?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
regedit: improvements for hexedit
[Samba.git] / source3 / smbd / reply.c
blob21be320bb67be3f846ffeaf03dc8f08c08409637
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const uint8_t *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
535 {
536 struct smbd_server_connection *sconn = xconn->client->sconn;
537 int msg_type = CVAL(inbuf,0);
538 int msg_flags = CVAL(inbuf,1);
539 /*
540 * We only really use 4 bytes of the outbuf, but for the smb_setlen
541 * calculation & friends (srv_send_smb uses that) we need the full smb
542 * header.
543 */
544 char outbuf[smb_size];
545
546 memset(outbuf, '\0', sizeof(outbuf));
547
548 smb_setlen(outbuf,0);
549
550 switch (msg_type) {
551 case NBSSrequest: /* session request */
552 {
553 /* inbuf_size is guarenteed to be at least 4. */
554 fstring name1,name2;
555 int name_type1, name_type2;
556 int name_len1, name_len2;
557
558 *name1 = *name2 = 0;
559
560 if (xconn->transport.nbt.got_session) {
561 exit_server_cleanly("multiple session request not permitted");
562 }
563
564 SCVAL(outbuf,0,NBSSpositive);
565 SCVAL(outbuf,3,0);
566
567 /* inbuf_size is guaranteed to be at least 4. */
568 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
569 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
570 DEBUG(0,("Invalid name length in session request\n"));
571 reply_called_name_not_present(outbuf);
572 break;
573 }
574 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
575 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
576 DEBUG(0,("Invalid name length in session request\n"));
577 reply_called_name_not_present(outbuf);
578 break;
579 }
580
581 name_type1 = name_extract((unsigned char *)inbuf,
582 inbuf_size,(unsigned int)4,name1);
583 name_type2 = name_extract((unsigned char *)inbuf,
584 inbuf_size,(unsigned int)(4 + name_len1),name2);
585
586 if (name_type1 == -1 || name_type2 == -1) {
587 DEBUG(0,("Invalid name type in session request\n"));
588 reply_called_name_not_present(outbuf);
589 break;
590 }
591
592 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
593 name1, name_type1, name2, name_type2));
594
595 if (netbios_session_retarget(xconn, name1, name_type1)) {
596 exit_server_cleanly("retargeted client");
597 }
598
599 /*
600 * Windows NT/2k uses "*SMBSERVER" and XP uses
601 * "*SMBSERV" arrggg!!!
602 */
603 if (strequal(name1, "*SMBSERVER ")
604 || strequal(name1, "*SMBSERV ")) {
605 char *raddr;
606
607 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
608 talloc_tos());
609 if (raddr == NULL) {
610 exit_server_cleanly("could not allocate raddr");
611 }
612
613 fstrcpy(name1, raddr);
614 }
615
616 set_local_machine_name(name1, True);
617 set_remote_machine_name(name2, True);
618
619 if (is_ipaddress(sconn->remote_hostname)) {
620 char *p = discard_const_p(char, sconn->remote_hostname);
621
622 talloc_free(p);
623
624 sconn->remote_hostname = talloc_strdup(sconn,
625 get_remote_machine_name());
626 if (sconn->remote_hostname == NULL) {
627 exit_server_cleanly("could not copy remote name");
628 }
629 xconn->remote_hostname = sconn->remote_hostname;
630 }
631
632 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
633 get_local_machine_name(), get_remote_machine_name(),
634 name_type2));
635
636 if (name_type2 == 'R') {
637 /* We are being asked for a pathworks session ---
638 no thanks! */
639 reply_called_name_not_present(outbuf);
640 break;
641 }
642
643 reload_services(sconn, conn_snum_used, true);
644 reopen_logs();
645
646 xconn->transport.nbt.got_session = true;
647 break;
648 }
649
650 case 0x89: /* session keepalive request
651 (some old clients produce this?) */
652 SCVAL(outbuf,0,NBSSkeepalive);
653 SCVAL(outbuf,3,0);
654 break;
655
656 case NBSSpositive: /* positive session response */
657 case NBSSnegative: /* negative session response */
658 case NBSSretarget: /* retarget session response */
659 DEBUG(0,("Unexpected session response\n"));
660 break;
661
662 case NBSSkeepalive: /* session keepalive */
663 default:
664 return;
665 }
666
667 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
668 msg_type, msg_flags));
669
670 srv_send_smb(xconn, outbuf, false, 0, false, NULL);
671
672 if (CVAL(outbuf, 0) != 0x82) {
673 exit_server_cleanly("invalid netbios session");
674 }
675 return;
676 }
677
678 /****************************************************************************
679 Reply to a tcon.
680 conn POINTER CAN BE NULL HERE !
681 ****************************************************************************/
682
683 void reply_tcon(struct smb_request *req)
684 {
685 connection_struct *conn = req->conn;
686 const char *service;
687 char *service_buf = NULL;
688 char *password = NULL;
689 char *dev = NULL;
690 int pwlen=0;
691 NTSTATUS nt_status;
692 const uint8_t *p;
693 const char *p2;
694 TALLOC_CTX *ctx = talloc_tos();
695 struct smbXsrv_connection *xconn = req->xconn;
696 NTTIME now = timeval_to_nttime(&req->request_time);
697
698 START_PROFILE(SMBtcon);
699
700 if (req->buflen < 4) {
701 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
702 END_PROFILE(SMBtcon);
703 return;
704 }
705
706 p = req->buf + 1;
707 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
708 p += 1;
709 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
710 p += pwlen+1;
711 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
712 p += 1;
713
714 if (service_buf == NULL || password == NULL || dev == NULL) {
715 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
716 END_PROFILE(SMBtcon);
717 return;
718 }
719 p2 = strrchr_m(service_buf,'\\');
720 if (p2) {
721 service = p2+1;
722 } else {
723 service = service_buf;
724 }
725
726 conn = make_connection(req, now, service, dev,
727 req->vuid,&nt_status);
728 req->conn = conn;
729
730 if (!conn) {
731 reply_nterror(req, nt_status);
732 END_PROFILE(SMBtcon);
733 return;
734 }
735
736 reply_outbuf(req, 2, 0);
737 SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
738 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
739 SSVAL(req->outbuf,smb_tid,conn->cnum);
740
741 DEBUG(3,("tcon service=%s cnum=%d\n",
742 service, conn->cnum));
743
744 END_PROFILE(SMBtcon);
745 return;
746 }
747
748 /****************************************************************************
749 Reply to a tcon and X.
750 conn POINTER CAN BE NULL HERE !
751 ****************************************************************************/
752
753 void reply_tcon_and_X(struct smb_request *req)
754 {
755 connection_struct *conn = req->conn;
756 const char *service = NULL;
757 TALLOC_CTX *ctx = talloc_tos();
758 /* what the cleint thinks the device is */
759 char *client_devicetype = NULL;
760 /* what the server tells the client the share represents */
761 const char *server_devicetype;
762 NTSTATUS nt_status;
763 int passlen;
764 char *path = NULL;
765 const uint8_t *p;
766 const char *q;
767 uint16_t tcon_flags;
768 struct smbXsrv_session *session = NULL;
769 NTTIME now = timeval_to_nttime(&req->request_time);
770 bool session_key_updated = false;
771 uint16_t optional_support = 0;
772 struct smbXsrv_connection *xconn = req->xconn;
773
774 START_PROFILE(SMBtconX);
775
776 if (req->wct < 4) {
777 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
778 END_PROFILE(SMBtconX);
779 return;
780 }
781
782 passlen = SVAL(req->vwv+3, 0);
783 tcon_flags = SVAL(req->vwv+2, 0);
784
785 /* we might have to close an old one */
786 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
787 struct smbXsrv_tcon *tcon;
788 NTSTATUS status;
789
790 tcon = conn->tcon;
791 req->conn = NULL;
792 conn = NULL;
793
794 /*
795 * TODO: cancel all outstanding requests on the tcon
796 */
797 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
798 if (!NT_STATUS_IS_OK(status)) {
799 DEBUG(0, ("reply_tcon_and_X: "
800 "smbXsrv_tcon_disconnect() failed: %s\n",
801 nt_errstr(status)));
802 /*
803 * If we hit this case, there is something completely
804 * wrong, so we better disconnect the transport connection.
805 */
806 END_PROFILE(SMBtconX);
807 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
808 return;
809 }
810
811 TALLOC_FREE(tcon);
812 }
813
814 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
815 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
816 END_PROFILE(SMBtconX);
817 return;
818 }
819
820 if (xconn->smb1.negprot.encrypted_passwords) {
821 p = req->buf + passlen;
822 } else {
823 p = req->buf + passlen + 1;
824 }
825
826 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
827
828 if (path == NULL) {
829 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
830 END_PROFILE(SMBtconX);
831 return;
832 }
833
834 /*
835 * the service name can be either: \\server\share
836 * or share directly like on the DELL PowerVault 705
837 */
838 if (*path=='\\') {
839 q = strchr_m(path+2,'\\');
840 if (!q) {
841 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
842 END_PROFILE(SMBtconX);
843 return;
844 }
845 service = q+1;
846 } else {
847 service = path;
848 }
849
850 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
851 &client_devicetype, p,
852 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
853
854 if (client_devicetype == NULL) {
855 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
856 END_PROFILE(SMBtconX);
857 return;
858 }
859
860 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
861
862 nt_status = smb1srv_session_lookup(xconn,
863 req->vuid, now, &session);
864 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
865 reply_force_doserror(req, ERRSRV, ERRbaduid);
866 END_PROFILE(SMBtconX);
867 return;
868 }
869 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
870 reply_nterror(req, nt_status);
871 END_PROFILE(SMBtconX);
872 return;
873 }
874 if (!NT_STATUS_IS_OK(nt_status)) {
875 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
876 END_PROFILE(SMBtconX);
877 return;
878 }
879
880 if (session->global->auth_session_info == NULL) {
881 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
882 END_PROFILE(SMBtconX);
883 return;
884 }
885
886 /*
887 * If there is no application key defined yet
888 * we create one.
889 *
890 * This means we setup the application key on the
891 * first tcon that happens via the given session.
892 *
893 * Once the application key is defined, it does not
894 * change any more.
895 */
896 if (session->global->application_key.length == 0 &&
897 session->global->signing_key.length > 0)
898 {
899 struct smbXsrv_session *x = session;
900 struct auth_session_info *session_info =
901 session->global->auth_session_info;
902 uint8_t session_key[16];
903
904 ZERO_STRUCT(session_key);
905 memcpy(session_key, x->global->signing_key.data,
906 MIN(x->global->signing_key.length, sizeof(session_key)));
907
908 /*
909 * The application key is truncated/padded to 16 bytes
910 */
911 x->global->application_key = data_blob_talloc(x->global,
912 session_key,
913 sizeof(session_key));
914 ZERO_STRUCT(session_key);
915 if (x->global->application_key.data == NULL) {
916 reply_nterror(req, NT_STATUS_NO_MEMORY);
917 END_PROFILE(SMBtconX);
918 return;
919 }
920
921 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
922 smb_key_derivation(x->global->application_key.data,
923 x->global->application_key.length,
924 x->global->application_key.data);
925 optional_support |= SMB_EXTENDED_SIGNATURES;
926 }
927
928 /*
929 * Place the application key into the session_info
930 */
931 data_blob_clear_free(&session_info->session_key);
932 session_info->session_key = data_blob_dup_talloc(session_info,
933 x->global->application_key);
934 if (session_info->session_key.data == NULL) {
935 data_blob_clear_free(&x->global->application_key);
936 reply_nterror(req, NT_STATUS_NO_MEMORY);
937 END_PROFILE(SMBtconX);
938 return;
939 }
940 session_key_updated = true;
941 }
942
943 conn = make_connection(req, now, service, client_devicetype,
944 req->vuid, &nt_status);
945 req->conn =conn;
946
947 if (!conn) {
948 if (session_key_updated) {
949 struct smbXsrv_session *x = session;
950 struct auth_session_info *session_info =
951 session->global->auth_session_info;
952 data_blob_clear_free(&x->global->application_key);
953 data_blob_clear_free(&session_info->session_key);
954 }
955 reply_nterror(req, nt_status);
956 END_PROFILE(SMBtconX);
957 return;
958 }
959
960 if ( IS_IPC(conn) )
961 server_devicetype = "IPC";
962 else if ( IS_PRINT(conn) )
963 server_devicetype = "LPT1:";
964 else
965 server_devicetype = "A:";
966
967 if (get_Protocol() < PROTOCOL_NT1) {
968 reply_outbuf(req, 2, 0);
969 if (message_push_string(&req->outbuf, server_devicetype,
970 STR_TERMINATE|STR_ASCII) == -1) {
971 reply_nterror(req, NT_STATUS_NO_MEMORY);
972 END_PROFILE(SMBtconX);
973 return;
974 }
975 } else {
976 /* NT sets the fstype of IPC$ to the null string */
977 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
978
979 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
980 /* Return permissions. */
981 uint32 perm1 = 0;
982 uint32 perm2 = 0;
983
984 reply_outbuf(req, 7, 0);
985
986 if (IS_IPC(conn)) {
987 perm1 = FILE_ALL_ACCESS;
988 perm2 = FILE_ALL_ACCESS;
989 } else {
990 perm1 = conn->share_access;
991 }
992
993 SIVAL(req->outbuf, smb_vwv3, perm1);
994 SIVAL(req->outbuf, smb_vwv5, perm2);
995 } else {
996 reply_outbuf(req, 3, 0);
997 }
998
999 if ((message_push_string(&req->outbuf, server_devicetype,
1000 STR_TERMINATE|STR_ASCII) == -1)
1001 || (message_push_string(&req->outbuf, fstype,
1002 STR_TERMINATE) == -1)) {
1003 reply_nterror(req, NT_STATUS_NO_MEMORY);
1004 END_PROFILE(SMBtconX);
1005 return;
1006 }
1007
1008 /* what does setting this bit do? It is set by NT4 and
1009 may affect the ability to autorun mounted cdroms */
1010 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1011 optional_support |=
1012 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1013
1014 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1015 DEBUG(2,("Serving %s as a Dfs root\n",
1016 lp_servicename(ctx, SNUM(conn)) ));
1017 optional_support |= SMB_SHARE_IN_DFS;
1018 }
1019
1020 SSVAL(req->outbuf, smb_vwv2, optional_support);
1021 }
1022
1023 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1024 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1025
1026 DEBUG(3,("tconX service=%s \n",
1027 service));
1028
1029 /* set the incoming and outgoing tid to the just created one */
1030 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1031 SSVAL(req->outbuf,smb_tid,conn->cnum);
1032
1033 END_PROFILE(SMBtconX);
1034
1035 req->tid = conn->cnum;
1036 }
1037
1038 /****************************************************************************
1039 Reply to an unknown type.
1040 ****************************************************************************/
1041
1042 void reply_unknown_new(struct smb_request *req, uint8 type)
1043 {
1044 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1045 smb_fn_name(type), type, type));
1046 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1047 return;
1048 }
1049
1050 /****************************************************************************
1051 Reply to an ioctl.
1052 conn POINTER CAN BE NULL HERE !
1053 ****************************************************************************/
1054
1055 void reply_ioctl(struct smb_request *req)
1056 {
1057 connection_struct *conn = req->conn;
1058 uint16 device;
1059 uint16 function;
1060 uint32 ioctl_code;
1061 int replysize;
1062 char *p;
1063
1064 START_PROFILE(SMBioctl);
1065
1066 if (req->wct < 3) {
1067 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1068 END_PROFILE(SMBioctl);
1069 return;
1070 }
1071
1072 device = SVAL(req->vwv+1, 0);
1073 function = SVAL(req->vwv+2, 0);
1074 ioctl_code = (device << 16) + function;
1075
1076 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1077
1078 switch (ioctl_code) {
1079 case IOCTL_QUERY_JOB_INFO:
1080 replysize = 32;
1081 break;
1082 default:
1083 reply_force_doserror(req, ERRSRV, ERRnosupport);
1084 END_PROFILE(SMBioctl);
1085 return;
1086 }
1087
1088 reply_outbuf(req, 8, replysize+1);
1089 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1090 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1091 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1092 p = smb_buf(req->outbuf);
1093 memset(p, '\0', replysize+1); /* valgrind-safe. */
1094 p += 1; /* Allow for alignment */
1095
1096 switch (ioctl_code) {
1097 case IOCTL_QUERY_JOB_INFO:
1098 {
1099 NTSTATUS status;
1100 size_t len = 0;
1101 files_struct *fsp = file_fsp(
1102 req, SVAL(req->vwv+0, 0));
1103 if (!fsp) {
1104 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1105 END_PROFILE(SMBioctl);
1106 return;
1107 }
1108 /* Job number */
1109 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1110
1111 status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
1112 lp_netbios_name(), 15,
1113 STR_TERMINATE|STR_ASCII, &len);
1114 if (!NT_STATUS_IS_OK(status)) {
1115 reply_nterror(req, status);
1116 END_PROFILE(SMBioctl);
1117 return;
1118 }
1119 if (conn) {
1120 status = srvstr_push((char *)req->outbuf, req->flags2,
1121 p+18,
1122 lp_servicename(talloc_tos(),
1123 SNUM(conn)),
1124 13, STR_TERMINATE|STR_ASCII, &len);
1125 if (!NT_STATUS_IS_OK(status)) {
1126 reply_nterror(req, status);
1127 END_PROFILE(SMBioctl);
1128 return;
1129 }
1130 } else {
1131 memset(p+18, 0, 13);
1132 }
1133 break;
1134 }
1135 }
1136
1137 END_PROFILE(SMBioctl);
1138 return;
1139 }
1140
1141 /****************************************************************************
1142 Strange checkpath NTSTATUS mapping.
1143 ****************************************************************************/
1144
1145 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1146 {
1147 /* Strange DOS error code semantics only for checkpath... */
1148 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1149 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1150 /* We need to map to ERRbadpath */
1151 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1152 }
1153 }
1154 return status;
1155 }
1156
1157 /****************************************************************************
1158 Reply to a checkpath.
1159 ****************************************************************************/
1160
1161 void reply_checkpath(struct smb_request *req)
1162 {
1163 connection_struct *conn = req->conn;
1164 struct smb_filename *smb_fname = NULL;
1165 char *name = NULL;
1166 NTSTATUS status;
1167 TALLOC_CTX *ctx = talloc_tos();
1168
1169 START_PROFILE(SMBcheckpath);
1170
1171 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1172 STR_TERMINATE, &status);
1173
1174 if (!NT_STATUS_IS_OK(status)) {
1175 status = map_checkpath_error(req->flags2, status);
1176 reply_nterror(req, status);
1177 END_PROFILE(SMBcheckpath);
1178 return;
1179 }
1180
1181 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1182
1183 status = filename_convert(ctx,
1184 conn,
1185 req->flags2 & FLAGS2_DFS_PATHNAMES,
1186 name,
1187 0,
1188 NULL,
1189 &smb_fname);
1190
1191 if (!NT_STATUS_IS_OK(status)) {
1192 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1193 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1194 ERRSRV, ERRbadpath);
1195 END_PROFILE(SMBcheckpath);
1196 return;
1197 }
1198 goto path_err;
1199 }
1200
1201 if (!VALID_STAT(smb_fname->st) &&
1202 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1203 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1204 smb_fname_str_dbg(smb_fname), strerror(errno)));
1205 status = map_nt_error_from_unix(errno);
1206 goto path_err;
1207 }
1208
1209 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1210 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1211 ERRDOS, ERRbadpath);
1212 goto out;
1213 }
1214
1215 reply_outbuf(req, 0, 0);
1216
1217 path_err:
1218 /* We special case this - as when a Windows machine
1219 is parsing a path is steps through the components
1220 one at a time - if a component fails it expects
1221 ERRbadpath, not ERRbadfile.
1222 */
1223 status = map_checkpath_error(req->flags2, status);
1224 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1225 /*
1226 * Windows returns different error codes if
1227 * the parent directory is valid but not the
1228 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1229 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1230 * if the path is invalid.
1231 */
1232 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1233 ERRDOS, ERRbadpath);
1234 goto out;
1235 }
1236
1237 reply_nterror(req, status);
1238
1239 out:
1240 TALLOC_FREE(smb_fname);
1241 END_PROFILE(SMBcheckpath);
1242 return;
1243 }
1244
1245 /****************************************************************************
1246 Reply to a getatr.
1247 ****************************************************************************/
1248
1249 void reply_getatr(struct smb_request *req)
1250 {
1251 connection_struct *conn = req->conn;
1252 struct smb_filename *smb_fname = NULL;
1253 char *fname = NULL;
1254 int mode=0;
1255 off_t size=0;
1256 time_t mtime=0;
1257 const char *p;
1258 NTSTATUS status;
1259 TALLOC_CTX *ctx = talloc_tos();
1260 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1261
1262 START_PROFILE(SMBgetatr);
1263
1264 p = (const char *)req->buf + 1;
1265 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 reply_nterror(req, status);
1268 goto out;
1269 }
1270
1271 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1272 under WfWg - weird! */
1273 if (*fname == '\0') {
1274 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1275 if (!CAN_WRITE(conn)) {
1276 mode |= FILE_ATTRIBUTE_READONLY;
1277 }
1278 size = 0;
1279 mtime = 0;
1280 } else {
1281 status = filename_convert(ctx,
1282 conn,
1283 req->flags2 & FLAGS2_DFS_PATHNAMES,
1284 fname,
1285 0,
1286 NULL,
1287 &smb_fname);
1288 if (!NT_STATUS_IS_OK(status)) {
1289 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1290 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1291 ERRSRV, ERRbadpath);
1292 goto out;
1293 }
1294 reply_nterror(req, status);
1295 goto out;
1296 }
1297 if (!VALID_STAT(smb_fname->st) &&
1298 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1299 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1300 smb_fname_str_dbg(smb_fname),
1301 strerror(errno)));
1302 reply_nterror(req, map_nt_error_from_unix(errno));
1303 goto out;
1304 }
1305
1306 mode = dos_mode(conn, smb_fname);
1307 size = smb_fname->st.st_ex_size;
1308
1309 if (ask_sharemode) {
1310 struct timespec write_time_ts;
1311 struct file_id fileid;
1312
1313 ZERO_STRUCT(write_time_ts);
1314 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1315 get_file_infos(fileid, 0, NULL, &write_time_ts);
1316 if (!null_timespec(write_time_ts)) {
1317 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1318 }
1319 }
1320
1321 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1322 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1323 size = 0;
1324 }
1325 }
1326
1327 reply_outbuf(req, 10, 0);
1328
1329 SSVAL(req->outbuf,smb_vwv0,mode);
1330 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1331 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1332 } else {
1333 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1334 }
1335 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1336
1337 if (get_Protocol() >= PROTOCOL_NT1) {
1338 SSVAL(req->outbuf, smb_flg2,
1339 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1340 }
1341
1342 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1343 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1344
1345 out:
1346 TALLOC_FREE(smb_fname);
1347 TALLOC_FREE(fname);
1348 END_PROFILE(SMBgetatr);
1349 return;
1350 }
1351
1352 /****************************************************************************
1353 Reply to a setatr.
1354 ****************************************************************************/
1355
1356 void reply_setatr(struct smb_request *req)
1357 {
1358 struct smb_file_time ft;
1359 connection_struct *conn = req->conn;
1360 struct smb_filename *smb_fname = NULL;
1361 char *fname = NULL;
1362 int mode;
1363 time_t mtime;
1364 const char *p;
1365 NTSTATUS status;
1366 TALLOC_CTX *ctx = talloc_tos();
1367
1368 START_PROFILE(SMBsetatr);
1369
1370 ZERO_STRUCT(ft);
1371
1372 if (req->wct < 2) {
1373 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374 goto out;
1375 }
1376
1377 p = (const char *)req->buf + 1;
1378 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1379 if (!NT_STATUS_IS_OK(status)) {
1380 reply_nterror(req, status);
1381 goto out;
1382 }
1383
1384 status = filename_convert(ctx,
1385 conn,
1386 req->flags2 & FLAGS2_DFS_PATHNAMES,
1387 fname,
1388 0,
1389 NULL,
1390 &smb_fname);
1391 if (!NT_STATUS_IS_OK(status)) {
1392 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1393 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1394 ERRSRV, ERRbadpath);
1395 goto out;
1396 }
1397 reply_nterror(req, status);
1398 goto out;
1399 }
1400
1401 if (smb_fname->base_name[0] == '.' &&
1402 smb_fname->base_name[1] == '\0') {
1403 /*
1404 * Not sure here is the right place to catch this
1405 * condition. Might be moved to somewhere else later -- vl
1406 */
1407 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1408 goto out;
1409 }
1410
1411 mode = SVAL(req->vwv+0, 0);
1412 mtime = srv_make_unix_date3(req->vwv+1);
1413
1414 if (mode != FILE_ATTRIBUTE_NORMAL) {
1415 if (VALID_STAT_OF_DIR(smb_fname->st))
1416 mode |= FILE_ATTRIBUTE_DIRECTORY;
1417 else
1418 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1419
1420 status = check_access(conn, NULL, smb_fname,
1421 FILE_WRITE_ATTRIBUTES);
1422 if (!NT_STATUS_IS_OK(status)) {
1423 reply_nterror(req, status);
1424 goto out;
1425 }
1426
1427 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1428 false) != 0) {
1429 reply_nterror(req, map_nt_error_from_unix(errno));
1430 goto out;
1431 }
1432 }
1433
1434 ft.mtime = convert_time_t_to_timespec(mtime);
1435 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 reply_nterror(req, status);
1438 goto out;
1439 }
1440
1441 reply_outbuf(req, 0, 0);
1442
1443 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1444 mode));
1445 out:
1446 TALLOC_FREE(smb_fname);
1447 END_PROFILE(SMBsetatr);
1448 return;
1449 }
1450
1451 /****************************************************************************
1452 Reply to a dskattr.
1453 ****************************************************************************/
1454
1455 void reply_dskattr(struct smb_request *req)
1456 {
1457 connection_struct *conn = req->conn;
1458 uint64_t dfree,dsize,bsize;
1459 START_PROFILE(SMBdskattr);
1460
1461 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1462 reply_nterror(req, map_nt_error_from_unix(errno));
1463 END_PROFILE(SMBdskattr);
1464 return;
1465 }
1466
1467 reply_outbuf(req, 5, 0);
1468
1469 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1470 double total_space, free_space;
1471 /* we need to scale this to a number that DOS6 can handle. We
1472 use floating point so we can handle large drives on systems
1473 that don't have 64 bit integers
1474
1475 we end up displaying a maximum of 2G to DOS systems
1476 */
1477 total_space = dsize * (double)bsize;
1478 free_space = dfree * (double)bsize;
1479
1480 dsize = (uint64_t)((total_space+63*512) / (64*512));
1481 dfree = (uint64_t)((free_space+63*512) / (64*512));
1482
1483 if (dsize > 0xFFFF) dsize = 0xFFFF;
1484 if (dfree > 0xFFFF) dfree = 0xFFFF;
1485
1486 SSVAL(req->outbuf,smb_vwv0,dsize);
1487 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1488 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1489 SSVAL(req->outbuf,smb_vwv3,dfree);
1490 } else {
1491 SSVAL(req->outbuf,smb_vwv0,dsize);
1492 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1493 SSVAL(req->outbuf,smb_vwv2,512);
1494 SSVAL(req->outbuf,smb_vwv3,dfree);
1495 }
1496
1497 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1498
1499 END_PROFILE(SMBdskattr);
1500 return;
1501 }
1502
1503 /*
1504 * Utility function to split the filename from the directory.
1505 */
1506 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1507 char **fname_dir_out,
1508 char **fname_mask_out)
1509 {
1510 const char *p = NULL;
1511 char *fname_dir = NULL;
1512 char *fname_mask = NULL;
1513
1514 p = strrchr_m(fname_in, '/');
1515 if (!p) {
1516 fname_dir = talloc_strdup(ctx, ".");
1517 fname_mask = talloc_strdup(ctx, fname_in);
1518 } else {
1519 fname_dir = talloc_strndup(ctx, fname_in,
1520 PTR_DIFF(p, fname_in));
1521 fname_mask = talloc_strdup(ctx, p+1);
1522 }
1523
1524 if (!fname_dir || !fname_mask) {
1525 TALLOC_FREE(fname_dir);
1526 TALLOC_FREE(fname_mask);
1527 return NT_STATUS_NO_MEMORY;
1528 }
1529
1530 *fname_dir_out = fname_dir;
1531 *fname_mask_out = fname_mask;
1532 return NT_STATUS_OK;
1533 }
1534
1535 /****************************************************************************
1536 Make a dir struct.
1537 ****************************************************************************/
1538
1539 static bool make_dir_struct(TALLOC_CTX *ctx,
1540 char *buf,
1541 const char *mask,
1542 const char *fname,
1543 off_t size,
1544 uint32 mode,
1545 time_t date,
1546 bool uc)
1547 {
1548 char *p;
1549 char *mask2 = talloc_strdup(ctx, mask);
1550
1551 if (!mask2) {
1552 return False;
1553 }
1554
1555 if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
1556 size = 0;
1557 }
1558
1559 memset(buf+1,' ',11);
1560 if ((p = strchr_m(mask2,'.')) != NULL) {
1561 *p = 0;
1562 push_ascii(buf+1,mask2,8, 0);
1563 push_ascii(buf+9,p+1,3, 0);
1564 *p = '.';
1565 } else {
1566 push_ascii(buf+1,mask2,11, 0);
1567 }
1568
1569 memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
1570 SCVAL(buf,21,mode);
1571 srv_put_dos_date(buf,22,date);
1572 SSVAL(buf,26,size & 0xFFFF);
1573 SSVAL(buf,28,(size >> 16)&0xFFFF);
1574 /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1575 Strange, but verified on W2K3. Needed for OS/2. JRA. */
1576 push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
1577 DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
1578 return True;
1579 }
1580
1581 /****************************************************************************
1582 Reply to a search.
1583 Can be called from SMBsearch, SMBffirst or SMBfunique.
1584 ****************************************************************************/
1585
1586 void reply_search(struct smb_request *req)
1587 {
1588 connection_struct *conn = req->conn;
1589 char *path = NULL;
1590 const char *mask = NULL;
1591 char *directory = NULL;
1592 struct smb_filename *smb_fname = NULL;
1593 char *fname = NULL;
1594 off_t size;
1595 uint32 mode;
1596 struct timespec date;
1597 uint32 dirtype;
1598 unsigned int numentries = 0;
1599 unsigned int maxentries = 0;
1600 bool finished = False;
1601 const char *p;
1602 int status_len;
1603 char status[21];
1604 int dptr_num= -1;
1605 bool check_descend = False;
1606 bool expect_close = False;
1607 NTSTATUS nt_status;
1608 bool mask_contains_wcard = False;
1609 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1610 TALLOC_CTX *ctx = talloc_tos();
1611 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1612 struct dptr_struct *dirptr = NULL;
1613 struct smbXsrv_connection *xconn = req->xconn;
1614 struct smbd_server_connection *sconn = req->sconn;
1615
1616 START_PROFILE(SMBsearch);
1617
1618 if (req->wct < 2) {
1619 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1620 goto out;
1621 }
1622
1623 if (lp_posix_pathnames()) {
1624 reply_unknown_new(req, req->cmd);
1625 goto out;
1626 }
1627
1628 /* If we were called as SMBffirst then we must expect close. */
1629 if(req->cmd == SMBffirst) {
1630 expect_close = True;
1631 }
1632
1633 reply_outbuf(req, 1, 3);
1634 maxentries = SVAL(req->vwv+0, 0);
1635 dirtype = SVAL(req->vwv+1, 0);
1636 p = (const char *)req->buf + 1;
1637 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1638 &nt_status, &mask_contains_wcard);
1639 if (!NT_STATUS_IS_OK(nt_status)) {
1640 reply_nterror(req, nt_status);
1641 goto out;
1642 }
1643
1644 p++;
1645 status_len = SVAL(p, 0);
1646 p += 2;
1647
1648 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1649
1650 if (status_len == 0) {
1651 nt_status = filename_convert(ctx, conn,
1652 req->flags2 & FLAGS2_DFS_PATHNAMES,
1653 path,
1654 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1655 &mask_contains_wcard,
1656 &smb_fname);
1657 if (!NT_STATUS_IS_OK(nt_status)) {
1658 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1659 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1660 ERRSRV, ERRbadpath);
1661 goto out;
1662 }
1663 reply_nterror(req, nt_status);
1664 goto out;
1665 }
1666
1667 directory = smb_fname->base_name;
1668
1669 p = strrchr_m(directory,'/');
1670 if ((p != NULL) && (*directory != '/')) {
1671 mask = p + 1;
1672 directory = talloc_strndup(ctx, directory,
1673 PTR_DIFF(p, directory));
1674 } else {
1675 mask = directory;
1676 directory = talloc_strdup(ctx,".");
1677 }
1678
1679 if (!directory) {
1680 reply_nterror(req, NT_STATUS_NO_MEMORY);
1681 goto out;
1682 }
1683
1684 memset((char *)status,'\0',21);
1685 SCVAL(status,0,(dirtype & 0x1F));
1686
1687 nt_status = dptr_create(conn,
1688 NULL, /* req */
1689 NULL, /* fsp */
1690 directory,
1691 True,
1692 expect_close,
1693 req->smbpid,
1694 mask,
1695 mask_contains_wcard,
1696 dirtype,
1697 &dirptr);
1698 if (!NT_STATUS_IS_OK(nt_status)) {
1699 reply_nterror(req, nt_status);
1700 goto out;
1701 }
1702 dptr_num = dptr_dnum(dirptr);
1703 } else {
1704 int status_dirtype;
1705 const char *dirpath;
1706
1707 memcpy(status,p,21);
1708 status_dirtype = CVAL(status,0) & 0x1F;
1709 if (status_dirtype != (dirtype & 0x1F)) {
1710 dirtype = status_dirtype;
1711 }
1712
1713 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1714 if (!dirptr) {
1715 goto SearchEmpty;
1716 }
1717 dirpath = dptr_path(sconn, dptr_num);
1718 directory = talloc_strdup(ctx, dirpath);
1719 if (!directory) {
1720 reply_nterror(req, NT_STATUS_NO_MEMORY);
1721 goto out;
1722 }
1723
1724 mask = dptr_wcard(sconn, dptr_num);
1725 if (!mask) {
1726 goto SearchEmpty;
1727 }
1728 /*
1729 * For a 'continue' search we have no string. So
1730 * check from the initial saved string.
1731 */
1732 mask_contains_wcard = ms_has_wild(mask);
1733 dirtype = dptr_attr(sconn, dptr_num);
1734 }
1735
1736 DEBUG(4,("dptr_num is %d\n",dptr_num));
1737
1738 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1739 dptr_init_search_op(dirptr);
1740
1741 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1742 char buf[DIR_STRUCT_SIZE];
1743 memcpy(buf,status,21);
1744 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1745 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1746 reply_nterror(req, NT_STATUS_NO_MEMORY);
1747 goto out;
1748 }
1749 dptr_fill(sconn, buf+12,dptr_num);
1750 if (dptr_zero(buf+12) && (status_len==0)) {
1751 numentries = 1;
1752 } else {
1753 numentries = 0;
1754 }
1755 if (message_push_blob(&req->outbuf,
1756 data_blob_const(buf, sizeof(buf)))
1757 == -1) {
1758 reply_nterror(req, NT_STATUS_NO_MEMORY);
1759 goto out;
1760 }
1761 } else {
1762 unsigned int i;
1763 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1764 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1765
1766 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1767
1768 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1769 directory,lp_dont_descend(ctx, SNUM(conn))));
1770 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1771 check_descend = True;
1772 }
1773
1774 for (i=numentries;(i<maxentries) && !finished;i++) {
1775 finished = !get_dir_entry(ctx,
1776 dirptr,
1777 mask,
1778 dirtype,
1779 &fname,
1780 &size,
1781 &mode,
1782 &date,
1783 check_descend,
1784 ask_sharemode);
1785 if (!finished) {
1786 char buf[DIR_STRUCT_SIZE];
1787 memcpy(buf,status,21);
1788 if (!make_dir_struct(ctx,
1789 buf,
1790 mask,
1791 fname,
1792 size,
1793 mode,
1794 convert_timespec_to_time_t(date),
1795 !allow_long_path_components)) {
1796 reply_nterror(req, NT_STATUS_NO_MEMORY);
1797 goto out;
1798 }
1799 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1800 break;
1801 }
1802 if (message_push_blob(&req->outbuf,
1803 data_blob_const(buf, sizeof(buf)))
1804 == -1) {
1805 reply_nterror(req, NT_STATUS_NO_MEMORY);
1806 goto out;
1807 }
1808 numentries++;
1809 }
1810 }
1811 }
1812
1813 SearchEmpty:
1814
1815 /* If we were called as SMBffirst with smb_search_id == NULL
1816 and no entries were found then return error and close dirptr
1817 (X/Open spec) */
1818
1819 if (numentries == 0) {
1820 dptr_close(sconn, &dptr_num);
1821 } else if(expect_close && status_len == 0) {
1822 /* Close the dptr - we know it's gone */
1823 dptr_close(sconn, &dptr_num);
1824 }
1825
1826 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1827 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1828 dptr_close(sconn, &dptr_num);
1829 }
1830
1831 if ((numentries == 0) && !mask_contains_wcard) {
1832 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1833 goto out;
1834 }
1835
1836 SSVAL(req->outbuf,smb_vwv0,numentries);
1837 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1838 SCVAL(smb_buf(req->outbuf),0,5);
1839 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1840
1841 /* The replies here are never long name. */
1842 SSVAL(req->outbuf, smb_flg2,
1843 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1844 if (!allow_long_path_components) {
1845 SSVAL(req->outbuf, smb_flg2,
1846 SVAL(req->outbuf, smb_flg2)
1847 & (~FLAGS2_LONG_PATH_COMPONENTS));
1848 }
1849
1850 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1851 SSVAL(req->outbuf, smb_flg2,
1852 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1853
1854 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1855 smb_fn_name(req->cmd),
1856 mask,
1857 directory,
1858 dirtype,
1859 numentries,
1860 maxentries ));
1861 out:
1862 TALLOC_FREE(directory);
1863 TALLOC_FREE(smb_fname);
1864 END_PROFILE(SMBsearch);
1865 return;
1866 }
1867
1868 /****************************************************************************
1869 Reply to a fclose (stop directory search).
1870 ****************************************************************************/
1871
1872 void reply_fclose(struct smb_request *req)
1873 {
1874 int status_len;
1875 char status[21];
1876 int dptr_num= -2;
1877 const char *p;
1878 char *path = NULL;
1879 NTSTATUS err;
1880 bool path_contains_wcard = False;
1881 TALLOC_CTX *ctx = talloc_tos();
1882 struct smbd_server_connection *sconn = req->sconn;
1883
1884 START_PROFILE(SMBfclose);
1885
1886 if (lp_posix_pathnames()) {
1887 reply_unknown_new(req, req->cmd);
1888 END_PROFILE(SMBfclose);
1889 return;
1890 }
1891
1892 p = (const char *)req->buf + 1;
1893 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1894 &err, &path_contains_wcard);
1895 if (!NT_STATUS_IS_OK(err)) {
1896 reply_nterror(req, err);
1897 END_PROFILE(SMBfclose);
1898 return;
1899 }
1900 p++;
1901 status_len = SVAL(p,0);
1902 p += 2;
1903
1904 if (status_len == 0) {
1905 reply_force_doserror(req, ERRSRV, ERRsrverror);
1906 END_PROFILE(SMBfclose);
1907 return;
1908 }
1909
1910 memcpy(status,p,21);
1911
1912 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1913 /* Close the dptr - we know it's gone */
1914 dptr_close(sconn, &dptr_num);
1915 }
1916
1917 reply_outbuf(req, 1, 0);
1918 SSVAL(req->outbuf,smb_vwv0,0);
1919
1920 DEBUG(3,("search close\n"));
1921
1922 END_PROFILE(SMBfclose);
1923 return;
1924 }
1925
1926 /****************************************************************************
1927 Reply to an open.
1928 ****************************************************************************/
1929
1930 void reply_open(struct smb_request *req)
1931 {
1932 connection_struct *conn = req->conn;
1933 struct smb_filename *smb_fname = NULL;
1934 char *fname = NULL;
1935 uint32 fattr=0;
1936 off_t size = 0;
1937 time_t mtime=0;
1938 int info;
1939 files_struct *fsp;
1940 int oplock_request;
1941 int deny_mode;
1942 uint32 dos_attr;
1943 uint32 access_mask;
1944 uint32 share_mode;
1945 uint32 create_disposition;
1946 uint32 create_options = 0;
1947 uint32_t private_flags = 0;
1948 NTSTATUS status;
1949 TALLOC_CTX *ctx = talloc_tos();
1950
1951 START_PROFILE(SMBopen);
1952
1953 if (req->wct < 2) {
1954 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1955 goto out;
1956 }
1957
1958 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1959 deny_mode = SVAL(req->vwv+0, 0);
1960 dos_attr = SVAL(req->vwv+1, 0);
1961
1962 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1963 STR_TERMINATE, &status);
1964 if (!NT_STATUS_IS_OK(status)) {
1965 reply_nterror(req, status);
1966 goto out;
1967 }
1968
1969 if (!map_open_params_to_ntcreate(fname, deny_mode,
1970 OPENX_FILE_EXISTS_OPEN, &access_mask,
1971 &share_mode, &create_disposition,
1972 &create_options, &private_flags)) {
1973 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1974 goto out;
1975 }
1976
1977 status = filename_convert(ctx,
1978 conn,
1979 req->flags2 & FLAGS2_DFS_PATHNAMES,
1980 fname,
1981 UCF_PREP_CREATEFILE,
1982 NULL,
1983 &smb_fname);
1984 if (!NT_STATUS_IS_OK(status)) {
1985 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1986 reply_botherror(req,
1987 NT_STATUS_PATH_NOT_COVERED,
1988 ERRSRV, ERRbadpath);
1989 goto out;
1990 }
1991 reply_nterror(req, status);
1992 goto out;
1993 }
1994
1995 status = SMB_VFS_CREATE_FILE(
1996 conn, /* conn */
1997 req, /* req */
1998 0, /* root_dir_fid */
1999 smb_fname, /* fname */
2000 access_mask, /* access_mask */
2001 share_mode, /* share_access */
2002 create_disposition, /* create_disposition*/
2003 create_options, /* create_options */
2004 dos_attr, /* file_attributes */
2005 oplock_request, /* oplock_request */
2006 NULL, /* lease */
2007 0, /* allocation_size */
2008 private_flags,
2009 NULL, /* sd */
2010 NULL, /* ea_list */
2011 &fsp, /* result */
2012 &info); /* pinfo */
2013
2014 if (!NT_STATUS_IS_OK(status)) {
2015 if (open_was_deferred(req->xconn, req->mid)) {
2016 /* We have re-scheduled this call. */
2017 goto out;
2018 }
2019 reply_openerror(req, status);
2020 goto out;
2021 }
2022
2023 /* Ensure we're pointing at the correct stat struct. */
2024 TALLOC_FREE(smb_fname);
2025 smb_fname = fsp->fsp_name;
2026
2027 size = smb_fname->st.st_ex_size;
2028 fattr = dos_mode(conn, smb_fname);
2029
2030 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
2031
2032 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2033 DEBUG(3,("attempt to open a directory %s\n",
2034 fsp_str_dbg(fsp)));
2035 close_file(req, fsp, ERROR_CLOSE);
2036 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
2037 ERRDOS, ERRnoaccess);
2038 goto out;
2039 }
2040
2041 reply_outbuf(req, 7, 0);
2042 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2043 SSVAL(req->outbuf,smb_vwv1,fattr);
2044 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2045 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
2046 } else {
2047 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
2048 }
2049 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
2050 SSVAL(req->outbuf,smb_vwv6,deny_mode);
2051
2052 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2053 SCVAL(req->outbuf,smb_flg,
2054 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2055 }
2056
2057 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2058 SCVAL(req->outbuf,smb_flg,
2059 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2060 }
2061 out:
2062 END_PROFILE(SMBopen);
2063 return;
2064 }
2065
2066 /****************************************************************************
2067 Reply to an open and X.
2068 ****************************************************************************/
2069
2070 void reply_open_and_X(struct smb_request *req)
2071 {
2072 connection_struct *conn = req->conn;
2073 struct smb_filename *smb_fname = NULL;
2074 char *fname = NULL;
2075 uint16 open_flags;
2076 int deny_mode;
2077 uint32 smb_attr;
2078 /* Breakout the oplock request bits so we can set the
2079 reply bits separately. */
2080 int ex_oplock_request;
2081 int core_oplock_request;
2082 int oplock_request;
2083 #if 0
2084 int smb_sattr = SVAL(req->vwv+4, 0);
2085 uint32 smb_time = make_unix_date3(req->vwv+6);
2086 #endif
2087 int smb_ofun;
2088 uint32 fattr=0;
2089 int mtime=0;
2090 int smb_action = 0;
2091 files_struct *fsp;
2092 NTSTATUS status;
2093 uint64_t allocation_size;
2094 ssize_t retval = -1;
2095 uint32 access_mask;
2096 uint32 share_mode;
2097 uint32 create_disposition;
2098 uint32 create_options = 0;
2099 uint32_t private_flags = 0;
2100 TALLOC_CTX *ctx = talloc_tos();
2101
2102 START_PROFILE(SMBopenX);
2103
2104 if (req->wct < 15) {
2105 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2106 goto out;
2107 }
2108
2109 open_flags = SVAL(req->vwv+2, 0);
2110 deny_mode = SVAL(req->vwv+3, 0);
2111 smb_attr = SVAL(req->vwv+5, 0);
2112 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2113 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2114 oplock_request = ex_oplock_request | core_oplock_request;
2115 smb_ofun = SVAL(req->vwv+8, 0);
2116 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2117
2118 /* If it's an IPC, pass off the pipe handler. */
2119 if (IS_IPC(conn)) {
2120 if (lp_nt_pipe_support()) {
2121 reply_open_pipe_and_X(conn, req);
2122 } else {
2123 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2124 }
2125 goto out;
2126 }
2127
2128 /* XXXX we need to handle passed times, sattr and flags */
2129 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2130 STR_TERMINATE, &status);
2131 if (!NT_STATUS_IS_OK(status)) {
2132 reply_nterror(req, status);
2133 goto out;
2134 }
2135
2136 if (!map_open_params_to_ntcreate(fname, deny_mode,
2137 smb_ofun,
2138 &access_mask, &share_mode,
2139 &create_disposition,
2140 &create_options,
2141 &private_flags)) {
2142 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2143 goto out;
2144 }
2145
2146 status = filename_convert(ctx,
2147 conn,
2148 req->flags2 & FLAGS2_DFS_PATHNAMES,
2149 fname,
2150 UCF_PREP_CREATEFILE,
2151 NULL,
2152 &smb_fname);
2153 if (!NT_STATUS_IS_OK(status)) {
2154 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2155 reply_botherror(req,
2156 NT_STATUS_PATH_NOT_COVERED,
2157 ERRSRV, ERRbadpath);
2158 goto out;
2159 }
2160 reply_nterror(req, status);
2161 goto out;
2162 }
2163
2164 status = SMB_VFS_CREATE_FILE(
2165 conn, /* conn */
2166 req, /* req */
2167 0, /* root_dir_fid */
2168 smb_fname, /* fname */
2169 access_mask, /* access_mask */
2170 share_mode, /* share_access */
2171 create_disposition, /* create_disposition*/
2172 create_options, /* create_options */
2173 smb_attr, /* file_attributes */
2174 oplock_request, /* oplock_request */
2175 NULL, /* lease */
2176 0, /* allocation_size */
2177 private_flags,
2178 NULL, /* sd */
2179 NULL, /* ea_list */
2180 &fsp, /* result */
2181 &smb_action); /* pinfo */
2182
2183 if (!NT_STATUS_IS_OK(status)) {
2184 if (open_was_deferred(req->xconn, req->mid)) {
2185 /* We have re-scheduled this call. */
2186 goto out;
2187 }
2188 reply_openerror(req, status);
2189 goto out;
2190 }
2191
2192 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2193 if the file is truncated or created. */
2194 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2195 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2196 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2197 close_file(req, fsp, ERROR_CLOSE);
2198 reply_nterror(req, NT_STATUS_DISK_FULL);
2199 goto out;
2200 }
2201 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2202 if (retval < 0) {
2203 close_file(req, fsp, ERROR_CLOSE);
2204 reply_nterror(req, NT_STATUS_DISK_FULL);
2205 goto out;
2206 }
2207 status = vfs_stat_fsp(fsp);
2208 if (!NT_STATUS_IS_OK(status)) {
2209 close_file(req, fsp, ERROR_CLOSE);
2210 reply_nterror(req, status);
2211 goto out;
2212 }
2213 }
2214
2215 fattr = dos_mode(conn, fsp->fsp_name);
2216 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2217 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2218 close_file(req, fsp, ERROR_CLOSE);
2219 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2220 goto out;
2221 }
2222
2223 /* If the caller set the extended oplock request bit
2224 and we granted one (by whatever means) - set the
2225 correct bit for extended oplock reply.
2226 */
2227
2228 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2229 smb_action |= EXTENDED_OPLOCK_GRANTED;
2230 }
2231
2232 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2233 smb_action |= EXTENDED_OPLOCK_GRANTED;
2234 }
2235
2236 /* If the caller set the core oplock request bit
2237 and we granted one (by whatever means) - set the
2238 correct bit for core oplock reply.
2239 */
2240
2241 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2242 reply_outbuf(req, 19, 0);
2243 } else {
2244 reply_outbuf(req, 15, 0);
2245 }
2246
2247 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2248 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2249
2250 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2251 SCVAL(req->outbuf, smb_flg,
2252 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2253 }
2254
2255 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2256 SCVAL(req->outbuf, smb_flg,
2257 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2258 }
2259
2260 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2261 SSVAL(req->outbuf,smb_vwv3,fattr);
2262 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2263 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2264 } else {
2265 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2266 }
2267 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2268 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2269 SSVAL(req->outbuf,smb_vwv11,smb_action);
2270
2271 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2272 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2273 }
2274
2275 out:
2276 TALLOC_FREE(smb_fname);
2277 END_PROFILE(SMBopenX);
2278 return;
2279 }
2280
2281 /****************************************************************************
2282 Reply to a SMBulogoffX.
2283 ****************************************************************************/
2284
2285 void reply_ulogoffX(struct smb_request *req)
2286 {
2287 struct smbd_server_connection *sconn = req->sconn;
2288 struct user_struct *vuser;
2289 struct smbXsrv_session *session = NULL;
2290 NTSTATUS status;
2291
2292 START_PROFILE(SMBulogoffX);
2293
2294 vuser = get_valid_user_struct(sconn, req->vuid);
2295
2296 if(vuser == NULL) {
2297 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2298 (unsigned long long)req->vuid));
2299
2300 req->vuid = UID_FIELD_INVALID;
2301 reply_force_doserror(req, ERRSRV, ERRbaduid);
2302 END_PROFILE(SMBulogoffX);
2303 return;
2304 }
2305
2306 session = vuser->session;
2307 vuser = NULL;
2308
2309 /*
2310 * TODO: cancel all outstanding requests on the session
2311 */
2312 status = smbXsrv_session_logoff(session);
2313 if (!NT_STATUS_IS_OK(status)) {
2314 DEBUG(0, ("reply_ulogoff: "
2315 "smbXsrv_session_logoff() failed: %s\n",
2316 nt_errstr(status)));
2317 /*
2318 * If we hit this case, there is something completely
2319 * wrong, so we better disconnect the transport connection.
2320 */
2321 END_PROFILE(SMBulogoffX);
2322 exit_server(__location__ ": smbXsrv_session_logoff failed");
2323 return;
2324 }
2325
2326 TALLOC_FREE(session);
2327
2328 reply_outbuf(req, 2, 0);
2329 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2330 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2331
2332 DEBUG(3, ("ulogoffX vuid=%llu\n",
2333 (unsigned long long)req->vuid));
2334
2335 END_PROFILE(SMBulogoffX);
2336 req->vuid = UID_FIELD_INVALID;
2337 }
2338
2339 /****************************************************************************
2340 Reply to a mknew or a create.
2341 ****************************************************************************/
2342
2343 void reply_mknew(struct smb_request *req)
2344 {
2345 connection_struct *conn = req->conn;
2346 struct smb_filename *smb_fname = NULL;
2347 char *fname = NULL;
2348 uint32 fattr = 0;
2349 struct smb_file_time ft;
2350 files_struct *fsp;
2351 int oplock_request = 0;
2352 NTSTATUS status;
2353 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2354 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2355 uint32 create_disposition;
2356 uint32 create_options = 0;
2357 TALLOC_CTX *ctx = talloc_tos();
2358
2359 START_PROFILE(SMBcreate);
2360 ZERO_STRUCT(ft);
2361
2362 if (req->wct < 3) {
2363 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2364 goto out;
2365 }
2366
2367 fattr = SVAL(req->vwv+0, 0);
2368 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2369
2370 /* mtime. */
2371 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2372
2373 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2374 STR_TERMINATE, &status);
2375 if (!NT_STATUS_IS_OK(status)) {
2376 reply_nterror(req, status);
2377 goto out;
2378 }
2379
2380 status = filename_convert(ctx,
2381 conn,
2382 req->flags2 & FLAGS2_DFS_PATHNAMES,
2383 fname,
2384 UCF_PREP_CREATEFILE,
2385 NULL,
2386 &smb_fname);
2387 if (!NT_STATUS_IS_OK(status)) {
2388 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2389 reply_botherror(req,
2390 NT_STATUS_PATH_NOT_COVERED,
2391 ERRSRV, ERRbadpath);
2392 goto out;
2393 }
2394 reply_nterror(req, status);
2395 goto out;
2396 }
2397
2398 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2399 DEBUG(0,("Attempt to create file (%s) with volid set - "
2400 "please report this\n",
2401 smb_fname_str_dbg(smb_fname)));
2402 }
2403
2404 if(req->cmd == SMBmknew) {
2405 /* We should fail if file exists. */
2406 create_disposition = FILE_CREATE;
2407 } else {
2408 /* Create if file doesn't exist, truncate if it does. */
2409 create_disposition = FILE_OVERWRITE_IF;
2410 }
2411
2412 status = SMB_VFS_CREATE_FILE(
2413 conn, /* conn */
2414 req, /* req */
2415 0, /* root_dir_fid */
2416 smb_fname, /* fname */
2417 access_mask, /* access_mask */
2418 share_mode, /* share_access */
2419 create_disposition, /* create_disposition*/
2420 create_options, /* create_options */
2421 fattr, /* file_attributes */
2422 oplock_request, /* oplock_request */
2423 NULL, /* lease */
2424 0, /* allocation_size */
2425 0, /* private_flags */
2426 NULL, /* sd */
2427 NULL, /* ea_list */
2428 &fsp, /* result */
2429 NULL); /* pinfo */
2430
2431 if (!NT_STATUS_IS_OK(status)) {
2432 if (open_was_deferred(req->xconn, req->mid)) {
2433 /* We have re-scheduled this call. */
2434 goto out;
2435 }
2436 reply_openerror(req, status);
2437 goto out;
2438 }
2439
2440 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2441 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2442 if (!NT_STATUS_IS_OK(status)) {
2443 END_PROFILE(SMBcreate);
2444 goto out;
2445 }
2446
2447 reply_outbuf(req, 1, 0);
2448 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2449
2450 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2451 SCVAL(req->outbuf,smb_flg,
2452 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2453 }
2454
2455 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2456 SCVAL(req->outbuf,smb_flg,
2457 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2458 }
2459
2460 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2461 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2462 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2463 (unsigned int)fattr));
2464
2465 out:
2466 TALLOC_FREE(smb_fname);
2467 END_PROFILE(SMBcreate);
2468 return;
2469 }
2470
2471 /****************************************************************************
2472 Reply to a create temporary file.
2473 ****************************************************************************/
2474
2475 void reply_ctemp(struct smb_request *req)
2476 {
2477 connection_struct *conn = req->conn;
2478 struct smb_filename *smb_fname = NULL;
2479 char *wire_name = NULL;
2480 char *fname = NULL;
2481 uint32 fattr;
2482 files_struct *fsp;
2483 int oplock_request;
2484 char *s;
2485 NTSTATUS status;
2486 int i;
2487 TALLOC_CTX *ctx = talloc_tos();
2488
2489 START_PROFILE(SMBctemp);
2490
2491 if (req->wct < 3) {
2492 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2493 goto out;
2494 }
2495
2496 fattr = SVAL(req->vwv+0, 0);
2497 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2498
2499 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2500 STR_TERMINATE, &status);
2501 if (!NT_STATUS_IS_OK(status)) {
2502 reply_nterror(req, status);
2503 goto out;
2504 }
2505
2506 for (i = 0; i < 10; i++) {
2507 if (*wire_name) {
2508 fname = talloc_asprintf(ctx,
2509 "%s/TMP%s",
2510 wire_name,
2511 generate_random_str_list(ctx, 5, "0123456789"));
2512 } else {
2513 fname = talloc_asprintf(ctx,
2514 "TMP%s",
2515 generate_random_str_list(ctx, 5, "0123456789"));
2516 }
2517
2518 if (!fname) {
2519 reply_nterror(req, NT_STATUS_NO_MEMORY);
2520 goto out;
2521 }
2522
2523 status = filename_convert(ctx, conn,
2524 req->flags2 & FLAGS2_DFS_PATHNAMES,
2525 fname,
2526 UCF_PREP_CREATEFILE,
2527 NULL,
2528 &smb_fname);
2529 if (!NT_STATUS_IS_OK(status)) {
2530 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2531 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2532 ERRSRV, ERRbadpath);
2533 goto out;
2534 }
2535 reply_nterror(req, status);
2536 goto out;
2537 }
2538
2539 /* Create the file. */
2540 status = SMB_VFS_CREATE_FILE(
2541 conn, /* conn */
2542 req, /* req */
2543 0, /* root_dir_fid */
2544 smb_fname, /* fname */
2545 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2546 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2547 FILE_CREATE, /* create_disposition*/
2548 0, /* create_options */
2549 fattr, /* file_attributes */
2550 oplock_request, /* oplock_request */
2551 NULL, /* lease */
2552 0, /* allocation_size */
2553 0, /* private_flags */
2554 NULL, /* sd */
2555 NULL, /* ea_list */
2556 &fsp, /* result */
2557 NULL); /* pinfo */
2558
2559 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2560 TALLOC_FREE(fname);
2561 TALLOC_FREE(smb_fname);
2562 continue;
2563 }
2564
2565 if (!NT_STATUS_IS_OK(status)) {
2566 if (open_was_deferred(req->xconn, req->mid)) {
2567 /* We have re-scheduled this call. */
2568 goto out;
2569 }
2570 reply_openerror(req, status);
2571 goto out;
2572 }
2573
2574 break;
2575 }
2576
2577 if (i == 10) {
2578 /* Collision after 10 times... */
2579 reply_nterror(req, status);
2580 goto out;
2581 }
2582
2583 reply_outbuf(req, 1, 0);
2584 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2585
2586 /* the returned filename is relative to the directory */
2587 s = strrchr_m(fsp->fsp_name->base_name, '/');
2588 if (!s) {
2589 s = fsp->fsp_name->base_name;
2590 } else {
2591 s++;
2592 }
2593
2594 #if 0
2595 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2596 thing in the byte section. JRA */
2597 SSVALS(p, 0, -1); /* what is this? not in spec */
2598 #endif
2599 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2600 == -1) {
2601 reply_nterror(req, NT_STATUS_NO_MEMORY);
2602 goto out;
2603 }
2604
2605 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2606 SCVAL(req->outbuf, smb_flg,
2607 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2608 }
2609
2610 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2611 SCVAL(req->outbuf, smb_flg,
2612 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2613 }
2614
2615 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2616 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2617 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2618 out:
2619 TALLOC_FREE(smb_fname);
2620 TALLOC_FREE(wire_name);
2621 END_PROFILE(SMBctemp);
2622 return;
2623 }
2624
2625 /*******************************************************************
2626 Check if a user is allowed to rename a file.
2627 ********************************************************************/
2628
2629 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2630 uint16 dirtype)
2631 {
2632 if (!CAN_WRITE(conn)) {
2633 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2634 }
2635
2636 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2637 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2638 /* Only bother to read the DOS attribute if we might deny the
2639 rename on the grounds of attribute missmatch. */
2640 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2641 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2642 return NT_STATUS_NO_SUCH_FILE;
2643 }
2644 }
2645
2646 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2647 if (fsp->posix_open) {
2648 return NT_STATUS_OK;
2649 }
2650
2651 /* If no pathnames are open below this
2652 directory, allow the rename. */
2653
2654 if (file_find_subpath(fsp)) {
2655 return NT_STATUS_ACCESS_DENIED;
2656 }
2657 return NT_STATUS_OK;
2658 }
2659
2660 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2661 return NT_STATUS_OK;
2662 }
2663
2664 return NT_STATUS_ACCESS_DENIED;
2665 }
2666
2667 /*******************************************************************
2668 * unlink a file with all relevant access checks
2669 *******************************************************************/
2670
2671 static NTSTATUS do_unlink(connection_struct *conn,
2672 struct smb_request *req,
2673 struct smb_filename *smb_fname,
2674 uint32 dirtype)
2675 {
2676 uint32 fattr;
2677 files_struct *fsp;
2678 uint32 dirtype_orig = dirtype;
2679 NTSTATUS status;
2680 int ret;
2681 bool posix_paths = lp_posix_pathnames();
2682
2683 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2684 smb_fname_str_dbg(smb_fname),
2685 dirtype));
2686
2687 if (!CAN_WRITE(conn)) {
2688 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2689 }
2690
2691 if (posix_paths) {
2692 ret = SMB_VFS_LSTAT(conn, smb_fname);
2693 } else {
2694 ret = SMB_VFS_STAT(conn, smb_fname);
2695 }
2696 if (ret != 0) {
2697 return map_nt_error_from_unix(errno);
2698 }
2699
2700 fattr = dos_mode(conn, smb_fname);
2701
2702 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2703 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2704 }
2705
2706 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2707 if (!dirtype) {
2708 return NT_STATUS_NO_SUCH_FILE;
2709 }
2710
2711 if (!dir_check_ftype(fattr, dirtype)) {
2712 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2713 return NT_STATUS_FILE_IS_A_DIRECTORY;
2714 }
2715 return NT_STATUS_NO_SUCH_FILE;
2716 }
2717
2718 if (dirtype_orig & 0x8000) {
2719 /* These will never be set for POSIX. */
2720 return NT_STATUS_NO_SUCH_FILE;
2721 }
2722
2723 #if 0
2724 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2725 return NT_STATUS_FILE_IS_A_DIRECTORY;
2726 }
2727
2728 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2729 return NT_STATUS_NO_SUCH_FILE;
2730 }
2731
2732 if (dirtype & 0xFF00) {
2733 /* These will never be set for POSIX. */
2734 return NT_STATUS_NO_SUCH_FILE;
2735 }
2736
2737 dirtype &= 0xFF;
2738 if (!dirtype) {
2739 return NT_STATUS_NO_SUCH_FILE;
2740 }
2741
2742 /* Can't delete a directory. */
2743 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2744 return NT_STATUS_FILE_IS_A_DIRECTORY;
2745 }
2746 #endif
2747
2748 #if 0 /* JRATEST */
2749 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2750 return NT_STATUS_OBJECT_NAME_INVALID;
2751 #endif /* JRATEST */
2752
2753 /* On open checks the open itself will check the share mode, so
2754 don't do it here as we'll get it wrong. */
2755
2756 status = SMB_VFS_CREATE_FILE
2757 (conn, /* conn */
2758 req, /* req */
2759 0, /* root_dir_fid */
2760 smb_fname, /* fname */
2761 DELETE_ACCESS, /* access_mask */
2762 FILE_SHARE_NONE, /* share_access */
2763 FILE_OPEN, /* create_disposition*/
2764 FILE_NON_DIRECTORY_FILE, /* create_options */
2765 /* file_attributes */
2766 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2767 FILE_ATTRIBUTE_NORMAL,
2768 0, /* oplock_request */
2769 NULL, /* lease */
2770 0, /* allocation_size */
2771 0, /* private_flags */
2772 NULL, /* sd */
2773 NULL, /* ea_list */
2774 &fsp, /* result */
2775 NULL); /* pinfo */
2776
2777 if (!NT_STATUS_IS_OK(status)) {
2778 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2779 nt_errstr(status)));
2780 return status;
2781 }
2782
2783 status = can_set_delete_on_close(fsp, fattr);
2784 if (!NT_STATUS_IS_OK(status)) {
2785 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2786 "(%s)\n",
2787 smb_fname_str_dbg(smb_fname),
2788 nt_errstr(status)));
2789 close_file(req, fsp, NORMAL_CLOSE);
2790 return status;
2791 }
2792
2793 /* The set is across all open files on this dev/inode pair. */
2794 if (!set_delete_on_close(fsp, True,
2795 conn->session_info->security_token,
2796 conn->session_info->unix_token)) {
2797 close_file(req, fsp, NORMAL_CLOSE);
2798 return NT_STATUS_ACCESS_DENIED;
2799 }
2800
2801 return close_file(req, fsp, NORMAL_CLOSE);
2802 }
2803
2804 /****************************************************************************
2805 The guts of the unlink command, split out so it may be called by the NT SMB
2806 code.
2807 ****************************************************************************/
2808
2809 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2810 uint32 dirtype, struct smb_filename *smb_fname,
2811 bool has_wild)
2812 {
2813 char *fname_dir = NULL;
2814 char *fname_mask = NULL;
2815 int count=0;
2816 NTSTATUS status = NT_STATUS_OK;
2817 TALLOC_CTX *ctx = talloc_tos();
2818
2819 /* Split up the directory from the filename/mask. */
2820 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2821 &fname_dir, &fname_mask);
2822 if (!NT_STATUS_IS_OK(status)) {
2823 goto out;
2824 }
2825
2826 /*
2827 * We should only check the mangled cache
2828 * here if unix_convert failed. This means
2829 * that the path in 'mask' doesn't exist
2830 * on the file system and so we need to look
2831 * for a possible mangle. This patch from
2832 * Tine Smukavec <valentin.smukavec@hermes.si>.
2833 */
2834
2835 if (!VALID_STAT(smb_fname->st) &&
2836 mangle_is_mangled(fname_mask, conn->params)) {
2837 char *new_mask = NULL;
2838 mangle_lookup_name_from_8_3(ctx, fname_mask,
2839 &new_mask, conn->params);
2840 if (new_mask) {
2841 TALLOC_FREE(fname_mask);
2842 fname_mask = new_mask;
2843 }
2844 }
2845
2846 if (!has_wild) {
2847
2848 /*
2849 * Only one file needs to be unlinked. Append the mask back
2850 * onto the directory.
2851 */
2852 TALLOC_FREE(smb_fname->base_name);
2853 if (ISDOT(fname_dir)) {
2854 /* Ensure we use canonical names on open. */
2855 smb_fname->base_name = talloc_asprintf(smb_fname,
2856 "%s",
2857 fname_mask);
2858 } else {
2859 smb_fname->base_name = talloc_asprintf(smb_fname,
2860 "%s/%s",
2861 fname_dir,
2862 fname_mask);
2863 }
2864 if (!smb_fname->base_name) {
2865 status = NT_STATUS_NO_MEMORY;
2866 goto out;
2867 }
2868 if (dirtype == 0) {
2869 dirtype = FILE_ATTRIBUTE_NORMAL;
2870 }
2871
2872 status = check_name(conn, smb_fname->base_name);
2873 if (!NT_STATUS_IS_OK(status)) {
2874 goto out;
2875 }
2876
2877 status = do_unlink(conn, req, smb_fname, dirtype);
2878 if (!NT_STATUS_IS_OK(status)) {
2879 goto out;
2880 }
2881
2882 count++;
2883 } else {
2884 struct smb_Dir *dir_hnd = NULL;
2885 long offset = 0;
2886 const char *dname = NULL;
2887 char *talloced = NULL;
2888
2889 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2890 status = NT_STATUS_OBJECT_NAME_INVALID;
2891 goto out;
2892 }
2893
2894 if (strequal(fname_mask,"????????.???")) {
2895 TALLOC_FREE(fname_mask);
2896 fname_mask = talloc_strdup(ctx, "*");
2897 if (!fname_mask) {
2898 status = NT_STATUS_NO_MEMORY;
2899 goto out;
2900 }
2901 }
2902
2903 status = check_name(conn, fname_dir);
2904 if (!NT_STATUS_IS_OK(status)) {
2905 goto out;
2906 }
2907
2908 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2909 dirtype);
2910 if (dir_hnd == NULL) {
2911 status = map_nt_error_from_unix(errno);
2912 goto out;
2913 }
2914
2915 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2916 the pattern matches against the long name, otherwise the short name
2917 We don't implement this yet XXXX
2918 */
2919
2920 status = NT_STATUS_NO_SUCH_FILE;
2921
2922 while ((dname = ReadDirName(dir_hnd, &offset,
2923 &smb_fname->st, &talloced))) {
2924 TALLOC_CTX *frame = talloc_stackframe();
2925
2926 if (!is_visible_file(conn, fname_dir, dname,
2927 &smb_fname->st, true)) {
2928 TALLOC_FREE(frame);
2929 TALLOC_FREE(talloced);
2930 continue;
2931 }
2932
2933 /* Quick check for "." and ".." */
2934 if (ISDOT(dname) || ISDOTDOT(dname)) {
2935 TALLOC_FREE(frame);
2936 TALLOC_FREE(talloced);
2937 continue;
2938 }
2939
2940 if(!mask_match(dname, fname_mask,
2941 conn->case_sensitive)) {
2942 TALLOC_FREE(frame);
2943 TALLOC_FREE(talloced);
2944 continue;
2945 }
2946
2947 TALLOC_FREE(smb_fname->base_name);
2948 if (ISDOT(fname_dir)) {
2949 /* Ensure we use canonical names on open. */
2950 smb_fname->base_name =
2951 talloc_asprintf(smb_fname, "%s",
2952 dname);
2953 } else {
2954 smb_fname->base_name =
2955 talloc_asprintf(smb_fname, "%s/%s",
2956 fname_dir, dname);
2957 }
2958
2959 if (!smb_fname->base_name) {
2960 TALLOC_FREE(dir_hnd);
2961 status = NT_STATUS_NO_MEMORY;
2962 TALLOC_FREE(frame);
2963 TALLOC_FREE(talloced);
2964 goto out;
2965 }
2966
2967 status = check_name(conn, smb_fname->base_name);
2968 if (!NT_STATUS_IS_OK(status)) {
2969 TALLOC_FREE(dir_hnd);
2970 TALLOC_FREE(frame);
2971 TALLOC_FREE(talloced);
2972 goto out;
2973 }
2974
2975 status = do_unlink(conn, req, smb_fname, dirtype);
2976 if (!NT_STATUS_IS_OK(status)) {
2977 TALLOC_FREE(dir_hnd);
2978 TALLOC_FREE(frame);
2979 TALLOC_FREE(talloced);
2980 goto out;
2981 }
2982
2983 count++;
2984 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2985 smb_fname->base_name));
2986
2987 TALLOC_FREE(frame);
2988 TALLOC_FREE(talloced);
2989 }
2990 TALLOC_FREE(dir_hnd);
2991 }
2992
2993 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2994 status = map_nt_error_from_unix(errno);
2995 }
2996
2997 out:
2998 TALLOC_FREE(fname_dir);
2999 TALLOC_FREE(fname_mask);
3000 return status;
3001 }
3002
3003 /****************************************************************************
3004 Reply to a unlink
3005 ****************************************************************************/
3006
3007 void reply_unlink(struct smb_request *req)
3008 {
3009 connection_struct *conn = req->conn;
3010 char *name = NULL;
3011 struct smb_filename *smb_fname = NULL;
3012 uint32 dirtype;
3013 NTSTATUS status;
3014 bool path_contains_wcard = False;
3015 TALLOC_CTX *ctx = talloc_tos();
3016
3017 START_PROFILE(SMBunlink);
3018
3019 if (req->wct < 1) {
3020 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3021 goto out;
3022 }
3023
3024 dirtype = SVAL(req->vwv+0, 0);
3025
3026 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
3027 STR_TERMINATE, &status,
3028 &path_contains_wcard);
3029 if (!NT_STATUS_IS_OK(status)) {
3030 reply_nterror(req, status);
3031 goto out;
3032 }
3033
3034 status = filename_convert(ctx, conn,
3035 req->flags2 & FLAGS2_DFS_PATHNAMES,
3036 name,
3037 UCF_COND_ALLOW_WCARD_LCOMP,
3038 &path_contains_wcard,
3039 &smb_fname);
3040 if (!NT_STATUS_IS_OK(status)) {
3041 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3042 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
3043 ERRSRV, ERRbadpath);
3044 goto out;
3045 }
3046 reply_nterror(req, status);
3047 goto out;
3048 }
3049
3050 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
3051
3052 status = unlink_internals(conn, req, dirtype, smb_fname,
3053 path_contains_wcard);
3054 if (!NT_STATUS_IS_OK(status)) {
3055 if (open_was_deferred(req->xconn, req->mid)) {
3056 /* We have re-scheduled this call. */
3057 goto out;
3058 }
3059 reply_nterror(req, status);
3060 goto out;
3061 }
3062
3063 reply_outbuf(req, 0, 0);
3064 out:
3065 TALLOC_FREE(smb_fname);
3066 END_PROFILE(SMBunlink);
3067 return;
3068 }
3069
3070 /****************************************************************************
3071 Fail for readbraw.
3072 ****************************************************************************/
3073
3074 static void fail_readraw(void)
3075 {
3076 const char *errstr = talloc_asprintf(talloc_tos(),
3077 "FAIL ! reply_readbraw: socket write fail (%s)",
3078 strerror(errno));
3079 if (!errstr) {
3080 errstr = "";
3081 }
3082 exit_server_cleanly(errstr);
3083 }
3084
3085 /****************************************************************************
3086 Fake (read/write) sendfile. Returns -1 on read or write fail.
3087 ****************************************************************************/
3088
3089 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3090 off_t startpos, size_t nread)
3091 {
3092 size_t bufsize;
3093 size_t tosend = nread;
3094 char *buf;
3095
3096 if (nread == 0) {
3097 return 0;
3098 }
3099
3100 bufsize = MIN(nread, 65536);
3101
3102 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3103 return -1;
3104 }
3105
3106 while (tosend > 0) {
3107 ssize_t ret;
3108 size_t cur_read;
3109
3110 if (tosend > bufsize) {
3111 cur_read = bufsize;
3112 } else {
3113 cur_read = tosend;
3114 }
3115 ret = read_file(fsp,buf,startpos,cur_read);
3116 if (ret == -1) {
3117 SAFE_FREE(buf);
3118 return -1;
3119 }
3120
3121 /* If we had a short read, fill with zeros. */
3122 if (ret < cur_read) {
3123 memset(buf + ret, '\0', cur_read - ret);
3124 }
3125
3126 ret = write_data(xconn->transport.sock, buf, cur_read);
3127 if (ret != cur_read) {
3128 int saved_errno = errno;
3129 /*
3130 * Try and give an error message saying what
3131 * client failed.
3132 */
3133 DEBUG(0, ("write_data failed for client %s. "
3134 "Error %s\n",
3135 smbXsrv_connection_dbg(xconn),
3136 strerror(saved_errno)));
3137 SAFE_FREE(buf);
3138 errno = saved_errno;
3139 return -1;
3140 }
3141 tosend -= cur_read;
3142 startpos += cur_read;
3143 }
3144
3145 SAFE_FREE(buf);
3146 return (ssize_t)nread;
3147 }
3148
3149 /****************************************************************************
3150 Deal with the case of sendfile reading less bytes from the file than
3151 requested. Fill with zeros (all we can do). Returns 0 on success
3152 ****************************************************************************/
3153
3154 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3155 files_struct *fsp,
3156 ssize_t nread,
3157 size_t headersize,
3158 size_t smb_maxcnt)
3159 {
3160 #define SHORT_SEND_BUFSIZE 1024
3161 if (nread < headersize) {
3162 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3163 "header for file %s (%s). Terminating\n",
3164 fsp_str_dbg(fsp), strerror(errno)));
3165 return -1;
3166 }
3167
3168 nread -= headersize;
3169
3170 if (nread < smb_maxcnt) {
3171 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3172 if (!buf) {
3173 DEBUG(0,("sendfile_short_send: malloc failed "
3174 "for file %s (%s). Terminating\n",
3175 fsp_str_dbg(fsp), strerror(errno)));
3176 return -1;
3177 }
3178
3179 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3180 "with zeros !\n", fsp_str_dbg(fsp)));
3181
3182 while (nread < smb_maxcnt) {
3183 /*
3184 * We asked for the real file size and told sendfile
3185 * to not go beyond the end of the file. But it can
3186 * happen that in between our fstat call and the
3187 * sendfile call the file was truncated. This is very
3188 * bad because we have already announced the larger
3189 * number of bytes to the client.
3190 *
3191 * The best we can do now is to send 0-bytes, just as
3192 * a read from a hole in a sparse file would do.
3193 *
3194 * This should happen rarely enough that I don't care
3195 * about efficiency here :-)
3196 */
3197 size_t to_write;
3198 ssize_t ret;
3199
3200 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3201 ret = write_data(xconn->transport.sock, buf, to_write);
3202 if (ret != to_write) {
3203 int saved_errno = errno;
3204 /*
3205 * Try and give an error message saying what
3206 * client failed.
3207 */
3208 DEBUG(0, ("write_data failed for client %s. "
3209 "Error %s\n",
3210 smbXsrv_connection_dbg(xconn),
3211 strerror(saved_errno)));
3212 errno = saved_errno;
3213 return -1;
3214 }
3215 nread += to_write;
3216 }
3217 SAFE_FREE(buf);
3218 }
3219
3220 return 0;
3221 }
3222
3223 /****************************************************************************
3224 Return a readbraw error (4 bytes of zero).
3225 ****************************************************************************/
3226
3227 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3228 {
3229 char header[4];
3230
3231 SIVAL(header,0,0);
3232
3233 smbd_lock_socket(xconn);
3234 if (write_data(xconn->transport.sock,header,4) != 4) {
3235 int saved_errno = errno;
3236 /*
3237 * Try and give an error message saying what
3238 * client failed.
3239 */
3240 DEBUG(0, ("write_data failed for client %s. "
3241 "Error %s\n",
3242 smbXsrv_connection_dbg(xconn),
3243 strerror(saved_errno)));
3244 errno = saved_errno;
3245
3246 fail_readraw();
3247 }
3248 smbd_unlock_socket(xconn);
3249 }
3250
3251 /****************************************************************************
3252 Use sendfile in readbraw.
3253 ****************************************************************************/
3254
3255 static void send_file_readbraw(connection_struct *conn,
3256 struct smb_request *req,
3257 files_struct *fsp,
3258 off_t startpos,
3259 size_t nread,
3260 ssize_t mincount)
3261 {
3262 struct smbXsrv_connection *xconn = req->xconn;
3263 char *outbuf = NULL;
3264 ssize_t ret=0;
3265
3266 /*
3267 * We can only use sendfile on a non-chained packet
3268 * but we can use on a non-oplocked file. tridge proved this
3269 * on a train in Germany :-). JRA.
3270 * reply_readbraw has already checked the length.
3271 */
3272
3273 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3274 (fsp->wcp == NULL) &&
3275 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3276 ssize_t sendfile_read = -1;
3277 char header[4];
3278 DATA_BLOB header_blob;
3279
3280 _smb_setlen(header,nread);
3281 header_blob = data_blob_const(header, 4);
3282
3283 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3284 &header_blob, startpos,
3285 nread);
3286 if (sendfile_read == -1) {
3287 /* Returning ENOSYS means no data at all was sent.
3288 * Do this as a normal read. */
3289 if (errno == ENOSYS) {
3290 goto normal_readbraw;
3291 }
3292
3293 /*
3294 * Special hack for broken Linux with no working sendfile. If we
3295 * return EINTR we sent the header but not the rest of the data.
3296 * Fake this up by doing read/write calls.
3297 */
3298 if (errno == EINTR) {
3299 /* Ensure we don't do this again. */
3300 set_use_sendfile(SNUM(conn), False);
3301 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3302
3303 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3304 DEBUG(0,("send_file_readbraw: "
3305 "fake_sendfile failed for "
3306 "file %s (%s).\n",
3307 fsp_str_dbg(fsp),
3308 strerror(errno)));
3309 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3310 }
3311 return;
3312 }
3313
3314 DEBUG(0,("send_file_readbraw: sendfile failed for "
3315 "file %s (%s). Terminating\n",
3316 fsp_str_dbg(fsp), strerror(errno)));
3317 exit_server_cleanly("send_file_readbraw sendfile failed");
3318 } else if (sendfile_read == 0) {
3319 /*
3320 * Some sendfile implementations return 0 to indicate
3321 * that there was a short read, but nothing was
3322 * actually written to the socket. In this case,
3323 * fallback to the normal read path so the header gets
3324 * the correct byte count.
3325 */
3326 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3327 "bytes falling back to the normal read: "
3328 "%s\n", fsp_str_dbg(fsp)));
3329 goto normal_readbraw;
3330 }
3331
3332 /* Deal with possible short send. */
3333 if (sendfile_read != 4+nread) {
3334 ret = sendfile_short_send(xconn, fsp,
3335 sendfile_read, 4, nread);
3336 if (ret == -1) {
3337 fail_readraw();
3338 }
3339 }
3340 return;
3341 }
3342
3343 normal_readbraw:
3344
3345 outbuf = talloc_array(NULL, char, nread+4);
3346 if (!outbuf) {
3347 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3348 (unsigned)(nread+4)));
3349 reply_readbraw_error(xconn);
3350 return;
3351 }
3352
3353 if (nread > 0) {
3354 ret = read_file(fsp,outbuf+4,startpos,nread);
3355 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3356 if (ret < mincount)
3357 ret = 0;
3358 #else
3359 if (ret < nread)
3360 ret = 0;
3361 #endif
3362 }
3363
3364 _smb_setlen(outbuf,ret);
3365 if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3366 int saved_errno = errno;
3367 /*
3368 * Try and give an error message saying what
3369 * client failed.
3370 */
3371 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3372 smbXsrv_connection_dbg(xconn),
3373 strerror(saved_errno)));
3374 errno = saved_errno;
3375
3376 fail_readraw();
3377 }
3378
3379 TALLOC_FREE(outbuf);
3380 }
3381
3382 /****************************************************************************
3383 Reply to a readbraw (core+ protocol).
3384 ****************************************************************************/
3385
3386 void reply_readbraw(struct smb_request *req)
3387 {
3388 connection_struct *conn = req->conn;
3389 struct smbXsrv_connection *xconn = req->xconn;
3390 ssize_t maxcount,mincount;
3391 size_t nread = 0;
3392 off_t startpos;
3393 files_struct *fsp;
3394 struct lock_struct lock;
3395 off_t size = 0;
3396
3397 START_PROFILE(SMBreadbraw);
3398
3399 if (srv_is_signing_active(xconn) || req->encrypted) {
3400 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3401 "raw reads/writes are disallowed.");
3402 }
3403
3404 if (req->wct < 8) {
3405 reply_readbraw_error(xconn);
3406 END_PROFILE(SMBreadbraw);
3407 return;
3408 }
3409
3410 if (xconn->smb1.echo_handler.trusted_fde) {
3411 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3412 "'async smb echo handler = yes'\n"));
3413 reply_readbraw_error(xconn);
3414 END_PROFILE(SMBreadbraw);
3415 return;
3416 }
3417
3418 /*
3419 * Special check if an oplock break has been issued
3420 * and the readraw request croses on the wire, we must
3421 * return a zero length response here.
3422 */
3423
3424 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3425
3426 /*
3427 * We have to do a check_fsp by hand here, as
3428 * we must always return 4 zero bytes on error,
3429 * not a NTSTATUS.
3430 */
3431
3432 if (!fsp || !conn || conn != fsp->conn ||
3433 req->vuid != fsp->vuid ||
3434 fsp->is_directory || fsp->fh->fd == -1) {
3435 /*
3436 * fsp could be NULL here so use the value from the packet. JRA.
3437 */
3438 DEBUG(3,("reply_readbraw: fnum %d not valid "
3439 "- cache prime?\n",
3440 (int)SVAL(req->vwv+0, 0)));
3441 reply_readbraw_error(xconn);
3442 END_PROFILE(SMBreadbraw);
3443 return;
3444 }
3445
3446 /* Do a "by hand" version of CHECK_READ. */
3447 if (!(fsp->can_read ||
3448 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3449 (fsp->access_mask & FILE_EXECUTE)))) {
3450 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3451 (int)SVAL(req->vwv+0, 0)));
3452 reply_readbraw_error(xconn);
3453 END_PROFILE(SMBreadbraw);
3454 return;
3455 }
3456
3457 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3458
3459 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3460 if(req->wct == 10) {
3461 /*
3462 * This is a large offset (64 bit) read.
3463 */
3464
3465 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3466
3467 if(startpos < 0) {
3468 DEBUG(0,("reply_readbraw: negative 64 bit "
3469 "readraw offset (%.0f) !\n",
3470 (double)startpos ));
3471 reply_readbraw_error(xconn);
3472 END_PROFILE(SMBreadbraw);
3473 return;
3474 }
3475 }
3476
3477 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3478 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3479
3480 /* ensure we don't overrun the packet size */
3481 maxcount = MIN(65535,maxcount);
3482
3483 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3484 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3485 &lock);
3486
3487 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3488 reply_readbraw_error(xconn);
3489 END_PROFILE(SMBreadbraw);
3490 return;
3491 }
3492
3493 if (fsp_stat(fsp) == 0) {
3494 size = fsp->fsp_name->st.st_ex_size;
3495 }
3496
3497 if (startpos >= size) {
3498 nread = 0;
3499 } else {
3500 nread = MIN(maxcount,(size - startpos));
3501 }
3502
3503 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3504 if (nread < mincount)
3505 nread = 0;
3506 #endif
3507
3508 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3509 "min=%lu nread=%lu\n",
3510 fsp_fnum_dbg(fsp), (double)startpos,
3511 (unsigned long)maxcount,
3512 (unsigned long)mincount,
3513 (unsigned long)nread ) );
3514
3515 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3516
3517 DEBUG(5,("reply_readbraw finished\n"));
3518
3519 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3520
3521 END_PROFILE(SMBreadbraw);
3522 return;
3523 }
3524
3525 #undef DBGC_CLASS
3526 #define DBGC_CLASS DBGC_LOCKING
3527
3528 /****************************************************************************
3529 Reply to a lockread (core+ protocol).
3530 ****************************************************************************/
3531
3532 void reply_lockread(struct smb_request *req)
3533 {
3534 connection_struct *conn = req->conn;
3535 ssize_t nread = -1;
3536 char *data;
3537 off_t startpos;
3538 size_t numtoread;
3539 size_t maxtoread;
3540 NTSTATUS status;
3541 files_struct *fsp;
3542 struct byte_range_lock *br_lck = NULL;
3543 char *p = NULL;
3544 struct smbXsrv_connection *xconn = req->xconn;
3545
3546 START_PROFILE(SMBlockread);
3547
3548 if (req->wct < 5) {
3549 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3550 END_PROFILE(SMBlockread);
3551 return;
3552 }
3553
3554 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3555
3556 if (!check_fsp(conn, req, fsp)) {
3557 END_PROFILE(SMBlockread);
3558 return;
3559 }
3560
3561 if (!CHECK_READ(fsp,req)) {
3562 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3563 END_PROFILE(SMBlockread);
3564 return;
3565 }
3566
3567 numtoread = SVAL(req->vwv+1, 0);
3568 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3569
3570 /*
3571 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3572 * protocol request that predates the read/write lock concept.
3573 * Thus instead of asking for a read lock here we need to ask
3574 * for a write lock. JRA.
3575 * Note that the requested lock size is unaffected by max_send.
3576 */
3577
3578 br_lck = do_lock(req->sconn->msg_ctx,
3579 fsp,
3580 (uint64_t)req->smbpid,
3581 (uint64_t)numtoread,
3582 (uint64_t)startpos,
3583 WRITE_LOCK,
3584 WINDOWS_LOCK,
3585 False, /* Non-blocking lock. */
3586 &status,
3587 NULL);
3588 TALLOC_FREE(br_lck);
3589
3590 if (NT_STATUS_V(status)) {
3591 reply_nterror(req, status);
3592 END_PROFILE(SMBlockread);
3593 return;
3594 }
3595
3596 /*
3597 * However the requested READ size IS affected by max_send. Insanity.... JRA.
3598 */
3599 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3600
3601 if (numtoread > maxtoread) {
3602 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3603 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3604 (unsigned int)numtoread, (unsigned int)maxtoread,
3605 (unsigned int)xconn->smb1.sessions.max_send));
3606 numtoread = maxtoread;
3607 }
3608
3609 reply_outbuf(req, 5, numtoread + 3);
3610
3611 data = smb_buf(req->outbuf) + 3;
3612
3613 nread = read_file(fsp,data,startpos,numtoread);
3614
3615 if (nread < 0) {
3616 reply_nterror(req, map_nt_error_from_unix(errno));
3617 END_PROFILE(SMBlockread);
3618 return;
3619 }
3620
3621 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3622
3623 SSVAL(req->outbuf,smb_vwv0,nread);
3624 SSVAL(req->outbuf,smb_vwv5,nread+3);
3625 p = smb_buf(req->outbuf);
3626 SCVAL(p,0,0); /* pad byte. */
3627 SSVAL(p,1,nread);
3628
3629 DEBUG(3,("lockread %s num=%d nread=%d\n",
3630 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3631
3632 END_PROFILE(SMBlockread);
3633 return;
3634 }
3635
3636 #undef DBGC_CLASS
3637 #define DBGC_CLASS DBGC_ALL
3638
3639 /****************************************************************************
3640 Reply to a read.
3641 ****************************************************************************/
3642
3643 void reply_read(struct smb_request *req)
3644 {
3645 connection_struct *conn = req->conn;
3646 size_t numtoread;
3647 size_t maxtoread;
3648 ssize_t nread = 0;
3649 char *data;
3650 off_t startpos;
3651 files_struct *fsp;
3652 struct lock_struct lock;
3653 struct smbXsrv_connection *xconn = req->xconn;
3654
3655 START_PROFILE(SMBread);
3656
3657 if (req->wct < 3) {
3658 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3659 END_PROFILE(SMBread);
3660 return;
3661 }
3662
3663 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3664
3665 if (!check_fsp(conn, req, fsp)) {
3666 END_PROFILE(SMBread);
3667 return;
3668 }
3669
3670 if (!CHECK_READ(fsp,req)) {
3671 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3672 END_PROFILE(SMBread);
3673 return;
3674 }
3675
3676 numtoread = SVAL(req->vwv+1, 0);
3677 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3678
3679 /*
3680 * The requested read size cannot be greater than max_send. JRA.
3681 */
3682 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3683
3684 if (numtoread > maxtoread) {
3685 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3686 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3687 (unsigned int)numtoread, (unsigned int)maxtoread,
3688 (unsigned int)xconn->smb1.sessions.max_send));
3689 numtoread = maxtoread;
3690 }
3691
3692 reply_outbuf(req, 5, numtoread+3);
3693
3694 data = smb_buf(req->outbuf) + 3;
3695
3696 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3697 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3698 &lock);
3699
3700 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3701 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3702 END_PROFILE(SMBread);
3703 return;
3704 }
3705
3706 if (numtoread > 0)
3707 nread = read_file(fsp,data,startpos,numtoread);
3708
3709 if (nread < 0) {
3710 reply_nterror(req, map_nt_error_from_unix(errno));
3711 goto strict_unlock;
3712 }
3713
3714 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3715
3716 SSVAL(req->outbuf,smb_vwv0,nread);
3717 SSVAL(req->outbuf,smb_vwv5,nread+3);
3718 SCVAL(smb_buf(req->outbuf),0,1);
3719 SSVAL(smb_buf(req->outbuf),1,nread);
3720
3721 DEBUG(3, ("read %s num=%d nread=%d\n",
3722 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3723
3724 strict_unlock:
3725 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3726
3727 END_PROFILE(SMBread);
3728 return;
3729 }
3730
3731 /****************************************************************************
3732 Setup readX header.
3733 ****************************************************************************/
3734
3735 static int setup_readX_header(struct smb_request *req, char *outbuf,
3736 size_t smb_maxcnt)
3737 {
3738 int outsize;
3739
3740 outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
3741 False);
3742
3743 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3744
3745 SCVAL(outbuf,smb_vwv0,0xFF);
3746 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3747 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3748 SSVAL(outbuf,smb_vwv6,
3749 (smb_wct - 4) /* offset from smb header to wct */
3750 + 1 /* the wct field */
3751 + 12 * sizeof(uint16_t) /* vwv */
3752 + 2 /* the buflen field */
3753 + 1); /* padding byte */
3754 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3755 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3756 SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
3757 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3758 _smb_setlen_large(outbuf,
3759 smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
3760 return outsize;
3761 }
3762
3763 /****************************************************************************
3764 Reply to a read and X - possibly using sendfile.
3765 ****************************************************************************/
3766
3767 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3768 files_struct *fsp, off_t startpos,
3769 size_t smb_maxcnt)
3770 {
3771 struct smbXsrv_connection *xconn = req->xconn;
3772 ssize_t nread = -1;
3773 struct lock_struct lock;
3774 int saved_errno = 0;
3775
3776 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3777 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3778 &lock);
3779
3780 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3781 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3782 return;
3783 }
3784
3785 /*
3786 * We can only use sendfile on a non-chained packet
3787 * but we can use on a non-oplocked file. tridge proved this
3788 * on a train in Germany :-). JRA.
3789 */
3790
3791 if (!req_is_in_chain(req) &&
3792 !req->encrypted &&
3793 (fsp->base_fsp == NULL) &&
3794 (fsp->wcp == NULL) &&
3795 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3796 uint8 headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
3797 DATA_BLOB header;
3798
3799 if(fsp_stat(fsp) == -1) {
3800 reply_nterror(req, map_nt_error_from_unix(errno));
3801 goto strict_unlock;
3802 }
3803
3804 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3805 (startpos > fsp->fsp_name->st.st_ex_size) ||
3806 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3807 /*
3808 * We already know that we would do a short read, so don't
3809 * try the sendfile() path.
3810 */
3811 goto nosendfile_read;
3812 }
3813
3814 /*
3815 * Set up the packet header before send. We
3816 * assume here the sendfile will work (get the
3817 * correct amount of data).
3818 */
3819
3820 header = data_blob_const(headerbuf, sizeof(headerbuf));
3821
3822 construct_reply_common_req(req, (char *)headerbuf);
3823 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3824
3825 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
3826 startpos, smb_maxcnt);
3827 if (nread == -1) {
3828 saved_errno = errno;
3829
3830 /* Returning ENOSYS means no data at all was sent.
3831 Do this as a normal read. */
3832 if (errno == ENOSYS) {
3833 goto normal_read;
3834 }
3835
3836 /*
3837 * Special hack for broken Linux with no working sendfile. If we
3838 * return EINTR we sent the header but not the rest of the data.
3839 * Fake this up by doing read/write calls.
3840 */
3841
3842 if (errno == EINTR) {
3843 /* Ensure we don't do this again. */
3844 set_use_sendfile(SNUM(conn), False);
3845 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3846 nread = fake_sendfile(xconn, fsp, startpos,
3847 smb_maxcnt);
3848 if (nread == -1) {
3849 saved_errno = errno;
3850 DEBUG(0,("send_file_readX: "
3851 "fake_sendfile failed for "
3852 "file %s (%s) for client %s. "
3853 "Terminating\n",
3854 fsp_str_dbg(fsp),
3855 smbXsrv_connection_dbg(xconn),
3856 strerror(saved_errno)));
3857 errno = saved_errno;
3858 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3859 }
3860 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3861 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3862 /* No outbuf here means successful sendfile. */
3863 goto strict_unlock;
3864 }
3865
3866 DEBUG(0,("send_file_readX: sendfile failed for file "
3867 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3868 strerror(errno)));
3869 exit_server_cleanly("send_file_readX sendfile failed");
3870 } else if (nread == 0) {
3871 /*
3872 * Some sendfile implementations return 0 to indicate
3873 * that there was a short read, but nothing was
3874 * actually written to the socket. In this case,
3875 * fallback to the normal read path so the header gets
3876 * the correct byte count.
3877 */
3878 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3879 "falling back to the normal read: %s\n",
3880 fsp_str_dbg(fsp)));
3881 goto normal_read;
3882 }
3883
3884 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3885 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3886
3887 /* Deal with possible short send. */
3888 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3889 ssize_t ret;
3890
3891 ret = sendfile_short_send(xconn, fsp, nread,
3892 sizeof(headerbuf), smb_maxcnt);
3893 if (ret == -1) {
3894 const char *r;
3895 r = "send_file_readX: sendfile_short_send failed";
3896 DEBUG(0,("%s for file %s (%s).\n",
3897 r, fsp_str_dbg(fsp), strerror(errno)));
3898 exit_server_cleanly(r);
3899 }
3900 }
3901 /* No outbuf here means successful sendfile. */
3902 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3903 SMB_PERFCOUNT_END(&req->pcd);
3904 goto strict_unlock;
3905 }
3906
3907 normal_read:
3908
3909 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3910 uint8 headerbuf[smb_size + 2*12 + 1 /* padding byte */];
3911 ssize_t ret;
3912
3913 construct_reply_common_req(req, (char *)headerbuf);
3914 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3915
3916 /* Send out the header. */
3917 ret = write_data(xconn->transport.sock, (char *)headerbuf,
3918 sizeof(headerbuf));
3919 if (ret != sizeof(headerbuf)) {
3920 saved_errno = errno;
3921 /*
3922 * Try and give an error message saying what
3923 * client failed.
3924 */
3925 DEBUG(0,("send_file_readX: write_data failed for file "
3926 "%s (%s) for client %s. Terminating\n",
3927 fsp_str_dbg(fsp),
3928 smbXsrv_connection_dbg(xconn),
3929 strerror(saved_errno)));
3930 errno = saved_errno;
3931 exit_server_cleanly("send_file_readX sendfile failed");
3932 }
3933 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
3934 if (nread == -1) {
3935 saved_errno = errno;
3936 DEBUG(0,("send_file_readX: fake_sendfile failed for file "
3937 "%s (%s) for client %s. Terminating\n",
3938 fsp_str_dbg(fsp),
3939 smbXsrv_connection_dbg(xconn),
3940 strerror(saved_errno)));
3941 errno = saved_errno;
3942 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3943 }
3944 goto strict_unlock;
3945 }
3946
3947 nosendfile_read:
3948
3949 reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
3950 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3951 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3952
3953 nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
3954 startpos, smb_maxcnt);
3955 saved_errno = errno;
3956
3957 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3958
3959 if (nread < 0) {
3960 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3961 return;
3962 }
3963
3964 setup_readX_header(req, (char *)req->outbuf, nread);
3965
3966 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3967 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3968 return;
3969
3970 strict_unlock:
3971 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3972 TALLOC_FREE(req->outbuf);
3973 return;
3974 }
3975
3976 /****************************************************************************
3977 Work out how much space we have for a read return.
3978 ****************************************************************************/
3979
3980 static size_t calc_max_read_pdu(const struct smb_request *req)
3981 {
3982 struct smbXsrv_connection *xconn = req->xconn;
3983
3984 if (xconn->protocol < PROTOCOL_NT1) {
3985 return xconn->smb1.sessions.max_send;
3986 }
3987
3988 if (!lp_large_readwrite()) {
3989 return xconn->smb1.sessions.max_send;
3990 }
3991
3992 if (req_is_in_chain(req)) {
3993 return xconn->smb1.sessions.max_send;
3994 }
3995
3996 if (req->encrypted) {
3997 /*
3998 * Don't take encrypted traffic up to the
3999 * limit. There are padding considerations
4000 * that make that tricky.
4001 */
4002 return xconn->smb1.sessions.max_send;
4003 }
4004
4005 if (srv_is_signing_active(xconn)) {
4006 return 0x1FFFF;
4007 }
4008
4009 if (!lp_unix_extensions()) {
4010 return 0x1FFFF;
4011 }
4012
4013 /*
4014 * We can do ultra-large POSIX reads.
4015 */
4016 return 0xFFFFFF;
4017 }
4018
4019 /****************************************************************************
4020 Calculate how big a read can be. Copes with all clients. It's always
4021 safe to return a short read - Windows does this.
4022 ****************************************************************************/
4023
4024 static size_t calc_read_size(const struct smb_request *req,
4025 size_t upper_size,
4026 size_t lower_size)
4027 {
4028 struct smbXsrv_connection *xconn = req->xconn;
4029 size_t max_pdu = calc_max_read_pdu(req);
4030 size_t total_size = 0;
4031 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
4032 size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
4033
4034 /*
4035 * Windows explicitly ignores upper size of 0xFFFF.
4036 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4037 * We must do the same as these will never fit even in
4038 * an extended size NetBIOS packet.
4039 */
4040 if (upper_size == 0xFFFF) {
4041 upper_size = 0;
4042 }
4043
4044 if (xconn->protocol < PROTOCOL_NT1) {
4045 upper_size = 0;
4046 }
4047
4048 total_size = ((upper_size<<16) | lower_size);
4049
4050 /*
4051 * LARGE_READX test shows it's always safe to return
4052 * a short read. Windows does so.
4053 */
4054 return MIN(total_size, max_len);
4055 }
4056
4057 /****************************************************************************
4058 Reply to a read and X.
4059 ****************************************************************************/
4060
4061 void reply_read_and_X(struct smb_request *req)
4062 {
4063 connection_struct *conn = req->conn;
4064 files_struct *fsp;
4065 off_t startpos;
4066 size_t smb_maxcnt;
4067 size_t upper_size;
4068 bool big_readX = False;
4069 #if 0
4070 size_t smb_mincnt = SVAL(req->vwv+6, 0);
4071 #endif
4072
4073 START_PROFILE(SMBreadX);
4074
4075 if ((req->wct != 10) && (req->wct != 12)) {
4076 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4077 return;
4078 }
4079
4080 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4081 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4082 smb_maxcnt = SVAL(req->vwv+5, 0);
4083
4084 /* If it's an IPC, pass off the pipe handler. */
4085 if (IS_IPC(conn)) {
4086 reply_pipe_read_and_X(req);
4087 END_PROFILE(SMBreadX);
4088 return;
4089 }
4090
4091 if (!check_fsp(conn, req, fsp)) {
4092 END_PROFILE(SMBreadX);
4093 return;
4094 }
4095
4096 if (!CHECK_READ(fsp,req)) {
4097 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4098 END_PROFILE(SMBreadX);
4099 return;
4100 }
4101
4102 upper_size = SVAL(req->vwv+7, 0);
4103 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4104 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4105 /*
4106 * This is a heuristic to avoid keeping large
4107 * outgoing buffers around over long-lived aio
4108 * requests.
4109 */
4110 big_readX = True;
4111 }
4112
4113 if (req->wct == 12) {
4114 /*
4115 * This is a large offset (64 bit) read.
4116 */
4117 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4118
4119 }
4120
4121 if (!big_readX) {
4122 NTSTATUS status = schedule_aio_read_and_X(conn,
4123 req,
4124 fsp,
4125 startpos,
4126 smb_maxcnt);
4127 if (NT_STATUS_IS_OK(status)) {
4128 /* Read scheduled - we're done. */
4129 goto out;
4130 }
4131 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4132 /* Real error - report to client. */
4133 END_PROFILE(SMBreadX);
4134 reply_nterror(req, status);
4135 return;
4136 }
4137 /* NT_STATUS_RETRY - fall back to sync read. */
4138 }
4139
4140 smbd_lock_socket(req->xconn);
4141 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4142 smbd_unlock_socket(req->xconn);
4143
4144 out:
4145 END_PROFILE(SMBreadX);
4146 return;
4147 }
4148
4149 /****************************************************************************
4150 Error replies to writebraw must have smb_wct == 1. Fix this up.
4151 ****************************************************************************/
4152
4153 void error_to_writebrawerr(struct smb_request *req)
4154 {
4155 uint8 *old_outbuf = req->outbuf;
4156
4157 reply_outbuf(req, 1, 0);
4158
4159 memcpy(req->outbuf, old_outbuf, smb_size);
4160 TALLOC_FREE(old_outbuf);
4161 }
4162
4163 /****************************************************************************
4164 Read 4 bytes of a smb packet and return the smb length of the packet.
4165 Store the result in the buffer. This version of the function will
4166 never return a session keepalive (length of zero).
4167 Timeout is in milliseconds.
4168 ****************************************************************************/
4169
4170 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4171 size_t *len)
4172 {
4173 uint8_t msgtype = NBSSkeepalive;
4174
4175 while (msgtype == NBSSkeepalive) {
4176 NTSTATUS status;
4177
4178 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4179 len);
4180 if (!NT_STATUS_IS_OK(status)) {
4181 char addr[INET6_ADDRSTRLEN];
4182 /* Try and give an error message
4183 * saying what client failed. */
4184 DEBUG(0, ("read_fd_with_timeout failed for "
4185 "client %s read error = %s.\n",
4186 get_peer_addr(fd,addr,sizeof(addr)),
4187 nt_errstr(status)));
4188 return status;
4189 }
4190
4191 msgtype = CVAL(inbuf, 0);
4192 }
4193
4194 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4195 (unsigned long)len));
4196
4197 return NT_STATUS_OK;
4198 }
4199
4200 /****************************************************************************
4201 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4202 ****************************************************************************/
4203
4204 void reply_writebraw(struct smb_request *req)
4205 {
4206 connection_struct *conn = req->conn;
4207 struct smbXsrv_connection *xconn = req->xconn;
4208 char *buf = NULL;
4209 ssize_t nwritten=0;
4210 ssize_t total_written=0;
4211 size_t numtowrite=0;
4212 size_t tcount;
4213 off_t startpos;
4214 const char *data=NULL;
4215 bool write_through;
4216 files_struct *fsp;
4217 struct lock_struct lock;
4218 NTSTATUS status;
4219
4220 START_PROFILE(SMBwritebraw);
4221
4222 /*
4223 * If we ever reply with an error, it must have the SMB command
4224 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4225 * we're finished.
4226 */
4227 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4228
4229 if (srv_is_signing_active(xconn)) {
4230 END_PROFILE(SMBwritebraw);
4231 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4232 "raw reads/writes are disallowed.");
4233 }
4234
4235 if (req->wct < 12) {
4236 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4237 error_to_writebrawerr(req);
4238 END_PROFILE(SMBwritebraw);
4239 return;
4240 }
4241
4242 if (xconn->smb1.echo_handler.trusted_fde) {
4243 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4244 "'async smb echo handler = yes'\n"));
4245 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4246 error_to_writebrawerr(req);
4247 END_PROFILE(SMBwritebraw);
4248 return;
4249 }
4250
4251 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4252 if (!check_fsp(conn, req, fsp)) {
4253 error_to_writebrawerr(req);
4254 END_PROFILE(SMBwritebraw);
4255 return;
4256 }
4257
4258 if (!CHECK_WRITE(fsp)) {
4259 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4260 error_to_writebrawerr(req);
4261 END_PROFILE(SMBwritebraw);
4262 return;
4263 }
4264
4265 tcount = IVAL(req->vwv+1, 0);
4266 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4267 write_through = BITSETW(req->vwv+7,0);
4268
4269 /* We have to deal with slightly different formats depending
4270 on whether we are using the core+ or lanman1.0 protocol */
4271
4272 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4273 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4274 data = smb_buf_const(req->inbuf);
4275 } else {
4276 numtowrite = SVAL(req->vwv+10, 0);
4277 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4278 }
4279
4280 /* Ensure we don't write bytes past the end of this packet. */
4281 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4282 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4283 error_to_writebrawerr(req);
4284 END_PROFILE(SMBwritebraw);
4285 return;
4286 }
4287
4288 if (!fsp->print_file) {
4289 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4290 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4291 &lock);
4292
4293 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4294 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4295 error_to_writebrawerr(req);
4296 END_PROFILE(SMBwritebraw);
4297 return;
4298 }
4299 }
4300
4301 if (numtowrite>0) {
4302 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4303 }
4304
4305 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4306 "wrote=%d sync=%d\n",
4307 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4308 (int)nwritten, (int)write_through));
4309
4310 if (nwritten < (ssize_t)numtowrite) {
4311 reply_nterror(req, NT_STATUS_DISK_FULL);
4312 error_to_writebrawerr(req);
4313 goto strict_unlock;
4314 }
4315
4316 total_written = nwritten;
4317
4318 /* Allocate a buffer of 64k + length. */
4319 buf = talloc_array(NULL, char, 65540);
4320 if (!buf) {
4321 reply_nterror(req, NT_STATUS_NO_MEMORY);
4322 error_to_writebrawerr(req);
4323 goto strict_unlock;
4324 }
4325
4326 /* Return a SMBwritebraw message to the redirector to tell
4327 * it to send more bytes */
4328
4329 memcpy(buf, req->inbuf, smb_size);
4330 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4331 SCVAL(buf,smb_com,SMBwritebraw);
4332 SSVALS(buf,smb_vwv0,0xFFFF);
4333 show_msg(buf);
4334 if (!srv_send_smb(req->xconn,
4335 buf,
4336 false, 0, /* no signing */
4337 IS_CONN_ENCRYPTED(conn),
4338 &req->pcd)) {
4339 exit_server_cleanly("reply_writebraw: srv_send_smb "
4340 "failed.");
4341 }
4342
4343 /* Now read the raw data into the buffer and write it */
4344 status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4345 &numtowrite);
4346 if (!NT_STATUS_IS_OK(status)) {
4347 exit_server_cleanly("secondary writebraw failed");
4348 }
4349
4350 /* Set up outbuf to return the correct size */
4351 reply_outbuf(req, 1, 0);
4352
4353 if (numtowrite != 0) {
4354
4355 if (numtowrite > 0xFFFF) {
4356 DEBUG(0,("reply_writebraw: Oversize secondary write "
4357 "raw requested (%u). Terminating\n",
4358 (unsigned int)numtowrite ));
4359 exit_server_cleanly("secondary writebraw failed");
4360 }
4361
4362 if (tcount > nwritten+numtowrite) {
4363 DEBUG(3,("reply_writebraw: Client overestimated the "
4364 "write %d %d %d\n",
4365 (int)tcount,(int)nwritten,(int)numtowrite));
4366 }
4367
4368 status = read_data(xconn->transport.sock, buf+4, numtowrite);
4369
4370 if (!NT_STATUS_IS_OK(status)) {
4371 /* Try and give an error message
4372 * saying what client failed. */
4373 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4374 "raw read failed (%s) for client %s. "
4375 "Terminating\n", nt_errstr(status),
4376 smbXsrv_connection_dbg(xconn)));
4377 exit_server_cleanly("secondary writebraw failed");
4378 }
4379
4380 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4381 if (nwritten == -1) {
4382 TALLOC_FREE(buf);
4383 reply_nterror(req, map_nt_error_from_unix(errno));
4384 error_to_writebrawerr(req);
4385 goto strict_unlock;
4386 }
4387
4388 if (nwritten < (ssize_t)numtowrite) {
4389 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4390 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4391 }
4392
4393 if (nwritten > 0) {
4394 total_written += nwritten;
4395 }
4396 }
4397
4398 TALLOC_FREE(buf);
4399 SSVAL(req->outbuf,smb_vwv0,total_written);
4400
4401 status = sync_file(conn, fsp, write_through);
4402 if (!NT_STATUS_IS_OK(status)) {
4403 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4404 fsp_str_dbg(fsp), nt_errstr(status)));
4405 reply_nterror(req, status);
4406 error_to_writebrawerr(req);
4407 goto strict_unlock;
4408 }
4409
4410 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4411 "wrote=%d\n",
4412 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4413 (int)total_written));
4414
4415 if (!fsp->print_file) {
4416 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4417 }
4418
4419 /* We won't return a status if write through is not selected - this
4420 * follows what WfWg does */
4421 END_PROFILE(SMBwritebraw);
4422
4423 if (!write_through && total_written==tcount) {
4424
4425 #if RABBIT_PELLET_FIX
4426 /*
4427 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4428 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4429 * JRA.
4430 */
4431 if (!send_keepalive(xconn->transport.sock)) {
4432 exit_server_cleanly("reply_writebraw: send of "
4433 "keepalive failed");
4434 }
4435 #endif
4436 TALLOC_FREE(req->outbuf);
4437 }
4438 return;
4439
4440 strict_unlock:
4441 if (!fsp->print_file) {
4442 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4443 }
4444
4445 END_PROFILE(SMBwritebraw);
4446 return;
4447 }
4448
4449 #undef DBGC_CLASS
4450 #define DBGC_CLASS DBGC_LOCKING
4451
4452 /****************************************************************************
4453 Reply to a writeunlock (core+).
4454 ****************************************************************************/
4455
4456 void reply_writeunlock(struct smb_request *req)
4457 {
4458 connection_struct *conn = req->conn;
4459 ssize_t nwritten = -1;
4460 size_t numtowrite;
4461 off_t startpos;
4462 const char *data;
4463 NTSTATUS status = NT_STATUS_OK;
4464 files_struct *fsp;
4465 struct lock_struct lock;
4466 int saved_errno = 0;
4467
4468 START_PROFILE(SMBwriteunlock);
4469
4470 if (req->wct < 5) {
4471 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4472 END_PROFILE(SMBwriteunlock);
4473 return;
4474 }
4475
4476 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4477
4478 if (!check_fsp(conn, req, fsp)) {
4479 END_PROFILE(SMBwriteunlock);
4480 return;
4481 }
4482
4483 if (!CHECK_WRITE(fsp)) {
4484 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4485 END_PROFILE(SMBwriteunlock);
4486 return;
4487 }
4488
4489 numtowrite = SVAL(req->vwv+1, 0);
4490 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4491 data = (const char *)req->buf + 3;
4492
4493 if (!fsp->print_file && numtowrite > 0) {
4494 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4495 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4496 &lock);
4497
4498 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4499 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4500 END_PROFILE(SMBwriteunlock);
4501 return;
4502 }
4503 }
4504
4505 /* The special X/Open SMB protocol handling of
4506 zero length writes is *NOT* done for
4507 this call */
4508 if(numtowrite == 0) {
4509 nwritten = 0;
4510 } else {
4511 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4512 saved_errno = errno;
4513 }
4514
4515 status = sync_file(conn, fsp, False /* write through */);
4516 if (!NT_STATUS_IS_OK(status)) {
4517 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4518 fsp_str_dbg(fsp), nt_errstr(status)));
4519 reply_nterror(req, status);
4520 goto strict_unlock;
4521 }
4522
4523 if(nwritten < 0) {
4524 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4525 goto strict_unlock;
4526 }
4527
4528 if((nwritten < numtowrite) && (numtowrite != 0)) {
4529 reply_nterror(req, NT_STATUS_DISK_FULL);
4530 goto strict_unlock;
4531 }
4532
4533 if (numtowrite && !fsp->print_file) {
4534 status = do_unlock(req->sconn->msg_ctx,
4535 fsp,
4536 (uint64_t)req->smbpid,
4537 (uint64_t)numtowrite,
4538 (uint64_t)startpos,
4539 WINDOWS_LOCK);
4540
4541 if (NT_STATUS_V(status)) {
4542 reply_nterror(req, status);
4543 goto strict_unlock;
4544 }
4545 }
4546
4547 reply_outbuf(req, 1, 0);
4548
4549 SSVAL(req->outbuf,smb_vwv0,nwritten);
4550
4551 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4552 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4553
4554 strict_unlock:
4555 if (numtowrite && !fsp->print_file) {
4556 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4557 }
4558
4559 END_PROFILE(SMBwriteunlock);
4560 return;
4561 }
4562
4563 #undef DBGC_CLASS
4564 #define DBGC_CLASS DBGC_ALL
4565
4566 /****************************************************************************
4567 Reply to a write.
4568 ****************************************************************************/
4569
4570 void reply_write(struct smb_request *req)
4571 {
4572 connection_struct *conn = req->conn;
4573 size_t numtowrite;
4574 ssize_t nwritten = -1;
4575 off_t startpos;
4576 const char *data;
4577 files_struct *fsp;
4578 struct lock_struct lock;
4579 NTSTATUS status;
4580 int saved_errno = 0;
4581
4582 START_PROFILE(SMBwrite);
4583
4584 if (req->wct < 5) {
4585 END_PROFILE(SMBwrite);
4586 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4587 return;
4588 }
4589
4590 /* If it's an IPC, pass off the pipe handler. */
4591 if (IS_IPC(conn)) {
4592 reply_pipe_write(req);
4593 END_PROFILE(SMBwrite);
4594 return;
4595 }
4596
4597 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4598
4599 if (!check_fsp(conn, req, fsp)) {
4600 END_PROFILE(SMBwrite);
4601 return;
4602 }
4603
4604 if (!CHECK_WRITE(fsp)) {
4605 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4606 END_PROFILE(SMBwrite);
4607 return;
4608 }
4609
4610 numtowrite = SVAL(req->vwv+1, 0);
4611 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4612 data = (const char *)req->buf + 3;
4613
4614 if (!fsp->print_file) {
4615 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4616 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4617 &lock);
4618
4619 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4620 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4621 END_PROFILE(SMBwrite);
4622 return;
4623 }
4624 }
4625
4626 /*
4627 * X/Open SMB protocol says that if smb_vwv1 is
4628 * zero then the file size should be extended or
4629 * truncated to the size given in smb_vwv[2-3].
4630 */
4631
4632 if(numtowrite == 0) {
4633 /*
4634 * This is actually an allocate call, and set EOF. JRA.
4635 */
4636 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4637 if (nwritten < 0) {
4638 reply_nterror(req, NT_STATUS_DISK_FULL);
4639 goto strict_unlock;
4640 }
4641 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4642 if (nwritten < 0) {
4643 reply_nterror(req, NT_STATUS_DISK_FULL);
4644 goto strict_unlock;
4645 }
4646 trigger_write_time_update_immediate(fsp);
4647 } else {
4648 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4649 }
4650
4651 status = sync_file(conn, fsp, False);
4652 if (!NT_STATUS_IS_OK(status)) {
4653 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4654 fsp_str_dbg(fsp), nt_errstr(status)));
4655 reply_nterror(req, status);
4656 goto strict_unlock;
4657 }
4658
4659 if(nwritten < 0) {
4660 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4661 goto strict_unlock;
4662 }
4663
4664 if((nwritten == 0) && (numtowrite != 0)) {
4665 reply_nterror(req, NT_STATUS_DISK_FULL);
4666 goto strict_unlock;
4667 }
4668
4669 reply_outbuf(req, 1, 0);
4670
4671 SSVAL(req->outbuf,smb_vwv0,nwritten);
4672
4673 if (nwritten < (ssize_t)numtowrite) {
4674 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4675 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4676 }
4677
4678 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4679
4680 strict_unlock:
4681 if (!fsp->print_file) {
4682 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4683 }
4684
4685 END_PROFILE(SMBwrite);
4686 return;
4687 }
4688
4689 /****************************************************************************
4690 Ensure a buffer is a valid writeX for recvfile purposes.
4691 ****************************************************************************/
4692
4693 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4694 (2*14) + /* word count (including bcc) */ \
4695 1 /* pad byte */)
4696
4697 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4698 const uint8_t *inbuf)
4699 {
4700 size_t numtowrite;
4701 unsigned int doff = 0;
4702 size_t len = smb_len_large(inbuf);
4703 uint16_t fnum;
4704 struct smbXsrv_open *op = NULL;
4705 struct files_struct *fsp = NULL;
4706 NTSTATUS status;
4707
4708 if (is_encrypted_packet(inbuf)) {
4709 /* Can't do this on encrypted
4710 * connections. */
4711 return false;
4712 }
4713
4714 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4715 return false;
4716 }
4717
4718 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4719 CVAL(inbuf,smb_wct) != 14) {
4720 DEBUG(10,("is_valid_writeX_buffer: chained or "
4721 "invalid word length.\n"));
4722 return false;
4723 }
4724
4725 fnum = SVAL(inbuf, smb_vwv2);
4726 status = smb1srv_open_lookup(xconn,
4727 fnum,
4728 0, /* now */
4729 &op);
4730 if (!NT_STATUS_IS_OK(status)) {
4731 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4732 return false;
4733 }
4734 fsp = op->compat;
4735 if (fsp == NULL) {
4736 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4737 return false;
4738 }
4739 if (fsp->conn == NULL) {
4740 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4741 return false;
4742 }
4743
4744 if (IS_IPC(fsp->conn)) {
4745 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4746 return false;
4747 }
4748 if (IS_PRINT(fsp->conn)) {
4749 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4750 return false;
4751 }
4752 doff = SVAL(inbuf,smb_vwv11);
4753
4754 numtowrite = SVAL(inbuf,smb_vwv10);
4755
4756 if (len > doff && len - doff > 0xFFFF) {
4757 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4758 }
4759
4760 if (numtowrite == 0) {
4761 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4762 return false;
4763 }
4764
4765 /* Ensure the sizes match up. */
4766 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4767 /* no pad byte...old smbclient :-( */
4768 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4769 (unsigned int)doff,
4770 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4771 return false;
4772 }
4773
4774 if (len - doff != numtowrite) {
4775 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4776 "len = %u, doff = %u, numtowrite = %u\n",
4777 (unsigned int)len,
4778 (unsigned int)doff,
4779 (unsigned int)numtowrite ));
4780 return false;
4781 }
4782
4783 DEBUG(10,("is_valid_writeX_buffer: true "
4784 "len = %u, doff = %u, numtowrite = %u\n",
4785 (unsigned int)len,
4786 (unsigned int)doff,
4787 (unsigned int)numtowrite ));
4788
4789 return true;
4790 }
4791
4792 /****************************************************************************
4793 Reply to a write and X.
4794 ****************************************************************************/
4795
4796 void reply_write_and_X(struct smb_request *req)
4797 {
4798 connection_struct *conn = req->conn;
4799 struct smbXsrv_connection *xconn = req->xconn;
4800 files_struct *fsp;
4801 struct lock_struct lock;
4802 off_t startpos;
4803 size_t numtowrite;
4804 bool write_through;
4805 ssize_t nwritten;
4806 unsigned int smb_doff;
4807 unsigned int smblen;
4808 const char *data;
4809 NTSTATUS status;
4810 int saved_errno = 0;
4811
4812 START_PROFILE(SMBwriteX);
4813
4814 if ((req->wct != 12) && (req->wct != 14)) {
4815 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4816 goto out;
4817 }
4818
4819 numtowrite = SVAL(req->vwv+10, 0);
4820 smb_doff = SVAL(req->vwv+11, 0);
4821 smblen = smb_len(req->inbuf);
4822
4823 if (req->unread_bytes > 0xFFFF ||
4824 (smblen > smb_doff &&
4825 smblen - smb_doff > 0xFFFF)) {
4826 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4827 }
4828
4829 if (req->unread_bytes) {
4830 /* Can't do a recvfile write on IPC$ */
4831 if (IS_IPC(conn)) {
4832 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4833 goto out;
4834 }
4835 if (numtowrite != req->unread_bytes) {
4836 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4837 goto out;
4838 }
4839 } else {
4840 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4841 smb_doff + numtowrite > smblen) {
4842 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4843 goto out;
4844 }
4845 }
4846
4847 /* If it's an IPC, pass off the pipe handler. */
4848 if (IS_IPC(conn)) {
4849 if (req->unread_bytes) {
4850 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4851 goto out;
4852 }
4853 reply_pipe_write_and_X(req);
4854 goto out;
4855 }
4856
4857 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4858 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4859 write_through = BITSETW(req->vwv+7,0);
4860
4861 if (!check_fsp(conn, req, fsp)) {
4862 goto out;
4863 }
4864
4865 if (!CHECK_WRITE(fsp)) {
4866 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4867 goto out;
4868 }
4869
4870 data = smb_base(req->inbuf) + smb_doff;
4871
4872 if(req->wct == 14) {
4873 /*
4874 * This is a large offset (64 bit) write.
4875 */
4876 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4877
4878 }
4879
4880 /* X/Open SMB protocol says that, unlike SMBwrite
4881 if the length is zero then NO truncation is
4882 done, just a write of zero. To truncate a file,
4883 use SMBwrite. */
4884
4885 if(numtowrite == 0) {
4886 nwritten = 0;
4887 } else {
4888 if (req->unread_bytes == 0) {
4889 status = schedule_aio_write_and_X(conn,
4890 req,
4891 fsp,
4892 data,
4893 startpos,
4894 numtowrite);
4895
4896 if (NT_STATUS_IS_OK(status)) {
4897 /* write scheduled - we're done. */
4898 goto out;
4899 }
4900 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4901 /* Real error - report to client. */
4902 reply_nterror(req, status);
4903 goto out;
4904 }
4905 /* NT_STATUS_RETRY - fall through to sync write. */
4906 }
4907
4908 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4909 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4910 &lock);
4911
4912 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4913 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4914 goto out;
4915 }
4916
4917 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4918 saved_errno = errno;
4919
4920 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4921 }
4922
4923 if(nwritten < 0) {
4924 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4925 goto out;
4926 }
4927
4928 if((nwritten == 0) && (numtowrite != 0)) {
4929 reply_nterror(req, NT_STATUS_DISK_FULL);
4930 goto out;
4931 }
4932
4933 reply_outbuf(req, 6, 0);
4934 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4935 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4936 SSVAL(req->outbuf,smb_vwv2,nwritten);
4937 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4938
4939 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4940 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4941
4942 status = sync_file(conn, fsp, write_through);
4943 if (!NT_STATUS_IS_OK(status)) {
4944 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4945 fsp_str_dbg(fsp), nt_errstr(status)));
4946 reply_nterror(req, status);
4947 goto out;
4948 }
4949
4950 END_PROFILE(SMBwriteX);
4951 return;
4952
4953 out:
4954 if (req->unread_bytes) {
4955 /* writeX failed. drain socket. */
4956 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
4957 req->unread_bytes) {
4958 smb_panic("failed to drain pending bytes");
4959 }
4960 req->unread_bytes = 0;
4961 }
4962
4963 END_PROFILE(SMBwriteX);
4964 return;
4965 }
4966
4967 /****************************************************************************
4968 Reply to a lseek.
4969 ****************************************************************************/
4970
4971 void reply_lseek(struct smb_request *req)
4972 {
4973 connection_struct *conn = req->conn;
4974 off_t startpos;
4975 off_t res= -1;
4976 int mode,umode;
4977 files_struct *fsp;
4978
4979 START_PROFILE(SMBlseek);
4980
4981 if (req->wct < 4) {
4982 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4983 END_PROFILE(SMBlseek);
4984 return;
4985 }
4986
4987 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4988
4989 if (!check_fsp(conn, req, fsp)) {
4990 return;
4991 }
4992
4993 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4994
4995 mode = SVAL(req->vwv+1, 0) & 3;
4996 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4997 startpos = (off_t)IVALS(req->vwv+2, 0);
4998
4999 switch (mode) {
5000 case 0:
5001 umode = SEEK_SET;
5002 res = startpos;
5003 break;
5004 case 1:
5005 umode = SEEK_CUR;
5006 res = fsp->fh->pos + startpos;
5007 break;
5008 case 2:
5009 umode = SEEK_END;
5010 break;
5011 default:
5012 umode = SEEK_SET;
5013 res = startpos;
5014 break;
5015 }
5016
5017 if (umode == SEEK_END) {
5018 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
5019 if(errno == EINVAL) {
5020 off_t current_pos = startpos;
5021
5022 if(fsp_stat(fsp) == -1) {
5023 reply_nterror(req,
5024 map_nt_error_from_unix(errno));
5025 END_PROFILE(SMBlseek);
5026 return;
5027 }
5028
5029 current_pos += fsp->fsp_name->st.st_ex_size;
5030 if(current_pos < 0)
5031 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
5032 }
5033 }
5034
5035 if(res == -1) {
5036 reply_nterror(req, map_nt_error_from_unix(errno));
5037 END_PROFILE(SMBlseek);
5038 return;
5039 }
5040 }
5041
5042 fsp->fh->pos = res;
5043
5044 reply_outbuf(req, 2, 0);
5045 SIVAL(req->outbuf,smb_vwv0,res);
5046
5047 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
5048 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
5049
5050 END_PROFILE(SMBlseek);
5051 return;
5052 }
5053
5054 /****************************************************************************
5055 Reply to a flush.
5056 ****************************************************************************/
5057
5058 void reply_flush(struct smb_request *req)
5059 {
5060 connection_struct *conn = req->conn;
5061 uint16 fnum;
5062 files_struct *fsp;
5063
5064 START_PROFILE(SMBflush);
5065
5066 if (req->wct < 1) {
5067 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5068 return;
5069 }
5070
5071 fnum = SVAL(req->vwv+0, 0);
5072 fsp = file_fsp(req, fnum);
5073
5074 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5075 return;
5076 }
5077
5078 if (!fsp) {
5079 file_sync_all(conn);
5080 } else {
5081 NTSTATUS status = sync_file(conn, fsp, True);
5082 if (!NT_STATUS_IS_OK(status)) {
5083 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5084 fsp_str_dbg(fsp), nt_errstr(status)));
5085 reply_nterror(req, status);
5086 END_PROFILE(SMBflush);
5087 return;
5088 }
5089 }
5090
5091 reply_outbuf(req, 0, 0);
5092
5093 DEBUG(3,("flush\n"));
5094 END_PROFILE(SMBflush);
5095 return;
5096 }
5097
5098 /****************************************************************************
5099 Reply to a exit.
5100 conn POINTER CAN BE NULL HERE !
5101 ****************************************************************************/
5102
5103 void reply_exit(struct smb_request *req)
5104 {
5105 START_PROFILE(SMBexit);
5106
5107 file_close_pid(req->sconn, req->smbpid, req->vuid);
5108
5109 reply_outbuf(req, 0, 0);
5110
5111 DEBUG(3,("exit\n"));
5112
5113 END_PROFILE(SMBexit);
5114 return;
5115 }
5116
5117 struct reply_close_state {
5118 files_struct *fsp;
5119 struct smb_request *smbreq;
5120 };
5121
5122 static void do_smb1_close(struct tevent_req *req);
5123
5124 void reply_close(struct smb_request *req)
5125 {
5126 connection_struct *conn = req->conn;
5127 NTSTATUS status = NT_STATUS_OK;
5128 files_struct *fsp = NULL;
5129 START_PROFILE(SMBclose);
5130
5131 if (req->wct < 3) {
5132 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5133 END_PROFILE(SMBclose);
5134 return;
5135 }
5136
5137 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5138
5139 /*
5140 * We can only use check_fsp if we know it's not a directory.
5141 */
5142
5143 if (!check_fsp_open(conn, req, fsp)) {
5144 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5145 END_PROFILE(SMBclose);
5146 return;
5147 }
5148
5149 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5150 fsp->is_directory ? "directory" : "file",
5151 fsp->fh->fd, fsp_fnum_dbg(fsp),
5152 conn->num_files_open));
5153
5154 if (!fsp->is_directory) {
5155 time_t t;
5156
5157 /*
5158 * Take care of any time sent in the close.
5159 */
5160
5161 t = srv_make_unix_date3(req->vwv+1);
5162 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5163 }
5164
5165 if (fsp->num_aio_requests != 0) {
5166
5167 struct reply_close_state *state;
5168
5169 DEBUG(10, ("closing with aio %u requests pending\n",
5170 fsp->num_aio_requests));
5171
5172 /*
5173 * We depend on the aio_extra destructor to take care of this
5174 * close request once fsp->num_aio_request drops to 0.
5175 */
5176
5177 fsp->deferred_close = tevent_wait_send(
5178 fsp, fsp->conn->sconn->ev_ctx);
5179 if (fsp->deferred_close == NULL) {
5180 status = NT_STATUS_NO_MEMORY;
5181 goto done;
5182 }
5183
5184 state = talloc(fsp, struct reply_close_state);
5185 if (state == NULL) {
5186 TALLOC_FREE(fsp->deferred_close);
5187 status = NT_STATUS_NO_MEMORY;
5188 goto done;
5189 }
5190 state->fsp = fsp;
5191 state->smbreq = talloc_move(fsp, &req);
5192 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5193 state);
5194 END_PROFILE(SMBclose);
5195 return;
5196 }
5197
5198 /*
5199 * close_file() returns the unix errno if an error was detected on
5200 * close - normally this is due to a disk full error. If not then it
5201 * was probably an I/O error.
5202 */
5203
5204 status = close_file(req, fsp, NORMAL_CLOSE);
5205 done:
5206 if (!NT_STATUS_IS_OK(status)) {
5207 reply_nterror(req, status);
5208 END_PROFILE(SMBclose);
5209 return;
5210 }
5211
5212 reply_outbuf(req, 0, 0);
5213 END_PROFILE(SMBclose);
5214 return;
5215 }
5216
5217 static void do_smb1_close(struct tevent_req *req)
5218 {
5219 struct reply_close_state *state = tevent_req_callback_data(
5220 req, struct reply_close_state);
5221 struct smb_request *smbreq;
5222 NTSTATUS status;
5223 int ret;
5224
5225 ret = tevent_wait_recv(req);
5226 TALLOC_FREE(req);
5227 if (ret != 0) {
5228 DEBUG(10, ("tevent_wait_recv returned %s\n",
5229 strerror(ret)));
5230 /*
5231 * Continue anyway, this should never happen
5232 */
5233 }
5234
5235 /*
5236 * fsp->smb2_close_request right now is a talloc grandchild of
5237 * fsp. When we close_file(fsp), it would go with it. No chance to
5238 * reply...
5239 */
5240 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5241
5242 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5243 if (NT_STATUS_IS_OK(status)) {
5244 reply_outbuf(smbreq, 0, 0);
5245 } else {
5246 reply_nterror(smbreq, status);
5247 }
5248 if (!srv_send_smb(smbreq->xconn,
5249 (char *)smbreq->outbuf,
5250 true,
5251 smbreq->seqnum+1,
5252 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5253 NULL)) {
5254 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5255 "failed.");
5256 }
5257 TALLOC_FREE(smbreq);
5258 }
5259
5260 /****************************************************************************
5261 Reply to a writeclose (Core+ protocol).
5262 ****************************************************************************/
5263
5264 void reply_writeclose(struct smb_request *req)
5265 {
5266 connection_struct *conn = req->conn;
5267 size_t numtowrite;
5268 ssize_t nwritten = -1;
5269 NTSTATUS close_status = NT_STATUS_OK;
5270 off_t startpos;
5271 const char *data;
5272 struct timespec mtime;
5273 files_struct *fsp;
5274 struct lock_struct lock;
5275
5276 START_PROFILE(SMBwriteclose);
5277
5278 if (req->wct < 6) {
5279 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5280 END_PROFILE(SMBwriteclose);
5281 return;
5282 }
5283
5284 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5285
5286 if (!check_fsp(conn, req, fsp)) {
5287 END_PROFILE(SMBwriteclose);
5288 return;
5289 }
5290 if (!CHECK_WRITE(fsp)) {
5291 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5292 END_PROFILE(SMBwriteclose);
5293 return;
5294 }
5295
5296 numtowrite = SVAL(req->vwv+1, 0);
5297 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5298 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5299 data = (const char *)req->buf + 1;
5300
5301 if (fsp->print_file == NULL) {
5302 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5303 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5304 &lock);
5305
5306 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5307 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5308 END_PROFILE(SMBwriteclose);
5309 return;
5310 }
5311 }
5312
5313 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5314
5315 if (fsp->print_file == NULL) {
5316 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5317 }
5318
5319 set_close_write_time(fsp, mtime);
5320
5321 /*
5322 * More insanity. W2K only closes the file if writelen > 0.
5323 * JRA.
5324 */
5325
5326 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5327 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5328 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5329
5330 if (numtowrite) {
5331 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5332 "file %s\n", fsp_str_dbg(fsp)));
5333 close_status = close_file(req, fsp, NORMAL_CLOSE);
5334 fsp = NULL;
5335 }
5336
5337 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5338 reply_nterror(req, NT_STATUS_DISK_FULL);
5339 goto out;
5340 }
5341
5342 if(!NT_STATUS_IS_OK(close_status)) {
5343 reply_nterror(req, close_status);
5344 goto out;
5345 }
5346
5347 reply_outbuf(req, 1, 0);
5348
5349 SSVAL(req->outbuf,smb_vwv0,nwritten);
5350
5351 out:
5352
5353 END_PROFILE(SMBwriteclose);
5354 return;
5355 }
5356
5357 #undef DBGC_CLASS
5358 #define DBGC_CLASS DBGC_LOCKING
5359
5360 /****************************************************************************
5361 Reply to a lock.
5362 ****************************************************************************/
5363
5364 void reply_lock(struct smb_request *req)
5365 {
5366 connection_struct *conn = req->conn;
5367 uint64_t count,offset;
5368 NTSTATUS status;
5369 files_struct *fsp;
5370 struct byte_range_lock *br_lck = NULL;
5371
5372 START_PROFILE(SMBlock);
5373
5374 if (req->wct < 5) {
5375 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5376 END_PROFILE(SMBlock);
5377 return;
5378 }
5379
5380 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5381
5382 if (!check_fsp(conn, req, fsp)) {
5383 END_PROFILE(SMBlock);
5384 return;
5385 }
5386
5387 count = (uint64_t)IVAL(req->vwv+1, 0);
5388 offset = (uint64_t)IVAL(req->vwv+3, 0);
5389
5390 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5391 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5392
5393 br_lck = do_lock(req->sconn->msg_ctx,
5394 fsp,
5395 (uint64_t)req->smbpid,
5396 count,
5397 offset,
5398 WRITE_LOCK,
5399 WINDOWS_LOCK,
5400 False, /* Non-blocking lock. */
5401 &status,
5402 NULL);
5403
5404 TALLOC_FREE(br_lck);
5405
5406 if (NT_STATUS_V(status)) {
5407 reply_nterror(req, status);
5408 END_PROFILE(SMBlock);
5409 return;
5410 }
5411
5412 reply_outbuf(req, 0, 0);
5413
5414 END_PROFILE(SMBlock);
5415 return;
5416 }
5417
5418 /****************************************************************************
5419 Reply to a unlock.
5420 ****************************************************************************/
5421
5422 void reply_unlock(struct smb_request *req)
5423 {
5424 connection_struct *conn = req->conn;
5425 uint64_t count,offset;
5426 NTSTATUS status;
5427 files_struct *fsp;
5428
5429 START_PROFILE(SMBunlock);
5430
5431 if (req->wct < 5) {
5432 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5433 END_PROFILE(SMBunlock);
5434 return;
5435 }
5436
5437 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5438
5439 if (!check_fsp(conn, req, fsp)) {
5440 END_PROFILE(SMBunlock);
5441 return;
5442 }
5443
5444 count = (uint64_t)IVAL(req->vwv+1, 0);
5445 offset = (uint64_t)IVAL(req->vwv+3, 0);
5446
5447 status = do_unlock(req->sconn->msg_ctx,
5448 fsp,
5449 (uint64_t)req->smbpid,
5450 count,
5451 offset,
5452 WINDOWS_LOCK);
5453
5454 if (NT_STATUS_V(status)) {
5455 reply_nterror(req, status);
5456 END_PROFILE(SMBunlock);
5457 return;
5458 }
5459
5460 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5461 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5462
5463 reply_outbuf(req, 0, 0);
5464
5465 END_PROFILE(SMBunlock);
5466 return;
5467 }
5468
5469 #undef DBGC_CLASS
5470 #define DBGC_CLASS DBGC_ALL
5471
5472 /****************************************************************************
5473 Reply to a tdis.
5474 conn POINTER CAN BE NULL HERE !
5475 ****************************************************************************/
5476
5477 void reply_tdis(struct smb_request *req)
5478 {
5479 NTSTATUS status;
5480 connection_struct *conn = req->conn;
5481 struct smbXsrv_tcon *tcon;
5482
5483 START_PROFILE(SMBtdis);
5484
5485 if (!conn) {
5486 DEBUG(4,("Invalid connection in tdis\n"));
5487 reply_force_doserror(req, ERRSRV, ERRinvnid);
5488 END_PROFILE(SMBtdis);
5489 return;
5490 }
5491
5492 tcon = conn->tcon;
5493 req->conn = NULL;
5494
5495 /*
5496 * TODO: cancel all outstanding requests on the tcon
5497 */
5498 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5499 if (!NT_STATUS_IS_OK(status)) {
5500 DEBUG(0, ("reply_tdis: "
5501 "smbXsrv_tcon_disconnect() failed: %s\n",
5502 nt_errstr(status)));
5503 /*
5504 * If we hit this case, there is something completely
5505 * wrong, so we better disconnect the transport connection.
5506 */
5507 END_PROFILE(SMBtdis);
5508 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5509 return;
5510 }
5511
5512 TALLOC_FREE(tcon);
5513
5514 reply_outbuf(req, 0, 0);
5515 END_PROFILE(SMBtdis);
5516 return;
5517 }
5518
5519 /****************************************************************************
5520 Reply to a echo.
5521 conn POINTER CAN BE NULL HERE !
5522 ****************************************************************************/
5523
5524 void reply_echo(struct smb_request *req)
5525 {
5526 connection_struct *conn = req->conn;
5527 struct smb_perfcount_data local_pcd;
5528 struct smb_perfcount_data *cur_pcd;
5529 int smb_reverb;
5530 int seq_num;
5531
5532 START_PROFILE(SMBecho);
5533
5534 smb_init_perfcount_data(&local_pcd);
5535
5536 if (req->wct < 1) {
5537 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5538 END_PROFILE(SMBecho);
5539 return;
5540 }
5541
5542 smb_reverb = SVAL(req->vwv+0, 0);
5543
5544 reply_outbuf(req, 1, req->buflen);
5545
5546 /* copy any incoming data back out */
5547 if (req->buflen > 0) {
5548 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5549 }
5550
5551 if (smb_reverb > 100) {
5552 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5553 smb_reverb = 100;
5554 }
5555
5556 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5557
5558 /* this makes sure we catch the request pcd */
5559 if (seq_num == smb_reverb) {
5560 cur_pcd = &req->pcd;
5561 } else {
5562 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5563 cur_pcd = &local_pcd;
5564 }
5565
5566 SSVAL(req->outbuf,smb_vwv0,seq_num);
5567
5568 show_msg((char *)req->outbuf);
5569 if (!srv_send_smb(req->xconn,
5570 (char *)req->outbuf,
5571 true, req->seqnum+1,
5572 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5573 cur_pcd))
5574 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5575 }
5576
5577 DEBUG(3,("echo %d times\n", smb_reverb));
5578
5579 TALLOC_FREE(req->outbuf);
5580
5581 END_PROFILE(SMBecho);
5582 return;
5583 }
5584
5585 /****************************************************************************
5586 Reply to a printopen.
5587 ****************************************************************************/
5588
5589 void reply_printopen(struct smb_request *req)
5590 {
5591 connection_struct *conn = req->conn;
5592 files_struct *fsp;
5593 NTSTATUS status;
5594
5595 START_PROFILE(SMBsplopen);
5596
5597 if (req->wct < 2) {
5598 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5599 END_PROFILE(SMBsplopen);
5600 return;
5601 }
5602
5603 if (!CAN_PRINT(conn)) {
5604 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5605 END_PROFILE(SMBsplopen);
5606 return;
5607 }
5608
5609 status = file_new(req, conn, &fsp);
5610 if(!NT_STATUS_IS_OK(status)) {
5611 reply_nterror(req, status);
5612 END_PROFILE(SMBsplopen);
5613 return;
5614 }
5615
5616 /* Open for exclusive use, write only. */
5617 status = print_spool_open(fsp, NULL, req->vuid);
5618
5619 if (!NT_STATUS_IS_OK(status)) {
5620 file_free(req, fsp);
5621 reply_nterror(req, status);
5622 END_PROFILE(SMBsplopen);
5623 return;
5624 }
5625
5626 reply_outbuf(req, 1, 0);
5627 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5628
5629 DEBUG(3,("openprint fd=%d %s\n",
5630 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5631
5632 END_PROFILE(SMBsplopen);
5633 return;
5634 }
5635
5636 /****************************************************************************
5637 Reply to a printclose.
5638 ****************************************************************************/
5639
5640 void reply_printclose(struct smb_request *req)
5641 {
5642 connection_struct *conn = req->conn;
5643 files_struct *fsp;
5644 NTSTATUS status;
5645
5646 START_PROFILE(SMBsplclose);
5647
5648 if (req->wct < 1) {
5649 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5650 END_PROFILE(SMBsplclose);
5651 return;
5652 }
5653
5654 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5655
5656 if (!check_fsp(conn, req, fsp)) {
5657 END_PROFILE(SMBsplclose);
5658 return;
5659 }
5660
5661 if (!CAN_PRINT(conn)) {
5662 reply_force_doserror(req, ERRSRV, ERRerror);
5663 END_PROFILE(SMBsplclose);
5664 return;
5665 }
5666
5667 DEBUG(3,("printclose fd=%d %s\n",
5668 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5669
5670 status = close_file(req, fsp, NORMAL_CLOSE);
5671
5672 if(!NT_STATUS_IS_OK(status)) {
5673 reply_nterror(req, status);
5674 END_PROFILE(SMBsplclose);
5675 return;
5676 }
5677
5678 reply_outbuf(req, 0, 0);
5679
5680 END_PROFILE(SMBsplclose);
5681 return;
5682 }
5683
5684 /****************************************************************************
5685 Reply to a printqueue.
5686 ****************************************************************************/
5687
5688 void reply_printqueue(struct smb_request *req)
5689 {
5690 connection_struct *conn = req->conn;
5691 int max_count;
5692 int start_index;
5693
5694 START_PROFILE(SMBsplretq);
5695
5696 if (req->wct < 2) {
5697 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5698 END_PROFILE(SMBsplretq);
5699 return;
5700 }
5701
5702 max_count = SVAL(req->vwv+0, 0);
5703 start_index = SVAL(req->vwv+1, 0);
5704
5705 /* we used to allow the client to get the cnum wrong, but that
5706 is really quite gross and only worked when there was only
5707 one printer - I think we should now only accept it if they
5708 get it right (tridge) */
5709 if (!CAN_PRINT(conn)) {
5710 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5711 END_PROFILE(SMBsplretq);
5712 return;
5713 }
5714
5715 reply_outbuf(req, 2, 3);
5716 SSVAL(req->outbuf,smb_vwv0,0);
5717 SSVAL(req->outbuf,smb_vwv1,0);
5718 SCVAL(smb_buf(req->outbuf),0,1);
5719 SSVAL(smb_buf(req->outbuf),1,0);
5720
5721 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5722 start_index, max_count));
5723
5724 {
5725 TALLOC_CTX *mem_ctx = talloc_tos();
5726 NTSTATUS status;
5727 WERROR werr;
5728 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5729 struct rpc_pipe_client *cli = NULL;
5730 struct dcerpc_binding_handle *b = NULL;
5731 struct policy_handle handle;
5732 struct spoolss_DevmodeContainer devmode_ctr;
5733 union spoolss_JobInfo *info;
5734 uint32_t count;
5735 uint32_t num_to_get;
5736 uint32_t first;
5737 uint32_t i;
5738
5739 ZERO_STRUCT(handle);
5740
5741 status = rpc_pipe_open_interface(conn,
5742 &ndr_table_spoolss,
5743 conn->session_info,
5744 conn->sconn->remote_address,
5745 conn->sconn->msg_ctx,
5746 &cli);
5747 if (!NT_STATUS_IS_OK(status)) {
5748 DEBUG(0, ("reply_printqueue: "
5749 "could not connect to spoolss: %s\n",
5750 nt_errstr(status)));
5751 reply_nterror(req, status);
5752 goto out;
5753 }
5754 b = cli->binding_handle;
5755
5756 ZERO_STRUCT(devmode_ctr);
5757
5758 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5759 sharename,
5760 NULL, devmode_ctr,
5761 SEC_FLAG_MAXIMUM_ALLOWED,
5762 &handle,
5763 &werr);
5764 if (!NT_STATUS_IS_OK(status)) {
5765 reply_nterror(req, status);
5766 goto out;
5767 }
5768 if (!W_ERROR_IS_OK(werr)) {
5769 reply_nterror(req, werror_to_ntstatus(werr));
5770 goto out;
5771 }
5772
5773 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5774 &handle,
5775 0, /* firstjob */
5776 0xff, /* numjobs */
5777 2, /* level */
5778 0, /* offered */
5779 &count,
5780 &info);
5781 if (!W_ERROR_IS_OK(werr)) {
5782 reply_nterror(req, werror_to_ntstatus(werr));
5783 goto out;
5784 }
5785
5786 if (max_count > 0) {
5787 first = start_index;
5788 } else {
5789 first = start_index + max_count + 1;
5790 }
5791
5792 if (first >= count) {
5793 num_to_get = first;
5794 } else {
5795 num_to_get = first + MIN(ABS(max_count), count - first);
5796 }
5797
5798 for (i = first; i < num_to_get; i++) {
5799 char blob[28];
5800 char *p = blob;
5801 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5802 int qstatus;
5803 size_t len = 0;
5804 uint16_t qrapjobid = pjobid_to_rap(sharename,
5805 info[i].info2.job_id);
5806
5807 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5808 qstatus = 2;
5809 } else {
5810 qstatus = 3;
5811 }
5812
5813 srv_put_dos_date2(p, 0, qtime);
5814 SCVAL(p, 4, qstatus);
5815 SSVAL(p, 5, qrapjobid);
5816 SIVAL(p, 7, info[i].info2.size);
5817 SCVAL(p, 11, 0);
5818 status = srvstr_push(blob, req->flags2, p+12,
5819 info[i].info2.notify_name, 16, STR_ASCII, &len);
5820 if (!NT_STATUS_IS_OK(status)) {
5821 reply_nterror(req, status);
5822 goto out;
5823 }
5824 if (message_push_blob(
5825 &req->outbuf,
5826 data_blob_const(
5827 blob, sizeof(blob))) == -1) {
5828 reply_nterror(req, NT_STATUS_NO_MEMORY);
5829 goto out;
5830 }
5831 }
5832
5833 if (count > 0) {
5834 SSVAL(req->outbuf,smb_vwv0,count);
5835 SSVAL(req->outbuf,smb_vwv1,
5836 (max_count>0?first+count:first-1));
5837 SCVAL(smb_buf(req->outbuf),0,1);
5838 SSVAL(smb_buf(req->outbuf),1,28*count);
5839 }
5840
5841
5842 DEBUG(3, ("%u entries returned in queue\n",
5843 (unsigned)count));
5844
5845 out:
5846 if (b && is_valid_policy_hnd(&handle)) {
5847 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5848 }
5849
5850 }
5851
5852 END_PROFILE(SMBsplretq);
5853 return;
5854 }
5855
5856 /****************************************************************************
5857 Reply to a printwrite.
5858 ****************************************************************************/
5859
5860 void reply_printwrite(struct smb_request *req)
5861 {
5862 connection_struct *conn = req->conn;
5863 int numtowrite;
5864 const char *data;
5865 files_struct *fsp;
5866
5867 START_PROFILE(SMBsplwr);
5868
5869 if (req->wct < 1) {
5870 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5871 END_PROFILE(SMBsplwr);
5872 return;
5873 }
5874
5875 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5876
5877 if (!check_fsp(conn, req, fsp)) {
5878 END_PROFILE(SMBsplwr);
5879 return;
5880 }
5881
5882 if (!fsp->print_file) {
5883 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5884 END_PROFILE(SMBsplwr);
5885 return;
5886 }
5887
5888 if (!CHECK_WRITE(fsp)) {
5889 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5890 END_PROFILE(SMBsplwr);
5891 return;
5892 }
5893
5894 numtowrite = SVAL(req->buf, 1);
5895
5896 if (req->buflen < numtowrite + 3) {
5897 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5898 END_PROFILE(SMBsplwr);
5899 return;
5900 }
5901
5902 data = (const char *)req->buf + 3;
5903
5904 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5905 reply_nterror(req, map_nt_error_from_unix(errno));
5906 END_PROFILE(SMBsplwr);
5907 return;
5908 }
5909
5910 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5911
5912 END_PROFILE(SMBsplwr);
5913 return;
5914 }
5915
5916 /****************************************************************************
5917 Reply to a mkdir.
5918 ****************************************************************************/
5919
5920 void reply_mkdir(struct smb_request *req)
5921 {
5922 connection_struct *conn = req->conn;
5923 struct smb_filename *smb_dname = NULL;
5924 char *directory = NULL;
5925 NTSTATUS status;
5926 TALLOC_CTX *ctx = talloc_tos();
5927
5928 START_PROFILE(SMBmkdir);
5929
5930 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5931 STR_TERMINATE, &status);
5932 if (!NT_STATUS_IS_OK(status)) {
5933 reply_nterror(req, status);
5934 goto out;
5935 }
5936
5937 status = filename_convert(ctx, conn,
5938 req->flags2 & FLAGS2_DFS_PATHNAMES,
5939 directory,
5940 UCF_PREP_CREATEFILE,
5941 NULL,
5942 &smb_dname);
5943 if (!NT_STATUS_IS_OK(status)) {
5944 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5945 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5946 ERRSRV, ERRbadpath);
5947 goto out;
5948 }
5949 reply_nterror(req, status);
5950 goto out;
5951 }
5952
5953 status = create_directory(conn, req, smb_dname);
5954
5955 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5956
5957 if (!NT_STATUS_IS_OK(status)) {
5958
5959 if (!use_nt_status()
5960 && NT_STATUS_EQUAL(status,
5961 NT_STATUS_OBJECT_NAME_COLLISION)) {
5962 /*
5963 * Yes, in the DOS error code case we get a
5964 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5965 * samba4 torture test.
5966 */
5967 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5968 }
5969
5970 reply_nterror(req, status);
5971 goto out;
5972 }
5973
5974 reply_outbuf(req, 0, 0);
5975
5976 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5977 out:
5978 TALLOC_FREE(smb_dname);
5979 END_PROFILE(SMBmkdir);
5980 return;
5981 }
5982
5983 /****************************************************************************
5984 Reply to a rmdir.
5985 ****************************************************************************/
5986
5987 void reply_rmdir(struct smb_request *req)
5988 {
5989 connection_struct *conn = req->conn;
5990 struct smb_filename *smb_dname = NULL;
5991 char *directory = NULL;
5992 NTSTATUS status;
5993 TALLOC_CTX *ctx = talloc_tos();
5994 files_struct *fsp = NULL;
5995 int info = 0;
5996 struct smbd_server_connection *sconn = req->sconn;
5997
5998 START_PROFILE(SMBrmdir);
5999
6000 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6001 STR_TERMINATE, &status);
6002 if (!NT_STATUS_IS_OK(status)) {
6003 reply_nterror(req, status);
6004 goto out;
6005 }
6006
6007 status = filename_convert(ctx, conn,
6008 req->flags2 & FLAGS2_DFS_PATHNAMES,
6009 directory,
6010 0,
6011 NULL,
6012 &smb_dname);
6013 if (!NT_STATUS_IS_OK(status)) {
6014 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6015 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6016 ERRSRV, ERRbadpath);
6017 goto out;
6018 }
6019 reply_nterror(req, status);
6020 goto out;
6021 }
6022
6023 if (is_ntfs_stream_smb_fname(smb_dname)) {
6024 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
6025 goto out;
6026 }
6027
6028 status = SMB_VFS_CREATE_FILE(
6029 conn, /* conn */
6030 req, /* req */
6031 0, /* root_dir_fid */
6032 smb_dname, /* fname */
6033 DELETE_ACCESS, /* access_mask */
6034 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
6035 FILE_SHARE_DELETE),
6036 FILE_OPEN, /* create_disposition*/
6037 FILE_DIRECTORY_FILE, /* create_options */
6038 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
6039 0, /* oplock_request */
6040 NULL, /* lease */
6041 0, /* allocation_size */
6042 0, /* private_flags */
6043 NULL, /* sd */
6044 NULL, /* ea_list */
6045 &fsp, /* result */
6046 &info); /* pinfo */
6047
6048 if (!NT_STATUS_IS_OK(status)) {
6049 if (open_was_deferred(req->xconn, req->mid)) {
6050 /* We have re-scheduled this call. */
6051 goto out;
6052 }
6053 reply_nterror(req, status);
6054 goto out;
6055 }
6056
6057 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
6058 if (!NT_STATUS_IS_OK(status)) {
6059 close_file(req, fsp, ERROR_CLOSE);
6060 reply_nterror(req, status);
6061 goto out;
6062 }
6063
6064 if (!set_delete_on_close(fsp, true,
6065 conn->session_info->security_token,
6066 conn->session_info->unix_token)) {
6067 close_file(req, fsp, ERROR_CLOSE);
6068 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6069 goto out;
6070 }
6071
6072 status = close_file(req, fsp, NORMAL_CLOSE);
6073 if (!NT_STATUS_IS_OK(status)) {
6074 reply_nterror(req, status);
6075 } else {
6076 reply_outbuf(req, 0, 0);
6077 }
6078
6079 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6080
6081 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6082 out:
6083 TALLOC_FREE(smb_dname);
6084 END_PROFILE(SMBrmdir);
6085 return;
6086 }
6087
6088 /*******************************************************************
6089 Resolve wildcards in a filename rename.
6090 ********************************************************************/
6091
6092 static bool resolve_wildcards(TALLOC_CTX *ctx,
6093 const char *name1,
6094 const char *name2,
6095 char **pp_newname)
6096 {
6097 char *name2_copy = NULL;
6098 char *root1 = NULL;
6099 char *root2 = NULL;
6100 char *ext1 = NULL;
6101 char *ext2 = NULL;
6102 char *p,*p2, *pname1, *pname2;
6103
6104 name2_copy = talloc_strdup(ctx, name2);
6105 if (!name2_copy) {
6106 return False;
6107 }
6108
6109 pname1 = strrchr_m(name1,'/');
6110 pname2 = strrchr_m(name2_copy,'/');
6111
6112 if (!pname1 || !pname2) {
6113 return False;
6114 }
6115
6116 /* Truncate the copy of name2 at the last '/' */
6117 *pname2 = '\0';
6118
6119 /* Now go past the '/' */
6120 pname1++;
6121 pname2++;
6122
6123 root1 = talloc_strdup(ctx, pname1);
6124 root2 = talloc_strdup(ctx, pname2);
6125
6126 if (!root1 || !root2) {
6127 return False;
6128 }
6129
6130 p = strrchr_m(root1,'.');
6131 if (p) {
6132 *p = 0;
6133 ext1 = talloc_strdup(ctx, p+1);
6134 } else {
6135 ext1 = talloc_strdup(ctx, "");
6136 }
6137 p = strrchr_m(root2,'.');
6138 if (p) {
6139 *p = 0;
6140 ext2 = talloc_strdup(ctx, p+1);
6141 } else {
6142 ext2 = talloc_strdup(ctx, "");
6143 }
6144
6145 if (!ext1 || !ext2) {
6146 return False;
6147 }
6148
6149 p = root1;
6150 p2 = root2;
6151 while (*p2) {
6152 if (*p2 == '?') {
6153 /* Hmmm. Should this be mb-aware ? */
6154 *p2 = *p;
6155 p2++;
6156 } else if (*p2 == '*') {
6157 *p2 = '\0';
6158 root2 = talloc_asprintf(ctx, "%s%s",
6159 root2,
6160 p);
6161 if (!root2) {
6162 return False;
6163 }
6164 break;
6165 } else {
6166 p2++;
6167 }
6168 if (*p) {
6169 p++;
6170 }
6171 }
6172
6173 p = ext1;
6174 p2 = ext2;
6175 while (*p2) {
6176 if (*p2 == '?') {
6177 /* Hmmm. Should this be mb-aware ? */
6178 *p2 = *p;
6179 p2++;
6180 } else if (*p2 == '*') {
6181 *p2 = '\0';
6182 ext2 = talloc_asprintf(ctx, "%s%s",
6183 ext2,
6184 p);
6185 if (!ext2) {
6186 return False;
6187 }
6188 break;
6189 } else {
6190 p2++;
6191 }
6192 if (*p) {
6193 p++;
6194 }
6195 }
6196
6197 if (*ext2) {
6198 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6199 name2_copy,
6200 root2,
6201 ext2);
6202 } else {
6203 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6204 name2_copy,
6205 root2);
6206 }
6207
6208 if (!*pp_newname) {
6209 return False;
6210 }
6211
6212 return True;
6213 }
6214
6215 /****************************************************************************
6216 Ensure open files have their names updated. Updated to notify other smbd's
6217 asynchronously.
6218 ****************************************************************************/
6219
6220 static void rename_open_files(connection_struct *conn,
6221 struct share_mode_lock *lck,
6222 struct file_id id,
6223 uint32_t orig_name_hash,
6224 const struct smb_filename *smb_fname_dst)
6225 {
6226 files_struct *fsp;
6227 bool did_rename = False;
6228 NTSTATUS status;
6229 uint32_t new_name_hash = 0;
6230
6231 for(fsp = file_find_di_first(conn->sconn, id); fsp;
6232 fsp = file_find_di_next(fsp)) {
6233 /* fsp_name is a relative path under the fsp. To change this for other
6234 sharepaths we need to manipulate relative paths. */
6235 /* TODO - create the absolute path and manipulate the newname
6236 relative to the sharepath. */
6237 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6238 continue;
6239 }
6240 if (fsp->name_hash != orig_name_hash) {
6241 continue;
6242 }
6243 DEBUG(10, ("rename_open_files: renaming file %s "
6244 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6245 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6246 smb_fname_str_dbg(smb_fname_dst)));
6247
6248 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6249 if (NT_STATUS_IS_OK(status)) {
6250 did_rename = True;
6251 new_name_hash = fsp->name_hash;
6252 }
6253 }
6254
6255 if (!did_rename) {
6256 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6257 "for %s\n", file_id_string_tos(&id),
6258 smb_fname_str_dbg(smb_fname_dst)));
6259 }
6260
6261 /* Send messages to all smbd's (not ourself) that the name has changed. */
6262 rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6263 orig_name_hash, new_name_hash,
6264 smb_fname_dst);
6265
6266 }
6267
6268 /****************************************************************************
6269 We need to check if the source path is a parent directory of the destination
6270 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6271 refuse the rename with a sharing violation. Under UNIX the above call can
6272 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6273 probably need to check that the client is a Windows one before disallowing
6274 this as a UNIX client (one with UNIX extensions) can know the source is a
6275 symlink and make this decision intelligently. Found by an excellent bug
6276 report from <AndyLiebman@aol.com>.
6277 ****************************************************************************/
6278
6279 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6280 const struct smb_filename *smb_fname_dst)
6281 {
6282 const char *psrc = smb_fname_src->base_name;
6283 const char *pdst = smb_fname_dst->base_name;
6284 size_t slen;
6285
6286 if (psrc[0] == '.' && psrc[1] == '/') {
6287 psrc += 2;
6288 }
6289 if (pdst[0] == '.' && pdst[1] == '/') {
6290 pdst += 2;
6291 }
6292 if ((slen = strlen(psrc)) > strlen(pdst)) {
6293 return False;
6294 }
6295 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6296 }
6297
6298 /*
6299 * Do the notify calls from a rename
6300 */
6301
6302 static void notify_rename(connection_struct *conn, bool is_dir,
6303 const struct smb_filename *smb_fname_src,
6304 const struct smb_filename *smb_fname_dst)
6305 {
6306 char *parent_dir_src = NULL;
6307 char *parent_dir_dst = NULL;
6308 uint32 mask;
6309
6310 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6311 : FILE_NOTIFY_CHANGE_FILE_NAME;
6312
6313 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6314 &parent_dir_src, NULL) ||
6315 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6316 &parent_dir_dst, NULL)) {
6317 goto out;
6318 }
6319
6320 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6321 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6322 smb_fname_src->base_name);
6323 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6324 smb_fname_dst->base_name);
6325 }
6326 else {
6327 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6328 smb_fname_src->base_name);
6329 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6330 smb_fname_dst->base_name);
6331 }
6332
6333 /* this is a strange one. w2k3 gives an additional event for
6334 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6335 files, but not directories */
6336 if (!is_dir) {
6337 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6338 FILE_NOTIFY_CHANGE_ATTRIBUTES
6339 |FILE_NOTIFY_CHANGE_CREATION,
6340 smb_fname_dst->base_name);
6341 }
6342 out:
6343 TALLOC_FREE(parent_dir_src);
6344 TALLOC_FREE(parent_dir_dst);
6345 }
6346
6347 /****************************************************************************
6348 Returns an error if the parent directory for a filename is open in an
6349 incompatible way.
6350 ****************************************************************************/
6351
6352 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6353 const struct smb_filename *smb_fname_dst_in)
6354 {
6355 char *parent_dir = NULL;
6356 struct smb_filename smb_fname_parent;
6357 struct file_id id;
6358 files_struct *fsp = NULL;
6359 int ret;
6360
6361 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6362 &parent_dir, NULL)) {
6363 return NT_STATUS_NO_MEMORY;
6364 }
6365 ZERO_STRUCT(smb_fname_parent);
6366 smb_fname_parent.base_name = parent_dir;
6367
6368 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6369 if (ret == -1) {
6370 return map_nt_error_from_unix(errno);
6371 }
6372
6373 /*
6374 * We're only checking on this smbd here, mostly good
6375 * enough.. and will pass tests.
6376 */
6377
6378 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6379 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6380 fsp = file_find_di_next(fsp)) {
6381 if (fsp->access_mask & DELETE_ACCESS) {
6382 return NT_STATUS_SHARING_VIOLATION;
6383 }
6384 }
6385 return NT_STATUS_OK;
6386 }
6387
6388 /****************************************************************************
6389 Rename an open file - given an fsp.
6390 ****************************************************************************/
6391
6392 NTSTATUS rename_internals_fsp(connection_struct *conn,
6393 files_struct *fsp,
6394 const struct smb_filename *smb_fname_dst_in,
6395 uint32 attrs,
6396 bool replace_if_exists)
6397 {
6398 TALLOC_CTX *ctx = talloc_tos();
6399 struct smb_filename *smb_fname_dst = NULL;
6400 NTSTATUS status = NT_STATUS_OK;
6401 struct share_mode_lock *lck = NULL;
6402 bool dst_exists, old_is_stream, new_is_stream;
6403
6404 status = check_name(conn, smb_fname_dst_in->base_name);
6405 if (!NT_STATUS_IS_OK(status)) {
6406 return status;
6407 }
6408
6409 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6410 if (!NT_STATUS_IS_OK(status)) {
6411 return status;
6412 }
6413
6414 /* Make a copy of the dst smb_fname structs */
6415
6416 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6417 if (smb_fname_dst == NULL) {
6418 status = NT_STATUS_NO_MEMORY;
6419 goto out;
6420 }
6421
6422 /*
6423 * Check for special case with case preserving and not
6424 * case sensitive. If the old last component differs from the original
6425 * last component only by case, then we should allow
6426 * the rename (user is trying to change the case of the
6427 * filename).
6428 */
6429 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6430 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6431 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6432 char *last_slash;
6433 char *fname_dst_lcomp_base_mod = NULL;
6434 struct smb_filename *smb_fname_orig_lcomp = NULL;
6435
6436 /*
6437 * Get the last component of the destination name.
6438 */
6439 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6440 if (last_slash) {
6441 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6442 } else {
6443 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6444 }
6445 if (!fname_dst_lcomp_base_mod) {
6446 status = NT_STATUS_NO_MEMORY;
6447 goto out;
6448 }
6449
6450 /*
6451 * Create an smb_filename struct using the original last
6452 * component of the destination.
6453 */
6454 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6455 ctx, smb_fname_dst->original_lcomp, NULL);
6456 if (smb_fname_orig_lcomp == NULL) {
6457 status = NT_STATUS_NO_MEMORY;
6458 TALLOC_FREE(fname_dst_lcomp_base_mod);
6459 goto out;
6460 }
6461
6462 /* If the base names only differ by case, use original. */
6463 if(!strcsequal(fname_dst_lcomp_base_mod,
6464 smb_fname_orig_lcomp->base_name)) {
6465 char *tmp;
6466 /*
6467 * Replace the modified last component with the
6468 * original.
6469 */
6470 if (last_slash) {
6471 *last_slash = '\0'; /* Truncate at the '/' */
6472 tmp = talloc_asprintf(smb_fname_dst,
6473 "%s/%s",
6474 smb_fname_dst->base_name,
6475 smb_fname_orig_lcomp->base_name);
6476 } else {
6477 tmp = talloc_asprintf(smb_fname_dst,
6478 "%s",
6479 smb_fname_orig_lcomp->base_name);
6480 }
6481 if (tmp == NULL) {
6482 status = NT_STATUS_NO_MEMORY;
6483 TALLOC_FREE(fname_dst_lcomp_base_mod);
6484 TALLOC_FREE(smb_fname_orig_lcomp);
6485 goto out;
6486 }
6487 TALLOC_FREE(smb_fname_dst->base_name);
6488 smb_fname_dst->base_name = tmp;
6489 }
6490
6491 /* If the stream_names only differ by case, use original. */
6492 if(!strcsequal(smb_fname_dst->stream_name,
6493 smb_fname_orig_lcomp->stream_name)) {
6494 char *tmp = NULL;
6495 /* Use the original stream. */
6496 tmp = talloc_strdup(smb_fname_dst,
6497 smb_fname_orig_lcomp->stream_name);
6498 if (tmp == NULL) {
6499 status = NT_STATUS_NO_MEMORY;
6500 TALLOC_FREE(fname_dst_lcomp_base_mod);
6501 TALLOC_FREE(smb_fname_orig_lcomp);
6502 goto out;
6503 }
6504 TALLOC_FREE(smb_fname_dst->stream_name);
6505 smb_fname_dst->stream_name = tmp;
6506 }
6507 TALLOC_FREE(fname_dst_lcomp_base_mod);
6508 TALLOC_FREE(smb_fname_orig_lcomp);
6509 }
6510
6511 /*
6512 * If the src and dest names are identical - including case,
6513 * don't do the rename, just return success.
6514 */
6515
6516 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6517 strcsequal(fsp->fsp_name->stream_name,
6518 smb_fname_dst->stream_name)) {
6519 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6520 "- returning success\n",
6521 smb_fname_str_dbg(smb_fname_dst)));
6522 status = NT_STATUS_OK;
6523 goto out;
6524 }
6525
6526 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6527 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6528
6529 /* Return the correct error code if both names aren't streams. */
6530 if (!old_is_stream && new_is_stream) {
6531 status = NT_STATUS_OBJECT_NAME_INVALID;
6532 goto out;
6533 }
6534
6535 if (old_is_stream && !new_is_stream) {
6536 status = NT_STATUS_INVALID_PARAMETER;
6537 goto out;
6538 }
6539
6540 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6541
6542 if(!replace_if_exists && dst_exists) {
6543 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6544 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6545 smb_fname_str_dbg(smb_fname_dst)));
6546 status = NT_STATUS_OBJECT_NAME_COLLISION;
6547 goto out;
6548 }
6549
6550 if (dst_exists) {
6551 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6552 &smb_fname_dst->st);
6553 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6554 fileid);
6555 /* The file can be open when renaming a stream */
6556 if (dst_fsp && !new_is_stream) {
6557 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6558 status = NT_STATUS_ACCESS_DENIED;
6559 goto out;
6560 }
6561 }
6562
6563 /* Ensure we have a valid stat struct for the source. */
6564 status = vfs_stat_fsp(fsp);
6565 if (!NT_STATUS_IS_OK(status)) {
6566 goto out;
6567 }
6568
6569 status = can_rename(conn, fsp, attrs);
6570
6571 if (!NT_STATUS_IS_OK(status)) {
6572 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6573 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6574 smb_fname_str_dbg(smb_fname_dst)));
6575 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6576 status = NT_STATUS_ACCESS_DENIED;
6577 goto out;
6578 }
6579
6580 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6581 status = NT_STATUS_ACCESS_DENIED;
6582 }
6583
6584 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6585
6586 /*
6587 * We have the file open ourselves, so not being able to get the
6588 * corresponding share mode lock is a fatal error.
6589 */
6590
6591 SMB_ASSERT(lck != NULL);
6592
6593 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6594 uint32 create_options = fsp->fh->private_options;
6595
6596 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6597 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6598 smb_fname_str_dbg(smb_fname_dst)));
6599
6600 if (!fsp->is_directory &&
6601 !lp_posix_pathnames() &&
6602 (lp_map_archive(SNUM(conn)) ||
6603 lp_store_dos_attributes(SNUM(conn)))) {
6604 /* We must set the archive bit on the newly
6605 renamed file. */
6606 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6607 uint32_t old_dosmode = dos_mode(conn,
6608 smb_fname_dst);
6609 file_set_dosmode(conn,
6610 smb_fname_dst,
6611 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6612 NULL,
6613 true);
6614 }
6615 }
6616
6617 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6618 smb_fname_dst);
6619
6620 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6621 smb_fname_dst);
6622
6623 /*
6624 * A rename acts as a new file create w.r.t. allowing an initial delete
6625 * on close, probably because in Windows there is a new handle to the
6626 * new file. If initial delete on close was requested but not
6627 * originally set, we need to set it here. This is probably not 100% correct,
6628 * but will work for the CIFSFS client which in non-posix mode
6629 * depends on these semantics. JRA.
6630 */
6631
6632 if (create_options & FILE_DELETE_ON_CLOSE) {
6633 status = can_set_delete_on_close(fsp, 0);
6634
6635 if (NT_STATUS_IS_OK(status)) {
6636 /* Note that here we set the *inital* delete on close flag,
6637 * not the regular one. The magic gets handled in close. */
6638 fsp->initial_delete_on_close = True;
6639 }
6640 }
6641 TALLOC_FREE(lck);
6642 status = NT_STATUS_OK;
6643 goto out;
6644 }
6645
6646 TALLOC_FREE(lck);
6647
6648 if (errno == ENOTDIR || errno == EISDIR) {
6649 status = NT_STATUS_OBJECT_NAME_COLLISION;
6650 } else {
6651 status = map_nt_error_from_unix(errno);
6652 }
6653
6654 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6655 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6656 smb_fname_str_dbg(smb_fname_dst)));
6657
6658 out:
6659 TALLOC_FREE(smb_fname_dst);
6660
6661 return status;
6662 }
6663
6664 /****************************************************************************
6665 The guts of the rename command, split out so it may be called by the NT SMB
6666 code.
6667 ****************************************************************************/
6668
6669 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6670 connection_struct *conn,
6671 struct smb_request *req,
6672 struct smb_filename *smb_fname_src,
6673 struct smb_filename *smb_fname_dst,
6674 uint32 attrs,
6675 bool replace_if_exists,
6676 bool src_has_wild,
6677 bool dest_has_wild,
6678 uint32_t access_mask)
6679 {
6680 char *fname_src_dir = NULL;
6681 char *fname_src_mask = NULL;
6682 int count=0;
6683 NTSTATUS status = NT_STATUS_OK;
6684 struct smb_Dir *dir_hnd = NULL;
6685 const char *dname = NULL;
6686 char *talloced = NULL;
6687 long offset = 0;
6688 int create_options = 0;
6689 bool posix_pathnames = lp_posix_pathnames();
6690 int rc;
6691
6692 /*
6693 * Split the old name into directory and last component
6694 * strings. Note that unix_convert may have stripped off a
6695 * leading ./ from both name and newname if the rename is
6696 * at the root of the share. We need to make sure either both
6697 * name and newname contain a / character or neither of them do
6698 * as this is checked in resolve_wildcards().
6699 */
6700
6701 /* Split up the directory from the filename/mask. */
6702 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6703 &fname_src_dir, &fname_src_mask);
6704 if (!NT_STATUS_IS_OK(status)) {
6705 status = NT_STATUS_NO_MEMORY;
6706 goto out;
6707 }
6708
6709 /*
6710 * We should only check the mangled cache
6711 * here if unix_convert failed. This means
6712 * that the path in 'mask' doesn't exist
6713 * on the file system and so we need to look
6714 * for a possible mangle. This patch from
6715 * Tine Smukavec <valentin.smukavec@hermes.si>.
6716 */
6717
6718 if (!VALID_STAT(smb_fname_src->st) &&
6719 mangle_is_mangled(fname_src_mask, conn->params)) {
6720 char *new_mask = NULL;
6721 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6722 conn->params);
6723 if (new_mask) {
6724 TALLOC_FREE(fname_src_mask);
6725 fname_src_mask = new_mask;
6726 }
6727 }
6728
6729 if (!src_has_wild) {
6730 files_struct *fsp;
6731
6732 /*
6733 * Only one file needs to be renamed. Append the mask back
6734 * onto the directory.
6735 */
6736 TALLOC_FREE(smb_fname_src->base_name);
6737 if (ISDOT(fname_src_dir)) {
6738 /* Ensure we use canonical names on open. */
6739 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6740 "%s",
6741 fname_src_mask);
6742 } else {
6743 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6744 "%s/%s",
6745 fname_src_dir,
6746 fname_src_mask);
6747 }
6748 if (!smb_fname_src->base_name) {
6749 status = NT_STATUS_NO_MEMORY;
6750 goto out;
6751 }
6752
6753 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6754 "case_preserve = %d, short case preserve = %d, "
6755 "directory = %s, newname = %s, "
6756 "last_component_dest = %s\n",
6757 conn->case_sensitive, conn->case_preserve,
6758 conn->short_case_preserve,
6759 smb_fname_str_dbg(smb_fname_src),
6760 smb_fname_str_dbg(smb_fname_dst),
6761 smb_fname_dst->original_lcomp));
6762
6763 /* The dest name still may have wildcards. */
6764 if (dest_has_wild) {
6765 char *fname_dst_mod = NULL;
6766 if (!resolve_wildcards(smb_fname_dst,
6767 smb_fname_src->base_name,
6768 smb_fname_dst->base_name,
6769 &fname_dst_mod)) {
6770 DEBUG(6, ("rename_internals: resolve_wildcards "
6771 "%s %s failed\n",
6772 smb_fname_src->base_name,
6773 smb_fname_dst->base_name));
6774 status = NT_STATUS_NO_MEMORY;
6775 goto out;
6776 }
6777 TALLOC_FREE(smb_fname_dst->base_name);
6778 smb_fname_dst->base_name = fname_dst_mod;
6779 }
6780
6781 ZERO_STRUCT(smb_fname_src->st);
6782 if (posix_pathnames) {
6783 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6784 } else {
6785 rc = SMB_VFS_STAT(conn, smb_fname_src);
6786 }
6787 if (rc == -1) {
6788 status = map_nt_error_from_unix_common(errno);
6789 goto out;
6790 }
6791
6792 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6793 create_options |= FILE_DIRECTORY_FILE;
6794 }
6795
6796 status = SMB_VFS_CREATE_FILE(
6797 conn, /* conn */
6798 req, /* req */
6799 0, /* root_dir_fid */
6800 smb_fname_src, /* fname */
6801 access_mask, /* access_mask */
6802 (FILE_SHARE_READ | /* share_access */
6803 FILE_SHARE_WRITE),
6804 FILE_OPEN, /* create_disposition*/
6805 create_options, /* create_options */
6806 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6807 0, /* oplock_request */
6808 NULL, /* lease */
6809 0, /* allocation_size */
6810 0, /* private_flags */
6811 NULL, /* sd */
6812 NULL, /* ea_list */
6813 &fsp, /* result */
6814 NULL); /* pinfo */
6815
6816 if (!NT_STATUS_IS_OK(status)) {
6817 DEBUG(3, ("Could not open rename source %s: %s\n",
6818 smb_fname_str_dbg(smb_fname_src),
6819 nt_errstr(status)));
6820 goto out;
6821 }
6822
6823 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6824 attrs, replace_if_exists);
6825
6826 close_file(req, fsp, NORMAL_CLOSE);
6827
6828 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6829 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6830 smb_fname_str_dbg(smb_fname_dst)));
6831
6832 goto out;
6833 }
6834
6835 /*
6836 * Wildcards - process each file that matches.
6837 */
6838 if (strequal(fname_src_mask, "????????.???")) {
6839 TALLOC_FREE(fname_src_mask);
6840 fname_src_mask = talloc_strdup(ctx, "*");
6841 if (!fname_src_mask) {
6842 status = NT_STATUS_NO_MEMORY;
6843 goto out;
6844 }
6845 }
6846
6847 status = check_name(conn, fname_src_dir);
6848 if (!NT_STATUS_IS_OK(status)) {
6849 goto out;
6850 }
6851
6852 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6853 attrs);
6854 if (dir_hnd == NULL) {
6855 status = map_nt_error_from_unix(errno);
6856 goto out;
6857 }
6858
6859 status = NT_STATUS_NO_SUCH_FILE;
6860 /*
6861 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6862 * - gentest fix. JRA
6863 */
6864
6865 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6866 &talloced))) {
6867 files_struct *fsp = NULL;
6868 char *destname = NULL;
6869 bool sysdir_entry = False;
6870
6871 /* Quick check for "." and ".." */
6872 if (ISDOT(dname) || ISDOTDOT(dname)) {
6873 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6874 sysdir_entry = True;
6875 } else {
6876 TALLOC_FREE(talloced);
6877 continue;
6878 }
6879 }
6880
6881 if (!is_visible_file(conn, fname_src_dir, dname,
6882 &smb_fname_src->st, false)) {
6883 TALLOC_FREE(talloced);
6884 continue;
6885 }
6886
6887 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6888 TALLOC_FREE(talloced);
6889 continue;
6890 }
6891
6892 if (sysdir_entry) {
6893 status = NT_STATUS_OBJECT_NAME_INVALID;
6894 break;
6895 }
6896
6897 TALLOC_FREE(smb_fname_src->base_name);
6898 if (ISDOT(fname_src_dir)) {
6899 /* Ensure we use canonical names on open. */
6900 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6901 "%s",
6902 dname);
6903 } else {
6904 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6905 "%s/%s",
6906 fname_src_dir,
6907 dname);
6908 }
6909 if (!smb_fname_src->base_name) {
6910 status = NT_STATUS_NO_MEMORY;
6911 goto out;
6912 }
6913
6914 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6915 smb_fname_dst->base_name,
6916 &destname)) {
6917 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6918 smb_fname_src->base_name, destname));
6919 TALLOC_FREE(talloced);
6920 continue;
6921 }
6922 if (!destname) {
6923 status = NT_STATUS_NO_MEMORY;
6924 goto out;
6925 }
6926
6927 TALLOC_FREE(smb_fname_dst->base_name);
6928 smb_fname_dst->base_name = destname;
6929
6930 ZERO_STRUCT(smb_fname_src->st);
6931 if (posix_pathnames) {
6932 SMB_VFS_LSTAT(conn, smb_fname_src);
6933 } else {
6934 SMB_VFS_STAT(conn, smb_fname_src);
6935 }
6936
6937 create_options = 0;
6938
6939 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6940 create_options |= FILE_DIRECTORY_FILE;
6941 }
6942
6943 status = SMB_VFS_CREATE_FILE(
6944 conn, /* conn */
6945 req, /* req */
6946 0, /* root_dir_fid */
6947 smb_fname_src, /* fname */
6948 access_mask, /* access_mask */
6949 (FILE_SHARE_READ | /* share_access */
6950 FILE_SHARE_WRITE),
6951 FILE_OPEN, /* create_disposition*/
6952 create_options, /* create_options */
6953 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6954 0, /* oplock_request */
6955 NULL, /* lease */
6956 0, /* allocation_size */
6957 0, /* private_flags */
6958 NULL, /* sd */
6959 NULL, /* ea_list */
6960 &fsp, /* result */
6961 NULL); /* pinfo */
6962
6963 if (!NT_STATUS_IS_OK(status)) {
6964 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6965 "returned %s rename %s -> %s\n",
6966 nt_errstr(status),
6967 smb_fname_str_dbg(smb_fname_src),
6968 smb_fname_str_dbg(smb_fname_dst)));
6969 break;
6970 }
6971
6972 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6973 dname);
6974 if (!smb_fname_dst->original_lcomp) {
6975 status = NT_STATUS_NO_MEMORY;
6976 goto out;
6977 }
6978
6979 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6980 attrs, replace_if_exists);
6981
6982 close_file(req, fsp, NORMAL_CLOSE);
6983
6984 if (!NT_STATUS_IS_OK(status)) {
6985 DEBUG(3, ("rename_internals_fsp returned %s for "
6986 "rename %s -> %s\n", nt_errstr(status),
6987 smb_fname_str_dbg(smb_fname_src),
6988 smb_fname_str_dbg(smb_fname_dst)));
6989 break;
6990 }
6991
6992 count++;
6993
6994 DEBUG(3,("rename_internals: doing rename on %s -> "
6995 "%s\n", smb_fname_str_dbg(smb_fname_src),
6996 smb_fname_str_dbg(smb_fname_src)));
6997 TALLOC_FREE(talloced);
6998 }
6999 TALLOC_FREE(dir_hnd);
7000
7001 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
7002 status = map_nt_error_from_unix(errno);
7003 }
7004
7005 out:
7006 TALLOC_FREE(talloced);
7007 TALLOC_FREE(fname_src_dir);
7008 TALLOC_FREE(fname_src_mask);
7009 return status;
7010 }
7011
7012 /****************************************************************************
7013 Reply to a mv.
7014 ****************************************************************************/
7015
7016 void reply_mv(struct smb_request *req)
7017 {
7018 connection_struct *conn = req->conn;
7019 char *name = NULL;
7020 char *newname = NULL;
7021 const char *p;
7022 uint32 attrs;
7023 NTSTATUS status;
7024 bool src_has_wcard = False;
7025 bool dest_has_wcard = False;
7026 TALLOC_CTX *ctx = talloc_tos();
7027 struct smb_filename *smb_fname_src = NULL;
7028 struct smb_filename *smb_fname_dst = NULL;
7029 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
7030 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
7031 bool stream_rename = false;
7032
7033 START_PROFILE(SMBmv);
7034
7035 if (req->wct < 1) {
7036 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7037 goto out;
7038 }
7039
7040 attrs = SVAL(req->vwv+0, 0);
7041
7042 p = (const char *)req->buf + 1;
7043 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
7044 &status, &src_has_wcard);
7045 if (!NT_STATUS_IS_OK(status)) {
7046 reply_nterror(req, status);
7047 goto out;
7048 }
7049 p++;
7050 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
7051 &status, &dest_has_wcard);
7052 if (!NT_STATUS_IS_OK(status)) {
7053 reply_nterror(req, status);
7054 goto out;
7055 }
7056
7057 if (!lp_posix_pathnames()) {
7058 /* The newname must begin with a ':' if the
7059 name contains a ':'. */
7060 if (strchr_m(name, ':')) {
7061 if (newname[0] != ':') {
7062 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7063 goto out;
7064 }
7065 stream_rename = true;
7066 }
7067 }
7068
7069 status = filename_convert(ctx,
7070 conn,
7071 req->flags2 & FLAGS2_DFS_PATHNAMES,
7072 name,
7073 src_ucf_flags,
7074 &src_has_wcard,
7075 &smb_fname_src);
7076
7077 if (!NT_STATUS_IS_OK(status)) {
7078 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7079 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7080 ERRSRV, ERRbadpath);
7081 goto out;
7082 }
7083 reply_nterror(req, status);
7084 goto out;
7085 }
7086
7087 status = filename_convert(ctx,
7088 conn,
7089 req->flags2 & FLAGS2_DFS_PATHNAMES,
7090 newname,
7091 dst_ucf_flags,
7092 &dest_has_wcard,
7093 &smb_fname_dst);
7094
7095 if (!NT_STATUS_IS_OK(status)) {
7096 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7097 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7098 ERRSRV, ERRbadpath);
7099 goto out;
7100 }
7101 reply_nterror(req, status);
7102 goto out;
7103 }
7104
7105 if (stream_rename) {
7106 /* smb_fname_dst->base_name must be the same as
7107 smb_fname_src->base_name. */
7108 TALLOC_FREE(smb_fname_dst->base_name);
7109 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7110 smb_fname_src->base_name);
7111 if (!smb_fname_dst->base_name) {
7112 reply_nterror(req, NT_STATUS_NO_MEMORY);
7113 goto out;
7114 }
7115 }
7116
7117 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7118 smb_fname_str_dbg(smb_fname_dst)));
7119
7120 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7121 attrs, False, src_has_wcard, dest_has_wcard,
7122 DELETE_ACCESS);
7123 if (!NT_STATUS_IS_OK(status)) {
7124 if (open_was_deferred(req->xconn, req->mid)) {
7125 /* We have re-scheduled this call. */
7126 goto out;
7127 }
7128 reply_nterror(req, status);
7129 goto out;
7130 }
7131
7132 reply_outbuf(req, 0, 0);
7133 out:
7134 TALLOC_FREE(smb_fname_src);
7135 TALLOC_FREE(smb_fname_dst);
7136 END_PROFILE(SMBmv);
7137 return;
7138 }
7139
7140 /*******************************************************************
7141 Copy a file as part of a reply_copy.
7142 ******************************************************************/
7143
7144 /*
7145 * TODO: check error codes on all callers
7146 */
7147
7148 NTSTATUS copy_file(TALLOC_CTX *ctx,
7149 connection_struct *conn,
7150 struct smb_filename *smb_fname_src,
7151 struct smb_filename *smb_fname_dst,
7152 int ofun,
7153 int count,
7154 bool target_is_directory)
7155 {
7156 struct smb_filename *smb_fname_dst_tmp = NULL;
7157 off_t ret=-1;
7158 files_struct *fsp1,*fsp2;
7159 uint32 dosattrs;
7160 uint32 new_create_disposition;
7161 NTSTATUS status;
7162
7163
7164 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7165 if (smb_fname_dst_tmp == NULL) {
7166 return NT_STATUS_NO_MEMORY;
7167 }
7168
7169 /*
7170 * If the target is a directory, extract the last component from the
7171 * src filename and append it to the dst filename
7172 */
7173 if (target_is_directory) {
7174 const char *p;
7175
7176 /* dest/target can't be a stream if it's a directory. */
7177 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7178
7179 p = strrchr_m(smb_fname_src->base_name,'/');
7180 if (p) {
7181 p++;
7182 } else {
7183 p = smb_fname_src->base_name;
7184 }
7185 smb_fname_dst_tmp->base_name =
7186 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7187 p);
7188 if (!smb_fname_dst_tmp->base_name) {
7189 status = NT_STATUS_NO_MEMORY;
7190 goto out;
7191 }
7192 }
7193
7194 status = vfs_file_exist(conn, smb_fname_src);
7195 if (!NT_STATUS_IS_OK(status)) {
7196 goto out;
7197 }
7198
7199 if (!target_is_directory && count) {
7200 new_create_disposition = FILE_OPEN;
7201 } else {
7202 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7203 0, ofun,
7204 NULL, NULL,
7205 &new_create_disposition,
7206 NULL,
7207 NULL)) {
7208 status = NT_STATUS_INVALID_PARAMETER;
7209 goto out;
7210 }
7211 }
7212
7213 /* Open the src file for reading. */
7214 status = SMB_VFS_CREATE_FILE(
7215 conn, /* conn */
7216 NULL, /* req */
7217 0, /* root_dir_fid */
7218 smb_fname_src, /* fname */
7219 FILE_GENERIC_READ, /* access_mask */
7220 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7221 FILE_OPEN, /* create_disposition*/
7222 0, /* create_options */
7223 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7224 INTERNAL_OPEN_ONLY, /* oplock_request */
7225 NULL, /* lease */
7226 0, /* allocation_size */
7227 0, /* private_flags */
7228 NULL, /* sd */
7229 NULL, /* ea_list */
7230 &fsp1, /* result */
7231 NULL); /* psbuf */
7232
7233 if (!NT_STATUS_IS_OK(status)) {
7234 goto out;
7235 }
7236
7237 dosattrs = dos_mode(conn, smb_fname_src);
7238
7239 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7240 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7241 }
7242
7243 /* Open the dst file for writing. */
7244 status = SMB_VFS_CREATE_FILE(
7245 conn, /* conn */
7246 NULL, /* req */
7247 0, /* root_dir_fid */
7248 smb_fname_dst, /* fname */
7249 FILE_GENERIC_WRITE, /* access_mask */
7250 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7251 new_create_disposition, /* create_disposition*/
7252 0, /* create_options */
7253 dosattrs, /* file_attributes */
7254 INTERNAL_OPEN_ONLY, /* oplock_request */
7255 NULL, /* lease */
7256 0, /* allocation_size */
7257 0, /* private_flags */
7258 NULL, /* sd */
7259 NULL, /* ea_list */
7260 &fsp2, /* result */
7261 NULL); /* psbuf */
7262
7263 if (!NT_STATUS_IS_OK(status)) {
7264 close_file(NULL, fsp1, ERROR_CLOSE);
7265 goto out;
7266 }
7267
7268 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7269 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7270 if (ret == -1) {
7271 DEBUG(0, ("error - vfs lseek returned error %s\n",
7272 strerror(errno)));
7273 status = map_nt_error_from_unix(errno);
7274 close_file(NULL, fsp1, ERROR_CLOSE);
7275 close_file(NULL, fsp2, ERROR_CLOSE);
7276 goto out;
7277 }
7278 }
7279
7280 /* Do the actual copy. */
7281 if (smb_fname_src->st.st_ex_size) {
7282 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7283 } else {
7284 ret = 0;
7285 }
7286
7287 close_file(NULL, fsp1, NORMAL_CLOSE);
7288
7289 /* Ensure the modtime is set correctly on the destination file. */
7290 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7291
7292 /*
7293 * As we are opening fsp1 read-only we only expect
7294 * an error on close on fsp2 if we are out of space.
7295 * Thus we don't look at the error return from the
7296 * close of fsp1.
7297 */
7298 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7299
7300 if (!NT_STATUS_IS_OK(status)) {
7301 goto out;
7302 }
7303
7304 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7305 status = NT_STATUS_DISK_FULL;
7306 goto out;
7307 }
7308
7309 status = NT_STATUS_OK;
7310
7311 out:
7312 TALLOC_FREE(smb_fname_dst_tmp);
7313 return status;
7314 }
7315
7316 /****************************************************************************
7317 Reply to a file copy.
7318 ****************************************************************************/
7319
7320 void reply_copy(struct smb_request *req)
7321 {
7322 connection_struct *conn = req->conn;
7323 struct smb_filename *smb_fname_src = NULL;
7324 struct smb_filename *smb_fname_dst = NULL;
7325 char *fname_src = NULL;
7326 char *fname_dst = NULL;
7327 char *fname_src_mask = NULL;
7328 char *fname_src_dir = NULL;
7329 const char *p;
7330 int count=0;
7331 int error = ERRnoaccess;
7332 int tid2;
7333 int ofun;
7334 int flags;
7335 bool target_is_directory=False;
7336 bool source_has_wild = False;
7337 bool dest_has_wild = False;
7338 NTSTATUS status;
7339 TALLOC_CTX *ctx = talloc_tos();
7340
7341 START_PROFILE(SMBcopy);
7342
7343 if (req->wct < 3) {
7344 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7345 goto out;
7346 }
7347
7348 tid2 = SVAL(req->vwv+0, 0);
7349 ofun = SVAL(req->vwv+1, 0);
7350 flags = SVAL(req->vwv+2, 0);
7351
7352 p = (const char *)req->buf;
7353 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7354 &status, &source_has_wild);
7355 if (!NT_STATUS_IS_OK(status)) {
7356 reply_nterror(req, status);
7357 goto out;
7358 }
7359 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7360 &status, &dest_has_wild);
7361 if (!NT_STATUS_IS_OK(status)) {
7362 reply_nterror(req, status);
7363 goto out;
7364 }
7365
7366 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7367
7368 if (tid2 != conn->cnum) {
7369 /* can't currently handle inter share copies XXXX */
7370 DEBUG(3,("Rejecting inter-share copy\n"));
7371 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7372 goto out;
7373 }
7374
7375 status = filename_convert(ctx, conn,
7376 req->flags2 & FLAGS2_DFS_PATHNAMES,
7377 fname_src,
7378 UCF_COND_ALLOW_WCARD_LCOMP,
7379 &source_has_wild,
7380 &smb_fname_src);
7381 if (!NT_STATUS_IS_OK(status)) {
7382 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7383 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7384 ERRSRV, ERRbadpath);
7385 goto out;
7386 }
7387 reply_nterror(req, status);
7388 goto out;
7389 }
7390
7391 status = filename_convert(ctx, conn,
7392 req->flags2 & FLAGS2_DFS_PATHNAMES,
7393 fname_dst,
7394 UCF_COND_ALLOW_WCARD_LCOMP,
7395 &dest_has_wild,
7396 &smb_fname_dst);
7397 if (!NT_STATUS_IS_OK(status)) {
7398 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7399 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7400 ERRSRV, ERRbadpath);
7401 goto out;
7402 }
7403 reply_nterror(req, status);
7404 goto out;
7405 }
7406
7407 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7408
7409 if ((flags&1) && target_is_directory) {
7410 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7411 goto out;
7412 }
7413
7414 if ((flags&2) && !target_is_directory) {
7415 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7416 goto out;
7417 }
7418
7419 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7420 /* wants a tree copy! XXXX */
7421 DEBUG(3,("Rejecting tree copy\n"));
7422 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7423 goto out;
7424 }
7425
7426 /* Split up the directory from the filename/mask. */
7427 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7428 &fname_src_dir, &fname_src_mask);
7429 if (!NT_STATUS_IS_OK(status)) {
7430 reply_nterror(req, NT_STATUS_NO_MEMORY);
7431 goto out;
7432 }
7433
7434 /*
7435 * We should only check the mangled cache
7436 * here if unix_convert failed. This means
7437 * that the path in 'mask' doesn't exist
7438 * on the file system and so we need to look
7439 * for a possible mangle. This patch from
7440 * Tine Smukavec <valentin.smukavec@hermes.si>.
7441 */
7442 if (!VALID_STAT(smb_fname_src->st) &&
7443 mangle_is_mangled(fname_src_mask, conn->params)) {
7444 char *new_mask = NULL;
7445 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7446 &new_mask, conn->params);
7447
7448 /* Use demangled name if one was successfully found. */
7449 if (new_mask) {
7450 TALLOC_FREE(fname_src_mask);
7451 fname_src_mask = new_mask;
7452 }
7453 }
7454
7455 if (!source_has_wild) {
7456
7457 /*
7458 * Only one file needs to be copied. Append the mask back onto
7459 * the directory.
7460 */
7461 TALLOC_FREE(smb_fname_src->base_name);
7462 if (ISDOT(fname_src_dir)) {
7463 /* Ensure we use canonical names on open. */
7464 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7465 "%s",
7466 fname_src_mask);
7467 } else {
7468 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7469 "%s/%s",
7470 fname_src_dir,
7471 fname_src_mask);
7472 }
7473 if (!smb_fname_src->base_name) {
7474 reply_nterror(req, NT_STATUS_NO_MEMORY);
7475 goto out;
7476 }
7477
7478 if (dest_has_wild) {
7479 char *fname_dst_mod = NULL;
7480 if (!resolve_wildcards(smb_fname_dst,
7481 smb_fname_src->base_name,
7482 smb_fname_dst->base_name,
7483 &fname_dst_mod)) {
7484 reply_nterror(req, NT_STATUS_NO_MEMORY);
7485 goto out;
7486 }
7487 TALLOC_FREE(smb_fname_dst->base_name);
7488 smb_fname_dst->base_name = fname_dst_mod;
7489 }
7490
7491 status = check_name(conn, smb_fname_src->base_name);
7492 if (!NT_STATUS_IS_OK(status)) {
7493 reply_nterror(req, status);
7494 goto out;
7495 }
7496
7497 status = check_name(conn, smb_fname_dst->base_name);
7498 if (!NT_STATUS_IS_OK(status)) {
7499 reply_nterror(req, status);
7500 goto out;
7501 }
7502
7503 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7504 ofun, count, target_is_directory);
7505
7506 if(!NT_STATUS_IS_OK(status)) {
7507 reply_nterror(req, status);
7508 goto out;
7509 } else {
7510 count++;
7511 }
7512 } else {
7513 struct smb_Dir *dir_hnd = NULL;
7514 const char *dname = NULL;
7515 char *talloced = NULL;
7516 long offset = 0;
7517
7518 /*
7519 * There is a wildcard that requires us to actually read the
7520 * src dir and copy each file matching the mask to the dst.
7521 * Right now streams won't be copied, but this could
7522 * presumably be added with a nested loop for reach dir entry.
7523 */
7524 SMB_ASSERT(!smb_fname_src->stream_name);
7525 SMB_ASSERT(!smb_fname_dst->stream_name);
7526
7527 smb_fname_src->stream_name = NULL;
7528 smb_fname_dst->stream_name = NULL;
7529
7530 if (strequal(fname_src_mask,"????????.???")) {
7531 TALLOC_FREE(fname_src_mask);
7532 fname_src_mask = talloc_strdup(ctx, "*");
7533 if (!fname_src_mask) {
7534 reply_nterror(req, NT_STATUS_NO_MEMORY);
7535 goto out;
7536 }
7537 }
7538
7539 status = check_name(conn, fname_src_dir);
7540 if (!NT_STATUS_IS_OK(status)) {
7541 reply_nterror(req, status);
7542 goto out;
7543 }
7544
7545 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7546 if (dir_hnd == NULL) {
7547 status = map_nt_error_from_unix(errno);
7548 reply_nterror(req, status);
7549 goto out;
7550 }
7551
7552 error = ERRbadfile;
7553
7554 /* Iterate over the src dir copying each entry to the dst. */
7555 while ((dname = ReadDirName(dir_hnd, &offset,
7556 &smb_fname_src->st, &talloced))) {
7557 char *destname = NULL;
7558
7559 if (ISDOT(dname) || ISDOTDOT(dname)) {
7560 TALLOC_FREE(talloced);
7561 continue;
7562 }
7563
7564 if (!is_visible_file(conn, fname_src_dir, dname,
7565 &smb_fname_src->st, false)) {
7566 TALLOC_FREE(talloced);
7567 continue;
7568 }
7569
7570 if(!mask_match(dname, fname_src_mask,
7571 conn->case_sensitive)) {
7572 TALLOC_FREE(talloced);
7573 continue;
7574 }
7575
7576 error = ERRnoaccess;
7577
7578 /* Get the src smb_fname struct setup. */
7579 TALLOC_FREE(smb_fname_src->base_name);
7580 if (ISDOT(fname_src_dir)) {
7581 /* Ensure we use canonical names on open. */
7582 smb_fname_src->base_name =
7583 talloc_asprintf(smb_fname_src, "%s",
7584 dname);
7585 } else {
7586 smb_fname_src->base_name =
7587 talloc_asprintf(smb_fname_src, "%s/%s",
7588 fname_src_dir, dname);
7589 }
7590
7591 if (!smb_fname_src->base_name) {
7592 TALLOC_FREE(dir_hnd);
7593 TALLOC_FREE(talloced);
7594 reply_nterror(req, NT_STATUS_NO_MEMORY);
7595 goto out;
7596 }
7597
7598 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7599 smb_fname_dst->base_name,
7600 &destname)) {
7601 TALLOC_FREE(talloced);
7602 continue;
7603 }
7604 if (!destname) {
7605 TALLOC_FREE(dir_hnd);
7606 TALLOC_FREE(talloced);
7607 reply_nterror(req, NT_STATUS_NO_MEMORY);
7608 goto out;
7609 }
7610
7611 TALLOC_FREE(smb_fname_dst->base_name);
7612 smb_fname_dst->base_name = destname;
7613
7614 status = check_name(conn, smb_fname_src->base_name);
7615 if (!NT_STATUS_IS_OK(status)) {
7616 TALLOC_FREE(dir_hnd);
7617 TALLOC_FREE(talloced);
7618 reply_nterror(req, status);
7619 goto out;
7620 }
7621
7622 status = check_name(conn, smb_fname_dst->base_name);
7623 if (!NT_STATUS_IS_OK(status)) {
7624 TALLOC_FREE(dir_hnd);
7625 TALLOC_FREE(talloced);
7626 reply_nterror(req, status);
7627 goto out;
7628 }
7629
7630 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7631 smb_fname_src->base_name,
7632 smb_fname_dst->base_name));
7633
7634 status = copy_file(ctx, conn, smb_fname_src,
7635 smb_fname_dst, ofun, count,
7636 target_is_directory);
7637 if (NT_STATUS_IS_OK(status)) {
7638 count++;
7639 }
7640
7641 TALLOC_FREE(talloced);
7642 }
7643 TALLOC_FREE(dir_hnd);
7644 }
7645
7646 if (count == 0) {
7647 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7648 goto out;
7649 }
7650
7651 reply_outbuf(req, 1, 0);
7652 SSVAL(req->outbuf,smb_vwv0,count);
7653 out:
7654 TALLOC_FREE(smb_fname_src);
7655 TALLOC_FREE(smb_fname_dst);
7656 TALLOC_FREE(fname_src);
7657 TALLOC_FREE(fname_dst);
7658 TALLOC_FREE(fname_src_mask);
7659 TALLOC_FREE(fname_src_dir);
7660
7661 END_PROFILE(SMBcopy);
7662 return;
7663 }
7664
7665 #undef DBGC_CLASS
7666 #define DBGC_CLASS DBGC_LOCKING
7667
7668 /****************************************************************************
7669 Get a lock pid, dealing with large count requests.
7670 ****************************************************************************/
7671
7672 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7673 bool large_file_format)
7674 {
7675 if(!large_file_format)
7676 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7677 else
7678 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7679 }
7680
7681 /****************************************************************************
7682 Get a lock count, dealing with large count requests.
7683 ****************************************************************************/
7684
7685 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7686 bool large_file_format)
7687 {
7688 uint64_t count = 0;
7689
7690 if(!large_file_format) {
7691 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7692 } else {
7693 /*
7694 * No BVAL, this is reversed!
7695 */
7696 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7697 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7698 }
7699
7700 return count;
7701 }
7702
7703 /****************************************************************************
7704 Get a lock offset, dealing with large offset requests.
7705 ****************************************************************************/
7706
7707 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7708 bool large_file_format)
7709 {
7710 uint64_t offset = 0;
7711
7712 if(!large_file_format) {
7713 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7714 } else {
7715 /*
7716 * No BVAL, this is reversed!
7717 */
7718 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7719 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7720 }
7721
7722 return offset;
7723 }
7724
7725 NTSTATUS smbd_do_locking(struct smb_request *req,
7726 files_struct *fsp,
7727 uint8_t type,
7728 int32_t timeout,
7729 uint16_t num_locks,
7730 struct smbd_lock_element *locks,
7731 bool *async)
7732 {
7733 connection_struct *conn = req->conn;
7734 int i;
7735 NTSTATUS status = NT_STATUS_OK;
7736
7737 *async = false;
7738
7739 /* Setup the timeout in seconds. */
7740
7741 if (!lp_blocking_locks(SNUM(conn))) {
7742 timeout = 0;
7743 }
7744
7745 for(i = 0; i < (int)num_locks; i++) {
7746 struct smbd_lock_element *e = &locks[i];
7747
7748 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7749 "%llu, file %s timeout = %d\n",
7750 (double)e->offset,
7751 (double)e->count,
7752 (unsigned long long)e->smblctx,
7753 fsp_str_dbg(fsp),
7754 (int)timeout));
7755
7756 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7757 struct blocking_lock_record *blr = NULL;
7758
7759 if (num_locks > 1) {
7760 /*
7761 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7762 * if the lock vector contains one entry. When given multiple cancel
7763 * requests in a single PDU we expect the server to return an
7764 * error. Windows servers seem to accept the request but only
7765 * cancel the first lock.
7766 * JRA - Do what Windows does (tm) :-).
7767 */
7768
7769 #if 0
7770 /* MS-CIFS (2.2.4.32.1) behavior. */
7771 return NT_STATUS_DOS(ERRDOS,
7772 ERRcancelviolation);
7773 #else
7774 /* Windows behavior. */
7775 if (i != 0) {
7776 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7777 "cancel request\n"));
7778 continue;
7779 }
7780 #endif
7781 }
7782
7783 if (lp_blocking_locks(SNUM(conn))) {
7784
7785 /* Schedule a message to ourselves to
7786 remove the blocking lock record and
7787 return the right error. */
7788
7789 blr = blocking_lock_cancel_smb1(fsp,
7790 e->smblctx,
7791 e->offset,
7792 e->count,
7793 WINDOWS_LOCK,
7794 type,
7795 NT_STATUS_FILE_LOCK_CONFLICT);
7796 if (blr == NULL) {
7797 return NT_STATUS_DOS(
7798 ERRDOS,
7799 ERRcancelviolation);
7800 }
7801 }
7802 /* Remove a matching pending lock. */
7803 status = do_lock_cancel(fsp,
7804 e->smblctx,
7805 e->count,
7806 e->offset,
7807 WINDOWS_LOCK);
7808 } else {
7809 bool blocking_lock = timeout ? true : false;
7810 bool defer_lock = false;
7811 struct byte_range_lock *br_lck;
7812 uint64_t block_smblctx;
7813
7814 br_lck = do_lock(req->sconn->msg_ctx,
7815 fsp,
7816 e->smblctx,
7817 e->count,
7818 e->offset,
7819 e->brltype,
7820 WINDOWS_LOCK,
7821 blocking_lock,
7822 &status,
7823 &block_smblctx);
7824
7825 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7826 /* Windows internal resolution for blocking locks seems
7827 to be about 200ms... Don't wait for less than that. JRA. */
7828 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7829 timeout = lp_lock_spin_time();
7830 }
7831 defer_lock = true;
7832 }
7833
7834 /* If a lock sent with timeout of zero would fail, and
7835 * this lock has been requested multiple times,
7836 * according to brl_lock_failed() we convert this
7837 * request to a blocking lock with a timeout of between
7838 * 150 - 300 milliseconds.
7839 *
7840 * If lp_lock_spin_time() has been set to 0, we skip
7841 * this blocking retry and fail immediately.
7842 *
7843 * Replacement for do_lock_spin(). JRA. */
7844
7845 if (!req->sconn->using_smb2 &&
7846 br_lck && lp_blocking_locks(SNUM(conn)) &&
7847 lp_lock_spin_time() && !blocking_lock &&
7848 NT_STATUS_EQUAL((status),
7849 NT_STATUS_FILE_LOCK_CONFLICT))
7850 {
7851 defer_lock = true;
7852 timeout = lp_lock_spin_time();
7853 }
7854
7855 if (br_lck && defer_lock) {
7856 /*
7857 * A blocking lock was requested. Package up
7858 * this smb into a queued request and push it
7859 * onto the blocking lock queue.
7860 */
7861 if(push_blocking_lock_request(br_lck,
7862 req,
7863 fsp,
7864 timeout,
7865 i,
7866 e->smblctx,
7867 e->brltype,
7868 WINDOWS_LOCK,
7869 e->offset,
7870 e->count,
7871 block_smblctx)) {
7872 TALLOC_FREE(br_lck);
7873 *async = true;
7874 return NT_STATUS_OK;
7875 }
7876 }
7877
7878 TALLOC_FREE(br_lck);
7879 }
7880
7881 if (!NT_STATUS_IS_OK(status)) {
7882 break;
7883 }
7884 }
7885
7886 /* If any of the above locks failed, then we must unlock
7887 all of the previous locks (X/Open spec). */
7888
7889 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7890
7891 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7892 i = -1; /* we want to skip the for loop */
7893 }
7894
7895 /*
7896 * Ensure we don't do a remove on the lock that just failed,
7897 * as under POSIX rules, if we have a lock already there, we
7898 * will delete it (and we shouldn't) .....
7899 */
7900 for(i--; i >= 0; i--) {
7901 struct smbd_lock_element *e = &locks[i];
7902
7903 do_unlock(req->sconn->msg_ctx,
7904 fsp,
7905 e->smblctx,
7906 e->count,
7907 e->offset,
7908 WINDOWS_LOCK);
7909 }
7910 return status;
7911 }
7912
7913 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
7914 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
7915
7916 return NT_STATUS_OK;
7917 }
7918
7919 NTSTATUS smbd_do_unlocking(struct smb_request *req,
7920 files_struct *fsp,
7921 uint16_t num_ulocks,
7922 struct smbd_lock_element *ulocks)
7923 {
7924 int i;
7925
7926 for(i = 0; i < (int)num_ulocks; i++) {
7927 struct smbd_lock_element *e = &ulocks[i];
7928 NTSTATUS status;
7929
7930 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
7931 "pid %u, file %s\n", __func__,
7932 (double)e->offset,
7933 (double)e->count,
7934 (unsigned int)e->smblctx,
7935 fsp_str_dbg(fsp)));
7936
7937 if (e->brltype != UNLOCK_LOCK) {
7938 /* this can only happen with SMB2 */
7939 return NT_STATUS_INVALID_PARAMETER;
7940 }
7941
7942 status = do_unlock(req->sconn->msg_ctx,
7943 fsp,
7944 e->smblctx,
7945 e->count,
7946 e->offset,
7947 WINDOWS_LOCK);
7948
7949 DEBUG(10, ("%s: unlock returned %s\n", __func__,
7950 nt_errstr(status)));
7951
7952 if (!NT_STATUS_IS_OK(status)) {
7953 return status;
7954 }
7955 }
7956
7957 DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
7958 num_ulocks));
7959
7960 return NT_STATUS_OK;
7961 }
7962
7963 /****************************************************************************
7964 Reply to a lockingX request.
7965 ****************************************************************************/
7966
7967 void reply_lockingX(struct smb_request *req)
7968 {
7969 connection_struct *conn = req->conn;
7970 files_struct *fsp;
7971 unsigned char locktype;
7972 unsigned char oplocklevel;
7973 uint16 num_ulocks;
7974 uint16 num_locks;
7975 int32 lock_timeout;
7976 int i;
7977 const uint8_t *data;
7978 bool large_file_format;
7979 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7980 struct smbd_lock_element *ulocks;
7981 struct smbd_lock_element *locks;
7982 bool async = false;
7983
7984 START_PROFILE(SMBlockingX);
7985
7986 if (req->wct < 8) {
7987 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7988 END_PROFILE(SMBlockingX);
7989 return;
7990 }
7991
7992 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7993 locktype = CVAL(req->vwv+3, 0);
7994 oplocklevel = CVAL(req->vwv+3, 1);
7995 num_ulocks = SVAL(req->vwv+6, 0);
7996 num_locks = SVAL(req->vwv+7, 0);
7997 lock_timeout = IVAL(req->vwv+4, 0);
7998 large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
7999
8000 if (!check_fsp(conn, req, fsp)) {
8001 END_PROFILE(SMBlockingX);
8002 return;
8003 }
8004
8005 data = req->buf;
8006
8007 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
8008 /* we don't support these - and CANCEL_LOCK makes w2k
8009 and XP reboot so I don't really want to be
8010 compatible! (tridge) */
8011 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
8012 END_PROFILE(SMBlockingX);
8013 return;
8014 }
8015
8016 /* Check if this is an oplock break on a file
8017 we have granted an oplock on.
8018 */
8019 if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
8020 /* Client can insist on breaking to none. */
8021 bool break_to_none = (oplocklevel == 0);
8022 bool result;
8023
8024 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
8025 "for %s\n", (unsigned int)oplocklevel,
8026 fsp_fnum_dbg(fsp)));
8027
8028 /*
8029 * Make sure we have granted an exclusive or batch oplock on
8030 * this file.
8031 */
8032
8033 if (fsp->oplock_type == 0) {
8034
8035 /* The Samba4 nbench simulator doesn't understand
8036 the difference between break to level2 and break
8037 to none from level2 - it sends oplock break
8038 replies in both cases. Don't keep logging an error
8039 message here - just ignore it. JRA. */
8040
8041 DEBUG(5,("reply_lockingX: Error : oplock break from "
8042 "client for %s (oplock=%d) and no "
8043 "oplock granted on this file (%s).\n",
8044 fsp_fnum_dbg(fsp), fsp->oplock_type,
8045 fsp_str_dbg(fsp)));
8046
8047 /* if this is a pure oplock break request then don't
8048 * send a reply */
8049 if (num_locks == 0 && num_ulocks == 0) {
8050 END_PROFILE(SMBlockingX);
8051 return;
8052 } else {
8053 END_PROFILE(SMBlockingX);
8054 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8055 return;
8056 }
8057 }
8058
8059 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8060 (break_to_none)) {
8061 result = remove_oplock(fsp);
8062 } else {
8063 result = downgrade_oplock(fsp);
8064 }
8065
8066 if (!result) {
8067 DEBUG(0, ("reply_lockingX: error in removing "
8068 "oplock on file %s\n", fsp_str_dbg(fsp)));
8069 /* Hmmm. Is this panic justified? */
8070 smb_panic("internal tdb error");
8071 }
8072
8073 /* if this is a pure oplock break request then don't send a
8074 * reply */
8075 if (num_locks == 0 && num_ulocks == 0) {
8076 /* Sanity check - ensure a pure oplock break is not a
8077 chained request. */
8078 if (CVAL(req->vwv+0, 0) != 0xff) {
8079 DEBUG(0,("reply_lockingX: Error : pure oplock "
8080 "break is a chained %d request !\n",
8081 (unsigned int)CVAL(req->vwv+0, 0)));
8082 }
8083 END_PROFILE(SMBlockingX);
8084 return;
8085 }
8086 }
8087
8088 if (req->buflen <
8089 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8090 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8091 END_PROFILE(SMBlockingX);
8092 return;
8093 }
8094
8095 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8096 if (ulocks == NULL) {
8097 reply_nterror(req, NT_STATUS_NO_MEMORY);
8098 END_PROFILE(SMBlockingX);
8099 return;
8100 }
8101
8102 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8103 if (locks == NULL) {
8104 reply_nterror(req, NT_STATUS_NO_MEMORY);
8105 END_PROFILE(SMBlockingX);
8106 return;
8107 }
8108
8109 /* Data now points at the beginning of the list
8110 of smb_unlkrng structs */
8111 for(i = 0; i < (int)num_ulocks; i++) {
8112 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8113 ulocks[i].count = get_lock_count(data, i, large_file_format);
8114 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8115 ulocks[i].brltype = UNLOCK_LOCK;
8116 }
8117
8118 /* Now do any requested locks */
8119 data += ((large_file_format ? 20 : 10)*num_ulocks);
8120
8121 /* Data now points at the beginning of the list
8122 of smb_lkrng structs */
8123
8124 for(i = 0; i < (int)num_locks; i++) {
8125 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8126 locks[i].count = get_lock_count(data, i, large_file_format);
8127 locks[i].offset = get_lock_offset(data, i, large_file_format);
8128
8129 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8130 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8131 locks[i].brltype = PENDING_READ_LOCK;
8132 } else {
8133 locks[i].brltype = READ_LOCK;
8134 }
8135 } else {
8136 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8137 locks[i].brltype = PENDING_WRITE_LOCK;
8138 } else {
8139 locks[i].brltype = WRITE_LOCK;
8140 }
8141 }
8142 }
8143
8144 status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8145 if (!NT_STATUS_IS_OK(status)) {
8146 END_PROFILE(SMBlockingX);
8147 reply_nterror(req, status);
8148 return;
8149 }
8150
8151 status = smbd_do_locking(req, fsp,
8152 locktype, lock_timeout,
8153 num_locks, locks,
8154 &async);
8155 if (!NT_STATUS_IS_OK(status)) {
8156 END_PROFILE(SMBlockingX);
8157 reply_nterror(req, status);
8158 return;
8159 }
8160 if (async) {
8161 END_PROFILE(SMBlockingX);
8162 return;
8163 }
8164
8165 reply_outbuf(req, 2, 0);
8166 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8167 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8168
8169 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8170 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8171
8172 END_PROFILE(SMBlockingX);
8173 }
8174
8175 #undef DBGC_CLASS
8176 #define DBGC_CLASS DBGC_ALL
8177
8178 /****************************************************************************
8179 Reply to a SMBreadbmpx (read block multiplex) request.
8180 Always reply with an error, if someone has a platform really needs this,
8181 please contact vl@samba.org
8182 ****************************************************************************/
8183
8184 void reply_readbmpx(struct smb_request *req)
8185 {
8186 START_PROFILE(SMBreadBmpx);
8187 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8188 END_PROFILE(SMBreadBmpx);
8189 return;
8190 }
8191
8192 /****************************************************************************
8193 Reply to a SMBreadbs (read block multiplex secondary) request.
8194 Always reply with an error, if someone has a platform really needs this,
8195 please contact vl@samba.org
8196 ****************************************************************************/
8197
8198 void reply_readbs(struct smb_request *req)
8199 {
8200 START_PROFILE(SMBreadBs);
8201 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8202 END_PROFILE(SMBreadBs);
8203 return;
8204 }
8205
8206 /****************************************************************************
8207 Reply to a SMBsetattrE.
8208 ****************************************************************************/
8209
8210 void reply_setattrE(struct smb_request *req)
8211 {
8212 connection_struct *conn = req->conn;
8213 struct smb_file_time ft;
8214 files_struct *fsp;
8215 NTSTATUS status;
8216
8217 START_PROFILE(SMBsetattrE);
8218 ZERO_STRUCT(ft);
8219
8220 if (req->wct < 7) {
8221 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8222 goto out;
8223 }
8224
8225 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8226
8227 if(!fsp || (fsp->conn != conn)) {
8228 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8229 goto out;
8230 }
8231
8232 /*
8233 * Convert the DOS times into unix times.
8234 */
8235
8236 ft.atime = convert_time_t_to_timespec(
8237 srv_make_unix_date2(req->vwv+3));
8238 ft.mtime = convert_time_t_to_timespec(
8239 srv_make_unix_date2(req->vwv+5));
8240 ft.create_time = convert_time_t_to_timespec(
8241 srv_make_unix_date2(req->vwv+1));
8242
8243 reply_outbuf(req, 0, 0);
8244
8245 /*
8246 * Patch from Ray Frush <frush@engr.colostate.edu>
8247 * Sometimes times are sent as zero - ignore them.
8248 */
8249
8250 /* Ensure we have a valid stat struct for the source. */
8251 status = vfs_stat_fsp(fsp);
8252 if (!NT_STATUS_IS_OK(status)) {
8253 reply_nterror(req, status);
8254 goto out;
8255 }
8256
8257 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8258 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8259 goto out;
8260 }
8261
8262 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8263 if (!NT_STATUS_IS_OK(status)) {
8264 reply_nterror(req, status);
8265 goto out;
8266 }
8267
8268 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8269 " createtime=%u\n",
8270 fsp_fnum_dbg(fsp),
8271 (unsigned int)ft.atime.tv_sec,
8272 (unsigned int)ft.mtime.tv_sec,
8273 (unsigned int)ft.create_time.tv_sec
8274 ));
8275 out:
8276 END_PROFILE(SMBsetattrE);
8277 return;
8278 }
8279
8280
8281 /* Back from the dead for OS/2..... JRA. */
8282
8283 /****************************************************************************
8284 Reply to a SMBwritebmpx (write block multiplex primary) request.
8285 Always reply with an error, if someone has a platform really needs this,
8286 please contact vl@samba.org
8287 ****************************************************************************/
8288
8289 void reply_writebmpx(struct smb_request *req)
8290 {
8291 START_PROFILE(SMBwriteBmpx);
8292 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8293 END_PROFILE(SMBwriteBmpx);
8294 return;
8295 }
8296
8297 /****************************************************************************
8298 Reply to a SMBwritebs (write block multiplex secondary) request.
8299 Always reply with an error, if someone has a platform really needs this,
8300 please contact vl@samba.org
8301 ****************************************************************************/
8302
8303 void reply_writebs(struct smb_request *req)
8304 {
8305 START_PROFILE(SMBwriteBs);
8306 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8307 END_PROFILE(SMBwriteBs);
8308 return;
8309 }
8310
8311 /****************************************************************************
8312 Reply to a SMBgetattrE.
8313 ****************************************************************************/
8314
8315 void reply_getattrE(struct smb_request *req)
8316 {
8317 connection_struct *conn = req->conn;
8318 int mode;
8319 files_struct *fsp;
8320 struct timespec create_ts;
8321
8322 START_PROFILE(SMBgetattrE);
8323
8324 if (req->wct < 1) {
8325 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8326 END_PROFILE(SMBgetattrE);
8327 return;
8328 }
8329
8330 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8331
8332 if(!fsp || (fsp->conn != conn)) {
8333 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8334 END_PROFILE(SMBgetattrE);
8335 return;
8336 }
8337
8338 /* Do an fstat on this file */
8339 if(fsp_stat(fsp)) {
8340 reply_nterror(req, map_nt_error_from_unix(errno));
8341 END_PROFILE(SMBgetattrE);
8342 return;
8343 }
8344
8345 mode = dos_mode(conn, fsp->fsp_name);
8346
8347 /*
8348 * Convert the times into dos times. Set create
8349 * date to be last modify date as UNIX doesn't save
8350 * this.
8351 */
8352
8353 reply_outbuf(req, 11, 0);
8354
8355 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8356 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8357 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8358 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8359 /* Should we check pending modtime here ? JRA */
8360 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8361 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8362
8363 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8364 SIVAL(req->outbuf, smb_vwv6, 0);
8365 SIVAL(req->outbuf, smb_vwv8, 0);
8366 } else {
8367 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8368 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8369 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8370 }
8371 SSVAL(req->outbuf,smb_vwv10, mode);
8372
8373 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8374
8375 END_PROFILE(SMBgetattrE);
8376 return;
8377 }
Samba GIT mirror