_from_unix(errno);
2713 }
2714
2715 out:
2716 TALLOC_FREE(fname_dir);
2717 TALLOC_FREE(fname_mask);
2718 return status;
2719 }
2720
2721 /****************************************************************************
2722 Reply to a unlink
2723 ****************************************************************************/
2724
2725 void reply_unlink(struct smb_request *req)
2726 {
2727 connection_struct *conn = req->conn;
2728 char *name = NULL;
2729 struct smb_filename *smb_fname = NULL;
2730 uint32 dirtype;
2731 NTSTATUS status;
2732 bool path_contains_wcard = False;
2733 TALLOC_CTX *ctx = talloc_tos();
2734
2735 START_PROFILE(SMBunlink);
2736
2737 if (req->wct < 1) {
2738 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2739 goto out;
2740 }
2741
2742 dirtype = SVAL(req->vwv+0, 0);
2743
2744 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2745 STR_TERMINATE, &status,
2746 &path_contains_wcard);
2747 if (!NT_STATUS_IS_OK(status)) {
2748 reply_nterror(req, status);
2749 goto out;
2750 }
2751
2752 status = filename_convert(ctx, conn,
2753 req->flags2 & FLAGS2_DFS_PATHNAMES,
2754 name,
2755 UCF_COND_ALLOW_WCARD_LCOMP,
2756 &path_contains_wcard,
2757 &smb_fname);
2758 if (!NT_STATUS_IS_OK(status)) {
2759 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2760 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2761 ERRSRV, ERRbadpath);
2762 goto out;
2763 }
2764 reply_nterror(req, status);
2765 goto out;
2766 }
2767
2768 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2769
2770 status = unlink_internals(conn, req, dirtype, smb_fname,
2771 path_contains_wcard);
2772 if (!NT_STATUS_IS_OK(status)) {
2773 if (open_was_deferred(req->mid)) {
2774 /* We have re-scheduled this call. */
2775 goto out;
2776 }
2777 reply_nterror(req, status);
2778 goto out;
2779 }
2780
2781 reply_outbuf(req, 0, 0);
2782 out:
2783 TALLOC_FREE(smb_fname);
2784 END_PROFILE(SMBunlink);
2785 return;
2786 }
2787
2788 /****************************************************************************
2789 Fail for readbraw.
2790 ****************************************************************************/
2791
2792 static void fail_readraw(void)
2793 {
2794 const char *errstr = talloc_asprintf(talloc_tos(),
2795 "FAIL ! reply_readbraw: socket write fail (%s)",
2796 strerror(errno));
2797 if (!errstr) {
2798 errstr = "";
2799 }
2800 exit_server_cleanly(errstr);
2801 }
2802
2803 /****************************************************************************
2804 Fake (read/write) sendfile. Returns -1 on read or write fail.
2805 ****************************************************************************/
2806
2807 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2808 size_t nread)
2809 {
2810 size_t bufsize;
2811 size_t tosend = nread;
2812 char *buf;
2813
2814 if (nread == 0) {
2815 return 0;
2816 }
2817
2818 bufsize = MIN(nread, 65536);
2819
2820 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2821 return -1;
2822 }
2823
2824 while (tosend > 0) {
2825 ssize_t ret;
2826 size_t cur_read;
2827
2828 if (tosend > bufsize) {
2829 cur_read = bufsize;
2830 } else {
2831 cur_read = tosend;
2832 }
2833 ret = read_file(fsp,buf,startpos,cur_read);
2834 if (ret == -1) {
2835 SAFE_FREE(buf);
2836 return -1;
2837 }
2838
2839 /* If we had a short read, fill with zeros. */
2840 if (ret < cur_read) {
2841 memset(buf + ret, '\0', cur_read - ret);
2842 }
2843
2844 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2845 != cur_read) {
2846 char addr[INET6_ADDRSTRLEN];
2847 /*
2848 * Try and give an error message saying what
2849 * client failed.
2850 */
2851 DEBUG(0, ("write_data failed for client %s. "
2852 "Error %s\n",
2853 get_peer_addr(fsp->conn->sconn->sock, addr,
2854 sizeof(addr)),
2855 strerror(errno)));
2856 SAFE_FREE(buf);
2857 return -1;
2858 }
2859 tosend -= cur_read;
2860 startpos += cur_read;
2861 }
2862
2863 SAFE_FREE(buf);
2864 return (ssize_t)nread;
2865 }
2866
2867 #if defined(WITH_SENDFILE)
2868 /****************************************************************************
2869 Deal with the case of sendfile reading less bytes from the file than
2870 requested. Fill with zeros (all we can do).
2871 ****************************************************************************/
2872
2873 static void sendfile_short_send(files_struct *fsp,
2874 ssize_t nread,
2875 size_t headersize,
2876 size_t smb_maxcnt)
2877 {
2878 #define SHORT_SEND_BUFSIZE 1024
2879 if (nread < headersize) {
2880 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2881 "header for file %s (%s). Terminating\n",
2882 fsp_str_dbg(fsp), strerror(errno)));
2883 exit_server_cleanly("sendfile_short_send failed");
2884 }
2885
2886 nread -= headersize;
2887
2888 if (nread < smb_maxcnt) {
2889 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2890 if (!buf) {
2891 exit_server_cleanly("sendfile_short_send: "
2892 "malloc failed");
2893 }
2894
2895 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2896 "with zeros !\n", fsp_str_dbg(fsp)));
2897
2898 while (nread < smb_maxcnt) {
2899 /*
2900 * We asked for the real file size and told sendfile
2901 * to not go beyond the end of the file. But it can
2902 * happen that in between our fstat call and the
2903 * sendfile call the file was truncated. This is very
2904 * bad because we have already announced the larger
2905 * number of bytes to the client.
2906 *
2907 * The best we can do now is to send 0-bytes, just as
2908 * a read from a hole in a sparse file would do.
2909 *
2910 * This should happen rarely enough that I don't care
2911 * about efficiency here :-)
2912 */
2913 size_t to_write;
2914
2915 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2916 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2917 != to_write) {
2918 char addr[INET6_ADDRSTRLEN];
2919 /*
2920 * Try and give an error message saying what
2921 * client failed.
2922 */
2923 DEBUG(0, ("write_data failed for client %s. "
2924 "Error %s\n",
2925 get_peer_addr(
2926 fsp->conn->sconn->sock, addr,
2927 sizeof(addr)),
2928 strerror(errno)));
2929 exit_server_cleanly("sendfile_short_send: "
2930 "write_data failed");
2931 }
2932 nread += to_write;
2933 }
2934 SAFE_FREE(buf);
2935 }
2936 }
2937 #endif /* defined WITH_SENDFILE */
2938
2939 /****************************************************************************
2940 Return a readbraw error (4 bytes of zero).
2941 ****************************************************************************/
2942
2943 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2944 {
2945 char header[4];
2946
2947 SIVAL(header,0,0);
2948
2949 smbd_lock_socket(sconn);
2950 if (write_data(sconn->sock,header,4) != 4) {
2951 char addr[INET6_ADDRSTRLEN];
2952 /*
2953 * Try and give an error message saying what
2954 * client failed.
2955 */
2956 DEBUG(0, ("write_data failed for client %s. "
2957 "Error %s\n",
2958 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2959 strerror(errno)));
2960
2961 fail_readraw();
2962 }
2963 smbd_unlock_socket(sconn);
2964 }
2965
2966 /****************************************************************************
2967 Use sendfile in readbraw.
2968 ****************************************************************************/
2969
2970 static void send_file_readbraw(connection_struct *conn,
2971 struct smb_request *req,
2972 files_struct *fsp,
2973 SMB_OFF_T startpos,
2974 size_t nread,
2975 ssize_t mincount)
2976 {
2977 struct smbd_server_connection *sconn = req->sconn;
2978 char *outbuf = NULL;
2979 ssize_t ret=0;
2980
2981 #if defined(WITH_SENDFILE)
2982 /*
2983 * We can only use sendfile on a non-chained packet
2984 * but we can use on a non-oplocked file. tridge proved this
2985 * on a train in Germany :-). JRA.
2986 * reply_readbraw has already checked the length.
2987 */
2988
2989 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2990 (fsp->wcp == NULL) &&
2991 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2992 ssize_t sendfile_read = -1;
2993 char header[4];
2994 DATA_BLOB header_blob;
2995
2996 _smb_setlen(header,nread);
2997 header_blob = data_blob_const(header, 4);
2998
2999 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3000 &header_blob, startpos,
3001 nread);
3002 if (sendfile_read == -1) {
3003 /* Returning ENOSYS means no data at all was sent.
3004 * Do this as a normal read. */
3005 if (errno == ENOSYS) {
3006 goto normal_readbraw;
3007 }
3008
3009 /*
3010 * Special hack for broken Linux with no working sendfile. If we
3011 * return EINTR we sent the header but not the rest of the data.
3012 * Fake this up by doing read/write calls.
3013 */
3014 if (errno == EINTR) {
3015 /* Ensure we don't do this again. */
3016 set_use_sendfile(SNUM(conn), False);
3017 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3018
3019 if (fake_sendfile(fsp, startpos, nread) == -1) {
3020 DEBUG(0,("send_file_readbraw: "
3021 "fake_sendfile failed for "
3022 "file %s (%s).\n",
3023 fsp_str_dbg(fsp),
3024 strerror(errno)));
3025 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3026 }
3027 return;
3028 }
3029
3030 DEBUG(0,("send_file_readbraw: sendfile failed for "
3031 "file %s (%s). Terminating\n",
3032 fsp_str_dbg(fsp), strerror(errno)));
3033 exit_server_cleanly("send_file_readbraw sendfile failed");
3034 } else if (sendfile_read == 0) {
3035 /*
3036 * Some sendfile implementations return 0 to indicate
3037 * that there was a short read, but nothing was
3038 * actually written to the socket. In this case,
3039 * fallback to the normal read path so the header gets
3040 * the correct byte count.
3041 */
3042 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3043 "bytes falling back to the normal read: "
3044 "%s\n", fsp_str_dbg(fsp)));
3045 goto normal_readbraw;
3046 }
3047
3048 /* Deal with possible short send. */
3049 if (sendfile_read != 4+nread) {
3050 sendfile_short_send(fsp, sendfile_read, 4, nread);
3051 }
3052 return;
3053 }
3054
3055 normal_readbraw:
3056 #endif
3057
3058 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3059 if (!outbuf) {
3060 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3061 (unsigned)(nread+4)));
3062 reply_readbraw_error(sconn);
3063 return;
3064 }
3065
3066 if (nread > 0) {
3067 ret = read_file(fsp,outbuf+4,startpos,nread);
3068 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3069 if (ret < mincount)
3070 ret = 0;
3071 #else
3072 if (ret < nread)
3073 ret = 0;
3074 #endif
3075 }
3076
3077 _smb_setlen(outbuf,ret);
3078 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3079 char addr[INET6_ADDRSTRLEN];
3080 /*
3081 * Try and give an error message saying what
3082 * client failed.
3083 */
3084 DEBUG(0, ("write_data failed for client %s. "
3085 "Error %s\n",
3086 get_peer_addr(fsp->conn->sconn->sock, addr,
3087 sizeof(addr)),
3088 strerror(errno)));
3089
3090 fail_readraw();
3091 }
3092
3093 TALLOC_FREE(outbuf);
3094 }
3095
3096 /****************************************************************************
3097 Reply to a readbraw (core+ protocol).
3098 ****************************************************************************/
3099
3100 void reply_readbraw(struct smb_request *req)
3101 {
3102 connection_struct *conn = req->conn;
3103 struct smbd_server_connection *sconn = req->sconn;
3104 ssize_t maxcount,mincount;
3105 size_t nread = 0;
3106 SMB_OFF_T startpos;
3107 files_struct *fsp;
3108 struct lock_struct lock;
3109 SMB_OFF_T size = 0;
3110
3111 START_PROFILE(SMBreadbraw);
3112
3113 if (srv_is_signing_active(sconn) ||
3114 is_encrypted_packet(req->inbuf)) {
3115 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3116 "raw reads/writes are disallowed.");
3117 }
3118
3119 if (req->wct < 8) {
3120 reply_readbraw_error(sconn);
3121 END_PROFILE(SMBreadbraw);
3122 return;
3123 }
3124
3125 if (sconn->smb1.echo_handler.trusted_fde) {
3126 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3127 "'async smb echo handler = yes'\n"));
3128 reply_readbraw_error(sconn);
3129 END_PROFILE(SMBreadbraw);
3130 return;
3131 }
3132
3133 /*
3134 * Special check if an oplock break has been issued
3135 * and the readraw request croses on the wire, we must
3136 * return a zero length response here.
3137 */
3138
3139 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3140
3141 /*
3142 * We have to do a check_fsp by hand here, as
3143 * we must always return 4 zero bytes on error,
3144 * not a NTSTATUS.
3145 */
3146
3147 if (!fsp || !conn || conn != fsp->conn ||
3148 req->vuid != fsp->vuid ||
3149 fsp->is_directory || fsp->fh->fd == -1) {
3150 /*
3151 * fsp could be NULL here so use the value from the packet. JRA.
3152 */
3153 DEBUG(3,("reply_readbraw: fnum %d not valid "
3154 "- cache prime?\n",
3155 (int)SVAL(req->vwv+0, 0)));
3156 reply_readbraw_error(sconn);
3157 END_PROFILE(SMBreadbraw);
3158 return;
3159 }
3160
3161 /* Do a "by hand" version of CHECK_READ. */
3162 if (!(fsp->can_read ||
3163 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3164 (fsp->access_mask & FILE_EXECUTE)))) {
3165 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3166 (int)SVAL(req->vwv+0, 0)));
3167 reply_readbraw_error(sconn);
3168 END_PROFILE(SMBreadbraw);
3169 return;
3170 }
3171
3172 flush_write_cache(fsp, READRAW_FLUSH);
3173
3174 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3175 if(req->wct == 10) {
3176 /*
3177 * This is a large offset (64 bit) read.
3178 */
3179 #ifdef LARGE_SMB_OFF_T
3180
3181 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3182
3183 #else /* !LARGE_SMB_OFF_T */
3184
3185 /*
3186 * Ensure we haven't been sent a >32 bit offset.
3187 */
3188
3189 if(IVAL(req->vwv+8, 0) != 0) {
3190 DEBUG(0,("reply_readbraw: large offset "
3191 "(%x << 32) used and we don't support "
3192 "64 bit offsets.\n",
3193 (unsigned int)IVAL(req->vwv+8, 0) ));
3194 reply_readbraw_error();
3195 END_PROFILE(SMBreadbraw);
3196 return;
3197 }
3198
3199 #endif /* LARGE_SMB_OFF_T */
3200
3201 if(startpos < 0) {
3202 DEBUG(0,("reply_readbraw: negative 64 bit "
3203 "readraw offset (%.0f) !\n",
3204 (double)startpos ));
3205 reply_readbraw_error(sconn);
3206 END_PROFILE(SMBreadbraw);
3207 return;
3208 }
3209 }
3210
3211 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3212 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3213
3214 /* ensure we don't overrun the packet size */
3215 maxcount = MIN(65535,maxcount);
3216
3217 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3218 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3219 &lock);
3220
3221 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3222 reply_readbraw_error(sconn);
3223 END_PROFILE(SMBreadbraw);
3224 return;
3225 }
3226
3227 if (fsp_stat(fsp) == 0) {
3228 size = fsp->fsp_name->st.st_ex_size;
3229 }
3230
3231 if (startpos >= size) {
3232 nread = 0;
3233 } else {
3234 nread = MIN(maxcount,(size - startpos));
3235 }
3236
3237 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3238 if (nread < mincount)
3239 nread = 0;
3240 #endif
3241
3242 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3243 "min=%lu nread=%lu\n",
3244 fsp->fnum, (double)startpos,
3245 (unsigned long)maxcount,
3246 (unsigned long)mincount,
3247 (unsigned long)nread ) );
3248
3249 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3250
3251 DEBUG(5,("reply_readbraw finished\n"));
3252
3253 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3254
3255 END_PROFILE(SMBreadbraw);
3256 return;
3257 }
3258
3259 #undef DBGC_CLASS
3260 #define DBGC_CLASS DBGC_LOCKING
3261
3262 /****************************************************************************
3263 Reply to a lockread (core+ protocol).
3264 ****************************************************************************/
3265
3266 void reply_lockread(struct smb_request *req)
3267 {
3268 connection_struct *conn = req->conn;
3269 ssize_t nread = -1;
3270 char *data;
3271 SMB_OFF_T startpos;
3272 size_t numtoread;
3273 NTSTATUS status;
3274 files_struct *fsp;
3275 struct byte_range_lock *br_lck = NULL;
3276 char *p = NULL;
3277 struct smbd_server_connection *sconn = req->sconn;
3278
3279 START_PROFILE(SMBlockread);
3280
3281 if (req->wct < 5) {
3282 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3283 END_PROFILE(SMBlockread);
3284 return;
3285 }
3286
3287 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3288
3289 if (!check_fsp(conn, req, fsp)) {
3290 END_PROFILE(SMBlockread);
3291 return;
3292 }
3293
3294 if (!CHECK_READ(fsp,req)) {
3295 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3296 END_PROFILE(SMBlockread);
3297 return;
3298 }
3299
3300 numtoread = SVAL(req->vwv+1, 0);
3301 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3302
3303 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3304
3305 reply_outbuf(req, 5, numtoread + 3);
3306
3307 data = smb_buf(req->outbuf) + 3;
3308
3309 /*
3310 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3311 * protocol request that predates the read/write lock concept.
3312 * Thus instead of asking for a read lock here we need to ask
3313 * for a write lock. JRA.
3314 * Note that the requested lock size is unaffected by max_recv.
3315 */
3316
3317 br_lck = do_lock(req->sconn->msg_ctx,
3318 fsp,
3319 (uint64_t)req->smbpid,
3320 (uint64_t)numtoread,
3321 (uint64_t)startpos,
3322 WRITE_LOCK,
3323 WINDOWS_LOCK,
3324 False, /* Non-blocking lock. */
3325 &status,
3326 NULL,
3327 NULL);
3328 TALLOC_FREE(br_lck);
3329
3330 if (NT_STATUS_V(status)) {
3331 reply_nterror(req, status);
3332 END_PROFILE(SMBlockread);
3333 return;
3334 }
3335
3336 /*
3337 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3338 */
3339
3340 if (numtoread > sconn->smb1.negprot.max_recv) {
3341 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3342 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3343 (unsigned int)numtoread,
3344 (unsigned int)sconn->smb1.negprot.max_recv));
3345 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3346 }
3347 nread = read_file(fsp,data,startpos,numtoread);
3348
3349 if (nread < 0) {
3350 reply_nterror(req, map_nt_error_from_unix(errno));
3351 END_PROFILE(SMBlockread);
3352 return;
3353 }
3354
3355 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3356
3357 SSVAL(req->outbuf,smb_vwv0,nread);
3358 SSVAL(req->outbuf,smb_vwv5,nread+3);
3359 p = smb_buf(req->outbuf);
3360 SCVAL(p,0,0); /* pad byte. */
3361 SSVAL(p,1,nread);
3362
3363 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3364 fsp->fnum, (int)numtoread, (int)nread));
3365
3366 END_PROFILE(SMBlockread);
3367 return;
3368 }
3369
3370 #undef DBGC_CLASS
3371 #define DBGC_CLASS DBGC_ALL
3372
3373 /****************************************************************************
3374 Reply to a read.
3375 ****************************************************************************/
3376
3377 void reply_read(struct smb_request *req)
3378 {
3379 connection_struct *conn = req->conn;
3380 size_t numtoread;
3381 ssize_t nread = 0;
3382 char *data;
3383 SMB_OFF_T startpos;
3384 int outsize = 0;
3385 files_struct *fsp;
3386 struct lock_struct lock;
3387 struct smbd_server_connection *sconn = req->sconn;
3388
3389 START_PROFILE(SMBread);
3390
3391 if (req->wct < 3) {
3392 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3393 END_PROFILE(SMBread);
3394 return;
3395 }
3396
3397 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3398
3399 if (!check_fsp(conn, req, fsp)) {
3400 END_PROFILE(SMBread);
3401 return;
3402 }
3403
3404 if (!CHECK_READ(fsp,req)) {
3405 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3406 END_PROFILE(SMBread);
3407 return;
3408 }
3409
3410 numtoread = SVAL(req->vwv+1, 0);
3411 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3412
3413 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3414
3415 /*
3416 * The requested read size cannot be greater than max_recv. JRA.
3417 */
3418 if (numtoread > sconn->smb1.negprot.max_recv) {
3419 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3420 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3421 (unsigned int)numtoread,
3422 (unsigned int)sconn->smb1.negprot.max_recv));
3423 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3424 }
3425
3426 reply_outbuf(req, 5, numtoread+3);
3427
3428 data = smb_buf(req->outbuf) + 3;
3429
3430 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3431 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3432 &lock);
3433
3434 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3435 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3436 END_PROFILE(SMBread);
3437 return;
3438 }
3439
3440 if (numtoread > 0)
3441 nread = read_file(fsp,data,startpos,numtoread);
3442
3443 if (nread < 0) {
3444 reply_nterror(req, map_nt_error_from_unix(errno));
3445 goto strict_unlock;
3446 }
3447
3448 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3449
3450 SSVAL(req->outbuf,smb_vwv0,nread);
3451 SSVAL(req->outbuf,smb_vwv5,nread+3);
3452 SCVAL(smb_buf(req->outbuf),0,1);
3453 SSVAL(smb_buf(req->outbuf),1,nread);
3454
3455 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3456 fsp->fnum, (int)numtoread, (int)nread ) );
3457
3458 strict_unlock:
3459 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3460
3461 END_PROFILE(SMBread);
3462 return;
3463 }
3464
3465 /****************************************************************************
3466 Setup readX header.
3467 ****************************************************************************/
3468
3469 static int setup_readX_header(struct smb_request *req, char *outbuf,
3470 size_t smb_maxcnt)
3471 {
3472 int outsize;
3473 char *data;
3474
3475 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3476 data = smb_buf(outbuf);
3477
3478 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3479
3480 SCVAL(outbuf,smb_vwv0,0xFF);
3481 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3482 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3483 SSVAL(outbuf,smb_vwv6,
3484 req_wct_ofs(req)
3485 + 1 /* the wct field */
3486 + 12 * sizeof(uint16_t) /* vwv */
3487 + 2); /* the buflen field */
3488 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3489 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3490 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3491 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3492 return outsize;
3493 }
3494
3495 /****************************************************************************
3496 Reply to a read and X - possibly using sendfile.
3497 ****************************************************************************/
3498
3499 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3500 files_struct *fsp, SMB_OFF_T startpos,
3501 size_t smb_maxcnt)
3502 {
3503 ssize_t nread = -1;
3504 struct lock_struct lock;
3505 int saved_errno = 0;
3506
3507 if(fsp_stat(fsp) == -1) {
3508 reply_nterror(req, map_nt_error_from_unix(errno));
3509 return;
3510 }
3511
3512 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3513 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3514 &lock);
3515
3516 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3517 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3518 return;
3519 }
3520
3521 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3522 (startpos > fsp->fsp_name->st.st_ex_size)
3523 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3524 /*
3525 * We already know that we would do a short read, so don't
3526 * try the sendfile() path.
3527 */
3528 goto nosendfile_read;
3529 }
3530
3531 #if defined(WITH_SENDFILE)
3532 /*
3533 * We can only use sendfile on a non-chained packet
3534 * but we can use on a non-oplocked file. tridge proved this
3535 * on a train in Germany :-). JRA.
3536 */
3537
3538 if (!req_is_in_chain(req) &&
3539 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3540 (fsp->wcp == NULL) &&
3541 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3542 uint8 headerbuf[smb_size + 12 * 2];
3543 DATA_BLOB header;
3544
3545 /*
3546 * Set up the packet header before send. We
3547 * assume here the sendfile will work (get the
3548 * correct amount of data).
3549 */
3550
3551 header = data_blob_const(headerbuf, sizeof(headerbuf));
3552
3553 construct_reply_common_req(req, (char *)headerbuf);
3554 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3555
3556 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3557 startpos, smb_maxcnt);
3558 if (nread == -1) {
3559 /* Returning ENOSYS means no data at all was sent.
3560 Do this as a normal read. */
3561 if (errno == ENOSYS) {
3562 goto normal_read;
3563 }
3564
3565 /*
3566 * Special hack for broken Linux with no working sendfile. If we
3567 * return EINTR we sent the header but not the rest of the data.
3568 * Fake this up by doing read/write calls.
3569 */
3570
3571 if (errno == EINTR) {
3572 /* Ensure we don't do this again. */
3573 set_use_sendfile(SNUM(conn), False);
3574 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3575 nread = fake_sendfile(fsp, startpos,
3576 smb_maxcnt);
3577 if (nread == -1) {
3578 DEBUG(0,("send_file_readX: "
3579 "fake_sendfile failed for "
3580 "file %s (%s).\n",
3581 fsp_str_dbg(fsp),
3582 strerror(errno)));
3583 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3584 }
3585 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3586 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3587 /* No outbuf here means successful sendfile. */
3588 goto strict_unlock;
3589 }
3590
3591 DEBUG(0,("send_file_readX: sendfile failed for file "
3592 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3593 strerror(errno)));
3594 exit_server_cleanly("send_file_readX sendfile failed");
3595 } else if (nread == 0) {
3596 /*
3597 * Some sendfile implementations return 0 to indicate
3598 * that there was a short read, but nothing was
3599 * actually written to the socket. In this case,
3600 * fallback to the normal read path so the header gets
3601 * the correct byte count.
3602 */
3603 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3604 "falling back to the normal read: %s\n",
3605 fsp_str_dbg(fsp)));
3606 goto normal_read;
3607 }
3608
3609 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3610 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3611
3612 /* Deal with possible short send. */
3613 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3614 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3615 }
3616 /* No outbuf here means successful sendfile. */
3617 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3618 SMB_PERFCOUNT_END(&req->pcd);
3619 goto strict_unlock;
3620 }
3621
3622 normal_read:
3623
3624 #endif
3625
3626 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3627 uint8 headerbuf[smb_size + 2*12];
3628
3629 construct_reply_common_req(req, (char *)headerbuf);
3630 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3631
3632 /* Send out the header. */
3633 if (write_data(req->sconn->sock, (char *)headerbuf,
3634 sizeof(headerbuf)) != sizeof(headerbuf)) {
3635
3636 char addr[INET6_ADDRSTRLEN];
3637 /*
3638 * Try and give an error message saying what
3639 * client failed.
3640 */
3641 DEBUG(0, ("write_data failed for client %s. "
3642 "Error %s\n",
3643 get_peer_addr(req->sconn->sock, addr,
3644 sizeof(addr)),
3645 strerror(errno)));
3646
3647 DEBUG(0,("send_file_readX: write_data failed for file "
3648 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3649 strerror(errno)));
3650 exit_server_cleanly("send_file_readX sendfile failed");
3651 }
3652 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3653 if (nread == -1) {
3654 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3655 "file %s (%s).\n", fsp_str_dbg(fsp),
3656 strerror(errno)));
3657 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3658 }
3659 goto strict_unlock;
3660 }
3661
3662 nosendfile_read:
3663
3664 reply_outbuf(req, 12, smb_maxcnt);
3665
3666 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3667 saved_errno = errno;
3668
3669 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3670
3671 if (nread < 0) {
3672 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3673 return;
3674 }
3675
3676 setup_readX_header(req, (char *)req->outbuf, nread);
3677
3678 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3679 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3680
3681 chain_reply(req);
3682 return;
3683
3684 strict_unlock:
3685 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3686 TALLOC_FREE(req->outbuf);
3687 return;
3688 }
3689
3690 /****************************************************************************
3691 Reply to a read and X.
3692 ****************************************************************************/
3693
3694 void reply_read_and_X(struct smb_request *req)
3695 {
3696 connection_struct *conn = req->conn;
3697 files_struct *fsp;
3698 SMB_OFF_T startpos;
3699 size_t smb_maxcnt;
3700 bool big_readX = False;
3701 #if 0
3702 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3703 #endif
3704
3705 START_PROFILE(SMBreadX);
3706
3707 if ((req->wct != 10) && (req->wct != 12)) {
3708 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3709 return;
3710 }
3711
3712 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3713 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3714 smb_maxcnt = SVAL(req->vwv+5, 0);
3715
3716 /* If it's an IPC, pass off the pipe handler. */
3717 if (IS_IPC(conn)) {
3718 reply_pipe_read_and_X(req);
3719 END_PROFILE(SMBreadX);
3720 return;
3721 }
3722
3723 if (!check_fsp(conn, req, fsp)) {
3724 END_PROFILE(SMBreadX);
3725 return;
3726 }
3727
3728 if (!CHECK_READ(fsp,req)) {
3729 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3730 END_PROFILE(SMBreadX);
3731 return;
3732 }
3733
3734 if (global_client_caps & CAP_LARGE_READX) {
3735 size_t upper_size = SVAL(req->vwv+7, 0);
3736 smb_maxcnt |= (upper_size<<16);
3737 if (upper_size > 1) {
3738 /* Can't do this on a chained packet. */
3739 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3740 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3741 END_PROFILE(SMBreadX);
3742 return;
3743 }
3744 /* We currently don't do this on signed or sealed data. */
3745 if (srv_is_signing_active(req->sconn) ||
3746 is_encrypted_packet(req->inbuf)) {
3747 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3748 END_PROFILE(SMBreadX);
3749 return;
3750 }
3751 /* Is there room in the reply for this data ? */
3752 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3753 reply_nterror(req,
3754 NT_STATUS_INVALID_PARAMETER);
3755 END_PROFILE(SMBreadX);
3756 return;
3757 }
3758 big_readX = True;
3759 }
3760 }
3761
3762 if (req->wct == 12) {
3763 #ifdef LARGE_SMB_OFF_T
3764 /*
3765 * This is a large offset (64 bit) read.
3766 */
3767 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3768
3769 #else /* !LARGE_SMB_OFF_T */
3770
3771 /*
3772 * Ensure we haven't been sent a >32 bit offset.
3773 */
3774
3775 if(IVAL(req->vwv+10, 0) != 0) {
3776 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3777 "used and we don't support 64 bit offsets.\n",
3778 (unsigned int)IVAL(req->vwv+10, 0) ));
3779 END_PROFILE(SMBreadX);
3780 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3781 return;
3782 }
3783
3784 #endif /* LARGE_SMB_OFF_T */
3785
3786 }
3787
3788 if (!big_readX) {
3789 NTSTATUS status = schedule_aio_read_and_X(conn,
3790 req,
3791 fsp,
3792 startpos,
3793 smb_maxcnt);
3794 if (NT_STATUS_IS_OK(status)) {
3795 /* Read scheduled - we're done. */
3796 goto out;
3797 }
3798 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3799 /* Real error - report to client. */
3800 END_PROFILE(SMBreadX);
3801 reply_nterror(req, status);
3802 return;
3803 }
3804 /* NT_STATUS_RETRY - fall back to sync read. */
3805 }
3806
3807 smbd_lock_socket(req->sconn);
3808 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3809 smbd_unlock_socket(req->sconn);
3810
3811 out:
3812 END_PROFILE(SMBreadX);
3813 return;
3814 }
3815
3816 /****************************************************************************
3817 Error replies to writebraw must have smb_wct == 1. Fix this up.
3818 ****************************************************************************/
3819
3820 void error_to_writebrawerr(struct smb_request *req)
3821 {
3822 uint8 *old_outbuf = req->outbuf;
3823
3824 reply_outbuf(req, 1, 0);
3825
3826 memcpy(req->outbuf, old_outbuf, smb_size);
3827 TALLOC_FREE(old_outbuf);
3828 }
3829
3830 /****************************************************************************
3831 Read 4 bytes of a smb packet and return the smb length of the packet.
3832 Store the result in the buffer. This version of the function will
3833 never return a session keepalive (length of zero).
3834 Timeout is in milliseconds.
3835 ****************************************************************************/
3836
3837 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3838 size_t *len)
3839 {
3840 uint8_t msgtype = SMBkeepalive;
3841
3842 while (msgtype == SMBkeepalive) {
3843 NTSTATUS status;
3844
3845 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3846 len);
3847 if (!NT_STATUS_IS_OK(status)) {
3848 char addr[INET6_ADDRSTRLEN];
3849 /* Try and give an error message
3850 * saying what client failed. */
3851 DEBUG(0, ("read_fd_with_timeout failed for "
3852 "client %s read error = %s.\n",
3853 get_peer_addr(fd,addr,sizeof(addr)),
3854 nt_errstr(status)));
3855 return status;
3856 }
3857
3858 msgtype = CVAL(inbuf, 0);
3859 }
3860
3861 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3862 (unsigned long)len));
3863
3864 return NT_STATUS_OK;
3865 }
3866
3867 /****************************************************************************
3868 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3869 ****************************************************************************/
3870
3871 void reply_writebraw(struct smb_request *req)
3872 {
3873 connection_struct *conn = req->conn;
3874 char *buf = NULL;
3875 ssize_t nwritten=0;
3876 ssize_t total_written=0;
3877 size_t numtowrite=0;
3878 size_t tcount;
3879 SMB_OFF_T startpos;
3880 char *data=NULL;
3881 bool write_through;
3882 files_struct *fsp;
3883 struct lock_struct lock;
3884 NTSTATUS status;
3885
3886 START_PROFILE(SMBwritebraw);
3887
3888 /*
3889 * If we ever reply with an error, it must have the SMB command
3890 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3891 * we're finished.
3892 */
3893 SCVAL(req->inbuf,smb_com,SMBwritec);
3894
3895 if (srv_is_signing_active(req->sconn)) {
3896 END_PROFILE(SMBwritebraw);
3897 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3898 "raw reads/writes are disallowed.");
3899 }
3900
3901 if (req->wct < 12) {
3902 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3903 error_to_writebrawerr(req);
3904 END_PROFILE(SMBwritebraw);
3905 return;
3906 }
3907
3908 if (req->sconn->smb1.echo_handler.trusted_fde) {
3909 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3910 "'async smb echo handler = yes'\n"));
3911 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3912 error_to_writebrawerr(req);
3913 END_PROFILE(SMBwritebraw);
3914 return;
3915 }
3916
3917 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3918 if (!check_fsp(conn, req, fsp)) {
3919 error_to_writebrawerr(req);
3920 END_PROFILE(SMBwritebraw);
3921 return;
3922 }
3923
3924 if (!CHECK_WRITE(fsp)) {
3925 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3926 error_to_writebrawerr(req);
3927 END_PROFILE(SMBwritebraw);
3928 return;
3929 }
3930
3931 tcount = IVAL(req->vwv+1, 0);
3932 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3933 write_through = BITSETW(req->vwv+7,0);
3934
3935 /* We have to deal with slightly different formats depending
3936 on whether we are using the core+ or lanman1.0 protocol */
3937
3938 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3939 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3940 data = smb_buf(req->inbuf);
3941 } else {
3942 numtowrite = SVAL(req->vwv+10, 0);
3943 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3944 }
3945
3946 /* Ensure we don't write bytes past the end of this packet. */
3947 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3948 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3949 error_to_writebrawerr(req);
3950 END_PROFILE(SMBwritebraw);
3951 return;
3952 }
3953
3954 if (!fsp->print_file) {
3955 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3956 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3957 &lock);
3958
3959 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3960 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3961 error_to_writebrawerr(req);
3962 END_PROFILE(SMBwritebraw);
3963 return;
3964 }
3965 }
3966
3967 if (numtowrite>0) {
3968 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3969 }
3970
3971 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3972 "wrote=%d sync=%d\n",
3973 fsp->fnum, (double)startpos, (int)numtowrite,
3974 (int)nwritten, (int)write_through));
3975
3976 if (nwritten < (ssize_t)numtowrite) {
3977 reply_nterror(req, NT_STATUS_DISK_FULL);
3978 error_to_writebrawerr(req);
3979 goto strict_unlock;
3980 }
3981
3982 total_written = nwritten;
3983
3984 /* Allocate a buffer of 64k + length. */
3985 buf = TALLOC_ARRAY(NULL, char, 65540);
3986 if (!buf) {
3987 reply_nterror(req, NT_STATUS_NO_MEMORY);
3988 error_to_writebrawerr(req);
3989 goto strict_unlock;
3990 }
3991
3992 /* Return a SMBwritebraw message to the redirector to tell
3993 * it to send more bytes */
3994
3995 memcpy(buf, req->inbuf, smb_size);
3996 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3997 SCVAL(buf,smb_com,SMBwritebraw);
3998 SSVALS(buf,smb_vwv0,0xFFFF);
3999 show_msg(buf);
4000 if (!srv_send_smb(req->sconn,
4001 buf,
4002 false, 0, /* no signing */
4003 IS_CONN_ENCRYPTED(conn),
4004 &req->pcd)) {
4005 exit_server_cleanly("reply_writebraw: srv_send_smb "
4006 "failed.");
4007 }
4008
4009 /* Now read the raw data into the buffer and write it */
4010 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4011 &numtowrite);
4012 if (!NT_STATUS_IS_OK(status)) {
4013 exit_server_cleanly("secondary writebraw failed");
4014 }
4015
4016 /* Set up outbuf to return the correct size */
4017 reply_outbuf(req, 1, 0);
4018
4019 if (numtowrite != 0) {
4020
4021 if (numtowrite > 0xFFFF) {
4022 DEBUG(0,("reply_writebraw: Oversize secondary write "
4023 "raw requested (%u). Terminating\n",
4024 (unsigned int)numtowrite ));
4025 exit_server_cleanly("secondary writebraw failed");
4026 }
4027
4028 if (tcount > nwritten+numtowrite) {
4029 DEBUG(3,("reply_writebraw: Client overestimated the "
4030 "write %d %d %d\n",
4031 (int)tcount,(int)nwritten,(int)numtowrite));
4032 }
4033
4034 status = read_data(req->sconn->sock, buf+4, numtowrite);
4035
4036 if (!NT_STATUS_IS_OK(status)) {
4037 char addr[INET6_ADDRSTRLEN];
4038 /* Try and give an error message
4039 * saying what client failed. */
4040 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4041 "raw read failed (%s) for client %s. "
4042 "Terminating\n", nt_errstr(status),
4043 get_peer_addr(req->sconn->sock, addr,
4044 sizeof(addr))));
4045 exit_server_cleanly("secondary writebraw failed");
4046 }
4047
4048 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4049 if (nwritten == -1) {
4050 TALLOC_FREE(buf);
4051 reply_nterror(req, map_nt_error_from_unix(errno));
4052 error_to_writebrawerr(req);
4053 goto strict_unlock;
4054 }
4055
4056 if (nwritten < (ssize_t)numtowrite) {
4057 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4058 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4059 }
4060
4061 if (nwritten > 0) {
4062 total_written += nwritten;
4063 }
4064 }
4065
4066 TALLOC_FREE(buf);
4067 SSVAL(req->outbuf,smb_vwv0,total_written);
4068
4069 status = sync_file(conn, fsp, write_through);
4070 if (!NT_STATUS_IS_OK(status)) {
4071 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4072 fsp_str_dbg(fsp), nt_errstr(status)));
4073 reply_nterror(req, status);
4074 error_to_writebrawerr(req);
4075 goto strict_unlock;
4076 }
4077
4078 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4079 "wrote=%d\n",
4080 fsp->fnum, (double)startpos, (int)numtowrite,
4081 (int)total_written));
4082
4083 if (!fsp->print_file) {
4084 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4085 }
4086
4087 /* We won't return a status if write through is not selected - this
4088 * follows what WfWg does */
4089 END_PROFILE(SMBwritebraw);
4090
4091 if (!write_through && total_written==tcount) {
4092
4093 #if RABBIT_PELLET_FIX
4094 /*
4095 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4096 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4097 * JRA.
4098 */
4099 if (!send_keepalive(req->sconn->sock)) {
4100 exit_server_cleanly("reply_writebraw: send of "
4101 "keepalive failed");
4102 }
4103 #endif
4104 TALLOC_FREE(req->outbuf);
4105 }
4106 return;
4107
4108 strict_unlock:
4109 if (!fsp->print_file) {
4110 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4111 }
4112
4113 END_PROFILE(SMBwritebraw);
4114 return;
4115 }
4116
4117 #undef DBGC_CLASS
4118 #define DBGC_CLASS DBGC_LOCKING
4119
4120 /****************************************************************************
4121 Reply to a writeunlock (core+).
4122 ****************************************************************************/
4123
4124 void reply_writeunlock(struct smb_request *req)
4125 {
4126 connection_struct *conn = req->conn;
4127 ssize_t nwritten = -1;
4128 size_t numtowrite;
4129 SMB_OFF_T startpos;
4130 const char *data;
4131 NTSTATUS status = NT_STATUS_OK;
4132 files_struct *fsp;
4133 struct lock_struct lock;
4134 int saved_errno = 0;
4135
4136 START_PROFILE(SMBwriteunlock);
4137
4138 if (req->wct < 5) {
4139 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4140 END_PROFILE(SMBwriteunlock);
4141 return;
4142 }
4143
4144 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4145
4146 if (!check_fsp(conn, req, fsp)) {
4147 END_PROFILE(SMBwriteunlock);
4148 return;
4149 }
4150
4151 if (!CHECK_WRITE(fsp)) {
4152 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4153 END_PROFILE(SMBwriteunlock);
4154 return;
4155 }
4156
4157 numtowrite = SVAL(req->vwv+1, 0);
4158 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4159 data = (const char *)req->buf + 3;
4160
4161 if (!fsp->print_file && numtowrite > 0) {
4162 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4163 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4164 &lock);
4165
4166 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4167 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4168 END_PROFILE(SMBwriteunlock);
4169 return;
4170 }
4171 }
4172
4173 /* The special X/Open SMB protocol handling of
4174 zero length writes is *NOT* done for
4175 this call */
4176 if(numtowrite == 0) {
4177 nwritten = 0;
4178 } else {
4179 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4180 saved_errno = errno;
4181 }
4182
4183 status = sync_file(conn, fsp, False /* write through */);
4184 if (!NT_STATUS_IS_OK(status)) {
4185 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4186 fsp_str_dbg(fsp), nt_errstr(status)));
4187 reply_nterror(req, status);
4188 goto strict_unlock;
4189 }
4190
4191 if(nwritten < 0) {
4192 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4193 goto strict_unlock;
4194 }
4195
4196 if((nwritten < numtowrite) && (numtowrite != 0)) {
4197 reply_nterror(req, NT_STATUS_DISK_FULL);
4198 goto strict_unlock;
4199 }
4200
4201 if (numtowrite && !fsp->print_file) {
4202 status = do_unlock(req->sconn->msg_ctx,
4203 fsp,
4204 (uint64_t)req->smbpid,
4205 (uint64_t)numtowrite,
4206 (uint64_t)startpos,
4207 WINDOWS_LOCK);
4208
4209 if (NT_STATUS_V(status)) {
4210 reply_nterror(req, status);
4211 goto strict_unlock;
4212 }
4213 }
4214
4215 reply_outbuf(req, 1, 0);
4216
4217 SSVAL(req->outbuf,smb_vwv0,nwritten);
4218
4219 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4220 fsp->fnum, (int)numtowrite, (int)nwritten));
4221
4222 strict_unlock:
4223 if (numtowrite && !fsp->print_file) {
4224 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4225 }
4226
4227 END_PROFILE(SMBwriteunlock);
4228 return;
4229 }
4230
4231 #undef DBGC_CLASS
4232 #define DBGC_CLASS DBGC_ALL
4233
4234 /****************************************************************************
4235 Reply to a write.
4236 ****************************************************************************/
4237
4238 void reply_write(struct smb_request *req)
4239 {
4240 connection_struct *conn = req->conn;
4241 size_t numtowrite;
4242 ssize_t nwritten = -1;
4243 SMB_OFF_T startpos;
4244 const char *data;
4245 files_struct *fsp;
4246 struct lock_struct lock;
4247 NTSTATUS status;
4248 int saved_errno = 0;
4249
4250 START_PROFILE(SMBwrite);
4251
4252 if (req->wct < 5) {
4253 END_PROFILE(SMBwrite);
4254 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4255 return;
4256 }
4257
4258 /* If it's an IPC, pass off the pipe handler. */
4259 if (IS_IPC(conn)) {
4260 reply_pipe_write(req);
4261 END_PROFILE(SMBwrite);
4262 return;
4263 }
4264
4265 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4266
4267 if (!check_fsp(conn, req, fsp)) {
4268 END_PROFILE(SMBwrite);
4269 return;
4270 }
4271
4272 if (!CHECK_WRITE(fsp)) {
4273 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4274 END_PROFILE(SMBwrite);
4275 return;
4276 }
4277
4278 numtowrite = SVAL(req->vwv+1, 0);
4279 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4280 data = (const char *)req->buf + 3;
4281
4282 if (!fsp->print_file) {
4283 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4284 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4285 &lock);
4286
4287 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4288 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4289 END_PROFILE(SMBwrite);
4290 return;
4291 }
4292 }
4293
4294 /*
4295 * X/Open SMB protocol says that if smb_vwv1 is
4296 * zero then the file size should be extended or
4297 * truncated to the size given in smb_vwv[2-3].
4298 */
4299
4300 if(numtowrite == 0) {
4301 /*
4302 * This is actually an allocate call, and set EOF. JRA.
4303 */
4304 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4305 if (nwritten < 0) {
4306 reply_nterror(req, NT_STATUS_DISK_FULL);
4307 goto strict_unlock;
4308 }
4309 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4310 if (nwritten < 0) {
4311 reply_nterror(req, NT_STATUS_DISK_FULL);
4312 goto strict_unlock;
4313 }
4314 trigger_write_time_update_immediate(fsp);
4315 } else {
4316 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4317 }
4318
4319 status = sync_file(conn, fsp, False);
4320 if (!NT_STATUS_IS_OK(status)) {
4321 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4322 fsp_str_dbg(fsp), nt_errstr(status)));
4323 reply_nterror(req, status);
4324 goto strict_unlock;
4325 }
4326
4327 if(nwritten < 0) {
4328 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4329 goto strict_unlock;
4330 }
4331
4332 if((nwritten == 0) && (numtowrite != 0)) {
4333 reply_nterror(req, NT_STATUS_DISK_FULL);
4334 goto strict_unlock;
4335 }
4336
4337 reply_outbuf(req, 1, 0);
4338
4339 SSVAL(req->outbuf,smb_vwv0,nwritten);
4340
4341 if (nwritten < (ssize_t)numtowrite) {
4342 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4343 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4344 }
4345
4346 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4347
4348 strict_unlock:
4349 if (!fsp->print_file) {
4350 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4351 }
4352
4353 END_PROFILE(SMBwrite);
4354 return;
4355 }
4356
4357 /****************************************************************************
4358 Ensure a buffer is a valid writeX for recvfile purposes.
4359 ****************************************************************************/
4360
4361 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4362 (2*14) + /* word count (including bcc) */ \
4363 1 /* pad byte */)
4364
4365 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4366 const uint8_t *inbuf)
4367 {
4368 size_t numtowrite;
4369 connection_struct *conn = NULL;
4370 unsigned int doff = 0;
4371 size_t len = smb_len_large(inbuf);
4372
4373 if (is_encrypted_packet(inbuf)) {
4374 /* Can't do this on encrypted
4375 * connections. */
4376 return false;
4377 }
4378
4379 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4380 return false;
4381 }
4382
4383 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4384 CVAL(inbuf,smb_wct) != 14) {
4385 DEBUG(10,("is_valid_writeX_buffer: chained or "
4386 "invalid word length.\n"));
4387 return false;
4388 }
4389
4390 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4391 if (conn == NULL) {
4392 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4393 return false;
4394 }
4395 if (IS_IPC(conn)) {
4396 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4397 return false;
4398 }
4399 if (IS_PRINT(conn)) {
4400 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4401 return false;
4402 }
4403 doff = SVAL(inbuf,smb_vwv11);
4404
4405 numtowrite = SVAL(inbuf,smb_vwv10);
4406
4407 if (len > doff && len - doff > 0xFFFF) {
4408 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4409 }
4410
4411 if (numtowrite == 0) {
4412 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4413 return false;
4414 }
4415
4416 /* Ensure the sizes match up. */
4417 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4418 /* no pad byte...old smbclient :-( */
4419 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4420 (unsigned int)doff,
4421 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4422 return false;
4423 }
4424
4425 if (len - doff != numtowrite) {
4426 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4427 "len = %u, doff = %u, numtowrite = %u\n",
4428 (unsigned int)len,
4429 (unsigned int)doff,
4430 (unsigned int)numtowrite ));
4431 return false;
4432 }
4433
4434 DEBUG(10,("is_valid_writeX_buffer: true "
4435 "len = %u, doff = %u, numtowrite = %u\n",
4436 (unsigned int)len,
4437 (unsigned int)doff,
4438 (unsigned int)numtowrite ));
4439
4440 return true;
4441 }
4442
4443 /****************************************************************************
4444 Reply to a write and X.
4445 ****************************************************************************/
4446
4447 void reply_write_and_X(struct smb_request *req)
4448 {
4449 connection_struct *conn = req->conn;
4450 files_struct *fsp;
4451 struct lock_struct lock;
4452 SMB_OFF_T startpos;
4453 size_t numtowrite;
4454 bool write_through;
4455 ssize_t nwritten;
4456 unsigned int smb_doff;
4457 unsigned int smblen;
4458 char *data;
4459 NTSTATUS status;
4460 int saved_errno = 0;
4461
4462 START_PROFILE(SMBwriteX);
4463
4464 if ((req->wct != 12) && (req->wct != 14)) {
4465 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4466 END_PROFILE(SMBwriteX);
4467 return;
4468 }
4469
4470 numtowrite = SVAL(req->vwv+10, 0);
4471 smb_doff = SVAL(req->vwv+11, 0);
4472 smblen = smb_len(req->inbuf);
4473
4474 if (req->unread_bytes > 0xFFFF ||
4475 (smblen > smb_doff &&
4476 smblen - smb_doff > 0xFFFF)) {
4477 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4478 }
4479
4480 if (req->unread_bytes) {
4481 /* Can't do a recvfile write on IPC$ */
4482 if (IS_IPC(conn)) {
4483 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4484 END_PROFILE(SMBwriteX);
4485 return;
4486 }
4487 if (numtowrite != req->unread_bytes) {
4488 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4489 END_PROFILE(SMBwriteX);
4490 return;
4491 }
4492 } else {
4493 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4494 smb_doff + numtowrite > smblen) {
4495 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4496 END_PROFILE(SMBwriteX);
4497 return;
4498 }
4499 }
4500
4501 /* If it's an IPC, pass off the pipe handler. */
4502 if (IS_IPC(conn)) {
4503 if (req->unread_bytes) {
4504 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4505 END_PROFILE(SMBwriteX);
4506 return;
4507 }
4508 reply_pipe_write_and_X(req);
4509 END_PROFILE(SMBwriteX);
4510 return;
4511 }
4512
4513 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4514 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4515 write_through = BITSETW(req->vwv+7,0);
4516
4517 if (!check_fsp(conn, req, fsp)) {
4518 END_PROFILE(SMBwriteX);
4519 return;
4520 }
4521
4522 if (!CHECK_WRITE(fsp)) {
4523 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4524 END_PROFILE(SMBwriteX);
4525 return;
4526 }
4527
4528 data = smb_base(req->inbuf) + smb_doff;
4529
4530 if(req->wct == 14) {
4531 #ifdef LARGE_SMB_OFF_T
4532 /*
4533 * This is a large offset (64 bit) write.
4534 */
4535 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4536
4537 #else /* !LARGE_SMB_OFF_T */
4538
4539 /*
4540 * Ensure we haven't been sent a >32 bit offset.
4541 */
4542
4543 if(IVAL(req->vwv+12, 0) != 0) {
4544 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4545 "used and we don't support 64 bit offsets.\n",
4546 (unsigned int)IVAL(req->vwv+12, 0) ));
4547 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4548 END_PROFILE(SMBwriteX);
4549 return;
4550 }
4551
4552 #endif /* LARGE_SMB_OFF_T */
4553 }
4554
4555 /* X/Open SMB protocol says that, unlike SMBwrite
4556 if the length is zero then NO truncation is
4557 done, just a write of zero. To truncate a file,
4558 use SMBwrite. */
4559
4560 if(numtowrite == 0) {
4561 nwritten = 0;
4562 } else {
4563 if (req->unread_bytes == 0) {
4564 status = schedule_aio_write_and_X(conn,
4565 req,
4566 fsp,
4567 data,
4568 startpos,
4569 numtowrite);
4570
4571 if (NT_STATUS_IS_OK(status)) {
4572 /* write scheduled - we're done. */
4573 goto out;
4574 }
4575 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4576 /* Real error - report to client. */
4577 reply_nterror(req, status);
4578 goto out;
4579 }
4580 /* NT_STATUS_RETRY - fall through to sync write. */
4581 }
4582
4583 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4584 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4585 &lock);
4586
4587 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4588 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4589 goto out;
4590 }
4591
4592 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4593 saved_errno = errno;
4594
4595 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4596 }
4597
4598 if(nwritten < 0) {
4599 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4600 goto out;
4601 }
4602
4603 if((nwritten == 0) && (numtowrite != 0)) {
4604 reply_nterror(req, NT_STATUS_DISK_FULL);
4605 goto out;
4606 }
4607
4608 reply_outbuf(req, 6, 0);
4609 SSVAL(req->outbuf,smb_vwv2,nwritten);
4610 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4611
4612 if (nwritten < (ssize_t)numtowrite) {
4613 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4614 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4615 }
4616
4617 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4618 fsp->fnum, (int)numtowrite, (int)nwritten));
4619
4620 status = sync_file(conn, fsp, write_through);
4621 if (!NT_STATUS_IS_OK(status)) {
4622 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4623 fsp_str_dbg(fsp), nt_errstr(status)));
4624 reply_nterror(req, status);
4625 goto out;
4626 }
4627
4628 END_PROFILE(SMBwriteX);
4629 chain_reply(req);
4630 return;
4631
4632 out:
4633 END_PROFILE(SMBwriteX);
4634 return;
4635 }
4636
4637 /****************************************************************************
4638 Reply to a lseek.
4639 ****************************************************************************/
4640
4641 void reply_lseek(struct smb_request *req)
4642 {
4643 connection_struct *conn = req->conn;
4644 SMB_OFF_T startpos;
4645 SMB_OFF_T res= -1;
4646 int mode,umode;
4647 files_struct *fsp;
4648
4649 START_PROFILE(SMBlseek);
4650
4651 if (req->wct < 4) {
4652 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4653 END_PROFILE(SMBlseek);
4654 return;
4655 }
4656
4657 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4658
4659 if (!check_fsp(conn, req, fsp)) {
4660 return;
4661 }
4662
4663 flush_write_cache(fsp, SEEK_FLUSH);
4664
4665 mode = SVAL(req->vwv+1, 0) & 3;
4666 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4667 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4668
4669 switch (mode) {
4670 case 0:
4671 umode = SEEK_SET;
4672 res = startpos;
4673 break;
4674 case 1:
4675 umode = SEEK_CUR;
4676 res = fsp->fh->pos + startpos;
4677 break;
4678 case 2:
4679 umode = SEEK_END;
4680 break;
4681 default:
4682 umode = SEEK_SET;
4683 res = startpos;
4684 break;
4685 }
4686
4687 if (umode == SEEK_END) {
4688 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4689 if(errno == EINVAL) {
4690 SMB_OFF_T current_pos = startpos;
4691
4692 if(fsp_stat(fsp) == -1) {
4693 reply_nterror(req,
4694 map_nt_error_from_unix(errno));
4695 END_PROFILE(SMBlseek);
4696 return;
4697 }
4698
4699 current_pos += fsp->fsp_name->st.st_ex_size;
4700 if(current_pos < 0)
4701 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4702 }
4703 }
4704
4705 if(res == -1) {
4706 reply_nterror(req, map_nt_error_from_unix(errno));
4707 END_PROFILE(SMBlseek);
4708 return;
4709 }
4710 }
4711
4712 fsp->fh->pos = res;
4713
4714 reply_outbuf(req, 2, 0);
4715 SIVAL(req->outbuf,smb_vwv0,res);
4716
4717 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4718 fsp->fnum, (double)startpos, (double)res, mode));
4719
4720 END_PROFILE(SMBlseek);
4721 return;
4722 }
4723
4724 /****************************************************************************
4725 Reply to a flush.
4726 ****************************************************************************/
4727
4728 void reply_flush(struct smb_request *req)
4729 {
4730 connection_struct *conn = req->conn;
4731 uint16 fnum;
4732 files_struct *fsp;
4733
4734 START_PROFILE(SMBflush);
4735
4736 if (req->wct < 1) {
4737 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4738 return;
4739 }
4740
4741 fnum = SVAL(req->vwv+0, 0);
4742 fsp = file_fsp(req, fnum);
4743
4744 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4745 return;
4746 }
4747
4748 if (!fsp) {
4749 file_sync_all(conn);
4750 } else {
4751 NTSTATUS status = sync_file(conn, fsp, True);
4752 if (!NT_STATUS_IS_OK(status)) {
4753 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4754 fsp_str_dbg(fsp), nt_errstr(status)));
4755 reply_nterror(req, status);
4756 END_PROFILE(SMBflush);
4757 return;
4758 }
4759 }
4760
4761 reply_outbuf(req, 0, 0);
4762
4763 DEBUG(3,("flush\n"));
4764 END_PROFILE(SMBflush);
4765 return;
4766 }
4767
4768 /****************************************************************************
4769 Reply to a exit.
4770 conn POINTER CAN BE NULL HERE !
4771 ****************************************************************************/
4772
4773 void reply_exit(struct smb_request *req)
4774 {
4775 START_PROFILE(SMBexit);
4776
4777 file_close_pid(req->sconn, req->smbpid, req->vuid);
4778
4779 reply_outbuf(req, 0, 0);
4780
4781 DEBUG(3,("exit\n"));
4782
4783 END_PROFILE(SMBexit);
4784 return;
4785 }
4786
4787 /****************************************************************************
4788 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4789 ****************************************************************************/
4790
4791 void reply_close(struct smb_request *req)
4792 {
4793 connection_struct *conn = req->conn;
4794 NTSTATUS status = NT_STATUS_OK;
4795 files_struct *fsp = NULL;
4796 START_PROFILE(SMBclose);
4797
4798 if (req->wct < 3) {
4799 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4800 END_PROFILE(SMBclose);
4801 return;
4802 }
4803
4804 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4805
4806 /*
4807 * We can only use check_fsp if we know it's not a directory.
4808 */
4809
4810 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4811 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4812 END_PROFILE(SMBclose);
4813 return;
4814 }
4815
4816 if(fsp->is_directory) {
4817 /*
4818 * Special case - close NT SMB directory handle.
4819 */
4820 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4821 status = close_file(req, fsp, NORMAL_CLOSE);
4822 } else {
4823 time_t t;
4824 /*
4825 * Close ordinary file.
4826 */
4827
4828 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4829 fsp->fh->fd, fsp->fnum,
4830 conn->num_files_open));
4831
4832 /*
4833 * Take care of any time sent in the close.
4834 */
4835
4836 t = srv_make_unix_date3(req->vwv+1);
4837 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4838
4839 /*
4840 * close_file() returns the unix errno if an error
4841 * was detected on close - normally this is due to
4842 * a disk full error. If not then it was probably an I/O error.
4843 */
4844
4845 status = close_file(req, fsp, NORMAL_CLOSE);
4846 }
4847
4848 if (!NT_STATUS_IS_OK(status)) {
4849 reply_nterror(req, status);
4850 END_PROFILE(SMBclose);
4851 return;
4852 }
4853
4854 reply_outbuf(req, 0, 0);
4855 END_PROFILE(SMBclose);
4856 return;
4857 }
4858
4859 /****************************************************************************
4860 Reply to a writeclose (Core+ protocol).
4861 ****************************************************************************/
4862
4863 void reply_writeclose(struct smb_request *req)
4864 {
4865 connection_struct *conn = req->conn;
4866 size_t numtowrite;
4867 ssize_t nwritten = -1;
4868 NTSTATUS close_status = NT_STATUS_OK;
4869 SMB_OFF_T startpos;
4870 const char *data;
4871 struct timespec mtime;
4872 files_struct *fsp;
4873 struct lock_struct lock;
4874
4875 START_PROFILE(SMBwriteclose);
4876
4877 if (req->wct < 6) {
4878 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4879 END_PROFILE(SMBwriteclose);
4880 return;
4881 }
4882
4883 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4884
4885 if (!check_fsp(conn, req, fsp)) {
4886 END_PROFILE(SMBwriteclose);
4887 return;
4888 }
4889 if (!CHECK_WRITE(fsp)) {
4890 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4891 END_PROFILE(SMBwriteclose);
4892 return;
4893 }
4894
4895 numtowrite = SVAL(req->vwv+1, 0);
4896 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4897 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4898 data = (const char *)req->buf + 1;
4899
4900 if (!fsp->print_file) {
4901 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4902 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4903 &lock);
4904
4905 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4906 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4907 END_PROFILE(SMBwriteclose);
4908 return;
4909 }
4910 }
4911
4912 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4913
4914 set_close_write_time(fsp, mtime);
4915
4916 /*
4917 * More insanity. W2K only closes the file if writelen > 0.
4918 * JRA.
4919 */
4920
4921 if (numtowrite) {
4922 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4923 "file %s\n", fsp_str_dbg(fsp)));
4924 close_status = close_file(req, fsp, NORMAL_CLOSE);
4925 }
4926
4927 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4928 fsp->fnum, (int)numtowrite, (int)nwritten,
4929 conn->num_files_open));
4930
4931 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4932 reply_nterror(req, NT_STATUS_DISK_FULL);
4933 goto strict_unlock;
4934 }
4935
4936 if(!NT_STATUS_IS_OK(close_status)) {
4937 reply_nterror(req, close_status);
4938 goto strict_unlock;
4939 }
4940
4941 reply_outbuf(req, 1, 0);
4942
4943 SSVAL(req->outbuf,smb_vwv0,nwritten);
4944
4945 strict_unlock:
4946 if (numtowrite && !fsp->print_file) {
4947 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4948 }
4949
4950 END_PROFILE(SMBwriteclose);
4951 return;
4952 }
4953
4954 #undef DBGC_CLASS
4955 #define DBGC_CLASS DBGC_LOCKING
4956
4957 /****************************************************************************
4958 Reply to a lock.
4959 ****************************************************************************/
4960
4961 void reply_lock(struct smb_request *req)
4962 {
4963 connection_struct *conn = req->conn;
4964 uint64_t count,offset;
4965 NTSTATUS status;
4966 files_struct *fsp;
4967 struct byte_range_lock *br_lck = NULL;
4968
4969 START_PROFILE(SMBlock);
4970
4971 if (req->wct < 5) {
4972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4973 END_PROFILE(SMBlock);
4974 return;
4975 }
4976
4977 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4978
4979 if (!check_fsp(conn, req, fsp)) {
4980 END_PROFILE(SMBlock);
4981 return;
4982 }
4983
4984 count = (uint64_t)IVAL(req->vwv+1, 0);
4985 offset = (uint64_t)IVAL(req->vwv+3, 0);
4986
4987 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4988 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4989
4990 br_lck = do_lock(req->sconn->msg_ctx,
4991 fsp,
4992 (uint64_t)req->smbpid,
4993 count,
4994 offset,
4995 WRITE_LOCK,
4996 WINDOWS_LOCK,
4997 False, /* Non-blocking lock. */
4998 &status,
4999 NULL,
5000 NULL);
5001
5002 TALLOC_FREE(br_lck);
5003
5004 if (NT_STATUS_V(status)) {
5005 reply_nterror(req, status);
5006 END_PROFILE(SMBlock);
5007 return;
5008 }
5009
5010 reply_outbuf(req, 0, 0);
5011
5012 END_PROFILE(SMBlock);
5013 return;
5014 }
5015
5016 /****************************************************************************
5017 Reply to a unlock.
5018 ****************************************************************************/
5019
5020 void reply_unlock(struct smb_request *req)
5021 {
5022 connection_struct *conn = req->conn;
5023 uint64_t count,offset;
5024 NTSTATUS status;
5025 files_struct *fsp;
5026
5027 START_PROFILE(SMBunlock);
5028
5029 if (req->wct < 5) {
5030 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5031 END_PROFILE(SMBunlock);
5032 return;
5033 }
5034
5035 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5036
5037 if (!check_fsp(conn, req, fsp)) {
5038 END_PROFILE(SMBunlock);
5039 return;
5040 }
5041
5042 count = (uint64_t)IVAL(req->vwv+1, 0);
5043 offset = (uint64_t)IVAL(req->vwv+3, 0);
5044
5045 status = do_unlock(req->sconn->msg_ctx,
5046 fsp,
5047 (uint64_t)req->smbpid,
5048 count,
5049 offset,
5050 WINDOWS_LOCK);
5051
5052 if (NT_STATUS_V(status)) {
5053 reply_nterror(req, status);
5054 END_PROFILE(SMBunlock);
5055 return;
5056 }
5057
5058 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5059 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5060
5061 reply_outbuf(req, 0, 0);
5062
5063 END_PROFILE(SMBunlock);
5064 return;
5065 }
5066
5067 #undef DBGC_CLASS
5068 #define DBGC_CLASS DBGC_ALL
5069
5070 /****************************************************************************
5071 Reply to a tdis.
5072 conn POINTER CAN BE NULL HERE !
5073 ****************************************************************************/
5074
5075 void reply_tdis(struct smb_request *req)
5076 {
5077 connection_struct *conn = req->conn;
5078 START_PROFILE(SMBtdis);
5079
5080 if (!conn) {
5081 DEBUG(4,("Invalid connection in tdis\n"));
5082 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5083 END_PROFILE(SMBtdis);
5084 return;
5085 }
5086
5087 conn->used = False;
5088
5089 close_cnum(conn,req->vuid);
5090 req->conn = NULL;
5091
5092 reply_outbuf(req, 0, 0);
5093 END_PROFILE(SMBtdis);
5094 return;
5095 }
5096
5097 /****************************************************************************
5098 Reply to a echo.
5099 conn POINTER CAN BE NULL HERE !
5100 ****************************************************************************/
5101
5102 void reply_echo(struct smb_request *req)
5103 {
5104 connection_struct *conn = req->conn;
5105 struct smb_perfcount_data local_pcd;
5106 struct smb_perfcount_data *cur_pcd;
5107 int smb_reverb;
5108 int seq_num;
5109
5110 START_PROFILE(SMBecho);
5111
5112 smb_init_perfcount_data(&local_pcd);
5113
5114 if (req->wct < 1) {
5115 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5116 END_PROFILE(SMBecho);
5117 return;
5118 }
5119
5120 smb_reverb = SVAL(req->vwv+0, 0);
5121
5122 reply_outbuf(req, 1, req->buflen);
5123
5124 /* copy any incoming data back out */
5125 if (req->buflen > 0) {
5126 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5127 }
5128
5129 if (smb_reverb > 100) {
5130 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5131 smb_reverb = 100;
5132 }
5133
5134 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5135
5136 /* this makes sure we catch the request pcd */
5137 if (seq_num == smb_reverb) {
5138 cur_pcd = &req->pcd;
5139 } else {
5140 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5141 cur_pcd = &local_pcd;
5142 }
5143
5144 SSVAL(req->outbuf,smb_vwv0,seq_num);
5145
5146 show_msg((char *)req->outbuf);
5147 if (!srv_send_smb(req->sconn,
5148 (char *)req->outbuf,
5149 true, req->seqnum+1,
5150 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5151 cur_pcd))
5152 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5153 }
5154
5155 DEBUG(3,("echo %d times\n", smb_reverb));
5156
5157 TALLOC_FREE(req->outbuf);
5158
5159 END_PROFILE(SMBecho);
5160 return;
5161 }
5162
5163 /****************************************************************************
5164 Reply to a printopen.
5165 ****************************************************************************/
5166
5167 void reply_printopen(struct smb_request *req)
5168 {
5169 connection_struct *conn = req->conn;
5170 files_struct *fsp;
5171 NTSTATUS status;
5172
5173 START_PROFILE(SMBsplopen);
5174
5175 if (req->wct < 2) {
5176 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5177 END_PROFILE(SMBsplopen);
5178 return;
5179 }
5180
5181 if (!CAN_PRINT(conn)) {
5182 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5183 END_PROFILE(SMBsplopen);
5184 return;
5185 }
5186
5187 status = file_new(req, conn, &fsp);
5188 if(!NT_STATUS_IS_OK(status)) {
5189 reply_nterror(req, status);
5190 END_PROFILE(SMBsplopen);
5191 return;
5192 }
5193
5194 /* Open for exclusive use, write only. */
5195 status = print_spool_open(fsp, NULL, req->vuid);
5196
5197 if (!NT_STATUS_IS_OK(status)) {
5198 file_free(req, fsp);
5199 reply_nterror(req, status);
5200 END_PROFILE(SMBsplopen);
5201 return;
5202 }
5203
5204 reply_outbuf(req, 1, 0);
5205 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5206
5207 DEBUG(3,("openprint fd=%d fnum=%d\n",
5208 fsp->fh->fd, fsp->fnum));
5209
5210 END_PROFILE(SMBsplopen);
5211 return;
5212 }
5213
5214 /****************************************************************************
5215 Reply to a printclose.
5216 ****************************************************************************/
5217
5218 void reply_printclose(struct smb_request *req)
5219 {
5220 connection_struct *conn = req->conn;
5221 files_struct *fsp;
5222 NTSTATUS status;
5223
5224 START_PROFILE(SMBsplclose);
5225
5226 if (req->wct < 1) {
5227 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5228 END_PROFILE(SMBsplclose);
5229 return;
5230 }
5231
5232 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5233
5234 if (!check_fsp(conn, req, fsp)) {
5235 END_PROFILE(SMBsplclose);
5236 return;
5237 }
5238
5239 if (!CAN_PRINT(conn)) {
5240 reply_force_doserror(req, ERRSRV, ERRerror);
5241 END_PROFILE(SMBsplclose);
5242 return;
5243 }
5244
5245 DEBUG(3,("printclose fd=%d fnum=%d\n",
5246 fsp->fh->fd,fsp->fnum));
5247
5248 status = close_file(req, fsp, NORMAL_CLOSE);
5249
5250 if(!NT_STATUS_IS_OK(status)) {
5251 reply_nterror(req, status);
5252 END_PROFILE(SMBsplclose);
5253 return;
5254 }
5255
5256 reply_outbuf(req, 0, 0);
5257
5258 END_PROFILE(SMBsplclose);
5259 return;
5260 }
5261
5262 /****************************************************************************
5263 Reply to a printqueue.
5264 ****************************************************************************/
5265
5266 void reply_printqueue(struct smb_request *req)
5267 {
5268 connection_struct *conn = req->conn;
5269 int max_count;
5270 int start_index;
5271
5272 START_PROFILE(SMBsplretq);
5273
5274 if (req->wct < 2) {
5275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5276 END_PROFILE(SMBsplretq);
5277 return;
5278 }
5279
5280 max_count = SVAL(req->vwv+0, 0);
5281 start_index = SVAL(req->vwv+1, 0);
5282
5283 /* we used to allow the client to get the cnum wrong, but that
5284 is really quite gross and only worked when there was only
5285 one printer - I think we should now only accept it if they
5286 get it right (tridge) */
5287 if (!CAN_PRINT(conn)) {
5288 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5289 END_PROFILE(SMBsplretq);
5290 return;
5291 }
5292
5293 reply_outbuf(req, 2, 3);
5294 SSVAL(req->outbuf,smb_vwv0,0);
5295 SSVAL(req->outbuf,smb_vwv1,0);
5296 SCVAL(smb_buf(req->outbuf),0,1);
5297 SSVAL(smb_buf(req->outbuf),1,0);
5298
5299 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5300 start_index, max_count));
5301
5302 {
5303 TALLOC_CTX *mem_ctx = talloc_tos();
5304 NTSTATUS status;
5305 WERROR werr;
5306 const char *sharename = lp_servicename(SNUM(conn));
5307 struct rpc_pipe_client *cli = NULL;
5308 struct policy_handle handle;
5309 struct spoolss_DevmodeContainer devmode_ctr;
5310 union spoolss_JobInfo *info;
5311 uint32_t count;
5312 uint32_t num_to_get;
5313 uint32_t first;
5314 uint32_t i;
5315
5316 ZERO_STRUCT(handle);
5317
5318 status = rpc_pipe_open_interface(conn,
5319 &ndr_table_spoolss.syntax_id,
5320 conn->server_info,
5321 &conn->sconn->client_id,
5322 conn->sconn->msg_ctx,
5323 &cli);
5324 if (!NT_STATUS_IS_OK(status)) {
5325 DEBUG(0, ("reply_printqueue: "
5326 "could not connect to spoolss: %s\n",
5327 nt_errstr(status)));
5328 reply_nterror(req, status);
5329 goto out;
5330 }
5331
5332 ZERO_STRUCT(devmode_ctr);
5333
5334 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5335 sharename,
5336 NULL, devmode_ctr,
5337 SEC_FLAG_MAXIMUM_ALLOWED,
5338 &handle,
5339 &werr);
5340 if (!NT_STATUS_IS_OK(status)) {
5341 reply_nterror(req, status);
5342 goto out;
5343 }
5344 if (!W_ERROR_IS_OK(werr)) {
5345 reply_nterror(req, werror_to_ntstatus(werr));
5346 goto out;
5347 }
5348
5349 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5350 &handle,
5351 0, /* firstjob */
5352 0xff, /* numjobs */
5353 2, /* level */
5354 0, /* offered */
5355 &count,
5356 &info);
5357 if (!W_ERROR_IS_OK(werr)) {
5358 reply_nterror(req, werror_to_ntstatus(werr));
5359 goto out;
5360 }
5361
5362 if (max_count > 0) {
5363 first = start_index;
5364 } else {
5365 first = start_index + max_count + 1;
5366 }
5367
5368 if (first >= count) {
5369 num_to_get = first;
5370 } else {
5371 num_to_get = first + MIN(ABS(max_count), count - first);
5372 }
5373
5374 for (i = first; i < num_to_get; i++) {
5375 char blob[28];
5376 char *p = blob;
5377 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5378 int qstatus;
5379 uint16_t qrapjobid = pjobid_to_rap(sharename,
5380 info[i].info2.job_id);
5381
5382 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5383 qstatus = 2;
5384 } else {
5385 qstatus = 3;
5386 }
5387
5388 srv_put_dos_date2(p, 0, qtime);
5389 SCVAL(p, 4, qstatus);
5390 SSVAL(p, 5, qrapjobid);
5391 SIVAL(p, 7, info[i].info2.size);
5392 SCVAL(p, 11, 0);
5393 srvstr_push(blob, req->flags2, p+12,
5394 info[i].info2.notify_name, 16, STR_ASCII);
5395
5396 if (message_push_blob(
5397 &req->outbuf,
5398 data_blob_const(
5399 blob, sizeof(blob))) == -1) {
5400 reply_nterror(req, NT_STATUS_NO_MEMORY);
5401 goto out;
5402 }
5403 }
5404
5405 if (count > 0) {
5406 SSVAL(req->outbuf,smb_vwv0,count);
5407 SSVAL(req->outbuf,smb_vwv1,
5408 (max_count>0?first+count:first-1));
5409 SCVAL(smb_buf(req->outbuf),0,1);
5410 SSVAL(smb_buf(req->outbuf),1,28*count);
5411 }
5412
5413
5414 DEBUG(3, ("%u entries returned in queue\n",
5415 (unsigned)count));
5416
5417 out:
5418 if (cli && is_valid_policy_hnd(&handle)) {
5419 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5420 }
5421
5422 }
5423
5424 END_PROFILE(SMBsplretq);
5425 return;
5426 }
5427
5428 /****************************************************************************
5429 Reply to a printwrite.
5430 ****************************************************************************/
5431
5432 void reply_printwrite(struct smb_request *req)
5433 {
5434 connection_struct *conn = req->conn;
5435 int numtowrite;
5436 const char *data;
5437 files_struct *fsp;
5438
5439 START_PROFILE(SMBsplwr);
5440
5441 if (req->wct < 1) {
5442 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5443 END_PROFILE(SMBsplwr);
5444 return;
5445 }
5446
5447 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5448
5449 if (!check_fsp(conn, req, fsp)) {
5450 END_PROFILE(SMBsplwr);
5451 return;
5452 }
5453
5454 if (!fsp->print_file) {
5455 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5456 END_PROFILE(SMBsplwr);
5457 return;
5458 }
5459
5460 if (!CHECK_WRITE(fsp)) {
5461 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5462 END_PROFILE(SMBsplwr);
5463 return;
5464 }
5465
5466 numtowrite = SVAL(req->buf, 1);
5467
5468 if (req->buflen < numtowrite + 3) {
5469 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5470 END_PROFILE(SMBsplwr);
5471 return;
5472 }
5473
5474 data = (const char *)req->buf + 3;
5475
5476 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5477 reply_nterror(req, map_nt_error_from_unix(errno));
5478 END_PROFILE(SMBsplwr);
5479 return;
5480 }
5481
5482 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5483
5484 END_PROFILE(SMBsplwr);
5485 return;
5486 }
5487
5488 /****************************************************************************
5489 Reply to a mkdir.
5490 ****************************************************************************/
5491
5492 void reply_mkdir(struct smb_request *req)
5493 {
5494 connection_struct *conn = req->conn;
5495 struct smb_filename *smb_dname = NULL;
5496 char *directory = NULL;
5497 NTSTATUS status;
5498 TALLOC_CTX *ctx = talloc_tos();
5499
5500 START_PROFILE(SMBmkdir);
5501
5502 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5503 STR_TERMINATE, &status);
5504 if (!NT_STATUS_IS_OK(status)) {
5505 reply_nterror(req, status);
5506 goto out;
5507 }
5508
5509 status = filename_convert(ctx, conn,
5510 req->flags2 & FLAGS2_DFS_PATHNAMES,
5511 directory,
5512 0,
5513 NULL,
5514 &smb_dname);
5515 if (!NT_STATUS_IS_OK(status)) {
5516 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5517 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5518 ERRSRV, ERRbadpath);
5519 goto out;
5520 }
5521 reply_nterror(req, status);
5522 goto out;
5523 }
5524
5525 status = create_directory(conn, req, smb_dname);
5526
5527 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5528
5529 if (!NT_STATUS_IS_OK(status)) {
5530
5531 if (!use_nt_status()
5532 && NT_STATUS_EQUAL(status,
5533 NT_STATUS_OBJECT_NAME_COLLISION)) {
5534 /*
5535 * Yes, in the DOS error code case we get a
5536 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5537 * samba4 torture test.
5538 */
5539 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5540 }
5541
5542 reply_nterror(req, status);
5543 goto out;
5544 }
5545
5546 reply_outbuf(req, 0, 0);
5547
5548 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5549 out:
5550 TALLOC_FREE(smb_dname);
5551 END_PROFILE(SMBmkdir);
5552 return;
5553 }
5554
5555 /****************************************************************************
5556 Reply to a rmdir.
5557 ****************************************************************************/
5558
5559 void reply_rmdir(struct smb_request *req)
5560 {
5561 connection_struct *conn = req->conn;
5562 struct smb_filename *smb_dname = NULL;
5563 char *directory = NULL;
5564 NTSTATUS status;
5565 TALLOC_CTX *ctx = talloc_tos();
5566 files_struct *fsp = NULL;
5567 int info = 0;
5568 struct smbd_server_connection *sconn = req->sconn;
5569
5570 START_PROFILE(SMBrmdir);
5571
5572 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5573 STR_TERMINATE, &status);
5574 if (!NT_STATUS_IS_OK(status)) {
5575 reply_nterror(req, status);
5576 goto out;
5577 }
5578
5579 status = filename_convert(ctx, conn,
5580 req->flags2 & FLAGS2_DFS_PATHNAMES,
5581 directory,
5582 0,
5583 NULL,
5584 &smb_dname);
5585 if (!NT_STATUS_IS_OK(status)) {
5586 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5587 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5588 ERRSRV, ERRbadpath);
5589 goto out;
5590 }
5591 reply_nterror(req, status);
5592 goto out;
5593 }
5594
5595 if (is_ntfs_stream_smb_fname(smb_dname)) {
5596 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5597 goto out;
5598 }
5599
5600 status = SMB_VFS_CREATE_FILE(
5601 conn, /* conn */
5602 req, /* req */
5603 0, /* root_dir_fid */
5604 smb_dname, /* fname */
5605 DELETE_ACCESS, /* access_mask */
5606 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5607 FILE_SHARE_DELETE),
5608 FILE_OPEN, /* create_disposition*/
5609 FILE_DIRECTORY_FILE, /* create_options */
5610 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5611 0, /* oplock_request */
5612 0, /* allocation_size */
5613 0, /* private_flags */
5614 NULL, /* sd */
5615 NULL, /* ea_list */
5616 &fsp, /* result */
5617 &info); /* pinfo */
5618
5619 if (!NT_STATUS_IS_OK(status)) {
5620 if (open_was_deferred(req->mid)) {
5621 /* We have re-scheduled this call. */
5622 goto out;
5623 }
5624 reply_nterror(req, status);
5625 goto out;
5626 }
5627
5628 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5629 if (!NT_STATUS_IS_OK(status)) {
5630 close_file(req, fsp, ERROR_CLOSE);
5631 reply_nterror(req, status);
5632 goto out;
5633 }
5634
5635 if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5636 close_file(req, fsp, ERROR_CLOSE);
5637 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5638 goto out;
5639 }
5640
5641 status = close_file(req, fsp, NORMAL_CLOSE);
5642 if (!NT_STATUS_IS_OK(status)) {
5643 reply_nterror(req, status);
5644 } else {
5645 reply_outbuf(req, 0, 0);
5646 }
5647
5648 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5649
5650 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5651 out:
5652 TALLOC_FREE(smb_dname);
5653 END_PROFILE(SMBrmdir);
5654 return;
5655 }
5656
5657 /*******************************************************************
5658 Resolve wildcards in a filename rename.
5659 ********************************************************************/
5660
5661 static bool resolve_wildcards(TALLOC_CTX *ctx,
5662 const char *name1,
5663 const char *name2,
5664 char **pp_newname)
5665 {
5666 char *name2_copy = NULL;
5667 char *root1 = NULL;
5668 char *root2 = NULL;
5669 char *ext1 = NULL;
5670 char *ext2 = NULL;
5671 char *p,*p2, *pname1, *pname2;
5672
5673 name2_copy = talloc_strdup(ctx, name2);
5674 if (!name2_copy) {
5675 return False;
5676 }
5677
5678 pname1 = strrchr_m(name1,'/');
5679 pname2 = strrchr_m(name2_copy,'/');
5680
5681 if (!pname1 || !pname2) {
5682 return False;
5683 }
5684
5685 /* Truncate the copy of name2 at the last '/' */
5686 *pname2 = '\0';
5687
5688 /* Now go past the '/' */
5689 pname1++;
5690 pname2++;
5691
5692 root1 = talloc_strdup(ctx, pname1);
5693 root2 = talloc_strdup(ctx, pname2);
5694
5695 if (!root1 || !root2) {
5696 return False;
5697 }
5698
5699 p = strrchr_m(root1,'.');
5700 if (p) {
5701 *p = 0;
5702 ext1 = talloc_strdup(ctx, p+1);
5703 } else {
5704 ext1 = talloc_strdup(ctx, "");
5705 }
5706 p = strrchr_m(root2,'.');
5707 if (p) {
5708 *p = 0;
5709 ext2 = talloc_strdup(ctx, p+1);
5710 } else {
5711 ext2 = talloc_strdup(ctx, "");
5712 }
5713
5714 if (!ext1 || !ext2) {
5715 return False;
5716 }
5717
5718 p = root1;
5719 p2 = root2;
5720 while (*p2) {
5721 if (*p2 == '?') {
5722 /* Hmmm. Should this be mb-aware ? */
5723 *p2 = *p;
5724 p2++;
5725 } else if (*p2 == '*') {
5726 *p2 = '\0';
5727 root2 = talloc_asprintf(ctx, "%s%s",
5728 root2,
5729 p);
5730 if (!root2) {
5731 return False;
5732 }
5733 break;
5734 } else {
5735 p2++;
5736 }
5737 if (*p) {
5738 p++;
5739 }
5740 }
5741
5742 p = ext1;
5743 p2 = ext2;
5744 while (*p2) {
5745 if (*p2 == '?') {
5746 /* Hmmm. Should this be mb-aware ? */
5747 *p2 = *p;
5748 p2++;
5749 } else if (*p2 == '*') {
5750 *p2 = '\0';
5751 ext2 = talloc_asprintf(ctx, "%s%s",
5752 ext2,
5753 p);
5754 if (!ext2) {
5755 return False;
5756 }
5757 break;
5758 } else {
5759 p2++;
5760 }
5761 if (*p) {
5762 p++;
5763 }
5764 }
5765
5766 if (*ext2) {
5767 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5768 name2_copy,
5769 root2,
5770 ext2);
5771 } else {
5772 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5773 name2_copy,
5774 root2);
5775 }
5776
5777 if (!*pp_newname) {
5778 return False;
5779 }
5780
5781 return True;
5782 }
5783
5784 /****************************************************************************
5785 Ensure open files have their names updated. Updated to notify other smbd's
5786 asynchronously.
5787 ****************************************************************************/
5788
5789 static void rename_open_files(connection_struct *conn,
5790 struct share_mode_lock *lck,
5791 const struct smb_filename *smb_fname_dst)
5792 {
5793 files_struct *fsp;
5794 bool did_rename = False;
5795 NTSTATUS status;
5796
5797 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5798 fsp = file_find_di_next(fsp)) {
5799 /* fsp_name is a relative path under the fsp. To change this for other
5800 sharepaths we need to manipulate relative paths. */
5801 /* TODO - create the absolute path and manipulate the newname
5802 relative to the sharepath. */
5803 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5804 continue;
5805 }
5806 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5807 "(file_id %s) from %s -> %s\n", fsp->fnum,
5808 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5809 smb_fname_str_dbg(smb_fname_dst)));
5810
5811 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5812 if (NT_STATUS_IS_OK(status)) {
5813 did_rename = True;
5814 }
5815 }
5816
5817 if (!did_rename) {
5818 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5819 "for %s\n", file_id_string_tos(&lck->id),
5820 smb_fname_str_dbg(smb_fname_dst)));
5821 }
5822
5823 /* Send messages to all smbd's (not ourself) that the name has changed. */
5824 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5825 smb_fname_dst);
5826
5827 }
5828
5829 /****************************************************************************
5830 We need to check if the source path is a parent directory of the destination
5831 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5832 refuse the rename with a sharing violation. Under UNIX the above call can
5833 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5834 probably need to check that the client is a Windows one before disallowing
5835 this as a UNIX client (one with UNIX extensions) can know the source is a
5836 symlink and make this decision intelligently. Found by an excellent bug
5837 report from <AndyLiebman@aol.com>.
5838 ****************************************************************************/
5839
5840 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5841 const struct smb_filename *smb_fname_dst)
5842 {
5843 const char *psrc = smb_fname_src->base_name;
5844 const char *pdst = smb_fname_dst->base_name;
5845 size_t slen;
5846
5847 if (psrc[0] == '.' && psrc[1] == '/') {
5848 psrc += 2;
5849 }
5850 if (pdst[0] == '.' && pdst[1] == '/') {
5851 pdst += 2;
5852 }
5853 if ((slen = strlen(psrc)) > strlen(pdst)) {
5854 return False;
5855 }
5856 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5857 }
5858
5859 /*
5860 * Do the notify calls from a rename
5861 */
5862
5863 static void notify_rename(connection_struct *conn, bool is_dir,
5864 const struct smb_filename *smb_fname_src,
5865 const struct smb_filename *smb_fname_dst)
5866 {
5867 char *parent_dir_src = NULL;
5868 char *parent_dir_dst = NULL;
5869 uint32 mask;
5870
5871 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5872 : FILE_NOTIFY_CHANGE_FILE_NAME;
5873
5874 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5875 &parent_dir_src, NULL) ||
5876 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5877 &parent_dir_dst, NULL)) {
5878 goto out;
5879 }
5880
5881 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5882 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5883 smb_fname_src->base_name);
5884 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5885 smb_fname_dst->base_name);
5886 }
5887 else {
5888 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5889 smb_fname_src->base_name);
5890 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5891 smb_fname_dst->base_name);
5892 }
5893
5894 /* this is a strange one. w2k3 gives an additional event for
5895 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5896 files, but not directories */
5897 if (!is_dir) {
5898 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5899 FILE_NOTIFY_CHANGE_ATTRIBUTES
5900 |FILE_NOTIFY_CHANGE_CREATION,
5901 smb_fname_dst->base_name);
5902 }
5903 out:
5904 TALLOC_FREE(parent_dir_src);
5905 TALLOC_FREE(parent_dir_dst);
5906 }
5907
5908 /****************************************************************************
5909 Rename an open file - given an fsp.
5910 ****************************************************************************/
5911
5912 NTSTATUS rename_internals_fsp(connection_struct *conn,
5913 files_struct *fsp,
5914 const struct smb_filename *smb_fname_dst_in,
5915 uint32 attrs,
5916 bool replace_if_exists)
5917 {
5918 TALLOC_CTX *ctx = talloc_tos();
5919 struct smb_filename *smb_fname_dst = NULL;
5920 NTSTATUS status = NT_STATUS_OK;
5921 struct share_mode_lock *lck = NULL;
5922 bool dst_exists, old_is_stream, new_is_stream;
5923
5924 status = check_name(conn, smb_fname_dst_in->base_name);
5925 if (!NT_STATUS_IS_OK(status)) {
5926 return status;
5927 }
5928
5929 /* Make a copy of the dst smb_fname structs */
5930
5931 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5932 if (!NT_STATUS_IS_OK(status)) {
5933 goto out;
5934 }
5935
5936 /* Ensure the dst smb_fname contains a '/' */
5937 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5938 char * tmp;
5939 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5940 smb_fname_dst->base_name);
5941 if (!tmp) {
5942 status = NT_STATUS_NO_MEMORY;
5943 goto out;
5944 }
5945 TALLOC_FREE(smb_fname_dst->base_name);
5946 smb_fname_dst->base_name = tmp;
5947 }
5948
5949 /*
5950 * Check for special case with case preserving and not
5951 * case sensitive. If the old last component differs from the original
5952 * last component only by case, then we should allow
5953 * the rename (user is trying to change the case of the
5954 * filename).
5955 */
5956 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5957 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5958 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5959 char *last_slash;
5960 char *fname_dst_lcomp_base_mod = NULL;
5961 struct smb_filename *smb_fname_orig_lcomp = NULL;
5962
5963 /*
5964 * Get the last component of the destination name. Note that
5965 * we guarantee that destination name contains a '/' character
5966 * above.
5967 */
5968 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5969 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5970 if (!fname_dst_lcomp_base_mod) {
5971 status = NT_STATUS_NO_MEMORY;
5972 goto out;
5973 }
5974
5975 /*
5976 * Create an smb_filename struct using the original last
5977 * component of the destination.
5978 */
5979 status = create_synthetic_smb_fname_split(ctx,
5980 smb_fname_dst->original_lcomp, NULL,
5981 &smb_fname_orig_lcomp);
5982 if (!NT_STATUS_IS_OK(status)) {
5983 TALLOC_FREE(fname_dst_lcomp_base_mod);
5984 goto out;
5985 }
5986
5987 /* If the base names only differ by case, use original. */
5988 if(!strcsequal(fname_dst_lcomp_base_mod,
5989 smb_fname_orig_lcomp->base_name)) {
5990 char *tmp;
5991 /*
5992 * Replace the modified last component with the
5993 * original.
5994 */
5995 *last_slash = '\0'; /* Truncate at the '/' */
5996 tmp = talloc_asprintf(smb_fname_dst,
5997 "%s/%s",
5998 smb_fname_dst->base_name,
5999 smb_fname_orig_lcomp->base_name);
6000 if (tmp == NULL) {
6001 status = NT_STATUS_NO_MEMORY;
6002 TALLOC_FREE(fname_dst_lcomp_base_mod);
6003 TALLOC_FREE(smb_fname_orig_lcomp);
6004 goto out;
6005 }
6006 TALLOC_FREE(smb_fname_dst->base_name);
6007 smb_fname_dst->base_name = tmp;
6008 }
6009
6010 /* If the stream_names only differ by case, use original. */
6011 if(!strcsequal(smb_fname_dst->stream_name,
6012 smb_fname_orig_lcomp->stream_name)) {
6013 char *tmp = NULL;
6014 /* Use the original stream. */
6015 tmp = talloc_strdup(smb_fname_dst,
6016 smb_fname_orig_lcomp->stream_name);
6017 if (tmp == NULL) {
6018 status = NT_STATUS_NO_MEMORY;
6019 TALLOC_FREE(fname_dst_lcomp_base_mod);
6020 TALLOC_FREE(smb_fname_orig_lcomp);
6021 goto out;
6022 }
6023 TALLOC_FREE(smb_fname_dst->stream_name);
6024 smb_fname_dst->stream_name = tmp;
6025 }
6026 TALLOC_FREE(fname_dst_lcomp_base_mod);
6027 TALLOC_FREE(smb_fname_orig_lcomp);
6028 }
6029
6030 /*
6031 * If the src and dest names are identical - including case,
6032 * don't do the rename, just return success.
6033 */
6034
6035 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6036 strcsequal(fsp->fsp_name->stream_name,
6037 smb_fname_dst->stream_name)) {
6038 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6039 "- returning success\n",
6040 smb_fname_str_dbg(smb_fname_dst)));
6041 status = NT_STATUS_OK;
6042 goto out;
6043 }
6044
6045 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6046 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6047
6048 /* Return the correct error code if both names aren't streams. */
6049 if (!old_is_stream && new_is_stream) {
6050 status = NT_STATUS_OBJECT_NAME_INVALID;
6051 goto out;
6052 }
6053
6054 if (old_is_stream && !new_is_stream) {
6055 status = NT_STATUS_INVALID_PARAMETER;
6056 goto out;
6057 }
6058
6059 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6060
6061 if(!replace_if_exists && dst_exists) {
6062 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6063 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6064 smb_fname_str_dbg(smb_fname_dst)));
6065 status = NT_STATUS_OBJECT_NAME_COLLISION;
6066 goto out;
6067 }
6068
6069 if (dst_exists) {
6070 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6071 &smb_fname_dst->st);
6072 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6073 fileid);
6074 /* The file can be open when renaming a stream */
6075 if (dst_fsp && !new_is_stream) {
6076 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6077 status = NT_STATUS_ACCESS_DENIED;
6078 goto out;
6079 }
6080 }
6081
6082 /* Ensure we have a valid stat struct for the source. */
6083 status = vfs_stat_fsp(fsp);
6084 if (!NT_STATUS_IS_OK(status)) {
6085 goto out;
6086 }
6087
6088 status = can_rename(conn, fsp, attrs);
6089
6090 if (!NT_STATUS_IS_OK(status)) {
6091 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6092 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6093 smb_fname_str_dbg(smb_fname_dst)));
6094 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6095 status = NT_STATUS_ACCESS_DENIED;
6096 goto out;
6097 }
6098
6099 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6100 status = NT_STATUS_ACCESS_DENIED;
6101 }
6102
6103 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6104 NULL);
6105
6106 /*
6107 * We have the file open ourselves, so not being able to get the
6108 * corresponding share mode lock is a fatal error.
6109 */
6110
6111 SMB_ASSERT(lck != NULL);
6112
6113 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6114 uint32 create_options = fsp->fh->private_options;
6115
6116 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6117 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6118 smb_fname_str_dbg(smb_fname_dst)));
6119
6120 if (!lp_posix_pathnames() &&
6121 (lp_map_archive(SNUM(conn)) ||
6122 lp_store_dos_attributes(SNUM(conn)))) {
6123 /* We must set the archive bit on the newly
6124 renamed file. */
6125 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6126 uint32_t old_dosmode = dos_mode(conn,
6127 smb_fname_dst);
6128 file_set_dosmode(conn,
6129 smb_fname_dst,
6130 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6131 NULL,
6132 true);
6133 }
6134 }
6135
6136 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6137 smb_fname_dst);
6138
6139 rename_open_files(conn, lck, smb_fname_dst);
6140
6141 /*
6142 * A rename acts as a new file create w.r.t. allowing an initial delete
6143 * on close, probably because in Windows there is a new handle to the
6144 * new file. If initial delete on close was requested but not
6145 * originally set, we need to set it here. This is probably not 100% correct,
6146 * but will work for the CIFSFS client which in non-posix mode
6147 * depends on these semantics. JRA.
6148 */
6149
6150 if (create_options & FILE_DELETE_ON_CLOSE) {
6151 status = can_set_delete_on_close(fsp, 0);
6152
6153 if (NT_STATUS_IS_OK(status)) {
6154 /* Note that here we set the *inital* delete on close flag,
6155 * not the regular one. The magic gets handled in close. */
6156 fsp->initial_delete_on_close = True;
6157 }
6158 }
6159 TALLOC_FREE(lck);
6160 status = NT_STATUS_OK;
6161 goto out;
6162 }
6163
6164 TALLOC_FREE(lck);
6165
6166 if (errno == ENOTDIR || errno == EISDIR) {
6167 status = NT_STATUS_OBJECT_NAME_COLLISION;
6168 } else {
6169 status = map_nt_error_from_unix(errno);
6170 }
6171
6172 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6173 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6174 smb_fname_str_dbg(smb_fname_dst)));
6175
6176 out:
6177 TALLOC_FREE(smb_fname_dst);
6178
6179 return status;
6180 }
6181
6182 /****************************************************************************
6183 The guts of the rename command, split out so it may be called by the NT SMB
6184 code.
6185 ****************************************************************************/
6186
6187 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6188 connection_struct *conn,
6189 struct smb_request *req,
6190 struct smb_filename *smb_fname_src,
6191 struct smb_filename *smb_fname_dst,
6192 uint32 attrs,
6193 bool replace_if_exists,
6194 bool src_has_wild,
6195 bool dest_has_wild,
6196 uint32_t access_mask)
6197 {
6198 char *fname_src_dir = NULL;
6199 char *fname_src_mask = NULL;
6200 int count=0;
6201 NTSTATUS status = NT_STATUS_OK;
6202 struct smb_Dir *dir_hnd = NULL;
6203 const char *dname = NULL;
6204 char *talloced = NULL;
6205 long offset = 0;
6206 int create_options = 0;
6207 bool posix_pathnames = lp_posix_pathnames();
6208
6209 /*
6210 * Split the old name into directory and last component
6211 * strings. Note that unix_convert may have stripped off a
6212 * leading ./ from both name and newname if the rename is
6213 * at the root of the share. We need to make sure either both
6214 * name and newname contain a / character or neither of them do
6215 * as this is checked in resolve_wildcards().
6216 */
6217
6218 /* Split up the directory from the filename/mask. */
6219 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6220 &fname_src_dir, &fname_src_mask);
6221 if (!NT_STATUS_IS_OK(status)) {
6222 status = NT_STATUS_NO_MEMORY;
6223 goto out;
6224 }
6225
6226 /*
6227 * We should only check the mangled cache
6228 * here if unix_convert failed. This means
6229 * that the path in 'mask' doesn't exist
6230 * on the file system and so we need to look
6231 * for a possible mangle. This patch from
6232 * Tine Smukavec <valentin.smukavec@hermes.si>.
6233 */
6234
6235 if (!VALID_STAT(smb_fname_src->st) &&
6236 mangle_is_mangled(fname_src_mask, conn->params)) {
6237 char *new_mask = NULL;
6238 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6239 conn->params);
6240 if (new_mask) {
6241 TALLOC_FREE(fname_src_mask);
6242 fname_src_mask = new_mask;
6243 }
6244 }
6245
6246 if (!src_has_wild) {
6247 files_struct *fsp;
6248
6249 /*
6250 * Only one file needs to be renamed. Append the mask back
6251 * onto the directory.
6252 */
6253 TALLOC_FREE(smb_fname_src->base_name);
6254 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6255 "%s/%s",
6256 fname_src_dir,
6257 fname_src_mask);
6258 if (!smb_fname_src->base_name) {
6259 status = NT_STATUS_NO_MEMORY;
6260 goto out;
6261 }
6262
6263 /* Ensure dst fname contains a '/' also */
6264 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6265 char *tmp;
6266 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6267 smb_fname_dst->base_name);
6268 if (!tmp) {
6269 status = NT_STATUS_NO_MEMORY;
6270 goto out;
6271 }
6272 TALLOC_FREE(smb_fname_dst->base_name);
6273 smb_fname_dst->base_name = tmp;
6274 }
6275
6276 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6277 "case_preserve = %d, short case preserve = %d, "
6278 "directory = %s, newname = %s, "
6279 "last_component_dest = %s\n",
6280 conn->case_sensitive, conn->case_preserve,
6281 conn->short_case_preserve,
6282 smb_fname_str_dbg(smb_fname_src),
6283 smb_fname_str_dbg(smb_fname_dst),
6284 smb_fname_dst->original_lcomp));
6285
6286 /* The dest name still may have wildcards. */
6287 if (dest_has_wild) {
6288 char *fname_dst_mod = NULL;
6289 if (!resolve_wildcards(smb_fname_dst,
6290 smb_fname_src->base_name,
6291 smb_fname_dst->base_name,
6292 &fname_dst_mod)) {
6293 DEBUG(6, ("rename_internals: resolve_wildcards "
6294 "%s %s failed\n",
6295 smb_fname_src->base_name,
6296 smb_fname_dst->base_name));
6297 status = NT_STATUS_NO_MEMORY;
6298 goto out;
6299 }
6300 TALLOC_FREE(smb_fname_dst->base_name);
6301 smb_fname_dst->base_name = fname_dst_mod;
6302 }
6303
6304 ZERO_STRUCT(smb_fname_src->st);
6305 if (posix_pathnames) {
6306 SMB_VFS_LSTAT(conn, smb_fname_src);
6307 } else {
6308 SMB_VFS_STAT(conn, smb_fname_src);
6309 }
6310
6311 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6312 create_options |= FILE_DIRECTORY_FILE;
6313 }
6314
6315 status = SMB_VFS_CREATE_FILE(
6316 conn, /* conn */
6317 req, /* req */
6318 0, /* root_dir_fid */
6319 smb_fname_src, /* fname */
6320 access_mask, /* access_mask */
6321 (FILE_SHARE_READ | /* share_access */
6322 FILE_SHARE_WRITE),
6323 FILE_OPEN, /* create_disposition*/
6324 create_options, /* create_options */
6325 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6326 0, /* oplock_request */
6327 0, /* allocation_size */
6328 0, /* private_flags */
6329 NULL, /* sd */
6330 NULL, /* ea_list */
6331 &fsp, /* result */
6332 NULL); /* pinfo */
6333
6334 if (!NT_STATUS_IS_OK(status)) {
6335 DEBUG(3, ("Could not open rename source %s: %s\n",
6336 smb_fname_str_dbg(smb_fname_src),
6337 nt_errstr(status)));
6338 goto out;
6339 }
6340
6341 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6342 attrs, replace_if_exists);
6343
6344 close_file(req, fsp, NORMAL_CLOSE);
6345
6346 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6347 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6348 smb_fname_str_dbg(smb_fname_dst)));
6349
6350 goto out;
6351 }
6352
6353 /*
6354 * Wildcards - process each file that matches.
6355 */
6356 if (strequal(fname_src_mask, "????????.???")) {
6357 TALLOC_FREE(fname_src_mask);
6358 fname_src_mask = talloc_strdup(ctx, "*");
6359 if (!fname_src_mask) {
6360 status = NT_STATUS_NO_MEMORY;
6361 goto out;
6362 }
6363 }
6364
6365 status = check_name(conn, fname_src_dir);
6366 if (!NT_STATUS_IS_OK(status)) {
6367 goto out;
6368 }
6369
6370 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6371 attrs);
6372 if (dir_hnd == NULL) {
6373 status = map_nt_error_from_unix(errno);
6374 goto out;
6375 }
6376
6377 status = NT_STATUS_NO_SUCH_FILE;
6378 /*
6379 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6380 * - gentest fix. JRA
6381 */
6382
6383 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6384 &talloced))) {
6385 files_struct *fsp = NULL;
6386 char *destname = NULL;
6387 bool sysdir_entry = False;
6388
6389 /* Quick check for "." and ".." */
6390 if (ISDOT(dname) || ISDOTDOT(dname)) {
6391 if (attrs & aDIR) {
6392 sysdir_entry = True;
6393 } else {
6394 TALLOC_FREE(talloced);
6395 continue;
6396 }
6397 }
6398
6399 if (!is_visible_file(conn, fname_src_dir, dname,
6400 &smb_fname_src->st, false)) {
6401 TALLOC_FREE(talloced);
6402 continue;
6403 }
6404
6405 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6406 TALLOC_FREE(talloced);
6407 continue;
6408 }
6409
6410 if (sysdir_entry) {
6411 status = NT_STATUS_OBJECT_NAME_INVALID;
6412 break;
6413 }
6414
6415 TALLOC_FREE(smb_fname_src->base_name);
6416 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6417 "%s/%s",
6418 fname_src_dir,
6419 dname);
6420 if (!smb_fname_src->base_name) {
6421 status = NT_STATUS_NO_MEMORY;
6422 goto out;
6423 }
6424
6425 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6426 smb_fname_dst->base_name,
6427 &destname)) {
6428 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6429 smb_fname_src->base_name, destname));
6430 TALLOC_FREE(talloced);
6431 continue;
6432 }
6433 if (!destname) {
6434 status = NT_STATUS_NO_MEMORY;
6435 goto out;
6436 }
6437
6438 TALLOC_FREE(smb_fname_dst->base_name);
6439 smb_fname_dst->base_name = destname;
6440
6441 ZERO_STRUCT(smb_fname_src->st);
6442 if (posix_pathnames) {
6443 SMB_VFS_LSTAT(conn, smb_fname_src);
6444 } else {
6445 SMB_VFS_STAT(conn, smb_fname_src);
6446 }
6447
6448 create_options = 0;
6449
6450 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6451 create_options |= FILE_DIRECTORY_FILE;
6452 }
6453
6454 status = SMB_VFS_CREATE_FILE(
6455 conn, /* conn */
6456 req, /* req */
6457 0, /* root_dir_fid */
6458 smb_fname_src, /* fname */
6459 access_mask, /* access_mask */
6460 (FILE_SHARE_READ | /* share_access */
6461 FILE_SHARE_WRITE),
6462 FILE_OPEN, /* create_disposition*/
6463 create_options, /* create_options */
6464 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6465 0, /* oplock_request */
6466 0, /* allocation_size */
6467 0, /* private_flags */
6468 NULL, /* sd */
6469 NULL, /* ea_list */
6470 &fsp, /* result */
6471 NULL); /* pinfo */
6472
6473 if (!NT_STATUS_IS_OK(status)) {
6474 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6475 "returned %s rename %s -> %s\n",
6476 nt_errstr(status),
6477 smb_fname_str_dbg(smb_fname_src),
6478 smb_fname_str_dbg(smb_fname_dst)));
6479 break;
6480 }
6481
6482 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6483 dname);
6484 if (!smb_fname_dst->original_lcomp) {
6485 status = NT_STATUS_NO_MEMORY;
6486 goto out;
6487 }
6488
6489 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6490 attrs, replace_if_exists);
6491
6492 close_file(req, fsp, NORMAL_CLOSE);
6493
6494 if (!NT_STATUS_IS_OK(status)) {
6495 DEBUG(3, ("rename_internals_fsp returned %s for "
6496 "rename %s -> %s\n", nt_errstr(status),
6497 smb_fname_str_dbg(smb_fname_src),
6498 smb_fname_str_dbg(smb_fname_dst)));
6499 break;
6500 }
6501
6502 count++;
6503
6504 DEBUG(3,("rename_internals: doing rename on %s -> "
6505 "%s\n", smb_fname_str_dbg(smb_fname_src),
6506 smb_fname_str_dbg(smb_fname_src)));
6507 TALLOC_FREE(talloced);
6508 }
6509 TALLOC_FREE(dir_hnd);
6510
6511 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6512 status = map_nt_error_from_unix(errno);
6513 }
6514
6515 out:
6516 TALLOC_FREE(talloced);
6517 TALLOC_FREE(fname_src_dir);
6518 TALLOC_FREE(fname_src_mask);
6519 return status;
6520 }
6521
6522 /****************************************************************************
6523 Reply to a mv.
6524 ****************************************************************************/
6525
6526 void reply_mv(struct smb_request *req)
6527 {
6528 connection_struct *conn = req->conn;
6529 char *name = NULL;
6530 char *newname = NULL;
6531 const char *p;
6532 uint32 attrs;
6533 NTSTATUS status;
6534 bool src_has_wcard = False;
6535 bool dest_has_wcard = False;
6536 TALLOC_CTX *ctx = talloc_tos();
6537 struct smb_filename *smb_fname_src = NULL;
6538 struct smb_filename *smb_fname_dst = NULL;
6539
6540 START_PROFILE(SMBmv);
6541
6542 if (req->wct < 1) {
6543 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6544 goto out;
6545 }
6546
6547 attrs = SVAL(req->vwv+0, 0);
6548
6549 p = (const char *)req->buf + 1;
6550 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6551 &status, &src_has_wcard);
6552 if (!NT_STATUS_IS_OK(status)) {
6553 reply_nterror(req, status);
6554 goto out;
6555 }
6556 p++;
6557 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6558 &status, &dest_has_wcard);
6559 if (!NT_STATUS_IS_OK(status)) {
6560 reply_nterror(req, status);
6561 goto out;
6562 }
6563
6564 status = filename_convert(ctx,
6565 conn,
6566 req->flags2 & FLAGS2_DFS_PATHNAMES,
6567 name,
6568 UCF_COND_ALLOW_WCARD_LCOMP,
6569 &src_has_wcard,
6570 &smb_fname_src);
6571
6572 if (!NT_STATUS_IS_OK(status)) {
6573 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6574 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6575 ERRSRV, ERRbadpath);
6576 goto out;
6577 }
6578 reply_nterror(req, status);
6579 goto out;
6580 }
6581
6582 status = filename_convert(ctx,
6583 conn,
6584 req->flags2 & FLAGS2_DFS_PATHNAMES,
6585 newname,
6586 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6587 &dest_has_wcard,
6588 &smb_fname_dst);
6589
6590 if (!NT_STATUS_IS_OK(status)) {
6591 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6592 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6593 ERRSRV, ERRbadpath);
6594 goto out;
6595 }
6596 reply_nterror(req, status);
6597 goto out;
6598 }
6599
6600 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6601 smb_fname_str_dbg(smb_fname_dst)));
6602
6603 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6604 attrs, False, src_has_wcard, dest_has_wcard,
6605 DELETE_ACCESS);
6606 if (!NT_STATUS_IS_OK(status)) {
6607 if (open_was_deferred(req->mid)) {
6608 /* We have re-scheduled this call. */
6609 goto out;
6610 }
6611 reply_nterror(req, status);
6612 goto out;
6613 }
6614
6615 reply_outbuf(req, 0, 0);
6616 out:
6617 TALLOC_FREE(smb_fname_src);
6618 TALLOC_FREE(smb_fname_dst);
6619 END_PROFILE(SMBmv);
6620 return;
6621 }
6622
6623 /*******************************************************************
6624 Copy a file as part of a reply_copy.
6625 ******************************************************************/
6626
6627 /*
6628 * TODO: check error codes on all callers
6629 */
6630
6631 NTSTATUS copy_file(TALLOC_CTX *ctx,
6632 connection_struct *conn,
6633 struct smb_filename *smb_fname_src,
6634 struct smb_filename *smb_fname_dst,
6635 int ofun,
6636 int count,
6637 bool target_is_directory)
6638 {
6639 struct smb_filename *smb_fname_dst_tmp = NULL;
6640 SMB_OFF_T ret=-1;
6641 files_struct *fsp1,*fsp2;
6642 uint32 dosattrs;
6643 uint32 new_create_disposition;
6644 NTSTATUS status;
6645
6646
6647 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6648 if (!NT_STATUS_IS_OK(status)) {
6649 return status;
6650 }
6651
6652 /*
6653 * If the target is a directory, extract the last component from the
6654 * src filename and append it to the dst filename
6655 */
6656 if (target_is_directory) {
6657 const char *p;
6658
6659 /* dest/target can't be a stream if it's a directory. */
6660 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6661
6662 p = strrchr_m(smb_fname_src->base_name,'/');
6663 if (p) {
6664 p++;
6665 } else {
6666 p = smb_fname_src->base_name;
6667 }
6668 smb_fname_dst_tmp->base_name =
6669 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6670 p);
6671 if (!smb_fname_dst_tmp->base_name) {
6672 status = NT_STATUS_NO_MEMORY;
6673 goto out;
6674 }
6675 }
6676
6677 status = vfs_file_exist(conn, smb_fname_src);
6678 if (!NT_STATUS_IS_OK(status)) {
6679 goto out;
6680 }
6681
6682 if (!target_is_directory && count) {
6683 new_create_disposition = FILE_OPEN;
6684 } else {
6685 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6686 NULL, NULL,
6687 &new_create_disposition,
6688 NULL,
6689 NULL)) {
6690 status = NT_STATUS_INVALID_PARAMETER;
6691 goto out;
6692 }
6693 }
6694
6695 /* Open the src file for reading. */
6696 status = SMB_VFS_CREATE_FILE(
6697 conn, /* conn */
6698 NULL, /* req */
6699 0, /* root_dir_fid */
6700 smb_fname_src, /* fname */
6701 FILE_GENERIC_READ, /* access_mask */
6702 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6703 FILE_OPEN, /* create_disposition*/
6704 0, /* create_options */
6705 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6706 INTERNAL_OPEN_ONLY, /* oplock_request */
6707 0, /* allocation_size */
6708 0, /* private_flags */
6709 NULL, /* sd */
6710 NULL, /* ea_list */
6711 &fsp1, /* result */
6712 NULL); /* psbuf */
6713
6714 if (!NT_STATUS_IS_OK(status)) {
6715 goto out;
6716 }
6717
6718 dosattrs = dos_mode(conn, smb_fname_src);
6719
6720 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6721 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6722 }
6723
6724 /* Open the dst file for writing. */
6725 status = SMB_VFS_CREATE_FILE(
6726 conn, /* conn */
6727 NULL, /* req */
6728 0, /* root_dir_fid */
6729 smb_fname_dst, /* fname */
6730 FILE_GENERIC_WRITE, /* access_mask */
6731 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6732 new_create_disposition, /* create_disposition*/
6733 0, /* create_options */
6734 dosattrs, /* file_attributes */
6735 INTERNAL_OPEN_ONLY, /* oplock_request */
6736 0, /* allocation_size */
6737 0, /* private_flags */
6738 NULL, /* sd */
6739 NULL, /* ea_list */
6740 &fsp2, /* result */
6741 NULL); /* psbuf */
6742
6743 if (!NT_STATUS_IS_OK(status)) {
6744 close_file(NULL, fsp1, ERROR_CLOSE);
6745 goto out;
6746 }
6747
6748 if ((ofun&3) == 1) {
6749 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6750 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6751 /*
6752 * Stop the copy from occurring.
6753 */
6754 ret = -1;
6755 smb_fname_src->st.st_ex_size = 0;
6756 }
6757 }
6758
6759 /* Do the actual copy. */
6760 if (smb_fname_src->st.st_ex_size) {
6761 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6762 }
6763
6764 close_file(NULL, fsp1, NORMAL_CLOSE);
6765
6766 /* Ensure the modtime is set correctly on the destination file. */
6767 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6768
6769 /*
6770 * As we are opening fsp1 read-only we only expect
6771 * an error on close on fsp2 if we are out of space.
6772 * Thus we don't look at the error return from the
6773 * close of fsp1.
6774 */
6775 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6776
6777 if (!NT_STATUS_IS_OK(status)) {
6778 goto out;
6779 }
6780
6781 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6782 status = NT_STATUS_DISK_FULL;
6783 goto out;
6784 }
6785
6786 status = NT_STATUS_OK;
6787
6788 out:
6789 TALLOC_FREE(smb_fname_dst_tmp);
6790 return status;
6791 }
6792
6793 /****************************************************************************
6794 Reply to a file copy.
6795 ****************************************************************************/
6796
6797 void reply_copy(struct smb_request *req)
6798 {
6799 connection_struct *conn = req->conn;
6800 struct smb_filename *smb_fname_src = NULL;
6801 struct smb_filename *smb_fname_dst = NULL;
6802 char *fname_src = NULL;
6803 char *fname_dst = NULL;
6804 char *fname_src_mask = NULL;
6805 char *fname_src_dir = NULL;
6806 const char *p;
6807 int count=0;
6808 int error = ERRnoaccess;
6809 int tid2;
6810 int ofun;
6811 int flags;
6812 bool target_is_directory=False;
6813 bool source_has_wild = False;
6814 bool dest_has_wild = False;
6815 NTSTATUS status;
6816 TALLOC_CTX *ctx = talloc_tos();
6817
6818 START_PROFILE(SMBcopy);
6819
6820 if (req->wct < 3) {
6821 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6822 goto out;
6823 }
6824
6825 tid2 = SVAL(req->vwv+0, 0);
6826 ofun = SVAL(req->vwv+1, 0);
6827 flags = SVAL(req->vwv+2, 0);
6828
6829 p = (const char *)req->buf;
6830 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6831 &status, &source_has_wild);
6832 if (!NT_STATUS_IS_OK(status)) {
6833 reply_nterror(req, status);
6834 goto out;
6835 }
6836 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6837 &status, &dest_has_wild);
6838 if (!NT_STATUS_IS_OK(status)) {
6839 reply_nterror(req, status);
6840 goto out;
6841 }
6842
6843 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6844
6845 if (tid2 != conn->cnum) {
6846 /* can't currently handle inter share copies XXXX */
6847 DEBUG(3,("Rejecting inter-share copy\n"));
6848 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6849 goto out;
6850 }
6851
6852 status = filename_convert(ctx, conn,
6853 req->flags2 & FLAGS2_DFS_PATHNAMES,
6854 fname_src,
6855 UCF_COND_ALLOW_WCARD_LCOMP,
6856 &source_has_wild,
6857 &smb_fname_src);
6858 if (!NT_STATUS_IS_OK(status)) {
6859 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6860 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6861 ERRSRV, ERRbadpath);
6862 goto out;
6863 }
6864 reply_nterror(req, status);
6865 goto out;
6866 }
6867
6868 status = filename_convert(ctx, conn,
6869 req->flags2 & FLAGS2_DFS_PATHNAMES,
6870 fname_dst,
6871 UCF_COND_ALLOW_WCARD_LCOMP,
6872 &dest_has_wild,
6873 &smb_fname_dst);
6874 if (!NT_STATUS_IS_OK(status)) {
6875 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6876 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6877 ERRSRV, ERRbadpath);
6878 goto out;
6879 }
6880 reply_nterror(req, status);
6881 goto out;
6882 }
6883
6884 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6885
6886 if ((flags&1) && target_is_directory) {
6887 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6888 goto out;
6889 }
6890
6891 if ((flags&2) && !target_is_directory) {
6892 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6893 goto out;
6894 }
6895
6896 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6897 /* wants a tree copy! XXXX */
6898 DEBUG(3,("Rejecting tree copy\n"));
6899 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6900 goto out;
6901 }
6902
6903 /* Split up the directory from the filename/mask. */
6904 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6905 &fname_src_dir, &fname_src_mask);
6906 if (!NT_STATUS_IS_OK(status)) {
6907 reply_nterror(req, NT_STATUS_NO_MEMORY);
6908 goto out;
6909 }
6910
6911 /*
6912 * We should only check the mangled cache
6913 * here if unix_convert failed. This means
6914 * that the path in 'mask' doesn't exist
6915 * on the file system and so we need to look
6916 * for a possible mangle. This patch from
6917 * Tine Smukavec <valentin.smukavec@hermes.si>.
6918 */
6919 if (!VALID_STAT(smb_fname_src->st) &&
6920 mangle_is_mangled(fname_src_mask, conn->params)) {
6921 char *new_mask = NULL;
6922 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6923 &new_mask, conn->params);
6924
6925 /* Use demangled name if one was successfully found. */
6926 if (new_mask) {
6927 TALLOC_FREE(fname_src_mask);
6928 fname_src_mask = new_mask;
6929 }
6930 }
6931
6932 if (!source_has_wild) {
6933
6934 /*
6935 * Only one file needs to be copied. Append the mask back onto
6936 * the directory.
6937 */
6938 TALLOC_FREE(smb_fname_src->base_name);
6939 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6940 "%s/%s",
6941 fname_src_dir,
6942 fname_src_mask);
6943 if (!smb_fname_src->base_name) {
6944 reply_nterror(req, NT_STATUS_NO_MEMORY);
6945 goto out;
6946 }
6947
6948 if (dest_has_wild) {
6949 char *fname_dst_mod = NULL;
6950 if (!resolve_wildcards(smb_fname_dst,
6951 smb_fname_src->base_name,
6952 smb_fname_dst->base_name,
6953 &fname_dst_mod)) {
6954 reply_nterror(req, NT_STATUS_NO_MEMORY);
6955 goto out;
6956 }
6957 TALLOC_FREE(smb_fname_dst->base_name);
6958 smb_fname_dst->base_name = fname_dst_mod;
6959 }
6960
6961 status = check_name(conn, smb_fname_src->base_name);
6962 if (!NT_STATUS_IS_OK(status)) {
6963 reply_nterror(req, status);
6964 goto out;
6965 }
6966
6967 status = check_name(conn, smb_fname_dst->base_name);
6968 if (!NT_STATUS_IS_OK(status)) {
6969 reply_nterror(req, status);
6970 goto out;
6971 }
6972
6973 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6974 ofun, count, target_is_directory);
6975
6976 if(!NT_STATUS_IS_OK(status)) {
6977 reply_nterror(req, status);
6978 goto out;
6979 } else {
6980 count++;
6981 }
6982 } else {
6983 struct smb_Dir *dir_hnd = NULL;
6984 const char *dname = NULL;
6985 char *talloced = NULL;
6986 long offset = 0;
6987
6988 /*
6989 * There is a wildcard that requires us to actually read the
6990 * src dir and copy each file matching the mask to the dst.
6991 * Right now streams won't be copied, but this could
6992 * presumably be added with a nested loop for reach dir entry.
6993 */
6994 SMB_ASSERT(!smb_fname_src->stream_name);
6995 SMB_ASSERT(!smb_fname_dst->stream_name);
6996
6997 smb_fname_src->stream_name = NULL;
6998 smb_fname_dst->stream_name = NULL;
6999
7000 if (strequal(fname_src_mask,"????????.???")) {
7001 TALLOC_FREE(fname_src_mask);
7002 fname_src_mask = talloc_strdup(ctx, "*");
7003 if (!fname_src_mask) {
7004 reply_nterror(req, NT_STATUS_NO_MEMORY);
7005 goto out;
7006 }
7007 }
7008
7009 status = check_name(conn, fname_src_dir);
7010 if (!NT_STATUS_IS_OK(status)) {
7011 reply_nterror(req, status);
7012 goto out;
7013 }
7014
7015 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7016 if (dir_hnd == NULL) {
7017 status = map_nt_error_from_unix(errno);
7018 reply_nterror(req, status);
7019 goto out;
7020 }
7021
7022 error = ERRbadfile;
7023
7024 /* Iterate over the src dir copying each entry to the dst. */
7025 while ((dname = ReadDirName(dir_hnd, &offset,
7026 &smb_fname_src->st, &talloced))) {
7027 char *destname = NULL;
7028
7029 if (ISDOT(dname) || ISDOTDOT(dname)) {
7030 TALLOC_FREE(talloced);
7031 continue;
7032 }
7033
7034 if (!is_visible_file(conn, fname_src_dir, dname,
7035 &smb_fname_src->st, false)) {
7036 TALLOC_FREE(talloced);
7037 continue;
7038 }
7039
7040 if(!mask_match(dname, fname_src_mask,
7041 conn->case_sensitive)) {
7042 TALLOC_FREE(talloced);
7043 continue;
7044 }
7045
7046 error = ERRnoaccess;
7047
7048 /* Get the src smb_fname struct setup. */
7049 TALLOC_FREE(smb_fname_src->base_name);
7050 smb_fname_src->base_name =
7051 talloc_asprintf(smb_fname_src, "%s/%s",
7052 fname_src_dir, dname);
7053
7054 if (!smb_fname_src->base_name) {
7055 TALLOC_FREE(dir_hnd);
7056 TALLOC_FREE(talloced);
7057 reply_nterror(req, NT_STATUS_NO_MEMORY);
7058 goto out;
7059 }
7060
7061 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7062 smb_fname_dst->base_name,
7063 &destname)) {
7064 TALLOC_FREE(talloced);
7065 continue;
7066 }
7067 if (!destname) {
7068 TALLOC_FREE(dir_hnd);
7069 TALLOC_FREE(talloced);
7070 reply_nterror(req, NT_STATUS_NO_MEMORY);
7071 goto out;
7072 }
7073
7074 TALLOC_FREE(smb_fname_dst->base_name);
7075 smb_fname_dst->base_name = destname;
7076
7077 status = check_name(conn, smb_fname_src->base_name);
7078 if (!NT_STATUS_IS_OK(status)) {
7079 TALLOC_FREE(dir_hnd);
7080 TALLOC_FREE(talloced);
7081 reply_nterror(req, status);
7082 goto out;
7083 }
7084
7085 status = check_name(conn, smb_fname_dst->base_name);
7086 if (!NT_STATUS_IS_OK(status)) {
7087 TALLOC_FREE(dir_hnd);
7088 TALLOC_FREE(talloced);
7089 reply_nterror(req, status);
7090 goto out;
7091 }
7092
7093 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7094 smb_fname_src->base_name,
7095 smb_fname_dst->base_name));
7096
7097 status = copy_file(ctx, conn, smb_fname_src,
7098 smb_fname_dst, ofun, count,
7099 target_is_directory);
7100 if (NT_STATUS_IS_OK(status)) {
7101 count++;
7102 }
7103
7104 TALLOC_FREE(talloced);
7105 }
7106 TALLOC_FREE(dir_hnd);
7107 }
7108
7109 if (count == 0) {
7110 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7111 goto out;
7112 }
7113
7114 reply_outbuf(req, 1, 0);
7115 SSVAL(req->outbuf,smb_vwv0,count);
7116 out:
7117 TALLOC_FREE(smb_fname_src);
7118 TALLOC_FREE(smb_fname_dst);
7119 TALLOC_FREE(fname_src);
7120 TALLOC_FREE(fname_dst);
7121 TALLOC_FREE(fname_src_mask);
7122 TALLOC_FREE(fname_src_dir);
7123
7124 END_PROFILE(SMBcopy);
7125 return;
7126 }
7127
7128 #undef DBGC_CLASS
7129 #define DBGC_CLASS DBGC_LOCKING
7130
7131 /****************************************************************************
7132 Get a lock pid, dealing with large count requests.
7133 ****************************************************************************/
7134
7135 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7136 bool large_file_format)
7137 {
7138 if(!large_file_format)
7139 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7140 else
7141 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7142 }
7143
7144 /****************************************************************************
7145 Get a lock count, dealing with large count requests.
7146 ****************************************************************************/
7147
7148 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7149 bool large_file_format)
7150 {
7151 uint64_t count = 0;
7152
7153 if(!large_file_format) {
7154 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7155 } else {
7156
7157 #if defined(HAVE_LONGLONG)
7158 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7159 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7160 #else /* HAVE_LONGLONG */
7161
7162 /*
7163 * NT4.x seems to be broken in that it sends large file (64 bit)
7164 * lockingX calls even if the CAP_LARGE_FILES was *not*
7165 * negotiated. For boxes without large unsigned ints truncate the
7166 * lock count by dropping the top 32 bits.
7167 */
7168
7169 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7170 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7171 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7172 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7173 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7174 }
7175
7176 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7177 #endif /* HAVE_LONGLONG */
7178 }
7179
7180 return count;
7181 }
7182
7183 #if !defined(HAVE_LONGLONG)
7184 /****************************************************************************
7185 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7186 ****************************************************************************/
7187
7188 static uint32 map_lock_offset(uint32 high, uint32 low)
7189 {
7190 unsigned int i;
7191 uint32 mask = 0;
7192 uint32 highcopy = high;
7193
7194 /*
7195 * Try and find out how many significant bits there are in high.
7196 */
7197
7198 for(i = 0; highcopy; i++)
7199 highcopy >>= 1;
7200
7201 /*
7202 * We use 31 bits not 32 here as POSIX
7203 * lock offsets may not be negative.
7204 */
7205
7206 mask = (~0) << (31 - i);
7207
7208 if(low & mask)
7209 return 0; /* Fail. */
7210
7211 high <<= (31 - i);
7212
7213 return (high|low);
7214 }
7215 #endif /* !defined(HAVE_LONGLONG) */
7216
7217 /****************************************************************************
7218 Get a lock offset, dealing with large offset requests.
7219 ****************************************************************************/
7220
7221 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7222 bool large_file_format, bool *err)
7223 {
7224 uint64_t offset = 0;
7225
7226 *err = False;
7227
7228 if(!large_file_format) {
7229 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7230 } else {
7231
7232 #if defined(HAVE_LONGLONG)
7233 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7234 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7235 #else /* HAVE_LONGLONG */
7236
7237 /*
7238 * NT4.x seems to be broken in that it sends large file (64 bit)
7239 * lockingX calls even if the CAP_LARGE_FILES was *not*
7240 * negotiated. For boxes without large unsigned ints mangle the
7241 * lock offset by mapping the top 32 bits onto the lower 32.
7242 */
7243
7244 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7245 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7246 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7247 uint32 new_low = 0;
7248
7249 if((new_low = map_lock_offset(high, low)) == 0) {
7250 *err = True;
7251 return (uint64_t)-1;
7252 }
7253
7254 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7255 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7256 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7257 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7258 }
7259
7260 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7261 #endif /* HAVE_LONGLONG */
7262 }
7263
7264 return offset;
7265 }
7266
7267 NTSTATUS smbd_do_locking(struct smb_request *req,
7268 files_struct *fsp,
7269 uint8_t type,
7270 int32_t timeout,
7271 uint16_t num_ulocks,
7272 struct smbd_lock_element *ulocks,
7273 uint16_t num_locks,
7274 struct smbd_lock_element *locks,
7275 bool *async)
7276 {
7277 connection_struct *conn = req->conn;
7278 int i;
7279 NTSTATUS status = NT_STATUS_OK;
7280
7281 *async = false;
7282
7283 /* Data now points at the beginning of the list
7284 of smb_unlkrng structs */
7285 for(i = 0; i < (int)num_ulocks; i++) {
7286 struct smbd_lock_element *e = &ulocks[i];
7287
7288 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7289 "pid %u, file %s\n",
7290 (double)e->offset,
7291 (double)e->count,
7292 (unsigned int)e->smblctx,
7293 fsp_str_dbg(fsp)));
7294
7295 if (e->brltype != UNLOCK_LOCK) {
7296 /* this can only happen with SMB2 */
7297 return NT_STATUS_INVALID_PARAMETER;
7298 }
7299
7300 status = do_unlock(req->sconn->msg_ctx,
7301 fsp,
7302 e->smblctx,
7303 e->count,
7304 e->offset,
7305 WINDOWS_LOCK);
7306
7307 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7308 nt_errstr(status)));
7309
7310 if (!NT_STATUS_IS_OK(status)) {
7311 return status;
7312 }
7313 }
7314
7315 /* Setup the timeout in seconds. */
7316
7317 if (!lp_blocking_locks(SNUM(conn))) {
7318 timeout = 0;
7319 }
7320
7321 /* Data now points at the beginning of the list
7322 of smb_lkrng structs */
7323
7324 for(i = 0; i < (int)num_locks; i++) {
7325 struct smbd_lock_element *e = &locks[i];
7326
7327 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7328 "%llu, file %s timeout = %d\n",
7329 (double)e->offset,
7330 (double)e->count,
7331 (unsigned long long)e->smblctx,
7332 fsp_str_dbg(fsp),
7333 (int)timeout));
7334
7335 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7336 struct blocking_lock_record *blr = NULL;
7337
7338 if (num_locks > 1) {
7339 /*
7340 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7341 * if the lock vector contains one entry. When given mutliple cancel
7342 * requests in a single PDU we expect the server to return an
7343 * error. Windows servers seem to accept the request but only
7344 * cancel the first lock.
7345 * JRA - Do what Windows does (tm) :-).
7346 */
7347
7348 #if 0
7349 /* MS-CIFS (2.2.4.32.1) behavior. */
7350 return NT_STATUS_DOS(ERRDOS,
7351 ERRcancelviolation);
7352 #else
7353 /* Windows behavior. */
7354 if (i != 0) {
7355 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7356 "cancel request\n"));
7357 continue;
7358 }
7359 #endif
7360 }
7361
7362 if (lp_blocking_locks(SNUM(conn))) {
7363
7364 /* Schedule a message to ourselves to
7365 remove the blocking lock record and
7366 return the right error. */
7367
7368 blr = blocking_lock_cancel_smb1(fsp,
7369 e->smblctx,
7370 e->offset,
7371 e->count,
7372 WINDOWS_LOCK,
7373 type,
7374 NT_STATUS_FILE_LOCK_CONFLICT);
7375 if (blr == NULL) {
7376 return NT_STATUS_DOS(
7377 ERRDOS,
7378 ERRcancelviolation);
7379 }
7380 }
7381 /* Remove a matching pending lock. */
7382 status = do_lock_cancel(fsp,
7383 e->smblctx,
7384 e->count,
7385 e->offset,
7386 WINDOWS_LOCK,
7387 blr);
7388 } else {
7389 bool blocking_lock = timeout ? true : false;
7390 bool defer_lock = false;
7391 struct byte_range_lock *br_lck;
7392 uint64_t block_smblctx;
7393
7394 br_lck = do_lock(req->sconn->msg_ctx,
7395 fsp,
7396 e->smblctx,
7397 e->count,
7398 e->offset,
7399 e->brltype,
7400 WINDOWS_LOCK,
7401 blocking_lock,
7402 &status,
7403 &block_smblctx,
7404 NULL);
7405
7406 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7407 /* Windows internal resolution for blocking locks seems
7408 to be about 200ms... Don't wait for less than that. JRA. */
7409 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7410 timeout = lp_lock_spin_time();
7411 }
7412 defer_lock = true;
7413 }
7414
7415 /* If a lock sent with timeout of zero would fail, and
7416 * this lock has been requested multiple times,
7417 * according to brl_lock_failed() we convert this
7418 * request to a blocking lock with a timeout of between
7419 * 150 - 300 milliseconds.
7420 *
7421 * If lp_lock_spin_time() has been set to 0, we skip
7422 * this blocking retry and fail immediately.
7423 *
7424 * Replacement for do_lock_spin(). JRA. */
7425
7426 if (!req->sconn->using_smb2 &&
7427 br_lck && lp_blocking_locks(SNUM(conn)) &&
7428 lp_lock_spin_time() && !blocking_lock &&
7429 NT_STATUS_EQUAL((status),
7430 NT_STATUS_FILE_LOCK_CONFLICT))
7431 {
7432 defer_lock = true;
7433 timeout = lp_lock_spin_time();
7434 }
7435
7436 if (br_lck && defer_lock) {
7437 /*
7438 * A blocking lock was requested. Package up
7439 * this smb into a queued request and push it
7440 * onto the blocking lock queue.
7441 */
7442 if(push_blocking_lock_request(br_lck,
7443 req,
7444 fsp,
7445 timeout,
7446 i,
7447 e->smblctx,
7448 e->brltype,
7449 WINDOWS_LOCK,
7450 e->offset,
7451 e->count,
7452 block_smblctx)) {
7453 TALLOC_FREE(br_lck);
7454 *async = true;
7455 return NT_STATUS_OK;
7456 }
7457 }
7458
7459 TALLOC_FREE(br_lck);
7460 }
7461
7462 if (!NT_STATUS_IS_OK(status)) {
7463 break;
7464 }
7465 }
7466
7467 /* If any of the above locks failed, then we must unlock
7468 all of the previous locks (X/Open spec). */
7469
7470 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7471
7472 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7473 i = -1; /* we want to skip the for loop */
7474 }
7475
7476 /*
7477 * Ensure we don't do a remove on the lock that just failed,
7478 * as under POSIX rules, if we have a lock already there, we
7479 * will delete it (and we shouldn't) .....
7480 */
7481 for(i--; i >= 0; i--) {
7482 struct smbd_lock_element *e = &locks[i];
7483
7484 do_unlock(req->sconn->msg_ctx,
7485 fsp,
7486 e->smblctx,
7487 e->count,
7488 e->offset,
7489 WINDOWS_LOCK);
7490 }
7491 return status;
7492 }
7493
7494 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7495 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7496
7497 return NT_STATUS_OK;
7498 }
7499
7500 /****************************************************************************
7501 Reply to a lockingX request.
7502 ****************************************************************************/
7503
7504 void reply_lockingX(struct smb_request *req)
7505 {
7506 connection_struct *conn = req->conn;
7507 files_struct *fsp;
7508 unsigned char locktype;
7509 unsigned char oplocklevel;
7510 uint16 num_ulocks;
7511 uint16 num_locks;
7512 int32 lock_timeout;
7513 int i;
7514 const uint8_t *data;
7515 bool large_file_format;
7516 bool err;
7517 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7518 struct smbd_lock_element *ulocks;
7519 struct smbd_lock_element *locks;
7520 bool async = false;
7521
7522 START_PROFILE(SMBlockingX);
7523
7524 if (req->wct < 8) {
7525 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7526 END_PROFILE(SMBlockingX);
7527 return;
7528 }
7529
7530 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7531 locktype = CVAL(req->vwv+3, 0);
7532 oplocklevel = CVAL(req->vwv+3, 1);
7533 num_ulocks = SVAL(req->vwv+6, 0);
7534 num_locks = SVAL(req->vwv+7, 0);
7535 lock_timeout = IVAL(req->vwv+4, 0);
7536 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7537
7538 if (!check_fsp(conn, req, fsp)) {
7539 END_PROFILE(SMBlockingX);
7540 return;
7541 }
7542
7543 data = req->buf;
7544
7545 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7546 /* we don't support these - and CANCEL_LOCK makes w2k
7547 and XP reboot so I don't really want to be
7548 compatible! (tridge) */
7549 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7550 END_PROFILE(SMBlockingX);
7551 return;
7552 }
7553
7554 /* Check if this is an oplock break on a file
7555 we have granted an oplock on.
7556 */
7557 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7558 /* Client can insist on breaking to none. */
7559 bool break_to_none = (oplocklevel == 0);
7560 bool result;
7561
7562 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7563 "for fnum = %d\n", (unsigned int)oplocklevel,
7564 fsp->fnum ));
7565
7566 /*
7567 * Make sure we have granted an exclusive or batch oplock on
7568 * this file.
7569 */
7570
7571 if (fsp->oplock_type == 0) {
7572
7573 /* The Samba4 nbench simulator doesn't understand
7574 the difference between break to level2 and break
7575 to none from level2 - it sends oplock break
7576 replies in both cases. Don't keep logging an error
7577 message here - just ignore it. JRA. */
7578
7579 DEBUG(5,("reply_lockingX: Error : oplock break from "
7580 "client for fnum = %d (oplock=%d) and no "
7581 "oplock granted on this file (%s).\n",
7582 fsp->fnum, fsp->oplock_type,
7583 fsp_str_dbg(fsp)));
7584
7585 /* if this is a pure oplock break request then don't
7586 * send a reply */
7587 if (num_locks == 0 && num_ulocks == 0) {
7588 END_PROFILE(SMBlockingX);
7589 return;
7590 } else {
7591 END_PROFILE(SMBlockingX);
7592 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7593 return;
7594 }
7595 }
7596
7597 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7598 (break_to_none)) {
7599 result = remove_oplock(fsp);
7600 } else {
7601 result = downgrade_oplock(fsp);
7602 }
7603
7604 if (!result) {
7605 DEBUG(0, ("reply_lockingX: error in removing "
7606 "oplock on file %s\n", fsp_str_dbg(fsp)));
7607 /* Hmmm. Is this panic justified? */
7608 smb_panic("internal tdb error");
7609 }
7610
7611 reply_to_oplock_break_requests(fsp);
7612
7613 /* if this is a pure oplock break request then don't send a
7614 * reply */
7615 if (num_locks == 0 && num_ulocks == 0) {
7616 /* Sanity check - ensure a pure oplock break is not a
7617 chained request. */
7618 if(CVAL(req->vwv+0, 0) != 0xff)
7619 DEBUG(0,("reply_lockingX: Error : pure oplock "
7620 "break is a chained %d request !\n",
7621 (unsigned int)CVAL(req->vwv+0, 0)));
7622 END_PROFILE(SMBlockingX);
7623 return;
7624 }
7625 }
7626
7627 if (req->buflen <
7628 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7629 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7630 END_PROFILE(SMBlockingX);
7631 return;
7632 }
7633
7634 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7635 if (ulocks == NULL) {
7636 reply_nterror(req, NT_STATUS_NO_MEMORY);
7637 END_PROFILE(SMBlockingX);
7638 return;
7639 }
7640
7641 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7642 if (locks == NULL) {
7643 reply_nterror(req, NT_STATUS_NO_MEMORY);
7644 END_PROFILE(SMBlockingX);
7645 return;
7646 }
7647
7648 /* Data now points at the beginning of the list
7649 of smb_unlkrng structs */
7650 for(i = 0; i < (int)num_ulocks; i++) {
7651 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7652 ulocks[i].count = get_lock_count(data, i, large_file_format);
7653 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7654 ulocks[i].brltype = UNLOCK_LOCK;
7655
7656 /*
7657 * There is no error code marked "stupid client bug".... :-).
7658 */
7659 if(err) {
7660 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7661 END_PROFILE(SMBlockingX);
7662 return;
7663 }
7664 }
7665
7666 /* Now do any requested locks */
7667 data += ((large_file_format ? 20 : 10)*num_ulocks);
7668
7669 /* Data now points at the beginning of the list
7670 of smb_lkrng structs */
7671
7672 for(i = 0; i < (int)num_locks; i++) {
7673 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7674 locks[i].count = get_lock_count(data, i, large_file_format);
7675 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7676
7677 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7678 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7679 locks[i].brltype = PENDING_READ_LOCK;
7680 } else {
7681 locks[i].brltype = READ_LOCK;
7682 }
7683 } else {
7684 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7685 locks[i].brltype = PENDING_WRITE_LOCK;
7686 } else {
7687 locks[i].brltype = WRITE_LOCK;
7688 }
7689 }
7690
7691 /*
7692 * There is no error code marked "stupid client bug".... :-).
7693 */
7694 if(err) {
7695 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7696 END_PROFILE(SMBlockingX);
7697 return;
7698 }
7699 }
7700
7701 status = smbd_do_locking(req, fsp,
7702 locktype, lock_timeout,
7703 num_ulocks, ulocks,
7704 num_locks, locks,
7705 &async);
7706 if (!NT_STATUS_IS_OK(status)) {
7707 END_PROFILE(SMBlockingX);
7708 reply_nterror(req, status);
7709 return;
7710 }
7711 if (async) {
7712 END_PROFILE(SMBlockingX);
7713 return;
7714 }
7715
7716 reply_outbuf(req, 2, 0);
7717
7718 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7719 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7720
7721 END_PROFILE(SMBlockingX);
7722 chain_reply(req);
7723 }
7724
7725 #undef DBGC_CLASS
7726 #define DBGC_CLASS DBGC_ALL
7727
7728 /****************************************************************************
7729 Reply to a SMBreadbmpx (read block multiplex) request.
7730 Always reply with an error, if someone has a platform really needs this,
7731 please contact vl@samba.org
7732 ****************************************************************************/
7733
7734 void reply_readbmpx(struct smb_request *req)
7735 {
7736 START_PROFILE(SMBreadBmpx);
7737 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7738 END_PROFILE(SMBreadBmpx);
7739 return;
7740 }
7741
7742 /****************************************************************************
7743 Reply to a SMBreadbs (read block multiplex secondary) request.
7744 Always reply with an error, if someone has a platform really needs this,
7745 please contact vl@samba.org
7746 ****************************************************************************/
7747
7748 void reply_readbs(struct smb_request *req)
7749 {
7750 START_PROFILE(SMBreadBs);
7751 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7752 END_PROFILE(SMBreadBs);
7753 return;
7754 }
7755
7756 /****************************************************************************
7757 Reply to a SMBsetattrE.
7758 ****************************************************************************/
7759
7760 void reply_setattrE(struct smb_request *req)
7761 {
7762 connection_struct *conn = req->conn;
7763 struct smb_file_time ft;
7764 files_struct *fsp;
7765 NTSTATUS status;
7766
7767 START_PROFILE(SMBsetattrE);
7768 ZERO_STRUCT(ft);
7769
7770 if (req->wct < 7) {
7771 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7772 goto out;
7773 }
7774
7775 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7776
7777 if(!fsp || (fsp->conn != conn)) {
7778 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7779 goto out;
7780 }
7781
7782 /*
7783 * Convert the DOS times into unix times.
7784 */
7785
7786 ft.atime = convert_time_t_to_timespec(
7787 srv_make_unix_date2(req->vwv+3));
7788 ft.mtime = convert_time_t_to_timespec(
7789 srv_make_unix_date2(req->vwv+5));
7790 ft.create_time = convert_time_t_to_timespec(
7791 srv_make_unix_date2(req->vwv+1));
7792
7793 reply_outbuf(req, 0, 0);
7794
7795 /*
7796 * Patch from Ray Frush <frush@engr.colostate.edu>
7797 * Sometimes times are sent as zero - ignore them.
7798 */
7799
7800 /* Ensure we have a valid stat struct for the source. */
7801 status = vfs_stat_fsp(fsp);
7802 if (!NT_STATUS_IS_OK(status)) {
7803 reply_nterror(req, status);
7804 goto out;
7805 }
7806
7807 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7808 if (!NT_STATUS_IS_OK(status)) {
7809 reply_nterror(req, status);
7810 goto out;
7811 }
7812
7813 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7814 " createtime=%u\n",
7815 fsp->fnum,
7816 (unsigned int)ft.atime.tv_sec,
7817 (unsigned int)ft.mtime.tv_sec,
7818 (unsigned int)ft.create_time.tv_sec
7819 ));
7820 out:
7821 END_PROFILE(SMBsetattrE);
7822 return;
7823 }
7824
7825
7826 /* Back from the dead for OS/2..... JRA. */
7827
7828 /****************************************************************************
7829 Reply to a SMBwritebmpx (write block multiplex primary) request.
7830 Always reply with an error, if someone has a platform really needs this,
7831 please contact vl@samba.org
7832 ****************************************************************************/
7833
7834 void reply_writebmpx(struct smb_request *req)
7835 {
7836 START_PROFILE(SMBwriteBmpx);
7837 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7838 END_PROFILE(SMBwriteBmpx);
7839 return;
7840 }
7841
7842 /****************************************************************************
7843 Reply to a SMBwritebs (write block multiplex secondary) request.
7844 Always reply with an error, if someone has a platform really needs this,
7845 please contact vl@samba.org
7846 ****************************************************************************/
7847
7848 void reply_writebs(struct smb_request *req)
7849 {
7850 START_PROFILE(SMBwriteBs);
7851 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7852 END_PROFILE(SMBwriteBs);
7853 return;
7854 }
7855
7856 /****************************************************************************
7857 Reply to a SMBgetattrE.
7858 ****************************************************************************/
7859
7860 void reply_getattrE(struct smb_request *req)
7861 {
7862 connection_struct *conn = req->conn;
7863 int mode;
7864 files_struct *fsp;
7865 struct timespec create_ts;
7866
7867 START_PROFILE(SMBgetattrE);
7868
7869 if (req->wct < 1) {
7870 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7871 END_PROFILE(SMBgetattrE);
7872 return;
7873 }
7874
7875 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7876
7877 if(!fsp || (fsp->conn != conn)) {
7878 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7879 END_PROFILE(SMBgetattrE);
7880 return;
7881 }
7882
7883 /* Do an fstat on this file */
7884 if(fsp_stat(fsp)) {
7885 reply_nterror(req, map_nt_error_from_unix(errno));
7886 END_PROFILE(SMBgetattrE);
7887 return;
7888 }
7889
7890 mode = dos_mode(conn, fsp->fsp_name);
7891
7892 /*
7893 * Convert the times into dos times. Set create
7894 * date to be last modify date as UNIX doesn't save
7895 * this.
7896 */
7897
7898 reply_outbuf(req, 11, 0);
7899
7900 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7901 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7902 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7903 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7904 /* Should we check pending modtime here ? JRA */
7905 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7906 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7907
7908 if (mode & aDIR) {
7909 SIVAL(req->outbuf, smb_vwv6, 0);
7910 SIVAL(req->outbuf, smb_vwv8, 0);
7911 } else {
7912 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7913 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7914 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7915 }
7916 SSVAL(req->outbuf,smb_vwv10, mode);
7917
7918 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7919
7920 END_PROFILE(SMBgetattrE);
7921 return;
7922 }
Samba GIT mirror