?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #Bug 6090 renaming or deleting a "not matching/resolving" symlink is failing.
[Samba.git] / source / smbd / reply.c
blob8e757da7063e82678973076a96dfe15d2726d288
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28
29 /* look in server.c for some explanation of these variables */
30 extern enum protocol_types Protocol;
31 extern int max_recv;
32 extern uint32 global_client_caps;
33
34 extern bool global_encrypted_passwords_negotiated;
35
36 /****************************************************************************
37 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
38 path or anything including wildcards.
39 We're assuming here that '/' is not the second byte in any multibyte char
40 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
41 set.
42 ****************************************************************************/
43
44 /* Custom version for processing POSIX paths. */
45 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
46
47 static NTSTATUS check_path_syntax_internal(char *path,
48 bool posix_path,
49 bool *p_last_component_contains_wcard)
50 {
51 char *d = path;
52 const char *s = path;
53 NTSTATUS ret = NT_STATUS_OK;
54 bool start_of_name_component = True;
55 bool stream_started = false;
56
57 *p_last_component_contains_wcard = False;
58
59 while (*s) {
60 if (stream_started) {
61 switch (*s) {
62 case '/':
63 case '\\':
64 return NT_STATUS_OBJECT_NAME_INVALID;
65 case ':':
66 if (s[1] == '\0') {
67 return NT_STATUS_OBJECT_NAME_INVALID;
68 }
69 if (strchr_m(&s[1], ':')) {
70 return NT_STATUS_OBJECT_NAME_INVALID;
71 }
72 if (StrCaseCmp(s, ":$DATA") != 0) {
73 return NT_STATUS_INVALID_PARAMETER;
74 }
75 break;
76 }
77 }
78
79 if (!stream_started && *s == ':') {
80 if (*p_last_component_contains_wcard) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 /* stream names allow more characters than file names */
84 stream_started = true;
85 start_of_name_component = false;
86 posix_path = true;
87
88 if (s[1] == '\0') {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 }
92
93 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
94 /*
95 * Safe to assume is not the second part of a mb char
96 * as this is handled below.
97 */
98 /* Eat multiple '/' or '\\' */
99 while (IS_PATH_SEP(*s,posix_path)) {
100 s++;
101 }
102 if ((d != path) && (*s != '\0')) {
103 /* We only care about non-leading or trailing '/' or '\\' */
104 *d++ = '/';
105 }
106
107 start_of_name_component = True;
108 /* New component. */
109 *p_last_component_contains_wcard = False;
110 continue;
111 }
112
113 if (start_of_name_component) {
114 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
115 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
116
117 /*
118 * No mb char starts with '.' so we're safe checking the directory separator here.
119 */
120
121 /* If we just added a '/' - delete it */
122 if ((d > path) && (*(d-1) == '/')) {
123 *(d-1) = '\0';
124 d--;
125 }
126
127 /* Are we at the start ? Can't go back further if so. */
128 if (d <= path) {
129 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
130 break;
131 }
132 /* Go back one level... */
133 /* We know this is safe as '/' cannot be part of a mb sequence. */
134 /* NOTE - if this assumption is invalid we are not in good shape... */
135 /* Decrement d first as d points to the *next* char to write into. */
136 for (d--; d > path; d--) {
137 if (*d == '/')
138 break;
139 }
140 s += 2; /* Else go past the .. */
141 /* We're still at the start of a name component, just the previous one. */
142 continue;
143
144 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
145 if (posix_path) {
146 /* Eat the '.' */
147 s++;
148 continue;
149 }
150 }
151
152 }
153
154 if (!(*s & 0x80)) {
155 if (!posix_path) {
156 if (*s <= 0x1f || *s == '|') {
157 return NT_STATUS_OBJECT_NAME_INVALID;
158 }
159 switch (*s) {
160 case '*':
161 case '?':
162 case '<':
163 case '>':
164 case '"':
165 *p_last_component_contains_wcard = True;
166 break;
167 default:
168 break;
169 }
170 }
171 *d++ = *s++;
172 } else {
173 size_t siz;
174 /* Get the size of the next MB character. */
175 next_codepoint(s,&siz);
176 switch(siz) {
177 case 5:
178 *d++ = *s++;
179 /*fall through*/
180 case 4:
181 *d++ = *s++;
182 /*fall through*/
183 case 3:
184 *d++ = *s++;
185 /*fall through*/
186 case 2:
187 *d++ = *s++;
188 /*fall through*/
189 case 1:
190 *d++ = *s++;
191 break;
192 default:
193 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
194 *d = '\0';
195 return NT_STATUS_INVALID_PARAMETER;
196 }
197 }
198 start_of_name_component = False;
199 }
200
201 *d = '\0';
202
203 return ret;
204 }
205
206 /****************************************************************************
207 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
208 No wildcards allowed.
209 ****************************************************************************/
210
211 NTSTATUS check_path_syntax(char *path)
212 {
213 bool ignore;
214 return check_path_syntax_internal(path, False, &ignore);
215 }
216
217 /****************************************************************************
218 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
219 Wildcards allowed - p_contains_wcard returns true if the last component contained
220 a wildcard.
221 ****************************************************************************/
222
223 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
224 {
225 return check_path_syntax_internal(path, False, p_contains_wcard);
226 }
227
228 /****************************************************************************
229 Check the path for a POSIX client.
230 We're assuming here that '/' is not the second byte in any multibyte char
231 set (a safe assumption).
232 ****************************************************************************/
233
234 NTSTATUS check_path_syntax_posix(char *path)
235 {
236 bool ignore;
237 return check_path_syntax_internal(path, True, &ignore);
238 }
239
240 /****************************************************************************
241 Pull a string and check the path allowing a wilcard - provide for error return.
242 ****************************************************************************/
243
244 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
245 const char *inbuf,
246 uint16 smb_flags2,
247 char **pp_dest,
248 const char *src,
249 size_t src_len,
250 int flags,
251 NTSTATUS *err,
252 bool *contains_wcard)
253 {
254 size_t ret;
255
256 *pp_dest = NULL;
257
258 if (src_len == 0) {
259 ret = srvstr_pull_buf_talloc(ctx,
260 inbuf,
261 smb_flags2,
262 pp_dest,
263 src,
264 flags);
265 } else {
266 ret = srvstr_pull_talloc(ctx,
267 inbuf,
268 smb_flags2,
269 pp_dest,
270 src,
271 src_len,
272 flags);
273 }
274
275 if (!*pp_dest) {
276 *err = NT_STATUS_INVALID_PARAMETER;
277 return ret;
278 }
279
280 *contains_wcard = False;
281
282 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
283 /*
284 * For a DFS path the function parse_dfs_path()
285 * will do the path processing, just make a copy.
286 */
287 *err = NT_STATUS_OK;
288 return ret;
289 }
290
291 if (lp_posix_pathnames()) {
292 *err = check_path_syntax_posix(*pp_dest);
293 } else {
294 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
295 }
296
297 return ret;
298 }
299
300 /****************************************************************************
301 Pull a string and check the path - provide for error return.
302 ****************************************************************************/
303
304 size_t srvstr_get_path(TALLOC_CTX *ctx,
305 const char *inbuf,
306 uint16 smb_flags2,
307 char **pp_dest,
308 const char *src,
309 size_t src_len,
310 int flags,
311 NTSTATUS *err)
312 {
313 size_t ret;
314
315 *pp_dest = NULL;
316
317 if (src_len == 0) {
318 ret = srvstr_pull_buf_talloc(ctx,
319 inbuf,
320 smb_flags2,
321 pp_dest,
322 src,
323 flags);
324 } else {
325 ret = srvstr_pull_talloc(ctx,
326 inbuf,
327 smb_flags2,
328 pp_dest,
329 src,
330 src_len,
331 flags);
332 }
333
334 if (!*pp_dest) {
335 *err = NT_STATUS_INVALID_PARAMETER;
336 return ret;
337 }
338
339 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
340 /*
341 * For a DFS path the function parse_dfs_path()
342 * will do the path processing, just make a copy.
343 */
344 *err = NT_STATUS_OK;
345 return ret;
346 }
347
348 if (lp_posix_pathnames()) {
349 *err = check_path_syntax_posix(*pp_dest);
350 } else {
351 *err = check_path_syntax(*pp_dest);
352 }
353
354 return ret;
355 }
356
357 /****************************************************************************
358 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
359 ****************************************************************************/
360
361 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
362 files_struct *fsp)
363 {
364 if (!(fsp) || !(conn)) {
365 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
366 return False;
367 }
368 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
369 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
370 return False;
371 }
372 return True;
373 }
374
375 /****************************************************************************
376 Check if we have a correct fsp pointing to a file.
377 ****************************************************************************/
378
379 bool check_fsp(connection_struct *conn, struct smb_request *req,
380 files_struct *fsp)
381 {
382 if (!check_fsp_open(conn, req, fsp)) {
383 return False;
384 }
385 if ((fsp)->is_directory) {
386 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
387 return False;
388 }
389 if ((fsp)->fh->fd == -1) {
390 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
391 return False;
392 }
393 (fsp)->num_smb_operations++;
394 return True;
395 }
396
397 /****************************************************************************
398 Check if we have a correct fsp pointing to a quota fake file. Replacement for
399 the CHECK_NTQUOTA_HANDLE_OK macro.
400 ****************************************************************************/
401
402 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
403 files_struct *fsp)
404 {
405 if (!check_fsp_open(conn, req, fsp)) {
406 return false;
407 }
408
409 if (fsp->is_directory) {
410 return false;
411 }
412
413 if (fsp->fake_file_handle == NULL) {
414 return false;
415 }
416
417 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
418 return false;
419 }
420
421 if (fsp->fake_file_handle->private_data == NULL) {
422 return false;
423 }
424
425 return true;
426 }
427
428 /****************************************************************************
429 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
430 ****************************************************************************/
431
432 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
433 files_struct *fsp)
434 {
435 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
436 && (req->vuid == (fsp)->vuid)) {
437 return True;
438 }
439
440 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
441 return False;
442 }
443
444 /****************************************************************************
445 Reply to a (netbios-level) special message.
446 ****************************************************************************/
447
448 void reply_special(char *inbuf)
449 {
450 int msg_type = CVAL(inbuf,0);
451 int msg_flags = CVAL(inbuf,1);
452 fstring name1,name2;
453 char name_type = 0;
454
455 /*
456 * We only really use 4 bytes of the outbuf, but for the smb_setlen
457 * calculation & friends (srv_send_smb uses that) we need the full smb
458 * header.
459 */
460 char outbuf[smb_size];
461
462 static bool already_got_session = False;
463
464 *name1 = *name2 = 0;
465
466 memset(outbuf, '\0', sizeof(outbuf));
467
468 smb_setlen(outbuf,0);
469
470 switch (msg_type) {
471 case 0x81: /* session request */
472
473 if (already_got_session) {
474 exit_server_cleanly("multiple session request not permitted");
475 }
476
477 SCVAL(outbuf,0,0x82);
478 SCVAL(outbuf,3,0);
479 if (name_len(inbuf+4) > 50 ||
480 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
481 DEBUG(0,("Invalid name length in session request\n"));
482 return;
483 }
484 name_extract(inbuf,4,name1);
485 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
486 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
487 name1,name2));
488
489 set_local_machine_name(name1, True);
490 set_remote_machine_name(name2, True);
491
492 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
493 get_local_machine_name(), get_remote_machine_name(),
494 name_type));
495
496 if (name_type == 'R') {
497 /* We are being asked for a pathworks session ---
498 no thanks! */
499 SCVAL(outbuf, 0,0x83);
500 break;
501 }
502
503 /* only add the client's machine name to the list
504 of possibly valid usernames if we are operating
505 in share mode security */
506 if (lp_security() == SEC_SHARE) {
507 add_session_user(get_remote_machine_name());
508 }
509
510 reload_services(True);
511 reopen_logs();
512
513 already_got_session = True;
514 break;
515
516 case 0x89: /* session keepalive request
517 (some old clients produce this?) */
518 SCVAL(outbuf,0,SMBkeepalive);
519 SCVAL(outbuf,3,0);
520 break;
521
522 case 0x82: /* positive session response */
523 case 0x83: /* negative session response */
524 case 0x84: /* retarget session response */
525 DEBUG(0,("Unexpected session response\n"));
526 break;
527
528 case SMBkeepalive: /* session keepalive */
529 default:
530 return;
531 }
532
533 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
534 msg_type, msg_flags));
535
536 srv_send_smb(smbd_server_fd(), outbuf, false);
537 return;
538 }
539
540 /****************************************************************************
541 Reply to a tcon.
542 conn POINTER CAN BE NULL HERE !
543 ****************************************************************************/
544
545 void reply_tcon(struct smb_request *req)
546 {
547 connection_struct *conn = req->conn;
548 const char *service;
549 char *service_buf = NULL;
550 char *password = NULL;
551 char *dev = NULL;
552 int pwlen=0;
553 NTSTATUS nt_status;
554 char *p;
555 DATA_BLOB password_blob;
556 TALLOC_CTX *ctx = talloc_tos();
557
558 START_PROFILE(SMBtcon);
559
560 if (smb_buflen(req->inbuf) < 4) {
561 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
562 END_PROFILE(SMBtcon);
563 return;
564 }
565
566 p = smb_buf(req->inbuf)+1;
567 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
568 &service_buf, p, STR_TERMINATE) + 1;
569 pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
570 &password, p, STR_TERMINATE) + 1;
571 p += pwlen;
572 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
573 &dev, p, STR_TERMINATE) + 1;
574
575 if (service_buf == NULL || password == NULL || dev == NULL) {
576 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
577 END_PROFILE(SMBtcon);
578 return;
579 }
580 p = strrchr_m(service_buf,'\\');
581 if (p) {
582 service = p+1;
583 } else {
584 service = service_buf;
585 }
586
587 password_blob = data_blob(password, pwlen+1);
588
589 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
590 req->conn = conn;
591
592 data_blob_clear_free(&password_blob);
593
594 if (!conn) {
595 reply_nterror(req, nt_status);
596 END_PROFILE(SMBtcon);
597 return;
598 }
599
600 reply_outbuf(req, 2, 0);
601 SSVAL(req->outbuf,smb_vwv0,max_recv);
602 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
603 SSVAL(req->outbuf,smb_tid,conn->cnum);
604
605 DEBUG(3,("tcon service=%s cnum=%d\n",
606 service, conn->cnum));
607
608 END_PROFILE(SMBtcon);
609 return;
610 }
611
612 /****************************************************************************
613 Reply to a tcon and X.
614 conn POINTER CAN BE NULL HERE !
615 ****************************************************************************/
616
617 void reply_tcon_and_X(struct smb_request *req)
618 {
619 connection_struct *conn = req->conn;
620 char *service = NULL;
621 DATA_BLOB password;
622 TALLOC_CTX *ctx = talloc_tos();
623 /* what the cleint thinks the device is */
624 char *client_devicetype = NULL;
625 /* what the server tells the client the share represents */
626 const char *server_devicetype;
627 NTSTATUS nt_status;
628 int passlen;
629 char *path = NULL;
630 char *p, *q;
631 uint16 tcon_flags;
632
633 START_PROFILE(SMBtconX);
634
635 if (req->wct < 4) {
636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
637 END_PROFILE(SMBtconX);
638 return;
639 }
640
641 passlen = SVAL(req->inbuf,smb_vwv3);
642 tcon_flags = SVAL(req->inbuf,smb_vwv2);
643
644 /* we might have to close an old one */
645 if ((tcon_flags & 0x1) && conn) {
646 close_cnum(conn,req->vuid);
647 req->conn = NULL;
648 conn = NULL;
649 }
650
651 if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
652 reply_doserror(req, ERRDOS, ERRbuftoosmall);
653 END_PROFILE(SMBtconX);
654 return;
655 }
656
657 if (global_encrypted_passwords_negotiated) {
658 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
659 passlen);
660 if (lp_security() == SEC_SHARE) {
661 /*
662 * Security = share always has a pad byte
663 * after the password.
664 */
665 p = smb_buf(req->inbuf) + passlen + 1;
666 } else {
667 p = smb_buf(req->inbuf) + passlen;
668 }
669 } else {
670 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
671 passlen+1);
672 /* Ensure correct termination */
673 password.data[passlen]=0;
674 p = smb_buf(req->inbuf) + passlen + 1;
675 }
676
677 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
678 STR_TERMINATE);
679
680 if (path == NULL) {
681 data_blob_clear_free(&password);
682 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
683 END_PROFILE(SMBtconX);
684 return;
685 }
686
687 /*
688 * the service name can be either: \\server\share
689 * or share directly like on the DELL PowerVault 705
690 */
691 if (*path=='\\') {
692 q = strchr_m(path+2,'\\');
693 if (!q) {
694 data_blob_clear_free(&password);
695 reply_doserror(req, ERRDOS, ERRnosuchshare);
696 END_PROFILE(SMBtconX);
697 return;
698 }
699 service = q+1;
700 } else {
701 service = path;
702 }
703
704 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
705 &client_devicetype, p,
706 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
707
708 if (client_devicetype == NULL) {
709 data_blob_clear_free(&password);
710 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
711 END_PROFILE(SMBtconX);
712 return;
713 }
714
715 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
716
717 conn = make_connection(service, password, client_devicetype,
718 req->vuid, &nt_status);
719 req->conn =conn;
720
721 data_blob_clear_free(&password);
722
723 if (!conn) {
724 reply_nterror(req, nt_status);
725 END_PROFILE(SMBtconX);
726 return;
727 }
728
729 if ( IS_IPC(conn) )
730 server_devicetype = "IPC";
731 else if ( IS_PRINT(conn) )
732 server_devicetype = "LPT1:";
733 else
734 server_devicetype = "A:";
735
736 if (Protocol < PROTOCOL_NT1) {
737 reply_outbuf(req, 2, 0);
738 if (message_push_string(&req->outbuf, server_devicetype,
739 STR_TERMINATE|STR_ASCII) == -1) {
740 reply_nterror(req, NT_STATUS_NO_MEMORY);
741 END_PROFILE(SMBtconX);
742 return;
743 }
744 } else {
745 /* NT sets the fstype of IPC$ to the null string */
746 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
747
748 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
749 /* Return permissions. */
750 uint32 perm1 = 0;
751 uint32 perm2 = 0;
752
753 reply_outbuf(req, 7, 0);
754
755 if (IS_IPC(conn)) {
756 perm1 = FILE_ALL_ACCESS;
757 perm2 = FILE_ALL_ACCESS;
758 } else {
759 perm1 = CAN_WRITE(conn) ?
760 SHARE_ALL_ACCESS :
761 SHARE_READ_ONLY;
762 }
763
764 SIVAL(req->outbuf, smb_vwv3, perm1);
765 SIVAL(req->outbuf, smb_vwv5, perm2);
766 } else {
767 reply_outbuf(req, 3, 0);
768 }
769
770 if ((message_push_string(&req->outbuf, server_devicetype,
771 STR_TERMINATE|STR_ASCII) == -1)
772 || (message_push_string(&req->outbuf, fstype,
773 STR_TERMINATE) == -1)) {
774 reply_nterror(req, NT_STATUS_NO_MEMORY);
775 END_PROFILE(SMBtconX);
776 return;
777 }
778
779 /* what does setting this bit do? It is set by NT4 and
780 may affect the ability to autorun mounted cdroms */
781 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
782 (lp_csc_policy(SNUM(conn)) << 2));
783
784 init_dfsroot(conn, req->inbuf, req->outbuf);
785 }
786
787
788 DEBUG(3,("tconX service=%s \n",
789 service));
790
791 /* set the incoming and outgoing tid to the just created one */
792 SSVAL(req->inbuf,smb_tid,conn->cnum);
793 SSVAL(req->outbuf,smb_tid,conn->cnum);
794
795 END_PROFILE(SMBtconX);
796
797 chain_reply(req);
798 return;
799 }
800
801 /****************************************************************************
802 Reply to an unknown type.
803 ****************************************************************************/
804
805 void reply_unknown_new(struct smb_request *req, uint8 type)
806 {
807 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
808 smb_fn_name(type), type, type));
809 reply_doserror(req, ERRSRV, ERRunknownsmb);
810 return;
811 }
812
813 /****************************************************************************
814 Reply to an ioctl.
815 conn POINTER CAN BE NULL HERE !
816 ****************************************************************************/
817
818 void reply_ioctl(struct smb_request *req)
819 {
820 connection_struct *conn = req->conn;
821 uint16 device;
822 uint16 function;
823 uint32 ioctl_code;
824 int replysize;
825 char *p;
826
827 START_PROFILE(SMBioctl);
828
829 if (req->wct < 3) {
830 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
831 END_PROFILE(SMBioctl);
832 return;
833 }
834
835 device = SVAL(req->inbuf,smb_vwv1);
836 function = SVAL(req->inbuf,smb_vwv2);
837 ioctl_code = (device << 16) + function;
838
839 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
840
841 switch (ioctl_code) {
842 case IOCTL_QUERY_JOB_INFO:
843 replysize = 32;
844 break;
845 default:
846 reply_doserror(req, ERRSRV, ERRnosupport);
847 END_PROFILE(SMBioctl);
848 return;
849 }
850
851 reply_outbuf(req, 8, replysize+1);
852 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
853 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
854 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
855 p = smb_buf(req->outbuf);
856 memset(p, '\0', replysize+1); /* valgrind-safe. */
857 p += 1; /* Allow for alignment */
858
859 switch (ioctl_code) {
860 case IOCTL_QUERY_JOB_INFO:
861 {
862 files_struct *fsp = file_fsp(SVAL(req->inbuf,
863 smb_vwv0));
864 if (!fsp) {
865 reply_doserror(req, ERRDOS, ERRbadfid);
866 END_PROFILE(SMBioctl);
867 return;
868 }
869 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
870 srvstr_push((char *)req->outbuf, req->flags2, p+2,
871 global_myname(), 15,
872 STR_TERMINATE|STR_ASCII);
873 if (conn) {
874 srvstr_push((char *)req->outbuf, req->flags2,
875 p+18, lp_servicename(SNUM(conn)),
876 13, STR_TERMINATE|STR_ASCII);
877 } else {
878 memset(p+18, 0, 13);
879 }
880 break;
881 }
882 }
883
884 END_PROFILE(SMBioctl);
885 return;
886 }
887
888 /****************************************************************************
889 Strange checkpath NTSTATUS mapping.
890 ****************************************************************************/
891
892 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
893 {
894 /* Strange DOS error code semantics only for checkpath... */
895 if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
896 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
897 /* We need to map to ERRbadpath */
898 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
899 }
900 }
901 return status;
902 }
903
904 /****************************************************************************
905 Reply to a checkpath.
906 ****************************************************************************/
907
908 void reply_checkpath(struct smb_request *req)
909 {
910 connection_struct *conn = req->conn;
911 char *name = NULL;
912 SMB_STRUCT_STAT sbuf;
913 NTSTATUS status;
914 TALLOC_CTX *ctx = talloc_tos();
915
916 START_PROFILE(SMBcheckpath);
917
918 srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
919 smb_buf(req->inbuf) + 1, 0,
920 STR_TERMINATE, &status);
921 if (!NT_STATUS_IS_OK(status)) {
922 status = map_checkpath_error((char *)req->inbuf, status);
923 reply_nterror(req, status);
924 END_PROFILE(SMBcheckpath);
925 return;
926 }
927
928 status = resolve_dfspath(ctx, conn,
929 req->flags2 & FLAGS2_DFS_PATHNAMES,
930 name,
931 &name);
932 if (!NT_STATUS_IS_OK(status)) {
933 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
934 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
935 ERRSRV, ERRbadpath);
936 END_PROFILE(SMBcheckpath);
937 return;
938 }
939 goto path_err;
940 }
941
942 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
943
944 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
945 if (!NT_STATUS_IS_OK(status)) {
946 goto path_err;
947 }
948
949 status = check_name(conn, name);
950 if (!NT_STATUS_IS_OK(status)) {
951 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
952 goto path_err;
953 }
954
955 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
956 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
957 status = map_nt_error_from_unix(errno);
958 goto path_err;
959 }
960
961 if (!S_ISDIR(sbuf.st_mode)) {
962 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
963 ERRDOS, ERRbadpath);
964 END_PROFILE(SMBcheckpath);
965 return;
966 }
967
968 reply_outbuf(req, 0, 0);
969
970 END_PROFILE(SMBcheckpath);
971 return;
972
973 path_err:
974
975 END_PROFILE(SMBcheckpath);
976
977 /* We special case this - as when a Windows machine
978 is parsing a path is steps through the components
979 one at a time - if a component fails it expects
980 ERRbadpath, not ERRbadfile.
981 */
982 status = map_checkpath_error((char *)req->inbuf, status);
983 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
984 /*
985 * Windows returns different error codes if
986 * the parent directory is valid but not the
987 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
988 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
989 * if the path is invalid.
990 */
991 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
992 ERRDOS, ERRbadpath);
993 return;
994 }
995
996 reply_nterror(req, status);
997 }
998
999 /****************************************************************************
1000 Reply to a getatr.
1001 ****************************************************************************/
1002
1003 void reply_getatr(struct smb_request *req)
1004 {
1005 connection_struct *conn = req->conn;
1006 char *fname = NULL;
1007 SMB_STRUCT_STAT sbuf;
1008 int mode=0;
1009 SMB_OFF_T size=0;
1010 time_t mtime=0;
1011 char *p;
1012 NTSTATUS status;
1013 TALLOC_CTX *ctx = talloc_tos();
1014
1015 START_PROFILE(SMBgetatr);
1016
1017 p = smb_buf(req->inbuf) + 1;
1018 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1019 0, STR_TERMINATE, &status);
1020 if (!NT_STATUS_IS_OK(status)) {
1021 reply_nterror(req, status);
1022 END_PROFILE(SMBgetatr);
1023 return;
1024 }
1025
1026 status = resolve_dfspath(ctx, conn,
1027 req->flags2 & FLAGS2_DFS_PATHNAMES,
1028 fname,
1029 &fname);
1030 if (!NT_STATUS_IS_OK(status)) {
1031 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1032 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1033 ERRSRV, ERRbadpath);
1034 END_PROFILE(SMBgetatr);
1035 return;
1036 }
1037 reply_nterror(req, status);
1038 END_PROFILE(SMBgetatr);
1039 return;
1040 }
1041
1042 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1043 under WfWg - weird! */
1044 if (*fname == '\0') {
1045 mode = aHIDDEN | aDIR;
1046 if (!CAN_WRITE(conn)) {
1047 mode |= aRONLY;
1048 }
1049 size = 0;
1050 mtime = 0;
1051 } else {
1052 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1053 if (!NT_STATUS_IS_OK(status)) {
1054 reply_nterror(req, status);
1055 END_PROFILE(SMBgetatr);
1056 return;
1057 }
1058 status = check_name(conn, fname);
1059 if (!NT_STATUS_IS_OK(status)) {
1060 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1061 reply_nterror(req, status);
1062 END_PROFILE(SMBgetatr);
1063 return;
1064 }
1065 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1066 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1067 reply_unixerror(req, ERRDOS,ERRbadfile);
1068 END_PROFILE(SMBgetatr);
1069 return;
1070 }
1071
1072 mode = dos_mode(conn,fname,&sbuf);
1073 size = sbuf.st_size;
1074 mtime = sbuf.st_mtime;
1075 if (mode & aDIR) {
1076 size = 0;
1077 }
1078 }
1079
1080 reply_outbuf(req, 10, 0);
1081
1082 SSVAL(req->outbuf,smb_vwv0,mode);
1083 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1084 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1085 } else {
1086 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1087 }
1088 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1089
1090 if (Protocol >= PROTOCOL_NT1) {
1091 SSVAL(req->outbuf, smb_flg2,
1092 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1093 }
1094
1095 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1096
1097 END_PROFILE(SMBgetatr);
1098 return;
1099 }
1100
1101 /****************************************************************************
1102 Reply to a setatr.
1103 ****************************************************************************/
1104
1105 void reply_setatr(struct smb_request *req)
1106 {
1107 struct timespec ts[2];
1108 connection_struct *conn = req->conn;
1109 char *fname = NULL;
1110 int mode;
1111 time_t mtime;
1112 SMB_STRUCT_STAT sbuf;
1113 char *p;
1114 NTSTATUS status;
1115 TALLOC_CTX *ctx = talloc_tos();
1116
1117 START_PROFILE(SMBsetatr);
1118
1119 ZERO_STRUCT(ts);
1120
1121 if (req->wct < 2) {
1122 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1123 return;
1124 }
1125
1126 p = smb_buf(req->inbuf) + 1;
1127 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1128 0, STR_TERMINATE, &status);
1129 if (!NT_STATUS_IS_OK(status)) {
1130 reply_nterror(req, status);
1131 END_PROFILE(SMBsetatr);
1132 return;
1133 }
1134
1135 status = resolve_dfspath(ctx, conn,
1136 req->flags2 & FLAGS2_DFS_PATHNAMES,
1137 fname,
1138 &fname);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1141 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1142 ERRSRV, ERRbadpath);
1143 END_PROFILE(SMBsetatr);
1144 return;
1145 }
1146 reply_nterror(req, status);
1147 END_PROFILE(SMBsetatr);
1148 return;
1149 }
1150
1151 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1152 if (!NT_STATUS_IS_OK(status)) {
1153 reply_nterror(req, status);
1154 END_PROFILE(SMBsetatr);
1155 return;
1156 }
1157
1158 status = check_name(conn, fname);
1159 if (!NT_STATUS_IS_OK(status)) {
1160 reply_nterror(req, status);
1161 END_PROFILE(SMBsetatr);
1162 return;
1163 }
1164
1165 if (fname[0] == '.' && fname[1] == '\0') {
1166 /*
1167 * Not sure here is the right place to catch this
1168 * condition. Might be moved to somewhere else later -- vl
1169 */
1170 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1171 END_PROFILE(SMBsetatr);
1172 return;
1173 }
1174
1175 mode = SVAL(req->inbuf,smb_vwv0);
1176 mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1177
1178 ts[1] = convert_time_t_to_timespec(mtime);
1179 status = smb_set_file_time(conn, NULL, fname,
1180 &sbuf, ts, true);
1181 if (!NT_STATUS_IS_OK(status)) {
1182 reply_unixerror(req, ERRDOS, ERRnoaccess);
1183 END_PROFILE(SMBsetatr);
1184 return;
1185 }
1186
1187 if (mode != FILE_ATTRIBUTE_NORMAL) {
1188 if (VALID_STAT_OF_DIR(sbuf))
1189 mode |= aDIR;
1190 else
1191 mode &= ~aDIR;
1192
1193 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1194 reply_unixerror(req, ERRDOS, ERRnoaccess);
1195 END_PROFILE(SMBsetatr);
1196 return;
1197 }
1198 }
1199
1200 reply_outbuf(req, 0, 0);
1201
1202 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1203
1204 END_PROFILE(SMBsetatr);
1205 return;
1206 }
1207
1208 /****************************************************************************
1209 Reply to a dskattr.
1210 ****************************************************************************/
1211
1212 void reply_dskattr(struct smb_request *req)
1213 {
1214 connection_struct *conn = req->conn;
1215 SMB_BIG_UINT dfree,dsize,bsize;
1216 START_PROFILE(SMBdskattr);
1217
1218 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
1219 reply_unixerror(req, ERRHRD, ERRgeneral);
1220 END_PROFILE(SMBdskattr);
1221 return;
1222 }
1223
1224 reply_outbuf(req, 5, 0);
1225
1226 if (Protocol <= PROTOCOL_LANMAN2) {
1227 double total_space, free_space;
1228 /* we need to scale this to a number that DOS6 can handle. We
1229 use floating point so we can handle large drives on systems
1230 that don't have 64 bit integers
1231
1232 we end up displaying a maximum of 2G to DOS systems
1233 */
1234 total_space = dsize * (double)bsize;
1235 free_space = dfree * (double)bsize;
1236
1237 dsize = (SMB_BIG_UINT)((total_space+63*512) / (64*512));
1238 dfree = (SMB_BIG_UINT)((free_space+63*512) / (64*512));
1239
1240 if (dsize > 0xFFFF) dsize = 0xFFFF;
1241 if (dfree > 0xFFFF) dfree = 0xFFFF;
1242
1243 SSVAL(req->outbuf,smb_vwv0,dsize);
1244 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1245 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1246 SSVAL(req->outbuf,smb_vwv3,dfree);
1247 } else {
1248 SSVAL(req->outbuf,smb_vwv0,dsize);
1249 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1250 SSVAL(req->outbuf,smb_vwv2,512);
1251 SSVAL(req->outbuf,smb_vwv3,dfree);
1252 }
1253
1254 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1255
1256 END_PROFILE(SMBdskattr);
1257 return;
1258 }
1259
1260 /****************************************************************************
1261 Reply to a search.
1262 Can be called from SMBsearch, SMBffirst or SMBfunique.
1263 ****************************************************************************/
1264
1265 void reply_search(struct smb_request *req)
1266 {
1267 connection_struct *conn = req->conn;
1268 char *mask = NULL;
1269 char *directory = NULL;
1270 char *fname = NULL;
1271 SMB_OFF_T size;
1272 uint32 mode;
1273 time_t date;
1274 uint32 dirtype;
1275 unsigned int numentries = 0;
1276 unsigned int maxentries = 0;
1277 bool finished = False;
1278 char *p;
1279 int status_len;
1280 char *path = NULL;
1281 char status[21];
1282 int dptr_num= -1;
1283 bool check_descend = False;
1284 bool expect_close = False;
1285 NTSTATUS nt_status;
1286 bool mask_contains_wcard = False;
1287 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1288 TALLOC_CTX *ctx = talloc_tos();
1289 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1290
1291 START_PROFILE(SMBsearch);
1292
1293 if (req->wct < 2) {
1294 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1295 END_PROFILE(SMBsearch);
1296 return;
1297 }
1298
1299 if (lp_posix_pathnames()) {
1300 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1301 END_PROFILE(SMBsearch);
1302 return;
1303 }
1304
1305 /* If we were called as SMBffirst then we must expect close. */
1306 if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1307 expect_close = True;
1308 }
1309
1310 reply_outbuf(req, 1, 3);
1311 maxentries = SVAL(req->inbuf,smb_vwv0);
1312 dirtype = SVAL(req->inbuf,smb_vwv1);
1313 p = smb_buf(req->inbuf) + 1;
1314 p += srvstr_get_path_wcard(ctx,
1315 (char *)req->inbuf,
1316 req->flags2,
1317 &path,
1318 p,
1319 0,
1320 STR_TERMINATE,
1321 &nt_status,
1322 &mask_contains_wcard);
1323 if (!NT_STATUS_IS_OK(nt_status)) {
1324 reply_nterror(req, nt_status);
1325 END_PROFILE(SMBsearch);
1326 return;
1327 }
1328
1329 nt_status = resolve_dfspath_wcard(ctx, conn,
1330 req->flags2 & FLAGS2_DFS_PATHNAMES,
1331 path,
1332 &path,
1333 &mask_contains_wcard);
1334 if (!NT_STATUS_IS_OK(nt_status)) {
1335 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1336 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1337 ERRSRV, ERRbadpath);
1338 END_PROFILE(SMBsearch);
1339 return;
1340 }
1341 reply_nterror(req, nt_status);
1342 END_PROFILE(SMBsearch);
1343 return;
1344 }
1345
1346 p++;
1347 status_len = SVAL(p, 0);
1348 p += 2;
1349
1350 /* dirtype &= ~aDIR; */
1351
1352 if (status_len == 0) {
1353 SMB_STRUCT_STAT sbuf;
1354
1355 nt_status = unix_convert(ctx, conn, path, True,
1356 &directory, NULL, &sbuf);
1357 if (!NT_STATUS_IS_OK(nt_status)) {
1358 reply_nterror(req, nt_status);
1359 END_PROFILE(SMBsearch);
1360 return;
1361 }
1362
1363 nt_status = check_name(conn, directory);
1364 if (!NT_STATUS_IS_OK(nt_status)) {
1365 reply_nterror(req, nt_status);
1366 END_PROFILE(SMBsearch);
1367 return;
1368 }
1369
1370 p = strrchr_m(directory,'/');
1371 if (!p) {
1372 mask = directory;
1373 directory = talloc_strdup(ctx,".");
1374 if (!directory) {
1375 reply_nterror(req, NT_STATUS_NO_MEMORY);
1376 END_PROFILE(SMBsearch);
1377 return;
1378 }
1379 } else {
1380 *p = 0;
1381 mask = p+1;
1382 }
1383
1384 if (*directory == '\0') {
1385 directory = talloc_strdup(ctx,".");
1386 if (!directory) {
1387 reply_nterror(req, NT_STATUS_NO_MEMORY);
1388 END_PROFILE(SMBsearch);
1389 return;
1390 }
1391 }
1392 memset((char *)status,'\0',21);
1393 SCVAL(status,0,(dirtype & 0x1F));
1394
1395 nt_status = dptr_create(conn,
1396 directory,
1397 True,
1398 expect_close,
1399 req->smbpid,
1400 mask,
1401 mask_contains_wcard,
1402 dirtype,
1403 &conn->dirptr);
1404 if (!NT_STATUS_IS_OK(nt_status)) {
1405 reply_nterror(req, nt_status);
1406 END_PROFILE(SMBsearch);
1407 return;
1408 }
1409 dptr_num = dptr_dnum(conn->dirptr);
1410 } else {
1411 int status_dirtype;
1412
1413 memcpy(status,p,21);
1414 status_dirtype = CVAL(status,0) & 0x1F;
1415 if (status_dirtype != (dirtype & 0x1F)) {
1416 dirtype = status_dirtype;
1417 }
1418
1419 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1420 if (!conn->dirptr) {
1421 goto SearchEmpty;
1422 }
1423 string_set(&conn->dirpath,dptr_path(dptr_num));
1424 mask = dptr_wcard(dptr_num);
1425 if (!mask) {
1426 goto SearchEmpty;
1427 }
1428 /*
1429 * For a 'continue' search we have no string. So
1430 * check from the initial saved string.
1431 */
1432 mask_contains_wcard = ms_has_wild(mask);
1433 dirtype = dptr_attr(dptr_num);
1434 }
1435
1436 DEBUG(4,("dptr_num is %d\n",dptr_num));
1437
1438 if ((dirtype&0x1F) == aVOLID) {
1439 char buf[DIR_STRUCT_SIZE];
1440 memcpy(buf,status,21);
1441 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1442 0,aVOLID,0,!allow_long_path_components)) {
1443 reply_nterror(req, NT_STATUS_NO_MEMORY);
1444 END_PROFILE(SMBsearch);
1445 return;
1446 }
1447 dptr_fill(buf+12,dptr_num);
1448 if (dptr_zero(buf+12) && (status_len==0)) {
1449 numentries = 1;
1450 } else {
1451 numentries = 0;
1452 }
1453 if (message_push_blob(&req->outbuf,
1454 data_blob_const(buf, sizeof(buf)))
1455 == -1) {
1456 reply_nterror(req, NT_STATUS_NO_MEMORY);
1457 END_PROFILE(SMBsearch);
1458 return;
1459 }
1460 } else {
1461 unsigned int i;
1462 maxentries = MIN(
1463 maxentries,
1464 ((BUFFER_SIZE -
1465 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1466 /DIR_STRUCT_SIZE));
1467
1468 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1469 conn->dirpath,lp_dontdescend(SNUM(conn))));
1470 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1471 check_descend = True;
1472 }
1473
1474 for (i=numentries;(i<maxentries) && !finished;i++) {
1475 finished = !get_dir_entry(ctx,
1476 conn,
1477 mask,
1478 dirtype,
1479 &fname,
1480 &size,
1481 &mode,
1482 &date,
1483 check_descend,
1484 ask_sharemode);
1485 if (!finished) {
1486 char buf[DIR_STRUCT_SIZE];
1487 memcpy(buf,status,21);
1488 if (!make_dir_struct(ctx,
1489 buf,
1490 mask,
1491 fname,
1492 size,
1493 mode,
1494 date,
1495 !allow_long_path_components)) {
1496 reply_nterror(req, NT_STATUS_NO_MEMORY);
1497 END_PROFILE(SMBsearch);
1498 return;
1499 }
1500 if (!dptr_fill(buf+12,dptr_num)) {
1501 break;
1502 }
1503 if (message_push_blob(&req->outbuf,
1504 data_blob_const(buf, sizeof(buf)))
1505 == -1) {
1506 reply_nterror(req, NT_STATUS_NO_MEMORY);
1507 END_PROFILE(SMBsearch);
1508 return;
1509 }
1510 numentries++;
1511 }
1512 }
1513 }
1514
1515 SearchEmpty:
1516
1517 /* If we were called as SMBffirst with smb_search_id == NULL
1518 and no entries were found then return error and close dirptr
1519 (X/Open spec) */
1520
1521 if (numentries == 0) {
1522 dptr_close(&dptr_num);
1523 } else if(expect_close && status_len == 0) {
1524 /* Close the dptr - we know it's gone */
1525 dptr_close(&dptr_num);
1526 }
1527
1528 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1529 if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1530 dptr_close(&dptr_num);
1531 }
1532
1533 if ((numentries == 0) && !mask_contains_wcard) {
1534 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1535 END_PROFILE(SMBsearch);
1536 return;
1537 }
1538
1539 SSVAL(req->outbuf,smb_vwv0,numentries);
1540 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1541 SCVAL(smb_buf(req->outbuf),0,5);
1542 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1543
1544 /* The replies here are never long name. */
1545 SSVAL(req->outbuf, smb_flg2,
1546 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1547 if (!allow_long_path_components) {
1548 SSVAL(req->outbuf, smb_flg2,
1549 SVAL(req->outbuf, smb_flg2)
1550 & (~FLAGS2_LONG_PATH_COMPONENTS));
1551 }
1552
1553 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1554 SSVAL(req->outbuf, smb_flg2,
1555 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1556
1557 if (!directory) {
1558 directory = dptr_path(dptr_num);
1559 }
1560
1561 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1562 smb_fn_name(CVAL(req->inbuf,smb_com)),
1563 mask,
1564 directory ? directory : "./",
1565 dirtype,
1566 numentries,
1567 maxentries ));
1568
1569 END_PROFILE(SMBsearch);
1570 return;
1571 }
1572
1573 /****************************************************************************
1574 Reply to a fclose (stop directory search).
1575 ****************************************************************************/
1576
1577 void reply_fclose(struct smb_request *req)
1578 {
1579 int status_len;
1580 char status[21];
1581 int dptr_num= -2;
1582 char *p;
1583 char *path = NULL;
1584 NTSTATUS err;
1585 bool path_contains_wcard = False;
1586 TALLOC_CTX *ctx = talloc_tos();
1587
1588 START_PROFILE(SMBfclose);
1589
1590 if (lp_posix_pathnames()) {
1591 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1592 END_PROFILE(SMBfclose);
1593 return;
1594 }
1595
1596 p = smb_buf(req->inbuf) + 1;
1597 p += srvstr_get_path_wcard(ctx,
1598 (char *)req->inbuf,
1599 req->flags2,
1600 &path,
1601 p,
1602 0,
1603 STR_TERMINATE,
1604 &err,
1605 &path_contains_wcard);
1606 if (!NT_STATUS_IS_OK(err)) {
1607 reply_nterror(req, err);
1608 END_PROFILE(SMBfclose);
1609 return;
1610 }
1611 p++;
1612 status_len = SVAL(p,0);
1613 p += 2;
1614
1615 if (status_len == 0) {
1616 reply_doserror(req, ERRSRV, ERRsrverror);
1617 END_PROFILE(SMBfclose);
1618 return;
1619 }
1620
1621 memcpy(status,p,21);
1622
1623 if(dptr_fetch(status+12,&dptr_num)) {
1624 /* Close the dptr - we know it's gone */
1625 dptr_close(&dptr_num);
1626 }
1627
1628 reply_outbuf(req, 1, 0);
1629 SSVAL(req->outbuf,smb_vwv0,0);
1630
1631 DEBUG(3,("search close\n"));
1632
1633 END_PROFILE(SMBfclose);
1634 return;
1635 }
1636
1637 /****************************************************************************
1638 Reply to an open.
1639 ****************************************************************************/
1640
1641 void reply_open(struct smb_request *req)
1642 {
1643 connection_struct *conn = req->conn;
1644 char *fname = NULL;
1645 uint32 fattr=0;
1646 SMB_OFF_T size = 0;
1647 time_t mtime=0;
1648 int info;
1649 SMB_STRUCT_STAT sbuf;
1650 files_struct *fsp;
1651 int oplock_request;
1652 int deny_mode;
1653 uint32 dos_attr;
1654 uint32 access_mask;
1655 uint32 share_mode;
1656 uint32 create_disposition;
1657 uint32 create_options = 0;
1658 NTSTATUS status;
1659 TALLOC_CTX *ctx = talloc_tos();
1660
1661 START_PROFILE(SMBopen);
1662
1663 if (req->wct < 2) {
1664 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1665 END_PROFILE(SMBopen);
1666 return;
1667 }
1668
1669 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1670 deny_mode = SVAL(req->inbuf,smb_vwv0);
1671 dos_attr = SVAL(req->inbuf,smb_vwv1);
1672
1673 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1674 smb_buf(req->inbuf)+1, 0,
1675 STR_TERMINATE, &status);
1676 if (!NT_STATUS_IS_OK(status)) {
1677 reply_nterror(req, status);
1678 END_PROFILE(SMBopen);
1679 return;
1680 }
1681
1682 if (!map_open_params_to_ntcreate(
1683 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1684 &share_mode, &create_disposition, &create_options)) {
1685 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1686 END_PROFILE(SMBopen);
1687 return;
1688 }
1689
1690 status = create_file(conn, /* conn */
1691 req, /* req */
1692 0, /* root_dir_fid */
1693 fname, /* fname */
1694 access_mask, /* access_mask */
1695 share_mode, /* share_access */
1696 create_disposition, /* create_disposition*/
1697 create_options, /* create_options */
1698 dos_attr, /* file_attributes */
1699 oplock_request, /* oplock_request */
1700 0, /* allocation_size */
1701 NULL, /* sd */
1702 NULL, /* ea_list */
1703 &fsp, /* result */
1704 &info, /* pinfo */
1705 &sbuf); /* psbuf */
1706
1707 if (!NT_STATUS_IS_OK(status)) {
1708 if (open_was_deferred(req->mid)) {
1709 /* We have re-scheduled this call. */
1710 END_PROFILE(SMBopen);
1711 return;
1712 }
1713 reply_openerror(req, status);
1714 END_PROFILE(SMBopen);
1715 return;
1716 }
1717
1718 size = sbuf.st_size;
1719 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1720 mtime = sbuf.st_mtime;
1721
1722 if (fattr & aDIR) {
1723 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1724 close_file(fsp,ERROR_CLOSE);
1725 reply_doserror(req, ERRDOS,ERRnoaccess);
1726 END_PROFILE(SMBopen);
1727 return;
1728 }
1729
1730 reply_outbuf(req, 7, 0);
1731 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1732 SSVAL(req->outbuf,smb_vwv1,fattr);
1733 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1734 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1735 } else {
1736 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1737 }
1738 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1739 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1740
1741 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1742 SCVAL(req->outbuf,smb_flg,
1743 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1744 }
1745
1746 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1747 SCVAL(req->outbuf,smb_flg,
1748 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1749 }
1750 END_PROFILE(SMBopen);
1751 return;
1752 }
1753
1754 /****************************************************************************
1755 Reply to an open and X.
1756 ****************************************************************************/
1757
1758 void reply_open_and_X(struct smb_request *req)
1759 {
1760 connection_struct *conn = req->conn;
1761 char *fname = NULL;
1762 uint16 open_flags;
1763 int deny_mode;
1764 uint32 smb_attr;
1765 /* Breakout the oplock request bits so we can set the
1766 reply bits separately. */
1767 int ex_oplock_request;
1768 int core_oplock_request;
1769 int oplock_request;
1770 #if 0
1771 int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1772 uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1773 #endif
1774 int smb_ofun;
1775 uint32 fattr=0;
1776 int mtime=0;
1777 SMB_STRUCT_STAT sbuf;
1778 int smb_action = 0;
1779 files_struct *fsp;
1780 NTSTATUS status;
1781 SMB_BIG_UINT allocation_size;
1782 ssize_t retval = -1;
1783 uint32 access_mask;
1784 uint32 share_mode;
1785 uint32 create_disposition;
1786 uint32 create_options = 0;
1787 TALLOC_CTX *ctx = talloc_tos();
1788
1789 START_PROFILE(SMBopenX);
1790
1791 if (req->wct < 15) {
1792 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1793 END_PROFILE(SMBopenX);
1794 return;
1795 }
1796
1797 open_flags = SVAL(req->inbuf,smb_vwv2);
1798 deny_mode = SVAL(req->inbuf,smb_vwv3);
1799 smb_attr = SVAL(req->inbuf,smb_vwv5);
1800 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1801 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1802 oplock_request = ex_oplock_request | core_oplock_request;
1803 smb_ofun = SVAL(req->inbuf,smb_vwv8);
1804 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv9);
1805
1806 /* If it's an IPC, pass off the pipe handler. */
1807 if (IS_IPC(conn)) {
1808 if (lp_nt_pipe_support()) {
1809 reply_open_pipe_and_X(conn, req);
1810 } else {
1811 reply_doserror(req, ERRSRV, ERRaccess);
1812 }
1813 END_PROFILE(SMBopenX);
1814 return;
1815 }
1816
1817 /* XXXX we need to handle passed times, sattr and flags */
1818 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1819 smb_buf(req->inbuf), 0, STR_TERMINATE,
1820 &status);
1821 if (!NT_STATUS_IS_OK(status)) {
1822 reply_nterror(req, status);
1823 END_PROFILE(SMBopenX);
1824 return;
1825 }
1826
1827 if (!map_open_params_to_ntcreate(
1828 fname, deny_mode, smb_ofun, &access_mask,
1829 &share_mode, &create_disposition, &create_options)) {
1830 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1831 END_PROFILE(SMBopenX);
1832 return;
1833 }
1834
1835 status = create_file(conn, /* conn */
1836 req, /* req */
1837 0, /* root_dir_fid */
1838 fname, /* fname */
1839 access_mask, /* access_mask */
1840 share_mode, /* share_access */
1841 create_disposition, /* create_disposition*/
1842 create_options, /* create_options */
1843 smb_attr, /* file_attributes */
1844 oplock_request, /* oplock_request */
1845 0, /* allocation_size */
1846 NULL, /* sd */
1847 NULL, /* ea_list */
1848 &fsp, /* result */
1849 &smb_action, /* pinfo */
1850 &sbuf); /* psbuf */
1851
1852 if (!NT_STATUS_IS_OK(status)) {
1853 END_PROFILE(SMBopenX);
1854 if (open_was_deferred(req->mid)) {
1855 /* We have re-scheduled this call. */
1856 return;
1857 }
1858 reply_openerror(req, status);
1859 return;
1860 }
1861
1862 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1863 if the file is truncated or created. */
1864 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1865 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1866 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1867 close_file(fsp,ERROR_CLOSE);
1868 reply_nterror(req, NT_STATUS_DISK_FULL);
1869 END_PROFILE(SMBopenX);
1870 return;
1871 }
1872 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1873 if (retval < 0) {
1874 close_file(fsp,ERROR_CLOSE);
1875 reply_nterror(req, NT_STATUS_DISK_FULL);
1876 END_PROFILE(SMBopenX);
1877 return;
1878 }
1879 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1880 }
1881
1882 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1883 mtime = sbuf.st_mtime;
1884 if (fattr & aDIR) {
1885 close_file(fsp,ERROR_CLOSE);
1886 reply_doserror(req, ERRDOS, ERRnoaccess);
1887 END_PROFILE(SMBopenX);
1888 return;
1889 }
1890
1891 /* If the caller set the extended oplock request bit
1892 and we granted one (by whatever means) - set the
1893 correct bit for extended oplock reply.
1894 */
1895
1896 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1897 smb_action |= EXTENDED_OPLOCK_GRANTED;
1898 }
1899
1900 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1901 smb_action |= EXTENDED_OPLOCK_GRANTED;
1902 }
1903
1904 /* If the caller set the core oplock request bit
1905 and we granted one (by whatever means) - set the
1906 correct bit for core oplock reply.
1907 */
1908
1909 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1910 reply_outbuf(req, 19, 0);
1911 } else {
1912 reply_outbuf(req, 15, 0);
1913 }
1914
1915 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1916 SCVAL(req->outbuf, smb_flg,
1917 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1918 }
1919
1920 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1921 SCVAL(req->outbuf, smb_flg,
1922 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1923 }
1924
1925 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1926 SSVAL(req->outbuf,smb_vwv3,fattr);
1927 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1928 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1929 } else {
1930 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1931 }
1932 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1933 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1934 SSVAL(req->outbuf,smb_vwv11,smb_action);
1935
1936 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1937 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1938 }
1939
1940 END_PROFILE(SMBopenX);
1941 chain_reply(req);
1942 return;
1943 }
1944
1945 /****************************************************************************
1946 Reply to a SMBulogoffX.
1947 ****************************************************************************/
1948
1949 void reply_ulogoffX(struct smb_request *req)
1950 {
1951 user_struct *vuser;
1952
1953 START_PROFILE(SMBulogoffX);
1954
1955 vuser = get_valid_user_struct(req->vuid);
1956
1957 if(vuser == NULL) {
1958 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1959 req->vuid));
1960 }
1961
1962 /* in user level security we are supposed to close any files
1963 open by this user */
1964 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1965 file_close_user(req->vuid);
1966 }
1967
1968 invalidate_vuid(req->vuid);
1969
1970 reply_outbuf(req, 2, 0);
1971
1972 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1973
1974 END_PROFILE(SMBulogoffX);
1975 chain_reply(req);
1976 }
1977
1978 /****************************************************************************
1979 Reply to a mknew or a create.
1980 ****************************************************************************/
1981
1982 void reply_mknew(struct smb_request *req)
1983 {
1984 connection_struct *conn = req->conn;
1985 char *fname = NULL;
1986 int com;
1987 uint32 fattr = 0;
1988 struct timespec ts[2];
1989 files_struct *fsp;
1990 int oplock_request = 0;
1991 SMB_STRUCT_STAT sbuf;
1992 NTSTATUS status;
1993 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1994 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1995 uint32 create_disposition;
1996 uint32 create_options = 0;
1997 TALLOC_CTX *ctx = talloc_tos();
1998
1999 START_PROFILE(SMBcreate);
2000
2001 if (req->wct < 3) {
2002 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2003 END_PROFILE(SMBcreate);
2004 return;
2005 }
2006
2007 fattr = SVAL(req->inbuf,smb_vwv0);
2008 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2009 com = SVAL(req->inbuf,smb_com);
2010
2011 ts[1] =convert_time_t_to_timespec(
2012 srv_make_unix_date3(req->inbuf + smb_vwv1));
2013 /* mtime. */
2014
2015 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2016 smb_buf(req->inbuf) + 1, 0,
2017 STR_TERMINATE, &status);
2018 if (!NT_STATUS_IS_OK(status)) {
2019 reply_nterror(req, status);
2020 END_PROFILE(SMBcreate);
2021 return;
2022 }
2023
2024 if (fattr & aVOLID) {
2025 DEBUG(0,("Attempt to create file (%s) with volid set - "
2026 "please report this\n", fname));
2027 }
2028
2029 if(com == SMBmknew) {
2030 /* We should fail if file exists. */
2031 create_disposition = FILE_CREATE;
2032 } else {
2033 /* Create if file doesn't exist, truncate if it does. */
2034 create_disposition = FILE_OVERWRITE_IF;
2035 }
2036
2037 status = create_file(conn, /* conn */
2038 req, /* req */
2039 0, /* root_dir_fid */
2040 fname, /* fname */
2041 access_mask, /* access_mask */
2042 share_mode, /* share_access */
2043 create_disposition, /* create_disposition*/
2044 create_options, /* create_options */
2045 fattr, /* file_attributes */
2046 oplock_request, /* oplock_request */
2047 0, /* allocation_size */
2048 NULL, /* sd */
2049 NULL, /* ea_list */
2050 &fsp, /* result */
2051 NULL, /* pinfo */
2052 &sbuf); /* psbuf */
2053
2054 if (!NT_STATUS_IS_OK(status)) {
2055 END_PROFILE(SMBcreate);
2056 if (open_was_deferred(req->mid)) {
2057 /* We have re-scheduled this call. */
2058 return;
2059 }
2060 reply_openerror(req, status);
2061 return;
2062 }
2063
2064 ts[0] = get_atimespec(&sbuf); /* atime. */
2065 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, ts, true);
2066 if (!NT_STATUS_IS_OK(status)) {
2067 END_PROFILE(SMBcreate);
2068 reply_openerror(req, status);
2069 return;
2070 }
2071
2072 reply_outbuf(req, 1, 0);
2073 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2074
2075 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2076 SCVAL(req->outbuf,smb_flg,
2077 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2078 }
2079
2080 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2081 SCVAL(req->outbuf,smb_flg,
2082 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2083 }
2084
2085 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2086 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2087 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2088
2089 END_PROFILE(SMBcreate);
2090 return;
2091 }
2092
2093 /****************************************************************************
2094 Reply to a create temporary file.
2095 ****************************************************************************/
2096
2097 void reply_ctemp(struct smb_request *req)
2098 {
2099 connection_struct *conn = req->conn;
2100 char *fname = NULL;
2101 uint32 fattr;
2102 files_struct *fsp;
2103 int oplock_request;
2104 int tmpfd;
2105 SMB_STRUCT_STAT sbuf;
2106 char *s;
2107 NTSTATUS status;
2108 TALLOC_CTX *ctx = talloc_tos();
2109
2110 START_PROFILE(SMBctemp);
2111
2112 if (req->wct < 3) {
2113 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2114 END_PROFILE(SMBctemp);
2115 return;
2116 }
2117
2118 fattr = SVAL(req->inbuf,smb_vwv0);
2119 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2120
2121 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2122 smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
2123 &status);
2124 if (!NT_STATUS_IS_OK(status)) {
2125 reply_nterror(req, status);
2126 END_PROFILE(SMBctemp);
2127 return;
2128 }
2129 if (*fname) {
2130 fname = talloc_asprintf(ctx,
2131 "%s/TMXXXXXX",
2132 fname);
2133 } else {
2134 fname = talloc_strdup(ctx, "TMXXXXXX");
2135 }
2136
2137 if (!fname) {
2138 reply_nterror(req, NT_STATUS_NO_MEMORY);
2139 END_PROFILE(SMBctemp);
2140 return;
2141 }
2142
2143 status = resolve_dfspath(ctx, conn,
2144 req->flags2 & FLAGS2_DFS_PATHNAMES,
2145 fname,
2146 &fname);
2147 if (!NT_STATUS_IS_OK(status)) {
2148 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2149 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2150 ERRSRV, ERRbadpath);
2151 END_PROFILE(SMBctemp);
2152 return;
2153 }
2154 reply_nterror(req, status);
2155 END_PROFILE(SMBctemp);
2156 return;
2157 }
2158
2159 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2160 if (!NT_STATUS_IS_OK(status)) {
2161 reply_nterror(req, status);
2162 END_PROFILE(SMBctemp);
2163 return;
2164 }
2165
2166 status = check_name(conn, fname);
2167 if (!NT_STATUS_IS_OK(status)) {
2168 reply_nterror(req, status);
2169 END_PROFILE(SMBctemp);
2170 return;
2171 }
2172
2173 tmpfd = smb_mkstemp(fname);
2174 if (tmpfd == -1) {
2175 reply_unixerror(req, ERRDOS, ERRnoaccess);
2176 END_PROFILE(SMBctemp);
2177 return;
2178 }
2179
2180 SMB_VFS_STAT(conn,fname,&sbuf);
2181
2182 /* We should fail if file does not exist. */
2183 status = open_file_ntcreate(conn, req, fname, &sbuf,
2184 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2185 FILE_SHARE_READ|FILE_SHARE_WRITE,
2186 FILE_OPEN,
2187 0,
2188 fattr,
2189 oplock_request,
2190 NULL, &fsp);
2191
2192 /* close fd from smb_mkstemp() */
2193 close(tmpfd);
2194
2195 if (!NT_STATUS_IS_OK(status)) {
2196 if (open_was_deferred(req->mid)) {
2197 /* We have re-scheduled this call. */
2198 END_PROFILE(SMBctemp);
2199 return;
2200 }
2201 reply_openerror(req, status);
2202 END_PROFILE(SMBctemp);
2203 return;
2204 }
2205
2206 reply_outbuf(req, 1, 0);
2207 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2208
2209 /* the returned filename is relative to the directory */
2210 s = strrchr_m(fsp->fsp_name, '/');
2211 if (!s) {
2212 s = fsp->fsp_name;
2213 } else {
2214 s++;
2215 }
2216
2217 #if 0
2218 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2219 thing in the byte section. JRA */
2220 SSVALS(p, 0, -1); /* what is this? not in spec */
2221 #endif
2222 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2223 == -1) {
2224 reply_nterror(req, NT_STATUS_NO_MEMORY);
2225 END_PROFILE(SMBctemp);
2226 return;
2227 }
2228
2229 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2230 SCVAL(req->outbuf, smb_flg,
2231 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2232 }
2233
2234 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2235 SCVAL(req->outbuf, smb_flg,
2236 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2237 }
2238
2239 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2240 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2241 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2242
2243 END_PROFILE(SMBctemp);
2244 return;
2245 }
2246
2247 /*******************************************************************
2248 Check if a user is allowed to rename a file.
2249 ********************************************************************/
2250
2251 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2252 uint16 dirtype, SMB_STRUCT_STAT *pst)
2253 {
2254 uint32 fmode;
2255
2256 if (!CAN_WRITE(conn)) {
2257 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2258 }
2259
2260 fmode = dos_mode(conn, fsp->fsp_name, pst);
2261 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2262 return NT_STATUS_NO_SUCH_FILE;
2263 }
2264
2265 if (S_ISDIR(pst->st_mode)) {
2266 return NT_STATUS_OK;
2267 }
2268
2269 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2270 return NT_STATUS_OK;
2271 }
2272
2273 return NT_STATUS_ACCESS_DENIED;
2274 }
2275
2276 /*******************************************************************
2277 * unlink a file with all relevant access checks
2278 *******************************************************************/
2279
2280 static NTSTATUS do_unlink(connection_struct *conn,
2281 struct smb_request *req,
2282 const char *fname,
2283 uint32 dirtype)
2284 {
2285 SMB_STRUCT_STAT sbuf;
2286 uint32 fattr;
2287 files_struct *fsp;
2288 uint32 dirtype_orig = dirtype;
2289 NTSTATUS status;
2290
2291 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2292
2293 if (!CAN_WRITE(conn)) {
2294 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2295 }
2296
2297 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2298 return map_nt_error_from_unix(errno);
2299 }
2300
2301 fattr = dos_mode(conn,fname,&sbuf);
2302
2303 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2304 dirtype = aDIR|aARCH|aRONLY;
2305 }
2306
2307 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2308 if (!dirtype) {
2309 return NT_STATUS_NO_SUCH_FILE;
2310 }
2311
2312 if (!dir_check_ftype(conn, fattr, dirtype)) {
2313 if (fattr & aDIR) {
2314 return NT_STATUS_FILE_IS_A_DIRECTORY;
2315 }
2316 return NT_STATUS_NO_SUCH_FILE;
2317 }
2318
2319 if (dirtype_orig & 0x8000) {
2320 /* These will never be set for POSIX. */
2321 return NT_STATUS_NO_SUCH_FILE;
2322 }
2323
2324 #if 0
2325 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2326 return NT_STATUS_FILE_IS_A_DIRECTORY;
2327 }
2328
2329 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2330 return NT_STATUS_NO_SUCH_FILE;
2331 }
2332
2333 if (dirtype & 0xFF00) {
2334 /* These will never be set for POSIX. */
2335 return NT_STATUS_NO_SUCH_FILE;
2336 }
2337
2338 dirtype &= 0xFF;
2339 if (!dirtype) {
2340 return NT_STATUS_NO_SUCH_FILE;
2341 }
2342
2343 /* Can't delete a directory. */
2344 if (fattr & aDIR) {
2345 return NT_STATUS_FILE_IS_A_DIRECTORY;
2346 }
2347 #endif
2348
2349 #if 0 /* JRATEST */
2350 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2351 return NT_STATUS_OBJECT_NAME_INVALID;
2352 #endif /* JRATEST */
2353
2354 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2355
2356 On a Windows share, a file with read-only dosmode can be opened with
2357 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2358 fails with NT_STATUS_CANNOT_DELETE error.
2359
2360 This semantic causes a problem that a user can not
2361 rename a file with read-only dosmode on a Samba share
2362 from a Windows command prompt (i.e. cmd.exe, but can rename
2363 from Windows Explorer).
2364 */
2365
2366 if (!lp_delete_readonly(SNUM(conn))) {
2367 if (fattr & aRONLY) {
2368 return NT_STATUS_CANNOT_DELETE;
2369 }
2370 }
2371
2372 /* On open checks the open itself will check the share mode, so
2373 don't do it here as we'll get it wrong. */
2374
2375 status = create_file_unixpath
2376 (conn, /* conn */
2377 req, /* req */
2378 fname, /* fname */
2379 DELETE_ACCESS, /* access_mask */
2380 FILE_SHARE_NONE, /* share_access */
2381 FILE_OPEN, /* create_disposition*/
2382 FILE_NON_DIRECTORY_FILE, /* create_options */
2383 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2384 0, /* oplock_request */
2385 0, /* allocation_size */
2386 NULL, /* sd */
2387 NULL, /* ea_list */
2388 &fsp, /* result */
2389 NULL, /* pinfo */
2390 &sbuf); /* psbuf */
2391
2392 if (!NT_STATUS_IS_OK(status)) {
2393 DEBUG(10, ("create_file_unixpath failed: %s\n",
2394 nt_errstr(status)));
2395 return status;
2396 }
2397
2398 /* The set is across all open files on this dev/inode pair. */
2399 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2400 close_file(fsp, NORMAL_CLOSE);
2401 return NT_STATUS_ACCESS_DENIED;
2402 }
2403
2404 return close_file(fsp,NORMAL_CLOSE);
2405 }
2406
2407 /****************************************************************************
2408 The guts of the unlink command, split out so it may be called by the NT SMB
2409 code.
2410 ****************************************************************************/
2411
2412 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2413 uint32 dirtype, const char *name_in, bool has_wild)
2414 {
2415 const char *directory = NULL;
2416 char *mask = NULL;
2417 char *name = NULL;
2418 char *p = NULL;
2419 int count=0;
2420 NTSTATUS status = NT_STATUS_OK;
2421 SMB_STRUCT_STAT sbuf;
2422 TALLOC_CTX *ctx = talloc_tos();
2423
2424 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2425 if (!NT_STATUS_IS_OK(status)) {
2426 return status;
2427 }
2428
2429 p = strrchr_m(name,'/');
2430 if (!p) {
2431 directory = talloc_strdup(ctx, ".");
2432 if (!directory) {
2433 return NT_STATUS_NO_MEMORY;
2434 }
2435 mask = name;
2436 } else {
2437 *p = 0;
2438 directory = name;
2439 mask = p+1;
2440 }
2441
2442 /*
2443 * We should only check the mangled cache
2444 * here if unix_convert failed. This means
2445 * that the path in 'mask' doesn't exist
2446 * on the file system and so we need to look
2447 * for a possible mangle. This patch from
2448 * Tine Smukavec <valentin.smukavec@hermes.si>.
2449 */
2450
2451 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2452 char *new_mask = NULL;
2453 mangle_lookup_name_from_8_3(ctx,
2454 mask,
2455 &new_mask,
2456 conn->params );
2457 if (new_mask) {
2458 mask = new_mask;
2459 }
2460 }
2461
2462 if (!has_wild) {
2463 directory = talloc_asprintf(ctx,
2464 "%s/%s",
2465 directory,
2466 mask);
2467 if (!directory) {
2468 return NT_STATUS_NO_MEMORY;
2469 }
2470 if (dirtype == 0) {
2471 dirtype = FILE_ATTRIBUTE_NORMAL;
2472 }
2473
2474 status = check_name(conn, directory);
2475 if (!NT_STATUS_IS_OK(status)) {
2476 return status;
2477 }
2478
2479 status = do_unlink(conn, req, directory, dirtype);
2480 if (!NT_STATUS_IS_OK(status)) {
2481 return status;
2482 }
2483
2484 count++;
2485 } else {
2486 struct smb_Dir *dir_hnd = NULL;
2487 long offset = 0;
2488 const char *dname;
2489
2490 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2491 return NT_STATUS_OBJECT_NAME_INVALID;
2492 }
2493
2494 if (strequal(mask,"????????.???")) {
2495 mask[0] = '*';
2496 mask[1] = '\0';
2497 }
2498
2499 status = check_name(conn, directory);
2500 if (!NT_STATUS_IS_OK(status)) {
2501 return status;
2502 }
2503
2504 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2505 dirtype);
2506 if (dir_hnd == NULL) {
2507 return map_nt_error_from_unix(errno);
2508 }
2509
2510 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2511 the pattern matches against the long name, otherwise the short name
2512 We don't implement this yet XXXX
2513 */
2514
2515 status = NT_STATUS_NO_SUCH_FILE;
2516
2517 while ((dname = ReadDirName(dir_hnd, &offset))) {
2518 SMB_STRUCT_STAT st;
2519 char *fname = NULL;
2520
2521 if (!is_visible_file(conn, directory, dname, &st, True)) {
2522 continue;
2523 }
2524
2525 /* Quick check for "." and ".." */
2526 if (ISDOT(dname) || ISDOTDOT(dname)) {
2527 continue;
2528 }
2529
2530 if(!mask_match(dname, mask, conn->case_sensitive)) {
2531 continue;
2532 }
2533
2534 fname = talloc_asprintf(ctx, "%s/%s",
2535 directory,
2536 dname);
2537 if (!fname) {
2538 return NT_STATUS_NO_MEMORY;
2539 }
2540
2541 status = check_name(conn, fname);
2542 if (!NT_STATUS_IS_OK(status)) {
2543 TALLOC_FREE(dir_hnd);
2544 return status;
2545 }
2546
2547 status = do_unlink(conn, req, fname, dirtype);
2548 if (!NT_STATUS_IS_OK(status)) {
2549 TALLOC_FREE(fname);
2550 continue;
2551 }
2552
2553 count++;
2554 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2555 fname));
2556
2557 TALLOC_FREE(fname);
2558 }
2559 TALLOC_FREE(dir_hnd);
2560 }
2561
2562 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2563 status = map_nt_error_from_unix(errno);
2564 }
2565
2566 return status;
2567 }
2568
2569 /****************************************************************************
2570 Reply to a unlink
2571 ****************************************************************************/
2572
2573 void reply_unlink(struct smb_request *req)
2574 {
2575 connection_struct *conn = req->conn;
2576 char *name = NULL;
2577 uint32 dirtype;
2578 NTSTATUS status;
2579 bool path_contains_wcard = False;
2580 TALLOC_CTX *ctx = talloc_tos();
2581
2582 START_PROFILE(SMBunlink);
2583
2584 if (req->wct < 1) {
2585 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2586 END_PROFILE(SMBunlink);
2587 return;
2588 }
2589
2590 dirtype = SVAL(req->inbuf,smb_vwv0);
2591
2592 srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2593 smb_buf(req->inbuf) + 1, 0,
2594 STR_TERMINATE, &status, &path_contains_wcard);
2595 if (!NT_STATUS_IS_OK(status)) {
2596 reply_nterror(req, status);
2597 END_PROFILE(SMBunlink);
2598 return;
2599 }
2600
2601 status = resolve_dfspath_wcard(ctx, conn,
2602 req->flags2 & FLAGS2_DFS_PATHNAMES,
2603 name,
2604 &name,
2605 &path_contains_wcard);
2606 if (!NT_STATUS_IS_OK(status)) {
2607 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2608 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2609 ERRSRV, ERRbadpath);
2610 END_PROFILE(SMBunlink);
2611 return;
2612 }
2613 reply_nterror(req, status);
2614 END_PROFILE(SMBunlink);
2615 return;
2616 }
2617
2618 DEBUG(3,("reply_unlink : %s\n",name));
2619
2620 status = unlink_internals(conn, req, dirtype, name,
2621 path_contains_wcard);
2622 if (!NT_STATUS_IS_OK(status)) {
2623 if (open_was_deferred(req->mid)) {
2624 /* We have re-scheduled this call. */
2625 END_PROFILE(SMBunlink);
2626 return;
2627 }
2628 reply_nterror(req, status);
2629 END_PROFILE(SMBunlink);
2630 return;
2631 }
2632
2633 reply_outbuf(req, 0, 0);
2634 END_PROFILE(SMBunlink);
2635
2636 return;
2637 }
2638
2639 /****************************************************************************
2640 Fail for readbraw.
2641 ****************************************************************************/
2642
2643 static void fail_readraw(void)
2644 {
2645 const char *errstr = talloc_asprintf(talloc_tos(),
2646 "FAIL ! reply_readbraw: socket write fail (%s)",
2647 strerror(errno));
2648 if (!errstr) {
2649 errstr = "";
2650 }
2651 exit_server_cleanly(errstr);
2652 }
2653
2654 /****************************************************************************
2655 Fake (read/write) sendfile. Returns -1 on read or write fail.
2656 ****************************************************************************/
2657
2658 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2659 size_t nread)
2660 {
2661 size_t bufsize;
2662 size_t tosend = nread;
2663 char *buf;
2664
2665 if (nread == 0) {
2666 return 0;
2667 }
2668
2669 bufsize = MIN(nread, 65536);
2670
2671 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2672 return -1;
2673 }
2674
2675 while (tosend > 0) {
2676 ssize_t ret;
2677 size_t cur_read;
2678
2679 if (tosend > bufsize) {
2680 cur_read = bufsize;
2681 } else {
2682 cur_read = tosend;
2683 }
2684 ret = read_file(fsp,buf,startpos,cur_read);
2685 if (ret == -1) {
2686 SAFE_FREE(buf);
2687 return -1;
2688 }
2689
2690 /* If we had a short read, fill with zeros. */
2691 if (ret < cur_read) {
2692 memset(buf, '\0', cur_read - ret);
2693 }
2694
2695 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2696 SAFE_FREE(buf);
2697 return -1;
2698 }
2699 tosend -= cur_read;
2700 startpos += cur_read;
2701 }
2702
2703 SAFE_FREE(buf);
2704 return (ssize_t)nread;
2705 }
2706
2707 /****************************************************************************
2708 Return a readbraw error (4 bytes of zero).
2709 ****************************************************************************/
2710
2711 static void reply_readbraw_error(void)
2712 {
2713 char header[4];
2714 SIVAL(header,0,0);
2715 if (write_data(smbd_server_fd(),header,4) != 4) {
2716 fail_readraw();
2717 }
2718 }
2719
2720 /****************************************************************************
2721 Use sendfile in readbraw.
2722 ****************************************************************************/
2723
2724 void send_file_readbraw(connection_struct *conn,
2725 files_struct *fsp,
2726 SMB_OFF_T startpos,
2727 size_t nread,
2728 ssize_t mincount)
2729 {
2730 char *outbuf = NULL;
2731 ssize_t ret=0;
2732
2733 #if defined(WITH_SENDFILE)
2734 /*
2735 * We can only use sendfile on a non-chained packet
2736 * but we can use on a non-oplocked file. tridge proved this
2737 * on a train in Germany :-). JRA.
2738 * reply_readbraw has already checked the length.
2739 */
2740
2741 if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2742 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2743 char header[4];
2744 DATA_BLOB header_blob;
2745
2746 _smb_setlen(header,nread);
2747 header_blob = data_blob_const(header, 4);
2748
2749 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2750 &header_blob, startpos, nread) == -1) {
2751 /* Returning ENOSYS means no data at all was sent.
2752 * Do this as a normal read. */
2753 if (errno == ENOSYS) {
2754 goto normal_readbraw;
2755 }
2756
2757 /*
2758 * Special hack for broken Linux with no working sendfile. If we
2759 * return EINTR we sent the header but not the rest of the data.
2760 * Fake this up by doing read/write calls.
2761 */
2762 if (errno == EINTR) {
2763 /* Ensure we don't do this again. */
2764 set_use_sendfile(SNUM(conn), False);
2765 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2766
2767 if (fake_sendfile(fsp, startpos, nread) == -1) {
2768 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2769 fsp->fsp_name, strerror(errno) ));
2770 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2771 }
2772 return;
2773 }
2774
2775 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2776 fsp->fsp_name, strerror(errno) ));
2777 exit_server_cleanly("send_file_readbraw sendfile failed");
2778 }
2779
2780 return;
2781 }
2782 #endif
2783
2784 normal_readbraw:
2785
2786 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2787 if (!outbuf) {
2788 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2789 (unsigned)(nread+4)));
2790 reply_readbraw_error();
2791 return;
2792 }
2793
2794 if (nread > 0) {
2795 ret = read_file(fsp,outbuf+4,startpos,nread);
2796 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2797 if (ret < mincount)
2798 ret = 0;
2799 #else
2800 if (ret < nread)
2801 ret = 0;
2802 #endif
2803 }
2804
2805 _smb_setlen(outbuf,ret);
2806 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2807 fail_readraw();
2808
2809 TALLOC_FREE(outbuf);
2810 }
2811
2812 /****************************************************************************
2813 Reply to a readbraw (core+ protocol).
2814 ****************************************************************************/
2815
2816 void reply_readbraw(struct smb_request *req)
2817 {
2818 connection_struct *conn = req->conn;
2819 ssize_t maxcount,mincount;
2820 size_t nread = 0;
2821 SMB_OFF_T startpos;
2822 files_struct *fsp;
2823 SMB_STRUCT_STAT st;
2824 SMB_OFF_T size = 0;
2825
2826 START_PROFILE(SMBreadbraw);
2827
2828 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2829 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2830 "raw reads/writes are disallowed.");
2831 }
2832
2833 if (req->wct < 8) {
2834 reply_readbraw_error();
2835 END_PROFILE(SMBreadbraw);
2836 return;
2837 }
2838
2839 /*
2840 * Special check if an oplock break has been issued
2841 * and the readraw request croses on the wire, we must
2842 * return a zero length response here.
2843 */
2844
2845 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2846
2847 /*
2848 * We have to do a check_fsp by hand here, as
2849 * we must always return 4 zero bytes on error,
2850 * not a NTSTATUS.
2851 */
2852
2853 if (!fsp || !conn || conn != fsp->conn ||
2854 req->vuid != fsp->vuid ||
2855 fsp->is_directory || fsp->fh->fd == -1) {
2856 /*
2857 * fsp could be NULL here so use the value from the packet. JRA.
2858 */
2859 DEBUG(3,("reply_readbraw: fnum %d not valid "
2860 "- cache prime?\n",
2861 (int)SVAL(req->inbuf,smb_vwv0)));
2862 reply_readbraw_error();
2863 END_PROFILE(SMBreadbraw);
2864 return;
2865 }
2866
2867 /* Do a "by hand" version of CHECK_READ. */
2868 if (!(fsp->can_read ||
2869 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2870 (fsp->access_mask & FILE_EXECUTE)))) {
2871 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2872 (int)SVAL(req->inbuf,smb_vwv0)));
2873 reply_readbraw_error();
2874 END_PROFILE(SMBreadbraw);
2875 return;
2876 }
2877
2878 flush_write_cache(fsp, READRAW_FLUSH);
2879
2880 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2881 if(req->wct == 10) {
2882 /*
2883 * This is a large offset (64 bit) read.
2884 */
2885 #ifdef LARGE_SMB_OFF_T
2886
2887 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2888
2889 #else /* !LARGE_SMB_OFF_T */
2890
2891 /*
2892 * Ensure we haven't been sent a >32 bit offset.
2893 */
2894
2895 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2896 DEBUG(0,("reply_readbraw: large offset "
2897 "(%x << 32) used and we don't support "
2898 "64 bit offsets.\n",
2899 (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2900 reply_readbraw_error();
2901 END_PROFILE(SMBreadbraw);
2902 return;
2903 }
2904
2905 #endif /* LARGE_SMB_OFF_T */
2906
2907 if(startpos < 0) {
2908 DEBUG(0,("reply_readbraw: negative 64 bit "
2909 "readraw offset (%.0f) !\n",
2910 (double)startpos ));
2911 reply_readbraw_error();
2912 END_PROFILE(SMBreadbraw);
2913 return;
2914 }
2915 }
2916
2917 maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2918 mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2919
2920 /* ensure we don't overrun the packet size */
2921 maxcount = MIN(65535,maxcount);
2922
2923 if (is_locked(fsp,(uint32)req->smbpid,
2924 (SMB_BIG_UINT)maxcount,
2925 (SMB_BIG_UINT)startpos,
2926 READ_LOCK)) {
2927 reply_readbraw_error();
2928 END_PROFILE(SMBreadbraw);
2929 return;
2930 }
2931
2932 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2933 size = st.st_size;
2934 }
2935
2936 if (startpos >= size) {
2937 nread = 0;
2938 } else {
2939 nread = MIN(maxcount,(size - startpos));
2940 }
2941
2942 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2943 if (nread < mincount)
2944 nread = 0;
2945 #endif
2946
2947 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2948 "min=%lu nread=%lu\n",
2949 fsp->fnum, (double)startpos,
2950 (unsigned long)maxcount,
2951 (unsigned long)mincount,
2952 (unsigned long)nread ) );
2953
2954 send_file_readbraw(conn, fsp, startpos, nread, mincount);
2955
2956 DEBUG(5,("reply_readbraw finished\n"));
2957 END_PROFILE(SMBreadbraw);
2958 }
2959
2960 #undef DBGC_CLASS
2961 #define DBGC_CLASS DBGC_LOCKING
2962
2963 /****************************************************************************
2964 Reply to a lockread (core+ protocol).
2965 ****************************************************************************/
2966
2967 void reply_lockread(struct smb_request *req)
2968 {
2969 connection_struct *conn = req->conn;
2970 ssize_t nread = -1;
2971 char *data;
2972 SMB_OFF_T startpos;
2973 size_t numtoread;
2974 NTSTATUS status;
2975 files_struct *fsp;
2976 struct byte_range_lock *br_lck = NULL;
2977 char *p = NULL;
2978
2979 START_PROFILE(SMBlockread);
2980
2981 if (req->wct < 5) {
2982 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2983 END_PROFILE(SMBlockread);
2984 return;
2985 }
2986
2987 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2988
2989 if (!check_fsp(conn, req, fsp)) {
2990 END_PROFILE(SMBlockread);
2991 return;
2992 }
2993
2994 if (!CHECK_READ(fsp,req->inbuf)) {
2995 reply_doserror(req, ERRDOS, ERRbadaccess);
2996 END_PROFILE(SMBlockread);
2997 return;
2998 }
2999
3000 release_level_2_oplocks_on_change(fsp);
3001
3002 numtoread = SVAL(req->inbuf,smb_vwv1);
3003 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3004
3005 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3006
3007 reply_outbuf(req, 5, numtoread + 3);
3008
3009 data = smb_buf(req->outbuf) + 3;
3010
3011 /*
3012 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3013 * protocol request that predates the read/write lock concept.
3014 * Thus instead of asking for a read lock here we need to ask
3015 * for a write lock. JRA.
3016 * Note that the requested lock size is unaffected by max_recv.
3017 */
3018
3019 br_lck = do_lock(smbd_messaging_context(),
3020 fsp,
3021 req->smbpid,
3022 (SMB_BIG_UINT)numtoread,
3023 (SMB_BIG_UINT)startpos,
3024 WRITE_LOCK,
3025 WINDOWS_LOCK,
3026 False, /* Non-blocking lock. */
3027 &status,
3028 NULL);
3029 TALLOC_FREE(br_lck);
3030
3031 if (NT_STATUS_V(status)) {
3032 reply_nterror(req, status);
3033 END_PROFILE(SMBlockread);
3034 return;
3035 }
3036
3037 /*
3038 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3039 */
3040
3041 if (numtoread > max_recv) {
3042 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3043 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3044 (unsigned int)numtoread, (unsigned int)max_recv ));
3045 numtoread = MIN(numtoread,max_recv);
3046 }
3047 nread = read_file(fsp,data,startpos,numtoread);
3048
3049 if (nread < 0) {
3050 reply_unixerror(req, ERRDOS, ERRnoaccess);
3051 END_PROFILE(SMBlockread);
3052 return;
3053 }
3054
3055 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3056
3057 SSVAL(req->outbuf,smb_vwv0,nread);
3058 SSVAL(req->outbuf,smb_vwv5,nread+3);
3059 p = smb_buf(req->outbuf);
3060 SCVAL(p,0,0); /* pad byte. */
3061 SSVAL(p,1,nread);
3062
3063 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3064 fsp->fnum, (int)numtoread, (int)nread));
3065
3066 END_PROFILE(SMBlockread);
3067 return;
3068 }
3069
3070 #undef DBGC_CLASS
3071 #define DBGC_CLASS DBGC_ALL
3072
3073 /****************************************************************************
3074 Reply to a read.
3075 ****************************************************************************/
3076
3077 void reply_read(struct smb_request *req)
3078 {
3079 connection_struct *conn = req->conn;
3080 size_t numtoread;
3081 ssize_t nread = 0;
3082 char *data;
3083 SMB_OFF_T startpos;
3084 int outsize = 0;
3085 files_struct *fsp;
3086
3087 START_PROFILE(SMBread);
3088
3089 if (req->wct < 3) {
3090 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3091 END_PROFILE(SMBread);
3092 return;
3093 }
3094
3095 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3096
3097 if (!check_fsp(conn, req, fsp)) {
3098 END_PROFILE(SMBread);
3099 return;
3100 }
3101
3102 if (!CHECK_READ(fsp,req->inbuf)) {
3103 reply_doserror(req, ERRDOS, ERRbadaccess);
3104 END_PROFILE(SMBread);
3105 return;
3106 }
3107
3108 numtoread = SVAL(req->inbuf,smb_vwv1);
3109 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3110
3111 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3112
3113 /*
3114 * The requested read size cannot be greater than max_recv. JRA.
3115 */
3116 if (numtoread > max_recv) {
3117 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3118 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3119 (unsigned int)numtoread, (unsigned int)max_recv ));
3120 numtoread = MIN(numtoread,max_recv);
3121 }
3122
3123 reply_outbuf(req, 5, numtoread+3);
3124
3125 data = smb_buf(req->outbuf) + 3;
3126
3127 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtoread,
3128 (SMB_BIG_UINT)startpos, READ_LOCK)) {
3129 reply_doserror(req, ERRDOS,ERRlock);
3130 END_PROFILE(SMBread);
3131 return;
3132 }
3133
3134 if (numtoread > 0)
3135 nread = read_file(fsp,data,startpos,numtoread);
3136
3137 if (nread < 0) {
3138 reply_unixerror(req, ERRDOS,ERRnoaccess);
3139 END_PROFILE(SMBread);
3140 return;
3141 }
3142
3143 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3144
3145 SSVAL(req->outbuf,smb_vwv0,nread);
3146 SSVAL(req->outbuf,smb_vwv5,nread+3);
3147 SCVAL(smb_buf(req->outbuf),0,1);
3148 SSVAL(smb_buf(req->outbuf),1,nread);
3149
3150 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3151 fsp->fnum, (int)numtoread, (int)nread ) );
3152
3153 END_PROFILE(SMBread);
3154 return;
3155 }
3156
3157 /****************************************************************************
3158 Setup readX header.
3159 ****************************************************************************/
3160
3161 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3162 {
3163 int outsize;
3164 char *data;
3165
3166 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3167 data = smb_buf(outbuf);
3168
3169 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3170
3171 SCVAL(outbuf,smb_vwv0,0xFF);
3172 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3173 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3174 SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3175 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3176 SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3177 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3178 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3179 return outsize;
3180 }
3181
3182 /****************************************************************************
3183 Reply to a read and X - possibly using sendfile.
3184 ****************************************************************************/
3185
3186 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3187 files_struct *fsp, SMB_OFF_T startpos,
3188 size_t smb_maxcnt)
3189 {
3190 SMB_STRUCT_STAT sbuf;
3191 ssize_t nread = -1;
3192
3193 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3194 reply_unixerror(req, ERRDOS, ERRnoaccess);
3195 return;
3196 }
3197
3198 if (startpos > sbuf.st_size) {
3199 smb_maxcnt = 0;
3200 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3201 smb_maxcnt = (sbuf.st_size - startpos);
3202 }
3203
3204 if (smb_maxcnt == 0) {
3205 goto normal_read;
3206 }
3207
3208 #if defined(WITH_SENDFILE)
3209 /*
3210 * We can only use sendfile on a non-chained packet
3211 * but we can use on a non-oplocked file. tridge proved this
3212 * on a train in Germany :-). JRA.
3213 */
3214
3215 if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3216 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3217 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3218 uint8 headerbuf[smb_size + 12 * 2];
3219 DATA_BLOB header;
3220
3221 /*
3222 * Set up the packet header before send. We
3223 * assume here the sendfile will work (get the
3224 * correct amount of data).
3225 */
3226
3227 header = data_blob_const(headerbuf, sizeof(headerbuf));
3228
3229 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3230 setup_readX_header((char *)headerbuf, smb_maxcnt);
3231
3232 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3233 /* Returning ENOSYS means no data at all was sent.
3234 Do this as a normal read. */
3235 if (errno == ENOSYS) {
3236 goto normal_read;
3237 }
3238
3239 /*
3240 * Special hack for broken Linux with no working sendfile. If we
3241 * return EINTR we sent the header but not the rest of the data.
3242 * Fake this up by doing read/write calls.
3243 */
3244
3245 if (errno == EINTR) {
3246 /* Ensure we don't do this again. */
3247 set_use_sendfile(SNUM(conn), False);
3248 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3249 nread = fake_sendfile(fsp, startpos,
3250 smb_maxcnt);
3251 if (nread == -1) {
3252 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3253 fsp->fsp_name, strerror(errno) ));
3254 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3255 }
3256 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3257 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3258 /* No outbuf here means successful sendfile. */
3259 TALLOC_FREE(req->outbuf);
3260 return;
3261 }
3262
3263 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3264 fsp->fsp_name, strerror(errno) ));
3265 exit_server_cleanly("send_file_readX sendfile failed");
3266 }
3267
3268 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3269 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3270 /* No outbuf here means successful sendfile. */
3271 TALLOC_FREE(req->outbuf);
3272 return;
3273 }
3274 #endif
3275
3276 normal_read:
3277
3278 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3279 uint8 headerbuf[smb_size + 2*12];
3280
3281 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3282 setup_readX_header((char *)headerbuf, smb_maxcnt);
3283
3284 /* Send out the header. */
3285 if (write_data(smbd_server_fd(), (char *)headerbuf,
3286 sizeof(headerbuf)) != sizeof(headerbuf)) {
3287 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3288 fsp->fsp_name, strerror(errno) ));
3289 exit_server_cleanly("send_file_readX sendfile failed");
3290 }
3291 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3292 if (nread == -1) {
3293 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3294 fsp->fsp_name, strerror(errno) ));
3295 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3296 }
3297 TALLOC_FREE(req->outbuf);
3298 return;
3299 } else {
3300 reply_outbuf(req, 12, smb_maxcnt);
3301
3302 nread = read_file(fsp, smb_buf(req->outbuf), startpos,
3303 smb_maxcnt);
3304 if (nread < 0) {
3305 reply_unixerror(req, ERRDOS, ERRnoaccess);
3306 return;
3307 }
3308
3309 setup_readX_header((char *)req->outbuf, nread);
3310
3311 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3312 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3313
3314 chain_reply(req);
3315
3316 return;
3317 }
3318 }
3319
3320 /****************************************************************************
3321 Reply to a read and X.
3322 ****************************************************************************/
3323
3324 void reply_read_and_X(struct smb_request *req)
3325 {
3326 connection_struct *conn = req->conn;
3327 files_struct *fsp;
3328 SMB_OFF_T startpos;
3329 size_t smb_maxcnt;
3330 bool big_readX = False;
3331 #if 0
3332 size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3333 #endif
3334
3335 START_PROFILE(SMBreadX);
3336
3337 if ((req->wct != 10) && (req->wct != 12)) {
3338 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3339 return;
3340 }
3341
3342 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3343 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3344 smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3345
3346 /* If it's an IPC, pass off the pipe handler. */
3347 if (IS_IPC(conn)) {
3348 reply_pipe_read_and_X(req);
3349 END_PROFILE(SMBreadX);
3350 return;
3351 }
3352
3353 if (!check_fsp(conn, req, fsp)) {
3354 END_PROFILE(SMBreadX);
3355 return;
3356 }
3357
3358 if (!CHECK_READ(fsp,req->inbuf)) {
3359 reply_doserror(req, ERRDOS,ERRbadaccess);
3360 END_PROFILE(SMBreadX);
3361 return;
3362 }
3363
3364 if (global_client_caps & CAP_LARGE_READX) {
3365 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3366 smb_maxcnt |= (upper_size<<16);
3367 if (upper_size > 1) {
3368 /* Can't do this on a chained packet. */
3369 if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3370 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3371 END_PROFILE(SMBreadX);
3372 return;
3373 }
3374 /* We currently don't do this on signed or sealed data. */
3375 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3376 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3377 END_PROFILE(SMBreadX);
3378 return;
3379 }
3380 /* Is there room in the reply for this data ? */
3381 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3382 reply_nterror(req,
3383 NT_STATUS_INVALID_PARAMETER);
3384 END_PROFILE(SMBreadX);
3385 return;
3386 }
3387 big_readX = True;
3388 }
3389 }
3390
3391 if (req->wct == 12) {
3392 #ifdef LARGE_SMB_OFF_T
3393 /*
3394 * This is a large offset (64 bit) read.
3395 */
3396 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3397
3398 #else /* !LARGE_SMB_OFF_T */
3399
3400 /*
3401 * Ensure we haven't been sent a >32 bit offset.
3402 */
3403
3404 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3405 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3406 "used and we don't support 64 bit offsets.\n",
3407 (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3408 END_PROFILE(SMBreadX);
3409 reply_doserror(req, ERRDOS, ERRbadaccess);
3410 return;
3411 }
3412
3413 #endif /* LARGE_SMB_OFF_T */
3414
3415 }
3416
3417 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)smb_maxcnt,
3418 (SMB_BIG_UINT)startpos, READ_LOCK)) {
3419 END_PROFILE(SMBreadX);
3420 reply_doserror(req, ERRDOS, ERRlock);
3421 return;
3422 }
3423
3424 if (!big_readX &&
3425 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3426 END_PROFILE(SMBreadX);
3427 return;
3428 }
3429
3430 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3431
3432 END_PROFILE(SMBreadX);
3433 return;
3434 }
3435
3436 /****************************************************************************
3437 Error replies to writebraw must have smb_wct == 1. Fix this up.
3438 ****************************************************************************/
3439
3440 void error_to_writebrawerr(struct smb_request *req)
3441 {
3442 uint8 *old_outbuf = req->outbuf;
3443
3444 reply_outbuf(req, 1, 0);
3445
3446 memcpy(req->outbuf, old_outbuf, smb_size);
3447 TALLOC_FREE(old_outbuf);
3448 }
3449
3450 /****************************************************************************
3451 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3452 ****************************************************************************/
3453
3454 void reply_writebraw(struct smb_request *req)
3455 {
3456 connection_struct *conn = req->conn;
3457 char *buf = NULL;
3458 ssize_t nwritten=0;
3459 ssize_t total_written=0;
3460 size_t numtowrite=0;
3461 size_t tcount;
3462 SMB_OFF_T startpos;
3463 char *data=NULL;
3464 bool write_through;
3465 files_struct *fsp;
3466 NTSTATUS status;
3467
3468 START_PROFILE(SMBwritebraw);
3469
3470 /*
3471 * If we ever reply with an error, it must have the SMB command
3472 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3473 * we're finished.
3474 */
3475 SCVAL(req->inbuf,smb_com,SMBwritec);
3476
3477 if (srv_is_signing_active()) {
3478 END_PROFILE(SMBwritebraw);
3479 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3480 "raw reads/writes are disallowed.");
3481 }
3482
3483 if (req->wct < 12) {
3484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3485 error_to_writebrawerr(req);
3486 END_PROFILE(SMBwritebraw);
3487 return;
3488 }
3489
3490 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3491 if (!check_fsp(conn, req, fsp)) {
3492 error_to_writebrawerr(req);
3493 END_PROFILE(SMBwritebraw);
3494 return;
3495 }
3496
3497 if (!CHECK_WRITE(fsp)) {
3498 reply_doserror(req, ERRDOS, ERRbadaccess);
3499 error_to_writebrawerr(req);
3500 END_PROFILE(SMBwritebraw);
3501 return;
3502 }
3503
3504 tcount = IVAL(req->inbuf,smb_vwv1);
3505 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3506 write_through = BITSETW(req->inbuf+smb_vwv7,0);
3507
3508 /* We have to deal with slightly different formats depending
3509 on whether we are using the core+ or lanman1.0 protocol */
3510
3511 if(Protocol <= PROTOCOL_COREPLUS) {
3512 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3513 data = smb_buf(req->inbuf);
3514 } else {
3515 numtowrite = SVAL(req->inbuf,smb_vwv10);
3516 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3517 }
3518
3519 /* Ensure we don't write bytes past the end of this packet. */
3520 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3521 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3522 error_to_writebrawerr(req);
3523 END_PROFILE(SMBwritebraw);
3524 return;
3525 }
3526
3527 if (is_locked(fsp,(uint32)req->smbpid,(SMB_BIG_UINT)tcount,
3528 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3529 reply_doserror(req, ERRDOS, ERRlock);
3530 error_to_writebrawerr(req);
3531 END_PROFILE(SMBwritebraw);
3532 return;
3533 }
3534
3535 if (numtowrite>0) {
3536 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3537 }
3538
3539 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3540 "wrote=%d sync=%d\n",
3541 fsp->fnum, (double)startpos, (int)numtowrite,
3542 (int)nwritten, (int)write_through));
3543
3544 if (nwritten < (ssize_t)numtowrite) {
3545 reply_unixerror(req, ERRHRD, ERRdiskfull);
3546 error_to_writebrawerr(req);
3547 END_PROFILE(SMBwritebraw);
3548 return;
3549 }
3550
3551 total_written = nwritten;
3552
3553 /* Allocate a buffer of 64k + length. */
3554 buf = TALLOC_ARRAY(NULL, char, 65540);
3555 if (!buf) {
3556 reply_doserror(req, ERRDOS, ERRnomem);
3557 error_to_writebrawerr(req);
3558 END_PROFILE(SMBwritebraw);
3559 return;
3560 }
3561
3562 /* Return a SMBwritebraw message to the redirector to tell
3563 * it to send more bytes */
3564
3565 memcpy(buf, req->inbuf, smb_size);
3566 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3567 SCVAL(buf,smb_com,SMBwritebraw);
3568 SSVALS(buf,smb_vwv0,0xFFFF);
3569 show_msg(buf);
3570 if (!srv_send_smb(smbd_server_fd(),
3571 buf,
3572 IS_CONN_ENCRYPTED(conn))) {
3573 exit_server_cleanly("reply_writebraw: srv_send_smb "
3574 "failed.");
3575 }
3576
3577 /* Now read the raw data into the buffer and write it */
3578 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3579 &numtowrite);
3580 if (!NT_STATUS_IS_OK(status)) {
3581 exit_server_cleanly("secondary writebraw failed");
3582 }
3583
3584 /* Set up outbuf to return the correct size */
3585 reply_outbuf(req, 1, 0);
3586
3587 if (numtowrite != 0) {
3588
3589 if (numtowrite > 0xFFFF) {
3590 DEBUG(0,("reply_writebraw: Oversize secondary write "
3591 "raw requested (%u). Terminating\n",
3592 (unsigned int)numtowrite ));
3593 exit_server_cleanly("secondary writebraw failed");
3594 }
3595
3596 if (tcount > nwritten+numtowrite) {
3597 DEBUG(3,("reply_writebraw: Client overestimated the "
3598 "write %d %d %d\n",
3599 (int)tcount,(int)nwritten,(int)numtowrite));
3600 }
3601
3602 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3603
3604 if (!NT_STATUS_IS_OK(status)) {
3605 DEBUG(0,("reply_writebraw: Oversize secondary write "
3606 "raw read failed (%s). Terminating\n",
3607 nt_errstr(status)));
3608 exit_server_cleanly("secondary writebraw failed");
3609 }
3610
3611 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3612 if (nwritten == -1) {
3613 TALLOC_FREE(buf);
3614 reply_unixerror(req, ERRHRD, ERRdiskfull);
3615 error_to_writebrawerr(req);
3616 END_PROFILE(SMBwritebraw);
3617 return;
3618 }
3619
3620 if (nwritten < (ssize_t)numtowrite) {
3621 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3622 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3623 }
3624
3625 if (nwritten > 0) {
3626 total_written += nwritten;
3627 }
3628 }
3629
3630 TALLOC_FREE(buf);
3631 SSVAL(req->outbuf,smb_vwv0,total_written);
3632
3633 status = sync_file(conn, fsp, write_through);
3634 if (!NT_STATUS_IS_OK(status)) {
3635 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3636 fsp->fsp_name, nt_errstr(status) ));
3637 reply_nterror(req, status);
3638 error_to_writebrawerr(req);
3639 END_PROFILE(SMBwritebraw);
3640 return;
3641 }
3642
3643 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3644 "wrote=%d\n",
3645 fsp->fnum, (double)startpos, (int)numtowrite,
3646 (int)total_written));
3647
3648 /* We won't return a status if write through is not selected - this
3649 * follows what WfWg does */
3650 END_PROFILE(SMBwritebraw);
3651
3652 if (!write_through && total_written==tcount) {
3653
3654 #if RABBIT_PELLET_FIX
3655 /*
3656 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3657 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3658 * JRA.
3659 */
3660 if (!send_keepalive(smbd_server_fd())) {
3661 exit_server_cleanly("reply_writebraw: send of "
3662 "keepalive failed");
3663 }
3664 #endif
3665 TALLOC_FREE(req->outbuf);
3666 }
3667 return;
3668 }
3669
3670 #undef DBGC_CLASS
3671 #define DBGC_CLASS DBGC_LOCKING
3672
3673 /****************************************************************************
3674 Reply to a writeunlock (core+).
3675 ****************************************************************************/
3676
3677 void reply_writeunlock(struct smb_request *req)
3678 {
3679 connection_struct *conn = req->conn;
3680 ssize_t nwritten = -1;
3681 size_t numtowrite;
3682 SMB_OFF_T startpos;
3683 char *data;
3684 NTSTATUS status = NT_STATUS_OK;
3685 files_struct *fsp;
3686
3687 START_PROFILE(SMBwriteunlock);
3688
3689 if (req->wct < 5) {
3690 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3691 END_PROFILE(SMBwriteunlock);
3692 return;
3693 }
3694
3695 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3696
3697 if (!check_fsp(conn, req, fsp)) {
3698 END_PROFILE(SMBwriteunlock);
3699 return;
3700 }
3701
3702 if (!CHECK_WRITE(fsp)) {
3703 reply_doserror(req, ERRDOS,ERRbadaccess);
3704 END_PROFILE(SMBwriteunlock);
3705 return;
3706 }
3707
3708 numtowrite = SVAL(req->inbuf,smb_vwv1);
3709 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3710 data = smb_buf(req->inbuf) + 3;
3711
3712 if (numtowrite
3713 && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3714 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3715 reply_doserror(req, ERRDOS, ERRlock);
3716 END_PROFILE(SMBwriteunlock);
3717 return;
3718 }
3719
3720 /* The special X/Open SMB protocol handling of
3721 zero length writes is *NOT* done for
3722 this call */
3723 if(numtowrite == 0) {
3724 nwritten = 0;
3725 } else {
3726 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3727 }
3728
3729 status = sync_file(conn, fsp, False /* write through */);
3730 if (!NT_STATUS_IS_OK(status)) {
3731 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3732 fsp->fsp_name, nt_errstr(status) ));
3733 reply_nterror(req, status);
3734 END_PROFILE(SMBwriteunlock);
3735 return;
3736 }
3737
3738 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3739 reply_unixerror(req, ERRHRD, ERRdiskfull);
3740 END_PROFILE(SMBwriteunlock);
3741 return;
3742 }
3743
3744 if (numtowrite) {
3745 status = do_unlock(smbd_messaging_context(),
3746 fsp,
3747 req->smbpid,
3748 (SMB_BIG_UINT)numtowrite,
3749 (SMB_BIG_UINT)startpos,
3750 WINDOWS_LOCK);
3751
3752 if (NT_STATUS_V(status)) {
3753 reply_nterror(req, status);
3754 END_PROFILE(SMBwriteunlock);
3755 return;
3756 }
3757 }
3758
3759 reply_outbuf(req, 1, 0);
3760
3761 SSVAL(req->outbuf,smb_vwv0,nwritten);
3762
3763 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3764 fsp->fnum, (int)numtowrite, (int)nwritten));
3765
3766 END_PROFILE(SMBwriteunlock);
3767 return;
3768 }
3769
3770 #undef DBGC_CLASS
3771 #define DBGC_CLASS DBGC_ALL
3772
3773 /****************************************************************************
3774 Reply to a write.
3775 ****************************************************************************/
3776
3777 void reply_write(struct smb_request *req)
3778 {
3779 connection_struct *conn = req->conn;
3780 size_t numtowrite;
3781 ssize_t nwritten = -1;
3782 SMB_OFF_T startpos;
3783 char *data;
3784 files_struct *fsp;
3785 NTSTATUS status;
3786
3787 START_PROFILE(SMBwrite);
3788
3789 if (req->wct < 5) {
3790 END_PROFILE(SMBwrite);
3791 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3792 return;
3793 }
3794
3795 /* If it's an IPC, pass off the pipe handler. */
3796 if (IS_IPC(conn)) {
3797 reply_pipe_write(req);
3798 END_PROFILE(SMBwrite);
3799 return;
3800 }
3801
3802 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3803
3804 if (!check_fsp(conn, req, fsp)) {
3805 END_PROFILE(SMBwrite);
3806 return;
3807 }
3808
3809 if (!CHECK_WRITE(fsp)) {
3810 reply_doserror(req, ERRDOS, ERRbadaccess);
3811 END_PROFILE(SMBwrite);
3812 return;
3813 }
3814
3815 numtowrite = SVAL(req->inbuf,smb_vwv1);
3816 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3817 data = smb_buf(req->inbuf) + 3;
3818
3819 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3820 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3821 reply_doserror(req, ERRDOS, ERRlock);
3822 END_PROFILE(SMBwrite);
3823 return;
3824 }
3825
3826 /*
3827 * X/Open SMB protocol says that if smb_vwv1 is
3828 * zero then the file size should be extended or
3829 * truncated to the size given in smb_vwv[2-3].
3830 */
3831
3832 if(numtowrite == 0) {
3833 /*
3834 * This is actually an allocate call, and set EOF. JRA.
3835 */
3836 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3837 if (nwritten < 0) {
3838 reply_nterror(req, NT_STATUS_DISK_FULL);
3839 END_PROFILE(SMBwrite);
3840 return;
3841 }
3842 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3843 if (nwritten < 0) {
3844 reply_nterror(req, NT_STATUS_DISK_FULL);
3845 END_PROFILE(SMBwrite);
3846 return;
3847 }
3848 trigger_write_time_update_immediate(fsp);
3849 } else {
3850 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3851 }
3852
3853 status = sync_file(conn, fsp, False);
3854 if (!NT_STATUS_IS_OK(status)) {
3855 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3856 fsp->fsp_name, nt_errstr(status) ));
3857 reply_nterror(req, status);
3858 END_PROFILE(SMBwrite);
3859 return;
3860 }
3861
3862 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3863 reply_unixerror(req, ERRHRD, ERRdiskfull);
3864 END_PROFILE(SMBwrite);
3865 return;
3866 }
3867
3868 reply_outbuf(req, 1, 0);
3869
3870 SSVAL(req->outbuf,smb_vwv0,nwritten);
3871
3872 if (nwritten < (ssize_t)numtowrite) {
3873 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3874 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3875 }
3876
3877 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3878
3879 END_PROFILE(SMBwrite);
3880 return;
3881 }
3882
3883 /****************************************************************************
3884 Ensure a buffer is a valid writeX for recvfile purposes.
3885 ****************************************************************************/
3886
3887 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3888 (2*14) + /* word count (including bcc) */ \
3889 1 /* pad byte */)
3890
3891 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3892 {
3893 size_t numtowrite;
3894 connection_struct *conn = NULL;
3895 unsigned int doff = 0;
3896 size_t len = smb_len_large(inbuf);
3897
3898 if (is_encrypted_packet(inbuf)) {
3899 /* Can't do this on encrypted
3900 * connections. */
3901 return false;
3902 }
3903
3904 if (CVAL(inbuf,smb_com) != SMBwriteX) {
3905 return false;
3906 }
3907
3908 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3909 CVAL(inbuf,smb_wct) != 14) {
3910 DEBUG(10,("is_valid_writeX_buffer: chained or "
3911 "invalid word length.\n"));
3912 return false;
3913 }
3914
3915 conn = conn_find(SVAL(inbuf, smb_tid));
3916 if (conn == NULL) {
3917 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3918 return false;
3919 }
3920 if (IS_IPC(conn)) {
3921 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3922 return false;
3923 }
3924 if (IS_PRINT(conn)) {
3925 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
3926 return false;
3927 }
3928 doff = SVAL(inbuf,smb_vwv11);
3929
3930 numtowrite = SVAL(inbuf,smb_vwv10);
3931
3932 if (len > doff && len - doff > 0xFFFF) {
3933 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3934 }
3935
3936 if (numtowrite == 0) {
3937 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3938 return false;
3939 }
3940
3941 /* Ensure the sizes match up. */
3942 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3943 /* no pad byte...old smbclient :-( */
3944 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3945 (unsigned int)doff,
3946 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3947 return false;
3948 }
3949
3950 if (len - doff != numtowrite) {
3951 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3952 "len = %u, doff = %u, numtowrite = %u\n",
3953 (unsigned int)len,
3954 (unsigned int)doff,
3955 (unsigned int)numtowrite ));
3956 return false;
3957 }
3958
3959 DEBUG(10,("is_valid_writeX_buffer: true "
3960 "len = %u, doff = %u, numtowrite = %u\n",
3961 (unsigned int)len,
3962 (unsigned int)doff,
3963 (unsigned int)numtowrite ));
3964
3965 return true;
3966 }
3967
3968 /****************************************************************************
3969 Reply to a write and X.
3970 ****************************************************************************/
3971
3972 void reply_write_and_X(struct smb_request *req)
3973 {
3974 connection_struct *conn = req->conn;
3975 files_struct *fsp;
3976 SMB_OFF_T startpos;
3977 size_t numtowrite;
3978 bool write_through;
3979 ssize_t nwritten;
3980 unsigned int smb_doff;
3981 unsigned int smblen;
3982 char *data;
3983 NTSTATUS status;
3984
3985 START_PROFILE(SMBwriteX);
3986
3987 if ((req->wct != 12) && (req->wct != 14)) {
3988 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3989 END_PROFILE(SMBwriteX);
3990 return;
3991 }
3992
3993 numtowrite = SVAL(req->inbuf,smb_vwv10);
3994 smb_doff = SVAL(req->inbuf,smb_vwv11);
3995 smblen = smb_len(req->inbuf);
3996
3997 if (req->unread_bytes > 0xFFFF ||
3998 (smblen > smb_doff &&
3999 smblen - smb_doff > 0xFFFF)) {
4000 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
4001 }
4002
4003 if (req->unread_bytes) {
4004 /* Can't do a recvfile write on IPC$ */
4005 if (IS_IPC(conn)) {
4006 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4007 END_PROFILE(SMBwriteX);
4008 return;
4009 }
4010 if (numtowrite != req->unread_bytes) {
4011 reply_doserror(req, ERRDOS, ERRbadmem);
4012 END_PROFILE(SMBwriteX);
4013 return;
4014 }
4015 } else {
4016 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4017 smb_doff + numtowrite > smblen) {
4018 reply_doserror(req, ERRDOS, ERRbadmem);
4019 END_PROFILE(SMBwriteX);
4020 return;
4021 }
4022 }
4023
4024 /* If it's an IPC, pass off the pipe handler. */
4025 if (IS_IPC(conn)) {
4026 if (req->unread_bytes) {
4027 reply_doserror(req, ERRDOS, ERRbadmem);
4028 END_PROFILE(SMBwriteX);
4029 return;
4030 }
4031 reply_pipe_write_and_X(req);
4032 END_PROFILE(SMBwriteX);
4033 return;
4034 }
4035
4036 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
4037 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
4038 write_through = BITSETW(req->inbuf+smb_vwv7,0);
4039
4040 if (!check_fsp(conn, req, fsp)) {
4041 END_PROFILE(SMBwriteX);
4042 return;
4043 }
4044
4045 if (!CHECK_WRITE(fsp)) {
4046 reply_doserror(req, ERRDOS, ERRbadaccess);
4047 END_PROFILE(SMBwriteX);
4048 return;
4049 }
4050
4051 data = smb_base(req->inbuf) + smb_doff;
4052
4053 if(req->wct == 14) {
4054 #ifdef LARGE_SMB_OFF_T
4055 /*
4056 * This is a large offset (64 bit) write.
4057 */
4058 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
4059
4060 #else /* !LARGE_SMB_OFF_T */
4061
4062 /*
4063 * Ensure we haven't been sent a >32 bit offset.
4064 */
4065
4066 if(IVAL(req->inbuf,smb_vwv12) != 0) {
4067 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4068 "used and we don't support 64 bit offsets.\n",
4069 (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
4070 reply_doserror(req, ERRDOS, ERRbadaccess);
4071 END_PROFILE(SMBwriteX);
4072 return;
4073 }
4074
4075 #endif /* LARGE_SMB_OFF_T */
4076 }
4077
4078 if (is_locked(fsp,(uint32)req->smbpid,
4079 (SMB_BIG_UINT)numtowrite,
4080 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4081 reply_doserror(req, ERRDOS, ERRlock);
4082 END_PROFILE(SMBwriteX);
4083 return;
4084 }
4085
4086 /* X/Open SMB protocol says that, unlike SMBwrite
4087 if the length is zero then NO truncation is
4088 done, just a write of zero. To truncate a file,
4089 use SMBwrite. */
4090
4091 if(numtowrite == 0) {
4092 nwritten = 0;
4093 } else {
4094
4095 if ((req->unread_bytes == 0) &&
4096 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4097 numtowrite)) {
4098 END_PROFILE(SMBwriteX);
4099 return;
4100 }
4101
4102 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4103 }
4104
4105 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4106 reply_unixerror(req, ERRHRD, ERRdiskfull);
4107 END_PROFILE(SMBwriteX);
4108 return;
4109 }
4110
4111 reply_outbuf(req, 6, 0);
4112 SSVAL(req->outbuf,smb_vwv2,nwritten);
4113 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4114
4115 if (nwritten < (ssize_t)numtowrite) {
4116 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4117 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4118 }
4119
4120 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4121 fsp->fnum, (int)numtowrite, (int)nwritten));
4122
4123 status = sync_file(conn, fsp, write_through);
4124 if (!NT_STATUS_IS_OK(status)) {
4125 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4126 fsp->fsp_name, nt_errstr(status) ));
4127 reply_nterror(req, status);
4128 END_PROFILE(SMBwriteX);
4129 return;
4130 }
4131
4132 END_PROFILE(SMBwriteX);
4133 chain_reply(req);
4134 return;
4135 }
4136
4137 /****************************************************************************
4138 Reply to a lseek.
4139 ****************************************************************************/
4140
4141 void reply_lseek(struct smb_request *req)
4142 {
4143 connection_struct *conn = req->conn;
4144 SMB_OFF_T startpos;
4145 SMB_OFF_T res= -1;
4146 int mode,umode;
4147 files_struct *fsp;
4148
4149 START_PROFILE(SMBlseek);
4150
4151 if (req->wct < 4) {
4152 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4153 END_PROFILE(SMBlseek);
4154 return;
4155 }
4156
4157 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4158
4159 if (!check_fsp(conn, req, fsp)) {
4160 return;
4161 }
4162
4163 flush_write_cache(fsp, SEEK_FLUSH);
4164
4165 mode = SVAL(req->inbuf,smb_vwv1) & 3;
4166 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4167 startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4168
4169 switch (mode) {
4170 case 0:
4171 umode = SEEK_SET;
4172 res = startpos;
4173 break;
4174 case 1:
4175 umode = SEEK_CUR;
4176 res = fsp->fh->pos + startpos;
4177 break;
4178 case 2:
4179 umode = SEEK_END;
4180 break;
4181 default:
4182 umode = SEEK_SET;
4183 res = startpos;
4184 break;
4185 }
4186
4187 if (umode == SEEK_END) {
4188 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4189 if(errno == EINVAL) {
4190 SMB_OFF_T current_pos = startpos;
4191 SMB_STRUCT_STAT sbuf;
4192
4193 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4194 reply_unixerror(req, ERRDOS,
4195 ERRnoaccess);
4196 END_PROFILE(SMBlseek);
4197 return;
4198 }
4199
4200 current_pos += sbuf.st_size;
4201 if(current_pos < 0)
4202 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4203 }
4204 }
4205
4206 if(res == -1) {
4207 reply_unixerror(req, ERRDOS, ERRnoaccess);
4208 END_PROFILE(SMBlseek);
4209 return;
4210 }
4211 }
4212
4213 fsp->fh->pos = res;
4214
4215 reply_outbuf(req, 2, 0);
4216 SIVAL(req->outbuf,smb_vwv0,res);
4217
4218 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4219 fsp->fnum, (double)startpos, (double)res, mode));
4220
4221 END_PROFILE(SMBlseek);
4222 return;
4223 }
4224
4225 /****************************************************************************
4226 Reply to a flush.
4227 ****************************************************************************/
4228
4229 void reply_flush(struct smb_request *req)
4230 {
4231 connection_struct *conn = req->conn;
4232 uint16 fnum;
4233 files_struct *fsp;
4234
4235 START_PROFILE(SMBflush);
4236
4237 if (req->wct < 1) {
4238 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4239 return;
4240 }
4241
4242 fnum = SVAL(req->inbuf,smb_vwv0);
4243 fsp = file_fsp(fnum);
4244
4245 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4246 return;
4247 }
4248
4249 if (!fsp) {
4250 file_sync_all(conn);
4251 } else {
4252 NTSTATUS status = sync_file(conn, fsp, True);
4253 if (!NT_STATUS_IS_OK(status)) {
4254 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4255 fsp->fsp_name, nt_errstr(status) ));
4256 reply_nterror(req, status);
4257 END_PROFILE(SMBflush);
4258 return;
4259 }
4260 }
4261
4262 reply_outbuf(req, 0, 0);
4263
4264 DEBUG(3,("flush\n"));
4265 END_PROFILE(SMBflush);
4266 return;
4267 }
4268
4269 /****************************************************************************
4270 Reply to a exit.
4271 conn POINTER CAN BE NULL HERE !
4272 ****************************************************************************/
4273
4274 void reply_exit(struct smb_request *req)
4275 {
4276 START_PROFILE(SMBexit);
4277
4278 file_close_pid(req->smbpid, req->vuid);
4279
4280 reply_outbuf(req, 0, 0);
4281
4282 DEBUG(3,("exit\n"));
4283
4284 END_PROFILE(SMBexit);
4285 return;
4286 }
4287
4288 /****************************************************************************
4289 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4290 ****************************************************************************/
4291
4292 void reply_close(struct smb_request *req)
4293 {
4294 connection_struct *conn = req->conn;
4295 NTSTATUS status = NT_STATUS_OK;
4296 files_struct *fsp = NULL;
4297 START_PROFILE(SMBclose);
4298
4299 if (req->wct < 3) {
4300 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4301 END_PROFILE(SMBclose);
4302 return;
4303 }
4304
4305 /* If it's an IPC, pass off to the pipe handler. */
4306 if (IS_IPC(conn)) {
4307 reply_pipe_close(conn, req);
4308 END_PROFILE(SMBclose);
4309 return;
4310 }
4311
4312 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4313
4314 /*
4315 * We can only use check_fsp if we know it's not a directory.
4316 */
4317
4318 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4319 reply_doserror(req, ERRDOS, ERRbadfid);
4320 END_PROFILE(SMBclose);
4321 return;
4322 }
4323
4324 if(fsp->is_directory) {
4325 /*
4326 * Special case - close NT SMB directory handle.
4327 */
4328 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4329 status = close_file(fsp,NORMAL_CLOSE);
4330 } else {
4331 time_t t;
4332 /*
4333 * Close ordinary file.
4334 */
4335
4336 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4337 fsp->fh->fd, fsp->fnum,
4338 conn->num_files_open));
4339
4340 /*
4341 * Take care of any time sent in the close.
4342 */
4343
4344 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4345 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4346
4347 /*
4348 * close_file() returns the unix errno if an error
4349 * was detected on close - normally this is due to
4350 * a disk full error. If not then it was probably an I/O error.
4351 */
4352
4353 status = close_file(fsp,NORMAL_CLOSE);
4354 }
4355
4356 if (!NT_STATUS_IS_OK(status)) {
4357 reply_nterror(req, status);
4358 END_PROFILE(SMBclose);
4359 return;
4360 }
4361
4362 reply_outbuf(req, 0, 0);
4363 END_PROFILE(SMBclose);
4364 return;
4365 }
4366
4367 /****************************************************************************
4368 Reply to a writeclose (Core+ protocol).
4369 ****************************************************************************/
4370
4371 void reply_writeclose(struct smb_request *req)
4372 {
4373 connection_struct *conn = req->conn;
4374 size_t numtowrite;
4375 ssize_t nwritten = -1;
4376 NTSTATUS close_status = NT_STATUS_OK;
4377 SMB_OFF_T startpos;
4378 char *data;
4379 struct timespec mtime;
4380 files_struct *fsp;
4381
4382 START_PROFILE(SMBwriteclose);
4383
4384 if (req->wct < 6) {
4385 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4386 END_PROFILE(SMBwriteclose);
4387 return;
4388 }
4389
4390 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4391
4392 if (!check_fsp(conn, req, fsp)) {
4393 END_PROFILE(SMBwriteclose);
4394 return;
4395 }
4396 if (!CHECK_WRITE(fsp)) {
4397 reply_doserror(req, ERRDOS,ERRbadaccess);
4398 END_PROFILE(SMBwriteclose);
4399 return;
4400 }
4401
4402 numtowrite = SVAL(req->inbuf,smb_vwv1);
4403 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4404 mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4405 req->inbuf+smb_vwv4));
4406 data = smb_buf(req->inbuf) + 1;
4407
4408 if (numtowrite
4409 && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
4410 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4411 reply_doserror(req, ERRDOS,ERRlock);
4412 END_PROFILE(SMBwriteclose);
4413 return;
4414 }
4415
4416 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4417
4418 set_close_write_time(fsp, mtime);
4419
4420 /*
4421 * More insanity. W2K only closes the file if writelen > 0.
4422 * JRA.
4423 */
4424
4425 if (numtowrite) {
4426 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4427 fsp->fsp_name ));
4428 close_status = close_file(fsp,NORMAL_CLOSE);
4429 }
4430
4431 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4432 fsp->fnum, (int)numtowrite, (int)nwritten,
4433 conn->num_files_open));
4434
4435 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4436 reply_doserror(req, ERRHRD, ERRdiskfull);
4437 END_PROFILE(SMBwriteclose);
4438 return;
4439 }
4440
4441 if(!NT_STATUS_IS_OK(close_status)) {
4442 reply_nterror(req, close_status);
4443 END_PROFILE(SMBwriteclose);
4444 return;
4445 }
4446
4447 reply_outbuf(req, 1, 0);
4448
4449 SSVAL(req->outbuf,smb_vwv0,nwritten);
4450 END_PROFILE(SMBwriteclose);
4451 return;
4452 }
4453
4454 #undef DBGC_CLASS
4455 #define DBGC_CLASS DBGC_LOCKING
4456
4457 /****************************************************************************
4458 Reply to a lock.
4459 ****************************************************************************/
4460
4461 void reply_lock(struct smb_request *req)
4462 {
4463 connection_struct *conn = req->conn;
4464 SMB_BIG_UINT count,offset;
4465 NTSTATUS status;
4466 files_struct *fsp;
4467 struct byte_range_lock *br_lck = NULL;
4468
4469 START_PROFILE(SMBlock);
4470
4471 if (req->wct < 5) {
4472 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4473 END_PROFILE(SMBlock);
4474 return;
4475 }
4476
4477 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4478
4479 if (!check_fsp(conn, req, fsp)) {
4480 END_PROFILE(SMBlock);
4481 return;
4482 }
4483
4484 release_level_2_oplocks_on_change(fsp);
4485
4486 count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4487 offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4488
4489 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4490 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4491
4492 br_lck = do_lock(smbd_messaging_context(),
4493 fsp,
4494 req->smbpid,
4495 count,
4496 offset,
4497 WRITE_LOCK,
4498 WINDOWS_LOCK,
4499 False, /* Non-blocking lock. */
4500 &status,
4501 NULL);
4502
4503 TALLOC_FREE(br_lck);
4504
4505 if (NT_STATUS_V(status)) {
4506 reply_nterror(req, status);
4507 END_PROFILE(SMBlock);
4508 return;
4509 }
4510
4511 reply_outbuf(req, 0, 0);
4512
4513 END_PROFILE(SMBlock);
4514 return;
4515 }
4516
4517 /****************************************************************************
4518 Reply to a unlock.
4519 ****************************************************************************/
4520
4521 void reply_unlock(struct smb_request *req)
4522 {
4523 connection_struct *conn = req->conn;
4524 SMB_BIG_UINT count,offset;
4525 NTSTATUS status;
4526 files_struct *fsp;
4527
4528 START_PROFILE(SMBunlock);
4529
4530 if (req->wct < 5) {
4531 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532 END_PROFILE(SMBunlock);
4533 return;
4534 }
4535
4536 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4537
4538 if (!check_fsp(conn, req, fsp)) {
4539 END_PROFILE(SMBunlock);
4540 return;
4541 }
4542
4543 count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4544 offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4545
4546 status = do_unlock(smbd_messaging_context(),
4547 fsp,
4548 req->smbpid,
4549 count,
4550 offset,
4551 WINDOWS_LOCK);
4552
4553 if (NT_STATUS_V(status)) {
4554 reply_nterror(req, status);
4555 END_PROFILE(SMBunlock);
4556 return;
4557 }
4558
4559 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4560 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4561
4562 reply_outbuf(req, 0, 0);
4563
4564 END_PROFILE(SMBunlock);
4565 return;
4566 }
4567
4568 #undef DBGC_CLASS
4569 #define DBGC_CLASS DBGC_ALL
4570
4571 /****************************************************************************
4572 Reply to a tdis.
4573 conn POINTER CAN BE NULL HERE !
4574 ****************************************************************************/
4575
4576 void reply_tdis(struct smb_request *req)
4577 {
4578 connection_struct *conn = req->conn;
4579 START_PROFILE(SMBtdis);
4580
4581 if (!conn) {
4582 DEBUG(4,("Invalid connection in tdis\n"));
4583 reply_doserror(req, ERRSRV, ERRinvnid);
4584 END_PROFILE(SMBtdis);
4585 return;
4586 }
4587
4588 conn->used = False;
4589
4590 close_cnum(conn,req->vuid);
4591 req->conn = NULL;
4592
4593 reply_outbuf(req, 0, 0);
4594 END_PROFILE(SMBtdis);
4595 return;
4596 }
4597
4598 /****************************************************************************
4599 Reply to a echo.
4600 conn POINTER CAN BE NULL HERE !
4601 ****************************************************************************/
4602
4603 void reply_echo(struct smb_request *req)
4604 {
4605 connection_struct *conn = req->conn;
4606 int smb_reverb;
4607 int seq_num;
4608 unsigned int data_len = smb_buflen(req->inbuf);
4609
4610 START_PROFILE(SMBecho);
4611
4612 if (req->wct < 1) {
4613 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4614 END_PROFILE(SMBecho);
4615 return;
4616 }
4617
4618 if (data_len > BUFFER_SIZE) {
4619 DEBUG(0,("reply_echo: data_len too large.\n"));
4620 reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
4621 END_PROFILE(SMBecho);
4622 return;
4623 }
4624
4625 smb_reverb = SVAL(req->inbuf,smb_vwv0);
4626
4627 reply_outbuf(req, 1, data_len);
4628
4629 /* copy any incoming data back out */
4630 if (data_len > 0) {
4631 memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
4632 }
4633
4634 if (smb_reverb > 100) {
4635 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4636 smb_reverb = 100;
4637 }
4638
4639 for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4640 SSVAL(req->outbuf,smb_vwv0,seq_num);
4641
4642 show_msg((char *)req->outbuf);
4643 if (!srv_send_smb(smbd_server_fd(),
4644 (char *)req->outbuf,
4645 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4646 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4647 }
4648
4649 DEBUG(3,("echo %d times\n", smb_reverb));
4650
4651 TALLOC_FREE(req->outbuf);
4652
4653 END_PROFILE(SMBecho);
4654 return;
4655 }
4656
4657 /****************************************************************************
4658 Reply to a printopen.
4659 ****************************************************************************/
4660
4661 void reply_printopen(struct smb_request *req)
4662 {
4663 connection_struct *conn = req->conn;
4664 files_struct *fsp;
4665 SMB_STRUCT_STAT sbuf;
4666 NTSTATUS status;
4667
4668 START_PROFILE(SMBsplopen);
4669
4670 if (req->wct < 2) {
4671 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4672 END_PROFILE(SMBsplopen);
4673 return;
4674 }
4675
4676 if (!CAN_PRINT(conn)) {
4677 reply_doserror(req, ERRDOS, ERRnoaccess);
4678 END_PROFILE(SMBsplopen);
4679 return;
4680 }
4681
4682 status = file_new(conn, &fsp);
4683 if(!NT_STATUS_IS_OK(status)) {
4684 reply_nterror(req, status);
4685 END_PROFILE(SMBsplopen);
4686 return;
4687 }
4688
4689 /* Open for exclusive use, write only. */
4690 status = print_fsp_open(conn, NULL, req->vuid, fsp, &sbuf);
4691
4692 if (!NT_STATUS_IS_OK(status)) {
4693 file_free(fsp);
4694 reply_nterror(req, status);
4695 END_PROFILE(SMBsplopen);
4696 return;
4697 }
4698
4699 reply_outbuf(req, 1, 0);
4700 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4701
4702 DEBUG(3,("openprint fd=%d fnum=%d\n",
4703 fsp->fh->fd, fsp->fnum));
4704
4705 END_PROFILE(SMBsplopen);
4706 return;
4707 }
4708
4709 /****************************************************************************
4710 Reply to a printclose.
4711 ****************************************************************************/
4712
4713 void reply_printclose(struct smb_request *req)
4714 {
4715 connection_struct *conn = req->conn;
4716 files_struct *fsp;
4717 NTSTATUS status;
4718
4719 START_PROFILE(SMBsplclose);
4720
4721 if (req->wct < 1) {
4722 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4723 END_PROFILE(SMBsplclose);
4724 return;
4725 }
4726
4727 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4728
4729 if (!check_fsp(conn, req, fsp)) {
4730 END_PROFILE(SMBsplclose);
4731 return;
4732 }
4733
4734 if (!CAN_PRINT(conn)) {
4735 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4736 END_PROFILE(SMBsplclose);
4737 return;
4738 }
4739
4740 DEBUG(3,("printclose fd=%d fnum=%d\n",
4741 fsp->fh->fd,fsp->fnum));
4742
4743 status = close_file(fsp,NORMAL_CLOSE);
4744
4745 if(!NT_STATUS_IS_OK(status)) {
4746 reply_nterror(req, status);
4747 END_PROFILE(SMBsplclose);
4748 return;
4749 }
4750
4751 reply_outbuf(req, 0, 0);
4752
4753 END_PROFILE(SMBsplclose);
4754 return;
4755 }
4756
4757 /****************************************************************************
4758 Reply to a printqueue.
4759 ****************************************************************************/
4760
4761 void reply_printqueue(struct smb_request *req)
4762 {
4763 connection_struct *conn = req->conn;
4764 int max_count;
4765 int start_index;
4766
4767 START_PROFILE(SMBsplretq);
4768
4769 if (req->wct < 2) {
4770 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4771 END_PROFILE(SMBsplretq);
4772 return;
4773 }
4774
4775 max_count = SVAL(req->inbuf,smb_vwv0);
4776 start_index = SVAL(req->inbuf,smb_vwv1);
4777
4778 /* we used to allow the client to get the cnum wrong, but that
4779 is really quite gross and only worked when there was only
4780 one printer - I think we should now only accept it if they
4781 get it right (tridge) */
4782 if (!CAN_PRINT(conn)) {
4783 reply_doserror(req, ERRDOS, ERRnoaccess);
4784 END_PROFILE(SMBsplretq);
4785 return;
4786 }
4787
4788 reply_outbuf(req, 2, 3);
4789 SSVAL(req->outbuf,smb_vwv0,0);
4790 SSVAL(req->outbuf,smb_vwv1,0);
4791 SCVAL(smb_buf(req->outbuf),0,1);
4792 SSVAL(smb_buf(req->outbuf),1,0);
4793
4794 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4795 start_index, max_count));
4796
4797 {
4798 print_queue_struct *queue = NULL;
4799 print_status_struct status;
4800 int count = print_queue_status(SNUM(conn), &queue, &status);
4801 int num_to_get = ABS(max_count);
4802 int first = (max_count>0?start_index:start_index+max_count+1);
4803 int i;
4804
4805 if (first >= count)
4806 num_to_get = 0;
4807 else
4808 num_to_get = MIN(num_to_get,count-first);
4809
4810
4811 for (i=first;i<first+num_to_get;i++) {
4812 char blob[28];
4813 char *p = blob;
4814
4815 srv_put_dos_date2(p,0,queue[i].time);
4816 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4817 SSVAL(p,5, queue[i].job);
4818 SIVAL(p,7,queue[i].size);
4819 SCVAL(p,11,0);
4820 srvstr_push(blob, req->flags2, p+12,
4821 queue[i].fs_user, 16, STR_ASCII);
4822
4823 if (message_push_blob(
4824 &req->outbuf,
4825 data_blob_const(
4826 blob, sizeof(blob))) == -1) {
4827 reply_nterror(req, NT_STATUS_NO_MEMORY);
4828 END_PROFILE(SMBsplretq);
4829 return;
4830 }
4831 }
4832
4833 if (count > 0) {
4834 SSVAL(req->outbuf,smb_vwv0,count);
4835 SSVAL(req->outbuf,smb_vwv1,
4836 (max_count>0?first+count:first-1));
4837 SCVAL(smb_buf(req->outbuf),0,1);
4838 SSVAL(smb_buf(req->outbuf),1,28*count);
4839 }
4840
4841 SAFE_FREE(queue);
4842
4843 DEBUG(3,("%d entries returned in queue\n",count));
4844 }
4845
4846 END_PROFILE(SMBsplretq);
4847 return;
4848 }
4849
4850 /****************************************************************************
4851 Reply to a printwrite.
4852 ****************************************************************************/
4853
4854 void reply_printwrite(struct smb_request *req)
4855 {
4856 connection_struct *conn = req->conn;
4857 int numtowrite;
4858 char *data;
4859 files_struct *fsp;
4860
4861 START_PROFILE(SMBsplwr);
4862
4863 if (req->wct < 1) {
4864 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4865 END_PROFILE(SMBsplwr);
4866 return;
4867 }
4868
4869 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4870
4871 if (!check_fsp(conn, req, fsp)) {
4872 END_PROFILE(SMBsplwr);
4873 return;
4874 }
4875
4876 if (!CAN_PRINT(conn)) {
4877 reply_doserror(req, ERRDOS, ERRnoaccess);
4878 END_PROFILE(SMBsplwr);
4879 return;
4880 }
4881
4882 if (!CHECK_WRITE(fsp)) {
4883 reply_doserror(req, ERRDOS, ERRbadaccess);
4884 END_PROFILE(SMBsplwr);
4885 return;
4886 }
4887
4888 numtowrite = SVAL(smb_buf(req->inbuf),1);
4889
4890 if (smb_buflen(req->inbuf) < numtowrite + 3) {
4891 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4892 END_PROFILE(SMBsplwr);
4893 return;
4894 }
4895
4896 data = smb_buf(req->inbuf) + 3;
4897
4898 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4899 reply_unixerror(req, ERRHRD, ERRdiskfull);
4900 END_PROFILE(SMBsplwr);
4901 return;
4902 }
4903
4904 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4905
4906 END_PROFILE(SMBsplwr);
4907 return;
4908 }
4909
4910 /****************************************************************************
4911 Reply to a mkdir.
4912 ****************************************************************************/
4913
4914 void reply_mkdir(struct smb_request *req)
4915 {
4916 connection_struct *conn = req->conn;
4917 char *directory = NULL;
4918 NTSTATUS status;
4919 SMB_STRUCT_STAT sbuf;
4920 TALLOC_CTX *ctx = talloc_tos();
4921
4922 START_PROFILE(SMBmkdir);
4923
4924 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4925 smb_buf(req->inbuf) + 1, 0,
4926 STR_TERMINATE, &status);
4927 if (!NT_STATUS_IS_OK(status)) {
4928 reply_nterror(req, status);
4929 END_PROFILE(SMBmkdir);
4930 return;
4931 }
4932
4933 status = resolve_dfspath(ctx, conn,
4934 req->flags2 & FLAGS2_DFS_PATHNAMES,
4935 directory,
4936 &directory);
4937 if (!NT_STATUS_IS_OK(status)) {
4938 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4939 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4940 ERRSRV, ERRbadpath);
4941 END_PROFILE(SMBmkdir);
4942 return;
4943 }
4944 reply_nterror(req, status);
4945 END_PROFILE(SMBmkdir);
4946 return;
4947 }
4948
4949 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4950 if (!NT_STATUS_IS_OK(status)) {
4951 reply_nterror(req, status);
4952 END_PROFILE(SMBmkdir);
4953 return;
4954 }
4955
4956 status = check_name(conn, directory);
4957 if (!NT_STATUS_IS_OK(status)) {
4958 reply_nterror(req, status);
4959 END_PROFILE(SMBmkdir);
4960 return;
4961 }
4962
4963 status = create_directory(conn, req, directory);
4964
4965 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4966
4967 if (!NT_STATUS_IS_OK(status)) {
4968
4969 if (!use_nt_status()
4970 && NT_STATUS_EQUAL(status,
4971 NT_STATUS_OBJECT_NAME_COLLISION)) {
4972 /*
4973 * Yes, in the DOS error code case we get a
4974 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4975 * samba4 torture test.
4976 */
4977 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4978 }
4979
4980 reply_nterror(req, status);
4981 END_PROFILE(SMBmkdir);
4982 return;
4983 }
4984
4985 reply_outbuf(req, 0, 0);
4986
4987 DEBUG( 3, ( "mkdir %s\n", directory ) );
4988
4989 END_PROFILE(SMBmkdir);
4990 return;
4991 }
4992
4993 /****************************************************************************
4994 Static function used by reply_rmdir to delete an entire directory
4995 tree recursively. Return True on ok, False on fail.
4996 ****************************************************************************/
4997
4998 static bool recursive_rmdir(TALLOC_CTX *ctx,
4999 connection_struct *conn,
5000 char *directory)
5001 {
5002 const char *dname = NULL;
5003 bool ret = True;
5004 long offset = 0;
5005 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5006 NULL, 0);
5007
5008 if(dir_hnd == NULL)
5009 return False;
5010
5011 while((dname = ReadDirName(dir_hnd, &offset))) {
5012 char *fullname = NULL;
5013 SMB_STRUCT_STAT st;
5014
5015 if (ISDOT(dname) || ISDOTDOT(dname)) {
5016 continue;
5017 }
5018
5019 if (!is_visible_file(conn, directory, dname, &st, False)) {
5020 continue;
5021 }
5022
5023 /* Construct the full name. */
5024 fullname = talloc_asprintf(ctx,
5025 "%s/%s",
5026 directory,
5027 dname);
5028 if (!fullname) {
5029 errno = ENOMEM;
5030 ret = False;
5031 break;
5032 }
5033
5034 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5035 ret = False;
5036 break;
5037 }
5038
5039 if(st.st_mode & S_IFDIR) {
5040 if(!recursive_rmdir(ctx, conn, fullname)) {
5041 ret = False;
5042 break;
5043 }
5044 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5045 ret = False;
5046 break;
5047 }
5048 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5049 ret = False;
5050 break;
5051 }
5052 TALLOC_FREE(fullname);
5053 }
5054 TALLOC_FREE(dir_hnd);
5055 return ret;
5056 }
5057
5058 /****************************************************************************
5059 The internals of the rmdir code - called elsewhere.
5060 ****************************************************************************/
5061
5062 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5063 connection_struct *conn,
5064 const char *directory)
5065 {
5066 int ret;
5067 SMB_STRUCT_STAT st;
5068
5069 /* Might be a symlink. */
5070 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5071 return map_nt_error_from_unix(errno);
5072 }
5073
5074 if (S_ISLNK(st.st_mode)) {
5075 /* Is what it points to a directory ? */
5076 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5077 return map_nt_error_from_unix(errno);
5078 }
5079 if (!(S_ISDIR(st.st_mode))) {
5080 return NT_STATUS_NOT_A_DIRECTORY;
5081 }
5082 ret = SMB_VFS_UNLINK(conn,directory);
5083 } else {
5084 ret = SMB_VFS_RMDIR(conn,directory);
5085 }
5086 if (ret == 0) {
5087 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5088 FILE_NOTIFY_CHANGE_DIR_NAME,
5089 directory);
5090 return NT_STATUS_OK;
5091 }
5092
5093 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5094 /*
5095 * Check to see if the only thing in this directory are
5096 * vetoed files/directories. If so then delete them and
5097 * retry. If we fail to delete any of them (and we *don't*
5098 * do a recursive delete) then fail the rmdir.
5099 */
5100 const char *dname;
5101 long dirpos = 0;
5102 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5103 directory, NULL, 0);
5104
5105 if(dir_hnd == NULL) {
5106 errno = ENOTEMPTY;
5107 goto err;
5108 }
5109
5110 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5111 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5112 continue;
5113 if (!is_visible_file(conn, directory, dname, &st, False))
5114 continue;
5115 if(!IS_VETO_PATH(conn, dname)) {
5116 TALLOC_FREE(dir_hnd);
5117 errno = ENOTEMPTY;
5118 goto err;
5119 }
5120 }
5121
5122 /* We only have veto files/directories.
5123 * Are we allowed to delete them ? */
5124
5125 if(!lp_recursive_veto_delete(SNUM(conn))) {
5126 TALLOC_FREE(dir_hnd);
5127 errno = ENOTEMPTY;
5128 goto err;
5129 }
5130
5131 /* Do a recursive delete. */
5132 RewindDir(dir_hnd,&dirpos);
5133 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5134 char *fullname = NULL;
5135
5136 if (ISDOT(dname) || ISDOTDOT(dname)) {
5137 continue;
5138 }
5139 if (!is_visible_file(conn, directory, dname, &st, False)) {
5140 continue;
5141 }
5142
5143 fullname = talloc_asprintf(ctx,
5144 "%s/%s",
5145 directory,
5146 dname);
5147
5148 if(!fullname) {
5149 errno = ENOMEM;
5150 break;
5151 }
5152
5153 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5154 break;
5155 }
5156 if(st.st_mode & S_IFDIR) {
5157 if(!recursive_rmdir(ctx, conn, fullname)) {
5158 break;
5159 }
5160 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5161 break;
5162 }
5163 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5164 break;
5165 }
5166 TALLOC_FREE(fullname);
5167 }
5168 TALLOC_FREE(dir_hnd);
5169 /* Retry the rmdir */
5170 ret = SMB_VFS_RMDIR(conn,directory);
5171 }
5172
5173 err:
5174
5175 if (ret != 0) {
5176 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5177 "%s\n", directory,strerror(errno)));
5178 return map_nt_error_from_unix(errno);
5179 }
5180
5181 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5182 FILE_NOTIFY_CHANGE_DIR_NAME,
5183 directory);
5184
5185 return NT_STATUS_OK;
5186 }
5187
5188 /****************************************************************************
5189 Reply to a rmdir.
5190 ****************************************************************************/
5191
5192 void reply_rmdir(struct smb_request *req)
5193 {
5194 connection_struct *conn = req->conn;
5195 char *directory = NULL;
5196 SMB_STRUCT_STAT sbuf;
5197 NTSTATUS status;
5198 TALLOC_CTX *ctx = talloc_tos();
5199
5200 START_PROFILE(SMBrmdir);
5201
5202 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5203 smb_buf(req->inbuf) + 1, 0,
5204 STR_TERMINATE, &status);
5205 if (!NT_STATUS_IS_OK(status)) {
5206 reply_nterror(req, status);
5207 END_PROFILE(SMBrmdir);
5208 return;
5209 }
5210
5211 status = resolve_dfspath(ctx, conn,
5212 req->flags2 & FLAGS2_DFS_PATHNAMES,
5213 directory,
5214 &directory);
5215 if (!NT_STATUS_IS_OK(status)) {
5216 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5217 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5218 ERRSRV, ERRbadpath);
5219 END_PROFILE(SMBrmdir);
5220 return;
5221 }
5222 reply_nterror(req, status);
5223 END_PROFILE(SMBrmdir);
5224 return;
5225 }
5226
5227 status = unix_convert(ctx, conn, directory, False, &directory,
5228 NULL, &sbuf);
5229 if (!NT_STATUS_IS_OK(status)) {
5230 reply_nterror(req, status);
5231 END_PROFILE(SMBrmdir);
5232 return;
5233 }
5234
5235 status = check_name(conn, directory);
5236 if (!NT_STATUS_IS_OK(status)) {
5237 reply_nterror(req, status);
5238 END_PROFILE(SMBrmdir);
5239 return;
5240 }
5241
5242 dptr_closepath(directory, req->smbpid);
5243 status = rmdir_internals(ctx, conn, directory);
5244 if (!NT_STATUS_IS_OK(status)) {
5245 reply_nterror(req, status);
5246 END_PROFILE(SMBrmdir);
5247 return;
5248 }
5249
5250 reply_outbuf(req, 0, 0);
5251
5252 DEBUG( 3, ( "rmdir %s\n", directory ) );
5253
5254 END_PROFILE(SMBrmdir);
5255 return;
5256 }
5257
5258 /*******************************************************************
5259 Resolve wildcards in a filename rename.
5260 ********************************************************************/
5261
5262 static bool resolve_wildcards(TALLOC_CTX *ctx,
5263 const char *name1,
5264 const char *name2,
5265 char **pp_newname)
5266 {
5267 char *name2_copy = NULL;
5268 char *root1 = NULL;
5269 char *root2 = NULL;
5270 char *ext1 = NULL;
5271 char *ext2 = NULL;
5272 char *p,*p2, *pname1, *pname2;
5273
5274 name2_copy = talloc_strdup(ctx, name2);
5275 if (!name2_copy) {
5276 return False;
5277 }
5278
5279 pname1 = strrchr_m(name1,'/');
5280 pname2 = strrchr_m(name2_copy,'/');
5281
5282 if (!pname1 || !pname2) {
5283 return False;
5284 }
5285
5286 /* Truncate the copy of name2 at the last '/' */
5287 *pname2 = '\0';
5288
5289 /* Now go past the '/' */
5290 pname1++;
5291 pname2++;
5292
5293 root1 = talloc_strdup(ctx, pname1);
5294 root2 = talloc_strdup(ctx, pname2);
5295
5296 if (!root1 || !root2) {
5297 return False;
5298 }
5299
5300 p = strrchr_m(root1,'.');
5301 if (p) {
5302 *p = 0;
5303 ext1 = talloc_strdup(ctx, p+1);
5304 } else {
5305 ext1 = talloc_strdup(ctx, "");
5306 }
5307 p = strrchr_m(root2,'.');
5308 if (p) {
5309 *p = 0;
5310 ext2 = talloc_strdup(ctx, p+1);
5311 } else {
5312 ext2 = talloc_strdup(ctx, "");
5313 }
5314
5315 if (!ext1 || !ext2) {
5316 return False;
5317 }
5318
5319 p = root1;
5320 p2 = root2;
5321 while (*p2) {
5322 if (*p2 == '?') {
5323 /* Hmmm. Should this be mb-aware ? */
5324 *p2 = *p;
5325 p2++;
5326 } else if (*p2 == '*') {
5327 *p2 = '\0';
5328 root2 = talloc_asprintf(ctx, "%s%s",
5329 root2,
5330 p);
5331 if (!root2) {
5332 return False;
5333 }
5334 break;
5335 } else {
5336 p2++;
5337 }
5338 if (*p) {
5339 p++;
5340 }
5341 }
5342
5343 p = ext1;
5344 p2 = ext2;
5345 while (*p2) {
5346 if (*p2 == '?') {
5347 /* Hmmm. Should this be mb-aware ? */
5348 *p2 = *p;
5349 p2++;
5350 } else if (*p2 == '*') {
5351 *p2 = '\0';
5352 ext2 = talloc_asprintf(ctx, "%s%s",
5353 ext2,
5354 p);
5355 if (!ext2) {
5356 return False;
5357 }
5358 break;
5359 } else {
5360 p2++;
5361 }
5362 if (*p) {
5363 p++;
5364 }
5365 }
5366
5367 if (*ext2) {
5368 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5369 name2_copy,
5370 root2,
5371 ext2);
5372 } else {
5373 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5374 name2_copy,
5375 root2);
5376 }
5377
5378 if (!*pp_newname) {
5379 return False;
5380 }
5381
5382 return True;
5383 }
5384
5385 /****************************************************************************
5386 Ensure open files have their names updated. Updated to notify other smbd's
5387 asynchronously.
5388 ****************************************************************************/
5389
5390 static void rename_open_files(connection_struct *conn,
5391 struct share_mode_lock *lck,
5392 const char *newname)
5393 {
5394 files_struct *fsp;
5395 bool did_rename = False;
5396
5397 for(fsp = file_find_di_first(lck->id); fsp;
5398 fsp = file_find_di_next(fsp)) {
5399 /* fsp_name is a relative path under the fsp. To change this for other
5400 sharepaths we need to manipulate relative paths. */
5401 /* TODO - create the absolute path and manipulate the newname
5402 relative to the sharepath. */
5403 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5404 continue;
5405 }
5406 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5407 fsp->fnum, file_id_string_tos(&fsp->file_id),
5408 fsp->fsp_name, newname ));
5409 string_set(&fsp->fsp_name, newname);
5410 did_rename = True;
5411 }
5412
5413 if (!did_rename) {
5414 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5415 file_id_string_tos(&lck->id), newname ));
5416 }
5417
5418 /* Send messages to all smbd's (not ourself) that the name has changed. */
5419 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5420 newname);
5421 }
5422
5423 /****************************************************************************
5424 We need to check if the source path is a parent directory of the destination
5425 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5426 refuse the rename with a sharing violation. Under UNIX the above call can
5427 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5428 probably need to check that the client is a Windows one before disallowing
5429 this as a UNIX client (one with UNIX extensions) can know the source is a
5430 symlink and make this decision intelligently. Found by an excellent bug
5431 report from <AndyLiebman@aol.com>.
5432 ****************************************************************************/
5433
5434 static bool rename_path_prefix_equal(const char *src, const char *dest)
5435 {
5436 const char *psrc = src;
5437 const char *pdst = dest;
5438 size_t slen;
5439
5440 if (psrc[0] == '.' && psrc[1] == '/') {
5441 psrc += 2;
5442 }
5443 if (pdst[0] == '.' && pdst[1] == '/') {
5444 pdst += 2;
5445 }
5446 if ((slen = strlen(psrc)) > strlen(pdst)) {
5447 return False;
5448 }
5449 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5450 }
5451
5452 /*
5453 * Do the notify calls from a rename
5454 */
5455
5456 static void notify_rename(connection_struct *conn, bool is_dir,
5457 const char *oldpath, const char *newpath)
5458 {
5459 char *olddir, *newdir;
5460 const char *oldname, *newname;
5461 uint32 mask;
5462
5463 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5464 : FILE_NOTIFY_CHANGE_FILE_NAME;
5465
5466 if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5467 || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5468 TALLOC_FREE(olddir);
5469 return;
5470 }
5471
5472 if (strcmp(olddir, newdir) == 0) {
5473 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5474 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5475 }
5476 else {
5477 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5478 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5479 }
5480 TALLOC_FREE(olddir);
5481 TALLOC_FREE(newdir);
5482
5483 /* this is a strange one. w2k3 gives an additional event for
5484 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5485 files, but not directories */
5486 if (!is_dir) {
5487 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5488 FILE_NOTIFY_CHANGE_ATTRIBUTES
5489 |FILE_NOTIFY_CHANGE_CREATION,
5490 newpath);
5491 }
5492 }
5493
5494 /****************************************************************************
5495 Rename an open file - given an fsp.
5496 ****************************************************************************/
5497
5498 NTSTATUS rename_internals_fsp(connection_struct *conn,
5499 files_struct *fsp,
5500 char *newname,
5501 const char *newname_last_component,
5502 uint32 attrs,
5503 bool replace_if_exists)
5504 {
5505 TALLOC_CTX *ctx = talloc_tos();
5506 SMB_STRUCT_STAT sbuf, sbuf1;
5507 NTSTATUS status = NT_STATUS_OK;
5508 struct share_mode_lock *lck = NULL;
5509 bool dst_exists, old_is_stream, new_is_stream;
5510
5511 ZERO_STRUCT(sbuf);
5512
5513 status = check_name(conn, newname);
5514 if (!NT_STATUS_IS_OK(status)) {
5515 return status;
5516 }
5517
5518 /* Ensure newname contains a '/' */
5519 if(strrchr_m(newname,'/') == 0) {
5520 newname = talloc_asprintf(ctx,
5521 "./%s",
5522 newname);
5523 if (!newname) {
5524 return NT_STATUS_NO_MEMORY;
5525 }
5526 }
5527
5528 /*
5529 * Check for special case with case preserving and not
5530 * case sensitive. If the old last component differs from the original
5531 * last component only by case, then we should allow
5532 * the rename (user is trying to change the case of the
5533 * filename).
5534 */
5535
5536 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5537 strequal(newname, fsp->fsp_name)) {
5538 char *p;
5539 char *newname_modified_last_component = NULL;
5540
5541 /*
5542 * Get the last component of the modified name.
5543 * Note that we guarantee that newname contains a '/'
5544 * character above.
5545 */
5546 p = strrchr_m(newname,'/');
5547 newname_modified_last_component = talloc_strdup(ctx,
5548 p+1);
5549 if (!newname_modified_last_component) {
5550 return NT_STATUS_NO_MEMORY;
5551 }
5552
5553 if(strcsequal(newname_modified_last_component,
5554 newname_last_component) == False) {
5555 /*
5556 * Replace the modified last component with
5557 * the original.
5558 */
5559 *p = '\0'; /* Truncate at the '/' */
5560 newname = talloc_asprintf(ctx,
5561 "%s/%s",
5562 newname,
5563 newname_last_component);
5564 }
5565 }
5566
5567 /*
5568 * If the src and dest names are identical - including case,
5569 * don't do the rename, just return success.
5570 */
5571
5572 if (strcsequal(fsp->fsp_name, newname)) {
5573 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5574 newname));
5575 return NT_STATUS_OK;
5576 }
5577
5578 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5579 new_is_stream = is_ntfs_stream_name(newname);
5580
5581 /* Return the correct error code if both names aren't streams. */
5582 if (!old_is_stream && new_is_stream) {
5583 return NT_STATUS_OBJECT_NAME_INVALID;
5584 }
5585
5586 if (old_is_stream && !new_is_stream) {
5587 return NT_STATUS_INVALID_PARAMETER;
5588 }
5589
5590 /*
5591 * Have vfs_object_exist also fill sbuf1
5592 */
5593 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5594
5595 if(!replace_if_exists && dst_exists) {
5596 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5597 fsp->fsp_name,newname));
5598 return NT_STATUS_OBJECT_NAME_COLLISION;
5599 }
5600
5601 if (dst_exists) {
5602 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5603 files_struct *dst_fsp = file_find_di_first(fileid);
5604 /* The file can be open when renaming a stream */
5605 if (dst_fsp && !new_is_stream) {
5606 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5607 return NT_STATUS_ACCESS_DENIED;
5608 }
5609 }
5610
5611 /* Ensure we have a valid stat struct for the source. */
5612 if (fsp->fh->fd != -1) {
5613 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5614 return map_nt_error_from_unix(errno);
5615 }
5616 } else {
5617 int ret = -1;
5618 if (fsp->posix_open) {
5619 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5620 } else {
5621 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5622 }
5623 if (ret == -1) {
5624 return map_nt_error_from_unix(errno);
5625 }
5626 }
5627
5628 status = can_rename(conn, fsp, attrs, &sbuf);
5629
5630 if (!NT_STATUS_IS_OK(status)) {
5631 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5632 nt_errstr(status), fsp->fsp_name,newname));
5633 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5634 status = NT_STATUS_ACCESS_DENIED;
5635 return status;
5636 }
5637
5638 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5639 return NT_STATUS_ACCESS_DENIED;
5640 }
5641
5642 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5643 NULL);
5644
5645 /*
5646 * We have the file open ourselves, so not being able to get the
5647 * corresponding share mode lock is a fatal error.
5648 */
5649
5650 SMB_ASSERT(lck != NULL);
5651
5652 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5653 uint32 create_options = fsp->fh->private_options;
5654
5655 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5656 fsp->fsp_name,newname));
5657
5658 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5659
5660 rename_open_files(conn, lck, newname);
5661
5662 /*
5663 * A rename acts as a new file create w.r.t. allowing an initial delete
5664 * on close, probably because in Windows there is a new handle to the
5665 * new file. If initial delete on close was requested but not
5666 * originally set, we need to set it here. This is probably not 100% correct,
5667 * but will work for the CIFSFS client which in non-posix mode
5668 * depends on these semantics. JRA.
5669 */
5670
5671 if (create_options & FILE_DELETE_ON_CLOSE) {
5672 status = can_set_delete_on_close(fsp, True, 0);
5673
5674 if (NT_STATUS_IS_OK(status)) {
5675 /* Note that here we set the *inital* delete on close flag,
5676 * not the regular one. The magic gets handled in close. */
5677 fsp->initial_delete_on_close = True;
5678 }
5679 }
5680 TALLOC_FREE(lck);
5681 return NT_STATUS_OK;
5682 }
5683
5684 TALLOC_FREE(lck);
5685
5686 if (errno == ENOTDIR || errno == EISDIR) {
5687 status = NT_STATUS_OBJECT_NAME_COLLISION;
5688 } else {
5689 status = map_nt_error_from_unix(errno);
5690 }
5691
5692 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5693 nt_errstr(status), fsp->fsp_name,newname));
5694
5695 return status;
5696 }
5697
5698 /****************************************************************************
5699 The guts of the rename command, split out so it may be called by the NT SMB
5700 code.
5701 ****************************************************************************/
5702
5703 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5704 connection_struct *conn,
5705 struct smb_request *req,
5706 const char *name_in,
5707 const char *newname_in,
5708 uint32 attrs,
5709 bool replace_if_exists,
5710 bool src_has_wild,
5711 bool dest_has_wild,
5712 uint32_t access_mask)
5713 {
5714 char *directory = NULL;
5715 char *mask = NULL;
5716 char *last_component_src = NULL;
5717 char *last_component_dest = NULL;
5718 char *name = NULL;
5719 char *newname = NULL;
5720 char *p;
5721 int count=0;
5722 NTSTATUS status = NT_STATUS_OK;
5723 SMB_STRUCT_STAT sbuf1, sbuf2;
5724 struct smb_Dir *dir_hnd = NULL;
5725 const char *dname;
5726 long offset = 0;
5727 bool posix_pathnames = lp_posix_pathnames();
5728
5729 ZERO_STRUCT(sbuf1);
5730 ZERO_STRUCT(sbuf2);
5731
5732 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5733 &last_component_src, &sbuf1);
5734 if (!NT_STATUS_IS_OK(status)) {
5735 return status;
5736 }
5737
5738 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5739 &last_component_dest, &sbuf2);
5740 if (!NT_STATUS_IS_OK(status)) {
5741 return status;
5742 }
5743
5744 /*
5745 * Split the old name into directory and last component
5746 * strings. Note that unix_convert may have stripped off a
5747 * leading ./ from both name and newname if the rename is
5748 * at the root of the share. We need to make sure either both
5749 * name and newname contain a / character or neither of them do
5750 * as this is checked in resolve_wildcards().
5751 */
5752
5753 p = strrchr_m(name,'/');
5754 if (!p) {
5755 directory = talloc_strdup(ctx, ".");
5756 if (!directory) {
5757 return NT_STATUS_NO_MEMORY;
5758 }
5759 mask = name;
5760 } else {
5761 *p = 0;
5762 directory = talloc_strdup(ctx, name);
5763 if (!directory) {
5764 return NT_STATUS_NO_MEMORY;
5765 }
5766 mask = p+1;
5767 *p = '/'; /* Replace needed for exceptional test below. */
5768 }
5769
5770 /*
5771 * We should only check the mangled cache
5772 * here if unix_convert failed. This means
5773 * that the path in 'mask' doesn't exist
5774 * on the file system and so we need to look
5775 * for a possible mangle. This patch from
5776 * Tine Smukavec <valentin.smukavec@hermes.si>.
5777 */
5778
5779 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5780 char *new_mask = NULL;
5781 mangle_lookup_name_from_8_3(ctx,
5782 mask,
5783 &new_mask,
5784 conn->params );
5785 if (new_mask) {
5786 mask = new_mask;
5787 }
5788 }
5789
5790 if (!src_has_wild) {
5791 files_struct *fsp;
5792
5793 /*
5794 * No wildcards - just process the one file.
5795 */
5796 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5797
5798 /* Add a terminating '/' to the directory name. */
5799 directory = talloc_asprintf_append(directory,
5800 "/%s",
5801 mask);
5802 if (!directory) {
5803 return NT_STATUS_NO_MEMORY;
5804 }
5805
5806 /* Ensure newname contains a '/' also */
5807 if(strrchr_m(newname,'/') == 0) {
5808 newname = talloc_asprintf(ctx,
5809 "./%s",
5810 newname);
5811 if (!newname) {
5812 return NT_STATUS_NO_MEMORY;
5813 }
5814 }
5815
5816 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5817 "case_preserve = %d, short case preserve = %d, "
5818 "directory = %s, newname = %s, "
5819 "last_component_dest = %s, is_8_3 = %d\n",
5820 conn->case_sensitive, conn->case_preserve,
5821 conn->short_case_preserve, directory,
5822 newname, last_component_dest, is_short_name));
5823
5824 /* The dest name still may have wildcards. */
5825 if (dest_has_wild) {
5826 char *mod_newname = NULL;
5827 if (!resolve_wildcards(ctx,
5828 directory,newname,&mod_newname)) {
5829 DEBUG(6, ("rename_internals: resolve_wildcards "
5830 "%s %s failed\n",
5831 directory,
5832 newname));
5833 return NT_STATUS_NO_MEMORY;
5834 }
5835 newname = mod_newname;
5836 }
5837
5838 ZERO_STRUCT(sbuf1);
5839 if (posix_pathnames) {
5840 SMB_VFS_LSTAT(conn, directory, &sbuf1);
5841 } else {
5842 SMB_VFS_STAT(conn, directory, &sbuf1);
5843 }
5844
5845 status = S_ISDIR(sbuf1.st_mode) ?
5846 open_directory(conn, req, directory, &sbuf1,
5847 access_mask,
5848 FILE_SHARE_READ|FILE_SHARE_WRITE,
5849 FILE_OPEN,
5850 0,
5851 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5852 NULL,
5853 &fsp)
5854 : open_file_ntcreate(conn, req, directory, &sbuf1,
5855 access_mask,
5856 FILE_SHARE_READ|FILE_SHARE_WRITE,
5857 FILE_OPEN,
5858 0,
5859 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5860 0,
5861 NULL,
5862 &fsp);
5863
5864 if (!NT_STATUS_IS_OK(status)) {
5865 DEBUG(3, ("Could not open rename source %s: %s\n",
5866 directory, nt_errstr(status)));
5867 return status;
5868 }
5869
5870 status = rename_internals_fsp(conn, fsp, newname,
5871 last_component_dest,
5872 attrs, replace_if_exists);
5873
5874 close_file(fsp, NORMAL_CLOSE);
5875
5876 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5877 nt_errstr(status), directory,newname));
5878
5879 return status;
5880 }
5881
5882 /*
5883 * Wildcards - process each file that matches.
5884 */
5885 if (strequal(mask,"????????.???")) {
5886 mask[0] = '*';
5887 mask[1] = '\0';
5888 }
5889
5890 status = check_name(conn, directory);
5891 if (!NT_STATUS_IS_OK(status)) {
5892 return status;
5893 }
5894
5895 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5896 if (dir_hnd == NULL) {
5897 return map_nt_error_from_unix(errno);
5898 }
5899
5900 status = NT_STATUS_NO_SUCH_FILE;
5901 /*
5902 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5903 * - gentest fix. JRA
5904 */
5905
5906 while ((dname = ReadDirName(dir_hnd, &offset))) {
5907 files_struct *fsp = NULL;
5908 char *fname = NULL;
5909 char *destname = NULL;
5910 bool sysdir_entry = False;
5911
5912 /* Quick check for "." and ".." */
5913 if (ISDOT(dname) || ISDOTDOT(dname)) {
5914 if (attrs & aDIR) {
5915 sysdir_entry = True;
5916 } else {
5917 continue;
5918 }
5919 }
5920
5921 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5922 continue;
5923 }
5924
5925 if(!mask_match(dname, mask, conn->case_sensitive)) {
5926 continue;
5927 }
5928
5929 if (sysdir_entry) {
5930 status = NT_STATUS_OBJECT_NAME_INVALID;
5931 break;
5932 }
5933
5934 fname = talloc_asprintf(ctx,
5935 "%s/%s",
5936 directory,
5937 dname);
5938 if (!fname) {
5939 return NT_STATUS_NO_MEMORY;
5940 }
5941
5942 if (!resolve_wildcards(ctx,
5943 fname,newname,&destname)) {
5944 DEBUG(6, ("resolve_wildcards %s %s failed\n",
5945 fname, destname));
5946 TALLOC_FREE(fname);
5947 continue;
5948 }
5949 if (!destname) {
5950 return NT_STATUS_NO_MEMORY;
5951 }
5952
5953 ZERO_STRUCT(sbuf1);
5954 if (posix_pathnames) {
5955 SMB_VFS_LSTAT(conn, fname, &sbuf1);
5956 } else {
5957 SMB_VFS_STAT(conn, fname, &sbuf1);
5958 }
5959
5960 status = S_ISDIR(sbuf1.st_mode) ?
5961 open_directory(conn, req, fname, &sbuf1,
5962 access_mask,
5963 FILE_SHARE_READ|FILE_SHARE_WRITE,
5964 FILE_OPEN,
5965 0,
5966 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5967 NULL,
5968 &fsp)
5969 : open_file_ntcreate(conn, req, fname, &sbuf1,
5970 access_mask,
5971 FILE_SHARE_READ|FILE_SHARE_WRITE,
5972 FILE_OPEN,
5973 0,
5974 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5975 0,
5976 NULL,
5977 &fsp);
5978
5979 if (!NT_STATUS_IS_OK(status)) {
5980 DEBUG(3,("rename_internals: open_file_ntcreate "
5981 "returned %s rename %s -> %s\n",
5982 nt_errstr(status), directory, newname));
5983 break;
5984 }
5985
5986 status = rename_internals_fsp(conn, fsp, destname, dname,
5987 attrs, replace_if_exists);
5988
5989 close_file(fsp, NORMAL_CLOSE);
5990
5991 if (!NT_STATUS_IS_OK(status)) {
5992 DEBUG(3, ("rename_internals_fsp returned %s for "
5993 "rename %s -> %s\n", nt_errstr(status),
5994 directory, newname));
5995 break;
5996 }
5997
5998 count++;
5999
6000 DEBUG(3,("rename_internals: doing rename on %s -> "
6001 "%s\n",fname,destname));
6002
6003 TALLOC_FREE(fname);
6004 TALLOC_FREE(destname);
6005 }
6006 TALLOC_FREE(dir_hnd);
6007
6008 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6009 status = map_nt_error_from_unix(errno);
6010 }
6011
6012 return status;
6013 }
6014
6015 /****************************************************************************
6016 Reply to a mv.
6017 ****************************************************************************/
6018
6019 void reply_mv(struct smb_request *req)
6020 {
6021 connection_struct *conn = req->conn;
6022 char *name = NULL;
6023 char *newname = NULL;
6024 char *p;
6025 uint32 attrs;
6026 NTSTATUS status;
6027 bool src_has_wcard = False;
6028 bool dest_has_wcard = False;
6029 TALLOC_CTX *ctx = talloc_tos();
6030
6031 START_PROFILE(SMBmv);
6032
6033 if (req->wct < 1) {
6034 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6035 END_PROFILE(SMBmv);
6036 return;
6037 }
6038
6039 attrs = SVAL(req->inbuf,smb_vwv0);
6040
6041 p = smb_buf(req->inbuf) + 1;
6042 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6043 0, STR_TERMINATE, &status,
6044 &src_has_wcard);
6045 if (!NT_STATUS_IS_OK(status)) {
6046 reply_nterror(req, status);
6047 END_PROFILE(SMBmv);
6048 return;
6049 }
6050 p++;
6051 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6052 0, STR_TERMINATE, &status,
6053 &dest_has_wcard);
6054 if (!NT_STATUS_IS_OK(status)) {
6055 reply_nterror(req, status);
6056 END_PROFILE(SMBmv);
6057 return;
6058 }
6059
6060 status = resolve_dfspath_wcard(ctx, conn,
6061 req->flags2 & FLAGS2_DFS_PATHNAMES,
6062 name,
6063 &name,
6064 &src_has_wcard);
6065 if (!NT_STATUS_IS_OK(status)) {
6066 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6067 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6068 ERRSRV, ERRbadpath);
6069 END_PROFILE(SMBmv);
6070 return;
6071 }
6072 reply_nterror(req, status);
6073 END_PROFILE(SMBmv);
6074 return;
6075 }
6076
6077 status = resolve_dfspath_wcard(ctx, conn,
6078 req->flags2 & FLAGS2_DFS_PATHNAMES,
6079 newname,
6080 &newname,
6081 &dest_has_wcard);
6082 if (!NT_STATUS_IS_OK(status)) {
6083 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6084 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6085 ERRSRV, ERRbadpath);
6086 END_PROFILE(SMBmv);
6087 return;
6088 }
6089 reply_nterror(req, status);
6090 END_PROFILE(SMBmv);
6091 return;
6092 }
6093
6094 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6095
6096 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6097 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6098 if (!NT_STATUS_IS_OK(status)) {
6099 if (open_was_deferred(req->mid)) {
6100 /* We have re-scheduled this call. */
6101 END_PROFILE(SMBmv);
6102 return;
6103 }
6104 reply_nterror(req, status);
6105 END_PROFILE(SMBmv);
6106 return;
6107 }
6108
6109 reply_outbuf(req, 0, 0);
6110
6111 END_PROFILE(SMBmv);
6112 return;
6113 }
6114
6115 /*******************************************************************
6116 Copy a file as part of a reply_copy.
6117 ******************************************************************/
6118
6119 /*
6120 * TODO: check error codes on all callers
6121 */
6122
6123 NTSTATUS copy_file(TALLOC_CTX *ctx,
6124 connection_struct *conn,
6125 const char *src,
6126 const char *dest1,
6127 int ofun,
6128 int count,
6129 bool target_is_directory)
6130 {
6131 SMB_STRUCT_STAT src_sbuf, sbuf2;
6132 SMB_OFF_T ret=-1;
6133 files_struct *fsp1,*fsp2;
6134 char *dest = NULL;
6135 uint32 dosattrs;
6136 uint32 new_create_disposition;
6137 NTSTATUS status;
6138
6139 dest = talloc_strdup(ctx, dest1);
6140 if (!dest) {
6141 return NT_STATUS_NO_MEMORY;
6142 }
6143 if (target_is_directory) {
6144 const char *p = strrchr_m(src,'/');
6145 if (p) {
6146 p++;
6147 } else {
6148 p = src;
6149 }
6150 dest = talloc_asprintf_append(dest,
6151 "/%s",
6152 p);
6153 if (!dest) {
6154 return NT_STATUS_NO_MEMORY;
6155 }
6156 }
6157
6158 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6159 TALLOC_FREE(dest);
6160 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6161 }
6162
6163 if (!target_is_directory && count) {
6164 new_create_disposition = FILE_OPEN;
6165 } else {
6166 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6167 NULL, NULL, &new_create_disposition, NULL)) {
6168 TALLOC_FREE(dest);
6169 return NT_STATUS_INVALID_PARAMETER;
6170 }
6171 }
6172
6173 status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6174 FILE_GENERIC_READ,
6175 FILE_SHARE_READ|FILE_SHARE_WRITE,
6176 FILE_OPEN,
6177 0,
6178 FILE_ATTRIBUTE_NORMAL,
6179 INTERNAL_OPEN_ONLY,
6180 NULL, &fsp1);
6181
6182 if (!NT_STATUS_IS_OK(status)) {
6183 TALLOC_FREE(dest);
6184 return status;
6185 }
6186
6187 dosattrs = dos_mode(conn, src, &src_sbuf);
6188 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6189 ZERO_STRUCTP(&sbuf2);
6190 }
6191
6192 status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6193 FILE_GENERIC_WRITE,
6194 FILE_SHARE_READ|FILE_SHARE_WRITE,
6195 new_create_disposition,
6196 0,
6197 dosattrs,
6198 INTERNAL_OPEN_ONLY,
6199 NULL, &fsp2);
6200
6201 TALLOC_FREE(dest);
6202
6203 if (!NT_STATUS_IS_OK(status)) {
6204 close_file(fsp1,ERROR_CLOSE);
6205 return status;
6206 }
6207
6208 if ((ofun&3) == 1) {
6209 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6210 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6211 /*
6212 * Stop the copy from occurring.
6213 */
6214 ret = -1;
6215 src_sbuf.st_size = 0;
6216 }
6217 }
6218
6219 if (src_sbuf.st_size) {
6220 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6221 }
6222
6223 close_file(fsp1,NORMAL_CLOSE);
6224
6225 /* Ensure the modtime is set correctly on the destination file. */
6226 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6227
6228 /*
6229 * As we are opening fsp1 read-only we only expect
6230 * an error on close on fsp2 if we are out of space.
6231 * Thus we don't look at the error return from the
6232 * close of fsp1.
6233 */
6234 status = close_file(fsp2,NORMAL_CLOSE);
6235
6236 if (!NT_STATUS_IS_OK(status)) {
6237 return status;
6238 }
6239
6240 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6241 return NT_STATUS_DISK_FULL;
6242 }
6243
6244 return NT_STATUS_OK;
6245 }
6246
6247 /****************************************************************************
6248 Reply to a file copy.
6249 ****************************************************************************/
6250
6251 void reply_copy(struct smb_request *req)
6252 {
6253 connection_struct *conn = req->conn;
6254 char *name = NULL;
6255 char *newname = NULL;
6256 char *directory = NULL;
6257 char *mask = NULL;
6258 char *p;
6259 int count=0;
6260 int error = ERRnoaccess;
6261 int err = 0;
6262 int tid2;
6263 int ofun;
6264 int flags;
6265 bool target_is_directory=False;
6266 bool source_has_wild = False;
6267 bool dest_has_wild = False;
6268 SMB_STRUCT_STAT sbuf1, sbuf2;
6269 NTSTATUS status;
6270 TALLOC_CTX *ctx = talloc_tos();
6271
6272 START_PROFILE(SMBcopy);
6273
6274 if (req->wct < 3) {
6275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6276 END_PROFILE(SMBcopy);
6277 return;
6278 }
6279
6280 tid2 = SVAL(req->inbuf,smb_vwv0);
6281 ofun = SVAL(req->inbuf,smb_vwv1);
6282 flags = SVAL(req->inbuf,smb_vwv2);
6283
6284 p = smb_buf(req->inbuf);
6285 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6286 0, STR_TERMINATE, &status,
6287 &source_has_wild);
6288 if (!NT_STATUS_IS_OK(status)) {
6289 reply_nterror(req, status);
6290 END_PROFILE(SMBcopy);
6291 return;
6292 }
6293 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6294 0, STR_TERMINATE, &status,
6295 &dest_has_wild);
6296 if (!NT_STATUS_IS_OK(status)) {
6297 reply_nterror(req, status);
6298 END_PROFILE(SMBcopy);
6299 return;
6300 }
6301
6302 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6303
6304 if (tid2 != conn->cnum) {
6305 /* can't currently handle inter share copies XXXX */
6306 DEBUG(3,("Rejecting inter-share copy\n"));
6307 reply_doserror(req, ERRSRV, ERRinvdevice);
6308 END_PROFILE(SMBcopy);
6309 return;
6310 }
6311
6312 status = resolve_dfspath_wcard(ctx, conn,
6313 req->flags2 & FLAGS2_DFS_PATHNAMES,
6314 name,
6315 &name,
6316 &source_has_wild);
6317 if (!NT_STATUS_IS_OK(status)) {
6318 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6319 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6320 ERRSRV, ERRbadpath);
6321 END_PROFILE(SMBcopy);
6322 return;
6323 }
6324 reply_nterror(req, status);
6325 END_PROFILE(SMBcopy);
6326 return;
6327 }
6328
6329 status = resolve_dfspath_wcard(ctx, conn,
6330 req->flags2 & FLAGS2_DFS_PATHNAMES,
6331 newname,
6332 &newname,
6333 &dest_has_wild);
6334 if (!NT_STATUS_IS_OK(status)) {
6335 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6336 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6337 ERRSRV, ERRbadpath);
6338 END_PROFILE(SMBcopy);
6339 return;
6340 }
6341 reply_nterror(req, status);
6342 END_PROFILE(SMBcopy);
6343 return;
6344 }
6345
6346 status = unix_convert(ctx, conn, name, source_has_wild,
6347 &name, NULL, &sbuf1);
6348 if (!NT_STATUS_IS_OK(status)) {
6349 reply_nterror(req, status);
6350 END_PROFILE(SMBcopy);
6351 return;
6352 }
6353
6354 status = unix_convert(ctx, conn, newname, dest_has_wild,
6355 &newname, NULL, &sbuf2);
6356 if (!NT_STATUS_IS_OK(status)) {
6357 reply_nterror(req, status);
6358 END_PROFILE(SMBcopy);
6359 return;
6360 }
6361
6362 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6363
6364 if ((flags&1) && target_is_directory) {
6365 reply_doserror(req, ERRDOS, ERRbadfile);
6366 END_PROFILE(SMBcopy);
6367 return;
6368 }
6369
6370 if ((flags&2) && !target_is_directory) {
6371 reply_doserror(req, ERRDOS, ERRbadpath);
6372 END_PROFILE(SMBcopy);
6373 return;
6374 }
6375
6376 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6377 /* wants a tree copy! XXXX */
6378 DEBUG(3,("Rejecting tree copy\n"));
6379 reply_doserror(req, ERRSRV, ERRerror);
6380 END_PROFILE(SMBcopy);
6381 return;
6382 }
6383
6384 p = strrchr_m(name,'/');
6385 if (!p) {
6386 directory = talloc_strdup(ctx, "./");
6387 if (!directory) {
6388 reply_nterror(req, NT_STATUS_NO_MEMORY);
6389 END_PROFILE(SMBcopy);
6390 return;
6391 }
6392 mask = name;
6393 } else {
6394 *p = 0;
6395 directory = talloc_strdup(ctx, name);
6396 if (!directory) {
6397 reply_nterror(req, NT_STATUS_NO_MEMORY);
6398 END_PROFILE(SMBcopy);
6399 return;
6400 }
6401 mask = p+1;
6402 }
6403
6404 /*
6405 * We should only check the mangled cache
6406 * here if unix_convert failed. This means
6407 * that the path in 'mask' doesn't exist
6408 * on the file system and so we need to look
6409 * for a possible mangle. This patch from
6410 * Tine Smukavec <valentin.smukavec@hermes.si>.
6411 */
6412
6413 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6414 char *new_mask = NULL;
6415 mangle_lookup_name_from_8_3(ctx,
6416 mask,
6417 &new_mask,
6418 conn->params );
6419 if (new_mask) {
6420 mask = new_mask;
6421 }
6422 }
6423
6424 if (!source_has_wild) {
6425 directory = talloc_asprintf_append(directory,
6426 "/%s",
6427 mask);
6428 if (dest_has_wild) {
6429 char *mod_newname = NULL;
6430 if (!resolve_wildcards(ctx,
6431 directory,newname,&mod_newname)) {
6432 reply_nterror(req, NT_STATUS_NO_MEMORY);
6433 END_PROFILE(SMBcopy);
6434 return;
6435 }
6436 newname = mod_newname;
6437 }
6438
6439 status = check_name(conn, directory);
6440 if (!NT_STATUS_IS_OK(status)) {
6441 reply_nterror(req, status);
6442 END_PROFILE(SMBcopy);
6443 return;
6444 }
6445
6446 status = check_name(conn, newname);
6447 if (!NT_STATUS_IS_OK(status)) {
6448 reply_nterror(req, status);
6449 END_PROFILE(SMBcopy);
6450 return;
6451 }
6452
6453 status = copy_file(ctx,conn,directory,newname,ofun,
6454 count,target_is_directory);
6455
6456 if(!NT_STATUS_IS_OK(status)) {
6457 reply_nterror(req, status);
6458 END_PROFILE(SMBcopy);
6459 return;
6460 } else {
6461 count++;
6462 }
6463 } else {
6464 struct smb_Dir *dir_hnd = NULL;
6465 const char *dname = NULL;
6466 long offset = 0;
6467
6468 if (strequal(mask,"????????.???")) {
6469 mask[0] = '*';
6470 mask[1] = '\0';
6471 }
6472
6473 status = check_name(conn, directory);
6474 if (!NT_STATUS_IS_OK(status)) {
6475 reply_nterror(req, status);
6476 END_PROFILE(SMBcopy);
6477 return;
6478 }
6479
6480 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6481 if (dir_hnd == NULL) {
6482 status = map_nt_error_from_unix(errno);
6483 reply_nterror(req, status);
6484 END_PROFILE(SMBcopy);
6485 return;
6486 }
6487
6488 error = ERRbadfile;
6489
6490 while ((dname = ReadDirName(dir_hnd, &offset))) {
6491 char *destname = NULL;
6492 char *fname = NULL;
6493
6494 if (ISDOT(dname) || ISDOTDOT(dname)) {
6495 continue;
6496 }
6497
6498 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6499 continue;
6500 }
6501
6502 if(!mask_match(dname, mask, conn->case_sensitive)) {
6503 continue;
6504 }
6505
6506 error = ERRnoaccess;
6507 fname = talloc_asprintf(ctx,
6508 "%s/%s",
6509 directory,
6510 dname);
6511 if (!fname) {
6512 TALLOC_FREE(dir_hnd);
6513 reply_nterror(req, NT_STATUS_NO_MEMORY);
6514 END_PROFILE(SMBcopy);
6515 return;
6516 }
6517
6518 if (!resolve_wildcards(ctx,
6519 fname,newname,&destname)) {
6520 continue;
6521 }
6522 if (!destname) {
6523 TALLOC_FREE(dir_hnd);
6524 reply_nterror(req, NT_STATUS_NO_MEMORY);
6525 END_PROFILE(SMBcopy);
6526 return;
6527 }
6528
6529 status = check_name(conn, fname);
6530 if (!NT_STATUS_IS_OK(status)) {
6531 TALLOC_FREE(dir_hnd);
6532 reply_nterror(req, status);
6533 END_PROFILE(SMBcopy);
6534 return;
6535 }
6536
6537 status = check_name(conn, destname);
6538 if (!NT_STATUS_IS_OK(status)) {
6539 TALLOC_FREE(dir_hnd);
6540 reply_nterror(req, status);
6541 END_PROFILE(SMBcopy);
6542 return;
6543 }
6544
6545 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6546
6547 status = copy_file(ctx,conn,fname,destname,ofun,
6548 count,target_is_directory);
6549 if (NT_STATUS_IS_OK(status)) {
6550 count++;
6551 }
6552 TALLOC_FREE(fname);
6553 TALLOC_FREE(destname);
6554 }
6555 TALLOC_FREE(dir_hnd);
6556 }
6557
6558 if (count == 0) {
6559 if(err) {
6560 /* Error on close... */
6561 errno = err;
6562 reply_unixerror(req, ERRHRD, ERRgeneral);
6563 END_PROFILE(SMBcopy);
6564 return;
6565 }
6566
6567 reply_doserror(req, ERRDOS, error);
6568 END_PROFILE(SMBcopy);
6569 return;
6570 }
6571
6572 reply_outbuf(req, 1, 0);
6573 SSVAL(req->outbuf,smb_vwv0,count);
6574
6575 END_PROFILE(SMBcopy);
6576 return;
6577 }
6578
6579 #undef DBGC_CLASS
6580 #define DBGC_CLASS DBGC_LOCKING
6581
6582 /****************************************************************************
6583 Get a lock pid, dealing with large count requests.
6584 ****************************************************************************/
6585
6586 uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
6587 {
6588 if(!large_file_format)
6589 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6590 else
6591 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6592 }
6593
6594 /****************************************************************************
6595 Get a lock count, dealing with large count requests.
6596 ****************************************************************************/
6597
6598 SMB_BIG_UINT get_lock_count( char *data, int data_offset, bool large_file_format)
6599 {
6600 SMB_BIG_UINT count = 0;
6601
6602 if(!large_file_format) {
6603 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6604 } else {
6605
6606 #if defined(HAVE_LONGLONG)
6607 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6608 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6609 #else /* HAVE_LONGLONG */
6610
6611 /*
6612 * NT4.x seems to be broken in that it sends large file (64 bit)
6613 * lockingX calls even if the CAP_LARGE_FILES was *not*
6614 * negotiated. For boxes without large unsigned ints truncate the
6615 * lock count by dropping the top 32 bits.
6616 */
6617
6618 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6619 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6620 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6621 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6622 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6623 }
6624
6625 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6626 #endif /* HAVE_LONGLONG */
6627 }
6628
6629 return count;
6630 }
6631
6632 #if !defined(HAVE_LONGLONG)
6633 /****************************************************************************
6634 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6635 ****************************************************************************/
6636
6637 static uint32 map_lock_offset(uint32 high, uint32 low)
6638 {
6639 unsigned int i;
6640 uint32 mask = 0;
6641 uint32 highcopy = high;
6642
6643 /*
6644 * Try and find out how many significant bits there are in high.
6645 */
6646
6647 for(i = 0; highcopy; i++)
6648 highcopy >>= 1;
6649
6650 /*
6651 * We use 31 bits not 32 here as POSIX
6652 * lock offsets may not be negative.
6653 */
6654
6655 mask = (~0) << (31 - i);
6656
6657 if(low & mask)
6658 return 0; /* Fail. */
6659
6660 high <<= (31 - i);
6661
6662 return (high|low);
6663 }
6664 #endif /* !defined(HAVE_LONGLONG) */
6665
6666 /****************************************************************************
6667 Get a lock offset, dealing with large offset requests.
6668 ****************************************************************************/
6669
6670 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
6671 {
6672 SMB_BIG_UINT offset = 0;
6673
6674 *err = False;
6675
6676 if(!large_file_format) {
6677 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6678 } else {
6679
6680 #if defined(HAVE_LONGLONG)
6681 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6682 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6683 #else /* HAVE_LONGLONG */
6684
6685 /*
6686 * NT4.x seems to be broken in that it sends large file (64 bit)
6687 * lockingX calls even if the CAP_LARGE_FILES was *not*
6688 * negotiated. For boxes without large unsigned ints mangle the
6689 * lock offset by mapping the top 32 bits onto the lower 32.
6690 */
6691
6692 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6693 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6694 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6695 uint32 new_low = 0;
6696
6697 if((new_low = map_lock_offset(high, low)) == 0) {
6698 *err = True;
6699 return (SMB_BIG_UINT)-1;
6700 }
6701
6702 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6703 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6704 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6705 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6706 }
6707
6708 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6709 #endif /* HAVE_LONGLONG */
6710 }
6711
6712 return offset;
6713 }
6714
6715 /****************************************************************************
6716 Reply to a lockingX request.
6717 ****************************************************************************/
6718
6719 void reply_lockingX(struct smb_request *req)
6720 {
6721 connection_struct *conn = req->conn;
6722 files_struct *fsp;
6723 unsigned char locktype;
6724 unsigned char oplocklevel;
6725 uint16 num_ulocks;
6726 uint16 num_locks;
6727 SMB_BIG_UINT count = 0, offset = 0;
6728 uint32 lock_pid;
6729 int32 lock_timeout;
6730 int i;
6731 char *data;
6732 bool large_file_format;
6733 bool err;
6734 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6735
6736 START_PROFILE(SMBlockingX);
6737
6738 if (req->wct < 8) {
6739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6740 END_PROFILE(SMBlockingX);
6741 return;
6742 }
6743
6744 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
6745 locktype = CVAL(req->inbuf,smb_vwv3);
6746 oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6747 num_ulocks = SVAL(req->inbuf,smb_vwv6);
6748 num_locks = SVAL(req->inbuf,smb_vwv7);
6749 lock_timeout = IVAL(req->inbuf,smb_vwv4);
6750 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6751
6752 if (!check_fsp(conn, req, fsp)) {
6753 END_PROFILE(SMBlockingX);
6754 return;
6755 }
6756
6757 data = smb_buf(req->inbuf);
6758
6759 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6760 /* we don't support these - and CANCEL_LOCK makes w2k
6761 and XP reboot so I don't really want to be
6762 compatible! (tridge) */
6763 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6764 END_PROFILE(SMBlockingX);
6765 return;
6766 }
6767
6768 /* Check if this is an oplock break on a file
6769 we have granted an oplock on.
6770 */
6771 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6772 /* Client can insist on breaking to none. */
6773 bool break_to_none = (oplocklevel == 0);
6774 bool result;
6775
6776 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6777 "for fnum = %d\n", (unsigned int)oplocklevel,
6778 fsp->fnum ));
6779
6780 /*
6781 * Make sure we have granted an exclusive or batch oplock on
6782 * this file.
6783 */
6784
6785 if (fsp->oplock_type == 0) {
6786
6787 /* The Samba4 nbench simulator doesn't understand
6788 the difference between break to level2 and break
6789 to none from level2 - it sends oplock break
6790 replies in both cases. Don't keep logging an error
6791 message here - just ignore it. JRA. */
6792
6793 DEBUG(5,("reply_lockingX: Error : oplock break from "
6794 "client for fnum = %d (oplock=%d) and no "
6795 "oplock granted on this file (%s).\n",
6796 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6797
6798 /* if this is a pure oplock break request then don't
6799 * send a reply */
6800 if (num_locks == 0 && num_ulocks == 0) {
6801 END_PROFILE(SMBlockingX);
6802 return;
6803 } else {
6804 END_PROFILE(SMBlockingX);
6805 reply_doserror(req, ERRDOS, ERRlock);
6806 return;
6807 }
6808 }
6809
6810 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6811 (break_to_none)) {
6812 result = remove_oplock(fsp);
6813 } else {
6814 result = downgrade_oplock(fsp);
6815 }
6816
6817 if (!result) {
6818 DEBUG(0, ("reply_lockingX: error in removing "
6819 "oplock on file %s\n", fsp->fsp_name));
6820 /* Hmmm. Is this panic justified? */
6821 smb_panic("internal tdb error");
6822 }
6823
6824 reply_to_oplock_break_requests(fsp);
6825
6826 /* if this is a pure oplock break request then don't send a
6827 * reply */
6828 if (num_locks == 0 && num_ulocks == 0) {
6829 /* Sanity check - ensure a pure oplock break is not a
6830 chained request. */
6831 if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6832 DEBUG(0,("reply_lockingX: Error : pure oplock "
6833 "break is a chained %d request !\n",
6834 (unsigned int)CVAL(req->inbuf,
6835 smb_vwv0) ));
6836 END_PROFILE(SMBlockingX);
6837 return;
6838 }
6839 }
6840
6841 /*
6842 * We do this check *after* we have checked this is not a oplock break
6843 * response message. JRA.
6844 */
6845
6846 release_level_2_oplocks_on_change(fsp);
6847
6848 if (smb_buflen(req->inbuf) <
6849 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6850 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6851 END_PROFILE(SMBlockingX);
6852 return;
6853 }
6854
6855 /* Data now points at the beginning of the list
6856 of smb_unlkrng structs */
6857 for(i = 0; i < (int)num_ulocks; i++) {
6858 lock_pid = get_lock_pid( data, i, large_file_format);
6859 count = get_lock_count( data, i, large_file_format);
6860 offset = get_lock_offset( data, i, large_file_format, &err);
6861
6862 /*
6863 * There is no error code marked "stupid client bug".... :-).
6864 */
6865 if(err) {
6866 END_PROFILE(SMBlockingX);
6867 reply_doserror(req, ERRDOS, ERRnoaccess);
6868 return;
6869 }
6870
6871 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6872 "pid %u, file %s\n", (double)offset, (double)count,
6873 (unsigned int)lock_pid, fsp->fsp_name ));
6874
6875 status = do_unlock(smbd_messaging_context(),
6876 fsp,
6877 lock_pid,
6878 count,
6879 offset,
6880 WINDOWS_LOCK);
6881
6882 if (NT_STATUS_V(status)) {
6883 END_PROFILE(SMBlockingX);
6884 reply_nterror(req, status);
6885 return;
6886 }
6887 }
6888
6889 /* Setup the timeout in seconds. */
6890
6891 if (!lp_blocking_locks(SNUM(conn))) {
6892 lock_timeout = 0;
6893 }
6894
6895 /* Now do any requested locks */
6896 data += ((large_file_format ? 20 : 10)*num_ulocks);
6897
6898 /* Data now points at the beginning of the list
6899 of smb_lkrng structs */
6900
6901 for(i = 0; i < (int)num_locks; i++) {
6902 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6903 READ_LOCK:WRITE_LOCK);
6904 lock_pid = get_lock_pid( data, i, large_file_format);
6905 count = get_lock_count( data, i, large_file_format);
6906 offset = get_lock_offset( data, i, large_file_format, &err);
6907
6908 /*
6909 * There is no error code marked "stupid client bug".... :-).
6910 */
6911 if(err) {
6912 END_PROFILE(SMBlockingX);
6913 reply_doserror(req, ERRDOS, ERRnoaccess);
6914 return;
6915 }
6916
6917 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6918 "%u, file %s timeout = %d\n", (double)offset,
6919 (double)count, (unsigned int)lock_pid,
6920 fsp->fsp_name, (int)lock_timeout ));
6921
6922 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6923 if (lp_blocking_locks(SNUM(conn))) {
6924
6925 /* Schedule a message to ourselves to
6926 remove the blocking lock record and
6927 return the right error. */
6928
6929 if (!blocking_lock_cancel(fsp,
6930 lock_pid,
6931 offset,
6932 count,
6933 WINDOWS_LOCK,
6934 locktype,
6935 NT_STATUS_FILE_LOCK_CONFLICT)) {
6936 END_PROFILE(SMBlockingX);
6937 reply_nterror(
6938 req,
6939 NT_STATUS_DOS(
6940 ERRDOS,
6941 ERRcancelviolation));
6942 return;
6943 }
6944 }
6945 /* Remove a matching pending lock. */
6946 status = do_lock_cancel(fsp,
6947 lock_pid,
6948 count,
6949 offset,
6950 WINDOWS_LOCK);
6951 } else {
6952 bool blocking_lock = lock_timeout ? True : False;
6953 bool defer_lock = False;
6954 struct byte_range_lock *br_lck;
6955 uint32 block_smbpid;
6956
6957 br_lck = do_lock(smbd_messaging_context(),
6958 fsp,
6959 lock_pid,
6960 count,
6961 offset,
6962 lock_type,
6963 WINDOWS_LOCK,
6964 blocking_lock,
6965 &status,
6966 &block_smbpid);
6967
6968 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6969 /* Windows internal resolution for blocking locks seems
6970 to be about 200ms... Don't wait for less than that. JRA. */
6971 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6972 lock_timeout = lp_lock_spin_time();
6973 }
6974 defer_lock = True;
6975 }
6976
6977 /* This heuristic seems to match W2K3 very well. If a
6978 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6979 it pretends we asked for a timeout of between 150 - 300 milliseconds as
6980 far as I can tell. Replacement for do_lock_spin(). JRA. */
6981
6982 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6983 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6984 defer_lock = True;
6985 lock_timeout = lp_lock_spin_time();
6986 }
6987
6988 if (br_lck && defer_lock) {
6989 /*
6990 * A blocking lock was requested. Package up
6991 * this smb into a queued request and push it
6992 * onto the blocking lock queue.
6993 */
6994 if(push_blocking_lock_request(br_lck,
6995 req,
6996 fsp,
6997 lock_timeout,
6998 i,
6999 lock_pid,
7000 lock_type,
7001 WINDOWS_LOCK,
7002 offset,
7003 count,
7004 block_smbpid)) {
7005 TALLOC_FREE(br_lck);
7006 END_PROFILE(SMBlockingX);
7007 return;
7008 }
7009 }
7010
7011 TALLOC_FREE(br_lck);
7012 }
7013
7014 if (NT_STATUS_V(status)) {
7015 END_PROFILE(SMBlockingX);
7016 reply_nterror(req, status);
7017 return;
7018 }
7019 }
7020
7021 /* If any of the above locks failed, then we must unlock
7022 all of the previous locks (X/Open spec). */
7023
7024 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7025 (i != num_locks) &&
7026 (num_locks != 0)) {
7027 /*
7028 * Ensure we don't do a remove on the lock that just failed,
7029 * as under POSIX rules, if we have a lock already there, we
7030 * will delete it (and we shouldn't) .....
7031 */
7032 for(i--; i >= 0; i--) {
7033 lock_pid = get_lock_pid( data, i, large_file_format);
7034 count = get_lock_count( data, i, large_file_format);
7035 offset = get_lock_offset( data, i, large_file_format,
7036 &err);
7037
7038 /*
7039 * There is no error code marked "stupid client
7040 * bug".... :-).
7041 */
7042 if(err) {
7043 END_PROFILE(SMBlockingX);
7044 reply_doserror(req, ERRDOS, ERRnoaccess);
7045 return;
7046 }
7047
7048 do_unlock(smbd_messaging_context(),
7049 fsp,
7050 lock_pid,
7051 count,
7052 offset,
7053 WINDOWS_LOCK);
7054 }
7055 END_PROFILE(SMBlockingX);
7056 reply_nterror(req, status);
7057 return;
7058 }
7059
7060 reply_outbuf(req, 2, 0);
7061
7062 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7063 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7064
7065 END_PROFILE(SMBlockingX);
7066 chain_reply(req);
7067 }
7068
7069 #undef DBGC_CLASS
7070 #define DBGC_CLASS DBGC_ALL
7071
7072 /****************************************************************************
7073 Reply to a SMBreadbmpx (read block multiplex) request.
7074 Always reply with an error, if someone has a platform really needs this,
7075 please contact vl@samba.org
7076 ****************************************************************************/
7077
7078 void reply_readbmpx(struct smb_request *req)
7079 {
7080 START_PROFILE(SMBreadBmpx);
7081 reply_doserror(req, ERRSRV, ERRuseSTD);
7082 END_PROFILE(SMBreadBmpx);
7083 return;
7084 }
7085
7086 /****************************************************************************
7087 Reply to a SMBreadbs (read block multiplex secondary) request.
7088 Always reply with an error, if someone has a platform really needs this,
7089 please contact vl@samba.org
7090 ****************************************************************************/
7091
7092 void reply_readbs(struct smb_request *req)
7093 {
7094 START_PROFILE(SMBreadBs);
7095 reply_doserror(req, ERRSRV, ERRuseSTD);
7096 END_PROFILE(SMBreadBs);
7097 return;
7098 }
7099
7100 /****************************************************************************
7101 Reply to a SMBsetattrE.
7102 ****************************************************************************/
7103
7104 void reply_setattrE(struct smb_request *req)
7105 {
7106 connection_struct *conn = req->conn;
7107 struct timespec ts[2];
7108 files_struct *fsp;
7109 SMB_STRUCT_STAT sbuf;
7110 NTSTATUS status;
7111
7112 START_PROFILE(SMBsetattrE);
7113
7114 if (req->wct < 7) {
7115 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7116 END_PROFILE(SMBsetattrE);
7117 return;
7118 }
7119
7120 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7121
7122 if(!fsp || (fsp->conn != conn)) {
7123 reply_doserror(req, ERRDOS, ERRbadfid);
7124 END_PROFILE(SMBsetattrE);
7125 return;
7126 }
7127
7128
7129 /*
7130 * Convert the DOS times into unix times. Ignore create
7131 * time as UNIX can't set this.
7132 */
7133
7134 ts[0] = convert_time_t_to_timespec(
7135 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7136 ts[1] = convert_time_t_to_timespec(
7137 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7138
7139 reply_outbuf(req, 0, 0);
7140
7141 /*
7142 * Patch from Ray Frush <frush@engr.colostate.edu>
7143 * Sometimes times are sent as zero - ignore them.
7144 */
7145
7146 /* Ensure we have a valid stat struct for the source. */
7147 if (fsp->fh->fd != -1) {
7148 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7149 status = map_nt_error_from_unix(errno);
7150 reply_nterror(req, status);
7151 END_PROFILE(SMBsetattrE);
7152 return;
7153 }
7154 } else {
7155 int ret = -1;
7156
7157 if (fsp->posix_open) {
7158 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7159 } else {
7160 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7161 }
7162 if (ret == -1) {
7163 status = map_nt_error_from_unix(errno);
7164 reply_nterror(req, status);
7165 END_PROFILE(SMBsetattrE);
7166 return;
7167 }
7168 }
7169
7170 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7171 &sbuf, ts, true);
7172 if (!NT_STATUS_IS_OK(status)) {
7173 reply_doserror(req, ERRDOS, ERRnoaccess);
7174 END_PROFILE(SMBsetattrE);
7175 return;
7176 }
7177
7178 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7179 fsp->fnum,
7180 (unsigned int)ts[0].tv_sec,
7181 (unsigned int)ts[1].tv_sec));
7182
7183 END_PROFILE(SMBsetattrE);
7184 return;
7185 }
7186
7187
7188 /* Back from the dead for OS/2..... JRA. */
7189
7190 /****************************************************************************
7191 Reply to a SMBwritebmpx (write block multiplex primary) request.
7192 Always reply with an error, if someone has a platform really needs this,
7193 please contact vl@samba.org
7194 ****************************************************************************/
7195
7196 void reply_writebmpx(struct smb_request *req)
7197 {
7198 START_PROFILE(SMBwriteBmpx);
7199 reply_doserror(req, ERRSRV, ERRuseSTD);
7200 END_PROFILE(SMBwriteBmpx);
7201 return;
7202 }
7203
7204 /****************************************************************************
7205 Reply to a SMBwritebs (write block multiplex secondary) request.
7206 Always reply with an error, if someone has a platform really needs this,
7207 please contact vl@samba.org
7208 ****************************************************************************/
7209
7210 void reply_writebs(struct smb_request *req)
7211 {
7212 START_PROFILE(SMBwriteBs);
7213 reply_doserror(req, ERRSRV, ERRuseSTD);
7214 END_PROFILE(SMBwriteBs);
7215 return;
7216 }
7217
7218 /****************************************************************************
7219 Reply to a SMBgetattrE.
7220 ****************************************************************************/
7221
7222 void reply_getattrE(struct smb_request *req)
7223 {
7224 connection_struct *conn = req->conn;
7225 SMB_STRUCT_STAT sbuf;
7226 int mode;
7227 files_struct *fsp;
7228 struct timespec create_ts;
7229
7230 START_PROFILE(SMBgetattrE);
7231
7232 if (req->wct < 1) {
7233 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7234 END_PROFILE(SMBgetattrE);
7235 return;
7236 }
7237
7238 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7239
7240 if(!fsp || (fsp->conn != conn)) {
7241 reply_doserror(req, ERRDOS, ERRbadfid);
7242 END_PROFILE(SMBgetattrE);
7243 return;
7244 }
7245
7246 /* Do an fstat on this file */
7247 if(fsp_stat(fsp, &sbuf)) {
7248 reply_unixerror(req, ERRDOS, ERRnoaccess);
7249 END_PROFILE(SMBgetattrE);
7250 return;
7251 }
7252
7253 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7254
7255 /*
7256 * Convert the times into dos times. Set create
7257 * date to be last modify date as UNIX doesn't save
7258 * this.
7259 */
7260
7261 reply_outbuf(req, 11, 0);
7262
7263 create_ts = get_create_timespec(&sbuf,
7264 lp_fake_dir_create_times(SNUM(conn)));
7265 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7266 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7267 /* Should we check pending modtime here ? JRA */
7268 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7269
7270 if (mode & aDIR) {
7271 SIVAL(req->outbuf, smb_vwv6, 0);
7272 SIVAL(req->outbuf, smb_vwv8, 0);
7273 } else {
7274 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7275 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7276 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7277 }
7278 SSVAL(req->outbuf,smb_vwv10, mode);
7279
7280 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7281
7282 END_PROFILE(SMBgetattrE);
7283 return;
7284 }
Samba GIT mirror