?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
messaging_dgm: Receive through a cb function
[Samba.git] / source3 / smbd / reply.c
blob4cb446fb23e6aa24418018ccdaadd530ffff9d12
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const uint8_t *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
432 const char *name, int name_type)
433 {
434 struct smbd_server_connection *sconn = xconn->sconn;
435 char *trim_name;
436 char *trim_name_type;
437 const char *retarget_parm;
438 char *retarget;
439 char *p;
440 int retarget_type = 0x20;
441 int retarget_port = NBT_SMB_PORT;
442 struct sockaddr_storage retarget_addr;
443 struct sockaddr_in *in_addr;
444 bool ret = false;
445 uint8_t outbuf[10];
446
447 if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
448 return false;
449 }
450
451 trim_name = talloc_strdup(talloc_tos(), name);
452 if (trim_name == NULL) {
453 goto fail;
454 }
455 trim_char(trim_name, ' ', ' ');
456
457 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
458 name_type);
459 if (trim_name_type == NULL) {
460 goto fail;
461 }
462
463 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
464 trim_name_type, NULL);
465 if (retarget_parm == NULL) {
466 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
467 trim_name, NULL);
468 }
469 if (retarget_parm == NULL) {
470 goto fail;
471 }
472
473 retarget = talloc_strdup(trim_name, retarget_parm);
474 if (retarget == NULL) {
475 goto fail;
476 }
477
478 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
479
480 p = strchr(retarget, ':');
481 if (p != NULL) {
482 *p++ = '\0';
483 retarget_port = atoi(p);
484 }
485
486 p = strchr_m(retarget, '#');
487 if (p != NULL) {
488 *p++ = '\0';
489 if (sscanf(p, "%x", &retarget_type) != 1) {
490 goto fail;
491 }
492 }
493
494 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
495 if (!ret) {
496 DEBUG(10, ("could not resolve %s\n", retarget));
497 goto fail;
498 }
499
500 if (retarget_addr.ss_family != AF_INET) {
501 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
502 goto fail;
503 }
504
505 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
506
507 _smb_setlen(outbuf, 6);
508 SCVAL(outbuf, 0, 0x84);
509 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
510 *(uint16_t *)(outbuf+8) = htons(retarget_port);
511
512 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
513 NULL)) {
514 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
515 "failed.");
516 }
517
518 ret = true;
519 fail:
520 TALLOC_FREE(trim_name);
521 return ret;
522 }
523
524 static void reply_called_name_not_present(char *outbuf)
525 {
526 smb_setlen(outbuf, 1);
527 SCVAL(outbuf, 0, 0x83);
528 SCVAL(outbuf, 4, 0x82);
529 }
530
531 /****************************************************************************
532 Reply to a (netbios-level) special message.
533 ****************************************************************************/
534
535 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
536 {
537 struct smbd_server_connection *sconn = xconn->sconn;
538 int msg_type = CVAL(inbuf,0);
539 int msg_flags = CVAL(inbuf,1);
540 /*
541 * We only really use 4 bytes of the outbuf, but for the smb_setlen
542 * calculation & friends (srv_send_smb uses that) we need the full smb
543 * header.
544 */
545 char outbuf[smb_size];
546
547 memset(outbuf, '\0', sizeof(outbuf));
548
549 smb_setlen(outbuf,0);
550
551 switch (msg_type) {
552 case NBSSrequest: /* session request */
553 {
554 /* inbuf_size is guarenteed to be at least 4. */
555 fstring name1,name2;
556 int name_type1, name_type2;
557 int name_len1, name_len2;
558
559 *name1 = *name2 = 0;
560
561 if (xconn->transport.nbt.got_session) {
562 exit_server_cleanly("multiple session request not permitted");
563 }
564
565 SCVAL(outbuf,0,NBSSpositive);
566 SCVAL(outbuf,3,0);
567
568 /* inbuf_size is guaranteed to be at least 4. */
569 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
570 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
571 DEBUG(0,("Invalid name length in session request\n"));
572 reply_called_name_not_present(outbuf);
573 break;
574 }
575 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
576 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
577 DEBUG(0,("Invalid name length in session request\n"));
578 reply_called_name_not_present(outbuf);
579 break;
580 }
581
582 name_type1 = name_extract((unsigned char *)inbuf,
583 inbuf_size,(unsigned int)4,name1);
584 name_type2 = name_extract((unsigned char *)inbuf,
585 inbuf_size,(unsigned int)(4 + name_len1),name2);
586
587 if (name_type1 == -1 || name_type2 == -1) {
588 DEBUG(0,("Invalid name type in session request\n"));
589 reply_called_name_not_present(outbuf);
590 break;
591 }
592
593 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
594 name1, name_type1, name2, name_type2));
595
596 if (netbios_session_retarget(xconn, name1, name_type1)) {
597 exit_server_cleanly("retargeted client");
598 }
599
600 /*
601 * Windows NT/2k uses "*SMBSERVER" and XP uses
602 * "*SMBSERV" arrggg!!!
603 */
604 if (strequal(name1, "*SMBSERVER ")
605 || strequal(name1, "*SMBSERV ")) {
606 char *raddr;
607
608 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
609 talloc_tos());
610 if (raddr == NULL) {
611 exit_server_cleanly("could not allocate raddr");
612 }
613
614 fstrcpy(name1, raddr);
615 }
616
617 set_local_machine_name(name1, True);
618 set_remote_machine_name(name2, True);
619
620 if (is_ipaddress(sconn->remote_hostname)) {
621 char *p = discard_const_p(char, sconn->remote_hostname);
622
623 talloc_free(p);
624
625 sconn->remote_hostname = talloc_strdup(sconn,
626 get_remote_machine_name());
627 if (sconn->remote_hostname == NULL) {
628 exit_server_cleanly("could not copy remote name");
629 }
630 xconn->remote_hostname = sconn->remote_hostname;
631 }
632
633 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
634 get_local_machine_name(), get_remote_machine_name(),
635 name_type2));
636
637 if (name_type2 == 'R') {
638 /* We are being asked for a pathworks session ---
639 no thanks! */
640 reply_called_name_not_present(outbuf);
641 break;
642 }
643
644 reload_services(sconn, conn_snum_used, true);
645 reopen_logs();
646
647 xconn->transport.nbt.got_session = true;
648 break;
649 }
650
651 case 0x89: /* session keepalive request
652 (some old clients produce this?) */
653 SCVAL(outbuf,0,NBSSkeepalive);
654 SCVAL(outbuf,3,0);
655 break;
656
657 case NBSSpositive: /* positive session response */
658 case NBSSnegative: /* negative session response */
659 case NBSSretarget: /* retarget session response */
660 DEBUG(0,("Unexpected session response\n"));
661 break;
662
663 case NBSSkeepalive: /* session keepalive */
664 default:
665 return;
666 }
667
668 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
669 msg_type, msg_flags));
670
671 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
672
673 if (CVAL(outbuf, 0) != 0x82) {
674 exit_server_cleanly("invalid netbios session");
675 }
676 return;
677 }
678
679 /****************************************************************************
680 Reply to a tcon.
681 conn POINTER CAN BE NULL HERE !
682 ****************************************************************************/
683
684 void reply_tcon(struct smb_request *req)
685 {
686 connection_struct *conn = req->conn;
687 const char *service;
688 char *service_buf = NULL;
689 char *password = NULL;
690 char *dev = NULL;
691 int pwlen=0;
692 NTSTATUS nt_status;
693 const uint8_t *p;
694 const char *p2;
695 TALLOC_CTX *ctx = talloc_tos();
696 struct smbXsrv_connection *xconn = req->xconn;
697 struct smbd_server_connection *sconn = xconn->sconn;
698 NTTIME now = timeval_to_nttime(&req->request_time);
699
700 START_PROFILE(SMBtcon);
701
702 if (req->buflen < 4) {
703 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
704 END_PROFILE(SMBtcon);
705 return;
706 }
707
708 p = req->buf + 1;
709 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
710 p += 1;
711 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
712 p += pwlen+1;
713 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
714 p += 1;
715
716 if (service_buf == NULL || password == NULL || dev == NULL) {
717 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
718 END_PROFILE(SMBtcon);
719 return;
720 }
721 p2 = strrchr_m(service_buf,'\\');
722 if (p2) {
723 service = p2+1;
724 } else {
725 service = service_buf;
726 }
727
728 conn = make_connection(sconn, now, service, dev,
729 req->vuid,&nt_status);
730 req->conn = conn;
731
732 if (!conn) {
733 reply_nterror(req, nt_status);
734 END_PROFILE(SMBtcon);
735 return;
736 }
737
738 reply_outbuf(req, 2, 0);
739 SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
740 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
741 SSVAL(req->outbuf,smb_tid,conn->cnum);
742
743 DEBUG(3,("tcon service=%s cnum=%d\n",
744 service, conn->cnum));
745
746 END_PROFILE(SMBtcon);
747 return;
748 }
749
750 /****************************************************************************
751 Reply to a tcon and X.
752 conn POINTER CAN BE NULL HERE !
753 ****************************************************************************/
754
755 void reply_tcon_and_X(struct smb_request *req)
756 {
757 connection_struct *conn = req->conn;
758 const char *service = NULL;
759 TALLOC_CTX *ctx = talloc_tos();
760 /* what the cleint thinks the device is */
761 char *client_devicetype = NULL;
762 /* what the server tells the client the share represents */
763 const char *server_devicetype;
764 NTSTATUS nt_status;
765 int passlen;
766 char *path = NULL;
767 const uint8_t *p;
768 const char *q;
769 uint16_t tcon_flags;
770 struct smbXsrv_session *session = NULL;
771 NTTIME now = timeval_to_nttime(&req->request_time);
772 bool session_key_updated = false;
773 uint16_t optional_support = 0;
774 struct smbXsrv_connection *xconn = req->xconn;
775 struct smbd_server_connection *sconn = xconn->sconn;
776
777 START_PROFILE(SMBtconX);
778
779 if (req->wct < 4) {
780 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
781 END_PROFILE(SMBtconX);
782 return;
783 }
784
785 passlen = SVAL(req->vwv+3, 0);
786 tcon_flags = SVAL(req->vwv+2, 0);
787
788 /* we might have to close an old one */
789 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
790 struct smbXsrv_tcon *tcon;
791 NTSTATUS status;
792
793 tcon = conn->tcon;
794 req->conn = NULL;
795 conn = NULL;
796
797 /*
798 * TODO: cancel all outstanding requests on the tcon
799 */
800 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
801 if (!NT_STATUS_IS_OK(status)) {
802 DEBUG(0, ("reply_tcon_and_X: "
803 "smbXsrv_tcon_disconnect() failed: %s\n",
804 nt_errstr(status)));
805 /*
806 * If we hit this case, there is something completely
807 * wrong, so we better disconnect the transport connection.
808 */
809 END_PROFILE(SMBtconX);
810 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
811 return;
812 }
813
814 TALLOC_FREE(tcon);
815 }
816
817 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
818 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
819 END_PROFILE(SMBtconX);
820 return;
821 }
822
823 if (xconn->smb1.negprot.encrypted_passwords) {
824 p = req->buf + passlen;
825 } else {
826 p = req->buf + passlen + 1;
827 }
828
829 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
830
831 if (path == NULL) {
832 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
833 END_PROFILE(SMBtconX);
834 return;
835 }
836
837 /*
838 * the service name can be either: \\server\share
839 * or share directly like on the DELL PowerVault 705
840 */
841 if (*path=='\\') {
842 q = strchr_m(path+2,'\\');
843 if (!q) {
844 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
845 END_PROFILE(SMBtconX);
846 return;
847 }
848 service = q+1;
849 } else {
850 service = path;
851 }
852
853 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
854 &client_devicetype, p,
855 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
856
857 if (client_devicetype == NULL) {
858 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
859 END_PROFILE(SMBtconX);
860 return;
861 }
862
863 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
864
865 nt_status = smb1srv_session_lookup(xconn,
866 req->vuid, now, &session);
867 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
868 reply_force_doserror(req, ERRSRV, ERRbaduid);
869 END_PROFILE(SMBtconX);
870 return;
871 }
872 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
873 reply_nterror(req, nt_status);
874 END_PROFILE(SMBtconX);
875 return;
876 }
877 if (!NT_STATUS_IS_OK(nt_status)) {
878 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
879 END_PROFILE(SMBtconX);
880 return;
881 }
882
883 if (session->global->auth_session_info == NULL) {
884 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
885 END_PROFILE(SMBtconX);
886 return;
887 }
888
889 /*
890 * If there is no application key defined yet
891 * we create one.
892 *
893 * This means we setup the application key on the
894 * first tcon that happens via the given session.
895 *
896 * Once the application key is defined, it does not
897 * change any more.
898 */
899 if (session->global->application_key.length == 0 &&
900 session->global->signing_key.length > 0)
901 {
902 struct smbXsrv_session *x = session;
903 struct auth_session_info *session_info =
904 session->global->auth_session_info;
905 uint8_t session_key[16];
906
907 ZERO_STRUCT(session_key);
908 memcpy(session_key, x->global->signing_key.data,
909 MIN(x->global->signing_key.length, sizeof(session_key)));
910
911 /*
912 * The application key is truncated/padded to 16 bytes
913 */
914 x->global->application_key = data_blob_talloc(x->global,
915 session_key,
916 sizeof(session_key));
917 ZERO_STRUCT(session_key);
918 if (x->global->application_key.data == NULL) {
919 reply_nterror(req, NT_STATUS_NO_MEMORY);
920 END_PROFILE(SMBtconX);
921 return;
922 }
923
924 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
925 smb_key_derivation(x->global->application_key.data,
926 x->global->application_key.length,
927 x->global->application_key.data);
928 optional_support |= SMB_EXTENDED_SIGNATURES;
929 }
930
931 /*
932 * Place the application key into the session_info
933 */
934 data_blob_clear_free(&session_info->session_key);
935 session_info->session_key = data_blob_dup_talloc(session_info,
936 x->global->application_key);
937 if (session_info->session_key.data == NULL) {
938 data_blob_clear_free(&x->global->application_key);
939 reply_nterror(req, NT_STATUS_NO_MEMORY);
940 END_PROFILE(SMBtconX);
941 return;
942 }
943 session_key_updated = true;
944 }
945
946 conn = make_connection(sconn, now, service, client_devicetype,
947 req->vuid, &nt_status);
948 req->conn =conn;
949
950 if (!conn) {
951 if (session_key_updated) {
952 struct smbXsrv_session *x = session;
953 struct auth_session_info *session_info =
954 session->global->auth_session_info;
955 data_blob_clear_free(&x->global->application_key);
956 data_blob_clear_free(&session_info->session_key);
957 }
958 reply_nterror(req, nt_status);
959 END_PROFILE(SMBtconX);
960 return;
961 }
962
963 if ( IS_IPC(conn) )
964 server_devicetype = "IPC";
965 else if ( IS_PRINT(conn) )
966 server_devicetype = "LPT1:";
967 else
968 server_devicetype = "A:";
969
970 if (get_Protocol() < PROTOCOL_NT1) {
971 reply_outbuf(req, 2, 0);
972 if (message_push_string(&req->outbuf, server_devicetype,
973 STR_TERMINATE|STR_ASCII) == -1) {
974 reply_nterror(req, NT_STATUS_NO_MEMORY);
975 END_PROFILE(SMBtconX);
976 return;
977 }
978 } else {
979 /* NT sets the fstype of IPC$ to the null string */
980 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
981
982 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
983 /* Return permissions. */
984 uint32 perm1 = 0;
985 uint32 perm2 = 0;
986
987 reply_outbuf(req, 7, 0);
988
989 if (IS_IPC(conn)) {
990 perm1 = FILE_ALL_ACCESS;
991 perm2 = FILE_ALL_ACCESS;
992 } else {
993 perm1 = conn->share_access;
994 }
995
996 SIVAL(req->outbuf, smb_vwv3, perm1);
997 SIVAL(req->outbuf, smb_vwv5, perm2);
998 } else {
999 reply_outbuf(req, 3, 0);
1000 }
1001
1002 if ((message_push_string(&req->outbuf, server_devicetype,
1003 STR_TERMINATE|STR_ASCII) == -1)
1004 || (message_push_string(&req->outbuf, fstype,
1005 STR_TERMINATE) == -1)) {
1006 reply_nterror(req, NT_STATUS_NO_MEMORY);
1007 END_PROFILE(SMBtconX);
1008 return;
1009 }
1010
1011 /* what does setting this bit do? It is set by NT4 and
1012 may affect the ability to autorun mounted cdroms */
1013 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1014 optional_support |=
1015 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1016
1017 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1018 DEBUG(2,("Serving %s as a Dfs root\n",
1019 lp_servicename(ctx, SNUM(conn)) ));
1020 optional_support |= SMB_SHARE_IN_DFS;
1021 }
1022
1023 SSVAL(req->outbuf, smb_vwv2, optional_support);
1024 }
1025
1026 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1027 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1028
1029 DEBUG(3,("tconX service=%s \n",
1030 service));
1031
1032 /* set the incoming and outgoing tid to the just created one */
1033 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1034 SSVAL(req->outbuf,smb_tid,conn->cnum);
1035
1036 END_PROFILE(SMBtconX);
1037
1038 req->tid = conn->cnum;
1039 }
1040
1041 /****************************************************************************
1042 Reply to an unknown type.
1043 ****************************************************************************/
1044
1045 void reply_unknown_new(struct smb_request *req, uint8 type)
1046 {
1047 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1048 smb_fn_name(type), type, type));
1049 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1050 return;
1051 }
1052
1053 /****************************************************************************
1054 Reply to an ioctl.
1055 conn POINTER CAN BE NULL HERE !
1056 ****************************************************************************/
1057
1058 void reply_ioctl(struct smb_request *req)
1059 {
1060 connection_struct *conn = req->conn;
1061 uint16 device;
1062 uint16 function;
1063 uint32 ioctl_code;
1064 int replysize;
1065 char *p;
1066
1067 START_PROFILE(SMBioctl);
1068
1069 if (req->wct < 3) {
1070 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1071 END_PROFILE(SMBioctl);
1072 return;
1073 }
1074
1075 device = SVAL(req->vwv+1, 0);
1076 function = SVAL(req->vwv+2, 0);
1077 ioctl_code = (device << 16) + function;
1078
1079 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1080
1081 switch (ioctl_code) {
1082 case IOCTL_QUERY_JOB_INFO:
1083 replysize = 32;
1084 break;
1085 default:
1086 reply_force_doserror(req, ERRSRV, ERRnosupport);
1087 END_PROFILE(SMBioctl);
1088 return;
1089 }
1090
1091 reply_outbuf(req, 8, replysize+1);
1092 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1093 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1094 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1095 p = smb_buf(req->outbuf);
1096 memset(p, '\0', replysize+1); /* valgrind-safe. */
1097 p += 1; /* Allow for alignment */
1098
1099 switch (ioctl_code) {
1100 case IOCTL_QUERY_JOB_INFO:
1101 {
1102 files_struct *fsp = file_fsp(
1103 req, SVAL(req->vwv+0, 0));
1104 if (!fsp) {
1105 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1106 END_PROFILE(SMBioctl);
1107 return;
1108 }
1109 /* Job number */
1110 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1111
1112 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1113 lp_netbios_name(), 15,
1114 STR_TERMINATE|STR_ASCII);
1115 if (conn) {
1116 srvstr_push((char *)req->outbuf, req->flags2,
1117 p+18,
1118 lp_servicename(talloc_tos(),
1119 SNUM(conn)),
1120 13, STR_TERMINATE|STR_ASCII);
1121 } else {
1122 memset(p+18, 0, 13);
1123 }
1124 break;
1125 }
1126 }
1127
1128 END_PROFILE(SMBioctl);
1129 return;
1130 }
1131
1132 /****************************************************************************
1133 Strange checkpath NTSTATUS mapping.
1134 ****************************************************************************/
1135
1136 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1137 {
1138 /* Strange DOS error code semantics only for checkpath... */
1139 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1140 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1141 /* We need to map to ERRbadpath */
1142 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1143 }
1144 }
1145 return status;
1146 }
1147
1148 /****************************************************************************
1149 Reply to a checkpath.
1150 ****************************************************************************/
1151
1152 void reply_checkpath(struct smb_request *req)
1153 {
1154 connection_struct *conn = req->conn;
1155 struct smb_filename *smb_fname = NULL;
1156 char *name = NULL;
1157 NTSTATUS status;
1158 TALLOC_CTX *ctx = talloc_tos();
1159
1160 START_PROFILE(SMBcheckpath);
1161
1162 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1163 STR_TERMINATE, &status);
1164
1165 if (!NT_STATUS_IS_OK(status)) {
1166 status = map_checkpath_error(req->flags2, status);
1167 reply_nterror(req, status);
1168 END_PROFILE(SMBcheckpath);
1169 return;
1170 }
1171
1172 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1173
1174 status = filename_convert(ctx,
1175 conn,
1176 req->flags2 & FLAGS2_DFS_PATHNAMES,
1177 name,
1178 0,
1179 NULL,
1180 &smb_fname);
1181
1182 if (!NT_STATUS_IS_OK(status)) {
1183 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1184 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1185 ERRSRV, ERRbadpath);
1186 END_PROFILE(SMBcheckpath);
1187 return;
1188 }
1189 goto path_err;
1190 }
1191
1192 if (!VALID_STAT(smb_fname->st) &&
1193 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1194 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1195 smb_fname_str_dbg(smb_fname), strerror(errno)));
1196 status = map_nt_error_from_unix(errno);
1197 goto path_err;
1198 }
1199
1200 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1201 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1202 ERRDOS, ERRbadpath);
1203 goto out;
1204 }
1205
1206 reply_outbuf(req, 0, 0);
1207
1208 path_err:
1209 /* We special case this - as when a Windows machine
1210 is parsing a path is steps through the components
1211 one at a time - if a component fails it expects
1212 ERRbadpath, not ERRbadfile.
1213 */
1214 status = map_checkpath_error(req->flags2, status);
1215 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1216 /*
1217 * Windows returns different error codes if
1218 * the parent directory is valid but not the
1219 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1220 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1221 * if the path is invalid.
1222 */
1223 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1224 ERRDOS, ERRbadpath);
1225 goto out;
1226 }
1227
1228 reply_nterror(req, status);
1229
1230 out:
1231 TALLOC_FREE(smb_fname);
1232 END_PROFILE(SMBcheckpath);
1233 return;
1234 }
1235
1236 /****************************************************************************
1237 Reply to a getatr.
1238 ****************************************************************************/
1239
1240 void reply_getatr(struct smb_request *req)
1241 {
1242 connection_struct *conn = req->conn;
1243 struct smb_filename *smb_fname = NULL;
1244 char *fname = NULL;
1245 int mode=0;
1246 off_t size=0;
1247 time_t mtime=0;
1248 const char *p;
1249 NTSTATUS status;
1250 TALLOC_CTX *ctx = talloc_tos();
1251 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1252
1253 START_PROFILE(SMBgetatr);
1254
1255 p = (const char *)req->buf + 1;
1256 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1257 if (!NT_STATUS_IS_OK(status)) {
1258 reply_nterror(req, status);
1259 goto out;
1260 }
1261
1262 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1263 under WfWg - weird! */
1264 if (*fname == '\0') {
1265 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1266 if (!CAN_WRITE(conn)) {
1267 mode |= FILE_ATTRIBUTE_READONLY;
1268 }
1269 size = 0;
1270 mtime = 0;
1271 } else {
1272 status = filename_convert(ctx,
1273 conn,
1274 req->flags2 & FLAGS2_DFS_PATHNAMES,
1275 fname,
1276 0,
1277 NULL,
1278 &smb_fname);
1279 if (!NT_STATUS_IS_OK(status)) {
1280 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1281 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1282 ERRSRV, ERRbadpath);
1283 goto out;
1284 }
1285 reply_nterror(req, status);
1286 goto out;
1287 }
1288 if (!VALID_STAT(smb_fname->st) &&
1289 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1290 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1291 smb_fname_str_dbg(smb_fname),
1292 strerror(errno)));
1293 reply_nterror(req, map_nt_error_from_unix(errno));
1294 goto out;
1295 }
1296
1297 mode = dos_mode(conn, smb_fname);
1298 size = smb_fname->st.st_ex_size;
1299
1300 if (ask_sharemode) {
1301 struct timespec write_time_ts;
1302 struct file_id fileid;
1303
1304 ZERO_STRUCT(write_time_ts);
1305 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1306 get_file_infos(fileid, 0, NULL, &write_time_ts);
1307 if (!null_timespec(write_time_ts)) {
1308 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1309 }
1310 }
1311
1312 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1313 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1314 size = 0;
1315 }
1316 }
1317
1318 reply_outbuf(req, 10, 0);
1319
1320 SSVAL(req->outbuf,smb_vwv0,mode);
1321 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1322 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1323 } else {
1324 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1325 }
1326 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1327
1328 if (get_Protocol() >= PROTOCOL_NT1) {
1329 SSVAL(req->outbuf, smb_flg2,
1330 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1331 }
1332
1333 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1334 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1335
1336 out:
1337 TALLOC_FREE(smb_fname);
1338 TALLOC_FREE(fname);
1339 END_PROFILE(SMBgetatr);
1340 return;
1341 }
1342
1343 /****************************************************************************
1344 Reply to a setatr.
1345 ****************************************************************************/
1346
1347 void reply_setatr(struct smb_request *req)
1348 {
1349 struct smb_file_time ft;
1350 connection_struct *conn = req->conn;
1351 struct smb_filename *smb_fname = NULL;
1352 char *fname = NULL;
1353 int mode;
1354 time_t mtime;
1355 const char *p;
1356 NTSTATUS status;
1357 TALLOC_CTX *ctx = talloc_tos();
1358
1359 START_PROFILE(SMBsetatr);
1360
1361 ZERO_STRUCT(ft);
1362
1363 if (req->wct < 2) {
1364 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1365 goto out;
1366 }
1367
1368 p = (const char *)req->buf + 1;
1369 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1370 if (!NT_STATUS_IS_OK(status)) {
1371 reply_nterror(req, status);
1372 goto out;
1373 }
1374
1375 status = filename_convert(ctx,
1376 conn,
1377 req->flags2 & FLAGS2_DFS_PATHNAMES,
1378 fname,
1379 0,
1380 NULL,
1381 &smb_fname);
1382 if (!NT_STATUS_IS_OK(status)) {
1383 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1384 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1385 ERRSRV, ERRbadpath);
1386 goto out;
1387 }
1388 reply_nterror(req, status);
1389 goto out;
1390 }
1391
1392 if (smb_fname->base_name[0] == '.' &&
1393 smb_fname->base_name[1] == '\0') {
1394 /*
1395 * Not sure here is the right place to catch this
1396 * condition. Might be moved to somewhere else later -- vl
1397 */
1398 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1399 goto out;
1400 }
1401
1402 mode = SVAL(req->vwv+0, 0);
1403 mtime = srv_make_unix_date3(req->vwv+1);
1404
1405 if (mode != FILE_ATTRIBUTE_NORMAL) {
1406 if (VALID_STAT_OF_DIR(smb_fname->st))
1407 mode |= FILE_ATTRIBUTE_DIRECTORY;
1408 else
1409 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1410
1411 status = check_access(conn, NULL, smb_fname,
1412 FILE_WRITE_ATTRIBUTES);
1413 if (!NT_STATUS_IS_OK(status)) {
1414 reply_nterror(req, status);
1415 goto out;
1416 }
1417
1418 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1419 false) != 0) {
1420 reply_nterror(req, map_nt_error_from_unix(errno));
1421 goto out;
1422 }
1423 }
1424
1425 ft.mtime = convert_time_t_to_timespec(mtime);
1426 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1427 if (!NT_STATUS_IS_OK(status)) {
1428 reply_nterror(req, status);
1429 goto out;
1430 }
1431
1432 reply_outbuf(req, 0, 0);
1433
1434 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1435 mode));
1436 out:
1437 TALLOC_FREE(smb_fname);
1438 END_PROFILE(SMBsetatr);
1439 return;
1440 }
1441
1442 /****************************************************************************
1443 Reply to a dskattr.
1444 ****************************************************************************/
1445
1446 void reply_dskattr(struct smb_request *req)
1447 {
1448 connection_struct *conn = req->conn;
1449 uint64_t dfree,dsize,bsize;
1450 START_PROFILE(SMBdskattr);
1451
1452 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1453 reply_nterror(req, map_nt_error_from_unix(errno));
1454 END_PROFILE(SMBdskattr);
1455 return;
1456 }
1457
1458 reply_outbuf(req, 5, 0);
1459
1460 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1461 double total_space, free_space;
1462 /* we need to scale this to a number that DOS6 can handle. We
1463 use floating point so we can handle large drives on systems
1464 that don't have 64 bit integers
1465
1466 we end up displaying a maximum of 2G to DOS systems
1467 */
1468 total_space = dsize * (double)bsize;
1469 free_space = dfree * (double)bsize;
1470
1471 dsize = (uint64_t)((total_space+63*512) / (64*512));
1472 dfree = (uint64_t)((free_space+63*512) / (64*512));
1473
1474 if (dsize > 0xFFFF) dsize = 0xFFFF;
1475 if (dfree > 0xFFFF) dfree = 0xFFFF;
1476
1477 SSVAL(req->outbuf,smb_vwv0,dsize);
1478 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1479 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1480 SSVAL(req->outbuf,smb_vwv3,dfree);
1481 } else {
1482 SSVAL(req->outbuf,smb_vwv0,dsize);
1483 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1484 SSVAL(req->outbuf,smb_vwv2,512);
1485 SSVAL(req->outbuf,smb_vwv3,dfree);
1486 }
1487
1488 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1489
1490 END_PROFILE(SMBdskattr);
1491 return;
1492 }
1493
1494 /*
1495 * Utility function to split the filename from the directory.
1496 */
1497 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1498 char **fname_dir_out,
1499 char **fname_mask_out)
1500 {
1501 const char *p = NULL;
1502 char *fname_dir = NULL;
1503 char *fname_mask = NULL;
1504
1505 p = strrchr_m(fname_in, '/');
1506 if (!p) {
1507 fname_dir = talloc_strdup(ctx, ".");
1508 fname_mask = talloc_strdup(ctx, fname_in);
1509 } else {
1510 fname_dir = talloc_strndup(ctx, fname_in,
1511 PTR_DIFF(p, fname_in));
1512 fname_mask = talloc_strdup(ctx, p+1);
1513 }
1514
1515 if (!fname_dir || !fname_mask) {
1516 TALLOC_FREE(fname_dir);
1517 TALLOC_FREE(fname_mask);
1518 return NT_STATUS_NO_MEMORY;
1519 }
1520
1521 *fname_dir_out = fname_dir;
1522 *fname_mask_out = fname_mask;
1523 return NT_STATUS_OK;
1524 }
1525
1526 /****************************************************************************
1527 Reply to a search.
1528 Can be called from SMBsearch, SMBffirst or SMBfunique.
1529 ****************************************************************************/
1530
1531 void reply_search(struct smb_request *req)
1532 {
1533 connection_struct *conn = req->conn;
1534 char *path = NULL;
1535 const char *mask = NULL;
1536 char *directory = NULL;
1537 struct smb_filename *smb_fname = NULL;
1538 char *fname = NULL;
1539 off_t size;
1540 uint32 mode;
1541 struct timespec date;
1542 uint32 dirtype;
1543 unsigned int numentries = 0;
1544 unsigned int maxentries = 0;
1545 bool finished = False;
1546 const char *p;
1547 int status_len;
1548 char status[21];
1549 int dptr_num= -1;
1550 bool check_descend = False;
1551 bool expect_close = False;
1552 NTSTATUS nt_status;
1553 bool mask_contains_wcard = False;
1554 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1555 TALLOC_CTX *ctx = talloc_tos();
1556 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1557 struct dptr_struct *dirptr = NULL;
1558 struct smbXsrv_connection *xconn = req->xconn;
1559 struct smbd_server_connection *sconn = xconn->sconn;
1560
1561 START_PROFILE(SMBsearch);
1562
1563 if (req->wct < 2) {
1564 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1565 goto out;
1566 }
1567
1568 if (lp_posix_pathnames()) {
1569 reply_unknown_new(req, req->cmd);
1570 goto out;
1571 }
1572
1573 /* If we were called as SMBffirst then we must expect close. */
1574 if(req->cmd == SMBffirst) {
1575 expect_close = True;
1576 }
1577
1578 reply_outbuf(req, 1, 3);
1579 maxentries = SVAL(req->vwv+0, 0);
1580 dirtype = SVAL(req->vwv+1, 0);
1581 p = (const char *)req->buf + 1;
1582 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1583 &nt_status, &mask_contains_wcard);
1584 if (!NT_STATUS_IS_OK(nt_status)) {
1585 reply_nterror(req, nt_status);
1586 goto out;
1587 }
1588
1589 p++;
1590 status_len = SVAL(p, 0);
1591 p += 2;
1592
1593 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1594
1595 if (status_len == 0) {
1596 nt_status = filename_convert(ctx, conn,
1597 req->flags2 & FLAGS2_DFS_PATHNAMES,
1598 path,
1599 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1600 &mask_contains_wcard,
1601 &smb_fname);
1602 if (!NT_STATUS_IS_OK(nt_status)) {
1603 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1604 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1605 ERRSRV, ERRbadpath);
1606 goto out;
1607 }
1608 reply_nterror(req, nt_status);
1609 goto out;
1610 }
1611
1612 directory = smb_fname->base_name;
1613
1614 p = strrchr_m(directory,'/');
1615 if ((p != NULL) && (*directory != '/')) {
1616 mask = p + 1;
1617 directory = talloc_strndup(ctx, directory,
1618 PTR_DIFF(p, directory));
1619 } else {
1620 mask = directory;
1621 directory = talloc_strdup(ctx,".");
1622 }
1623
1624 if (!directory) {
1625 reply_nterror(req, NT_STATUS_NO_MEMORY);
1626 goto out;
1627 }
1628
1629 memset((char *)status,'\0',21);
1630 SCVAL(status,0,(dirtype & 0x1F));
1631
1632 nt_status = dptr_create(conn,
1633 NULL, /* req */
1634 NULL, /* fsp */
1635 directory,
1636 True,
1637 expect_close,
1638 req->smbpid,
1639 mask,
1640 mask_contains_wcard,
1641 dirtype,
1642 &dirptr);
1643 if (!NT_STATUS_IS_OK(nt_status)) {
1644 reply_nterror(req, nt_status);
1645 goto out;
1646 }
1647 dptr_num = dptr_dnum(dirptr);
1648 } else {
1649 int status_dirtype;
1650 const char *dirpath;
1651
1652 memcpy(status,p,21);
1653 status_dirtype = CVAL(status,0) & 0x1F;
1654 if (status_dirtype != (dirtype & 0x1F)) {
1655 dirtype = status_dirtype;
1656 }
1657
1658 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1659 if (!dirptr) {
1660 goto SearchEmpty;
1661 }
1662 dirpath = dptr_path(sconn, dptr_num);
1663 directory = talloc_strdup(ctx, dirpath);
1664 if (!directory) {
1665 reply_nterror(req, NT_STATUS_NO_MEMORY);
1666 goto out;
1667 }
1668
1669 mask = dptr_wcard(sconn, dptr_num);
1670 if (!mask) {
1671 goto SearchEmpty;
1672 }
1673 /*
1674 * For a 'continue' search we have no string. So
1675 * check from the initial saved string.
1676 */
1677 mask_contains_wcard = ms_has_wild(mask);
1678 dirtype = dptr_attr(sconn, dptr_num);
1679 }
1680
1681 DEBUG(4,("dptr_num is %d\n",dptr_num));
1682
1683 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1684 dptr_init_search_op(dirptr);
1685
1686 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1687 char buf[DIR_STRUCT_SIZE];
1688 memcpy(buf,status,21);
1689 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1690 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1691 reply_nterror(req, NT_STATUS_NO_MEMORY);
1692 goto out;
1693 }
1694 dptr_fill(sconn, buf+12,dptr_num);
1695 if (dptr_zero(buf+12) && (status_len==0)) {
1696 numentries = 1;
1697 } else {
1698 numentries = 0;
1699 }
1700 if (message_push_blob(&req->outbuf,
1701 data_blob_const(buf, sizeof(buf)))
1702 == -1) {
1703 reply_nterror(req, NT_STATUS_NO_MEMORY);
1704 goto out;
1705 }
1706 } else {
1707 unsigned int i;
1708 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1709 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1710
1711 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1712
1713 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1714 directory,lp_dont_descend(ctx, SNUM(conn))));
1715 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1716 check_descend = True;
1717 }
1718
1719 for (i=numentries;(i<maxentries) && !finished;i++) {
1720 finished = !get_dir_entry(ctx,
1721 dirptr,
1722 mask,
1723 dirtype,
1724 &fname,
1725 &size,
1726 &mode,
1727 &date,
1728 check_descend,
1729 ask_sharemode);
1730 if (!finished) {
1731 char buf[DIR_STRUCT_SIZE];
1732 memcpy(buf,status,21);
1733 if (!make_dir_struct(ctx,
1734 buf,
1735 mask,
1736 fname,
1737 size,
1738 mode,
1739 convert_timespec_to_time_t(date),
1740 !allow_long_path_components)) {
1741 reply_nterror(req, NT_STATUS_NO_MEMORY);
1742 goto out;
1743 }
1744 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1745 break;
1746 }
1747 if (message_push_blob(&req->outbuf,
1748 data_blob_const(buf, sizeof(buf)))
1749 == -1) {
1750 reply_nterror(req, NT_STATUS_NO_MEMORY);
1751 goto out;
1752 }
1753 numentries++;
1754 }
1755 }
1756 }
1757
1758 SearchEmpty:
1759
1760 /* If we were called as SMBffirst with smb_search_id == NULL
1761 and no entries were found then return error and close dirptr
1762 (X/Open spec) */
1763
1764 if (numentries == 0) {
1765 dptr_close(sconn, &dptr_num);
1766 } else if(expect_close && status_len == 0) {
1767 /* Close the dptr - we know it's gone */
1768 dptr_close(sconn, &dptr_num);
1769 }
1770
1771 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1772 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1773 dptr_close(sconn, &dptr_num);
1774 }
1775
1776 if ((numentries == 0) && !mask_contains_wcard) {
1777 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1778 goto out;
1779 }
1780
1781 SSVAL(req->outbuf,smb_vwv0,numentries);
1782 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1783 SCVAL(smb_buf(req->outbuf),0,5);
1784 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1785
1786 /* The replies here are never long name. */
1787 SSVAL(req->outbuf, smb_flg2,
1788 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1789 if (!allow_long_path_components) {
1790 SSVAL(req->outbuf, smb_flg2,
1791 SVAL(req->outbuf, smb_flg2)
1792 & (~FLAGS2_LONG_PATH_COMPONENTS));
1793 }
1794
1795 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1796 SSVAL(req->outbuf, smb_flg2,
1797 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1798
1799 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1800 smb_fn_name(req->cmd),
1801 mask,
1802 directory,
1803 dirtype,
1804 numentries,
1805 maxentries ));
1806 out:
1807 TALLOC_FREE(directory);
1808 TALLOC_FREE(smb_fname);
1809 END_PROFILE(SMBsearch);
1810 return;
1811 }
1812
1813 /****************************************************************************
1814 Reply to a fclose (stop directory search).
1815 ****************************************************************************/
1816
1817 void reply_fclose(struct smb_request *req)
1818 {
1819 int status_len;
1820 char status[21];
1821 int dptr_num= -2;
1822 const char *p;
1823 char *path = NULL;
1824 NTSTATUS err;
1825 bool path_contains_wcard = False;
1826 TALLOC_CTX *ctx = talloc_tos();
1827 struct smbd_server_connection *sconn = req->sconn;
1828
1829 START_PROFILE(SMBfclose);
1830
1831 if (lp_posix_pathnames()) {
1832 reply_unknown_new(req, req->cmd);
1833 END_PROFILE(SMBfclose);
1834 return;
1835 }
1836
1837 p = (const char *)req->buf + 1;
1838 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1839 &err, &path_contains_wcard);
1840 if (!NT_STATUS_IS_OK(err)) {
1841 reply_nterror(req, err);
1842 END_PROFILE(SMBfclose);
1843 return;
1844 }
1845 p++;
1846 status_len = SVAL(p,0);
1847 p += 2;
1848
1849 if (status_len == 0) {
1850 reply_force_doserror(req, ERRSRV, ERRsrverror);
1851 END_PROFILE(SMBfclose);
1852 return;
1853 }
1854
1855 memcpy(status,p,21);
1856
1857 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1858 /* Close the dptr - we know it's gone */
1859 dptr_close(sconn, &dptr_num);
1860 }
1861
1862 reply_outbuf(req, 1, 0);
1863 SSVAL(req->outbuf,smb_vwv0,0);
1864
1865 DEBUG(3,("search close\n"));
1866
1867 END_PROFILE(SMBfclose);
1868 return;
1869 }
1870
1871 /****************************************************************************
1872 Reply to an open.
1873 ****************************************************************************/
1874
1875 void reply_open(struct smb_request *req)
1876 {
1877 connection_struct *conn = req->conn;
1878 struct smb_filename *smb_fname = NULL;
1879 char *fname = NULL;
1880 uint32 fattr=0;
1881 off_t size = 0;
1882 time_t mtime=0;
1883 int info;
1884 files_struct *fsp;
1885 int oplock_request;
1886 int deny_mode;
1887 uint32 dos_attr;
1888 uint32 access_mask;
1889 uint32 share_mode;
1890 uint32 create_disposition;
1891 uint32 create_options = 0;
1892 uint32_t private_flags = 0;
1893 NTSTATUS status;
1894 TALLOC_CTX *ctx = talloc_tos();
1895
1896 START_PROFILE(SMBopen);
1897
1898 if (req->wct < 2) {
1899 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1900 goto out;
1901 }
1902
1903 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1904 deny_mode = SVAL(req->vwv+0, 0);
1905 dos_attr = SVAL(req->vwv+1, 0);
1906
1907 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1908 STR_TERMINATE, &status);
1909 if (!NT_STATUS_IS_OK(status)) {
1910 reply_nterror(req, status);
1911 goto out;
1912 }
1913
1914 if (!map_open_params_to_ntcreate(fname, deny_mode,
1915 OPENX_FILE_EXISTS_OPEN, &access_mask,
1916 &share_mode, &create_disposition,
1917 &create_options, &private_flags)) {
1918 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1919 goto out;
1920 }
1921
1922 status = filename_convert(ctx,
1923 conn,
1924 req->flags2 & FLAGS2_DFS_PATHNAMES,
1925 fname,
1926 UCF_PREP_CREATEFILE,
1927 NULL,
1928 &smb_fname);
1929 if (!NT_STATUS_IS_OK(status)) {
1930 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1931 reply_botherror(req,
1932 NT_STATUS_PATH_NOT_COVERED,
1933 ERRSRV, ERRbadpath);
1934 goto out;
1935 }
1936 reply_nterror(req, status);
1937 goto out;
1938 }
1939
1940 status = SMB_VFS_CREATE_FILE(
1941 conn, /* conn */
1942 req, /* req */
1943 0, /* root_dir_fid */
1944 smb_fname, /* fname */
1945 access_mask, /* access_mask */
1946 share_mode, /* share_access */
1947 create_disposition, /* create_disposition*/
1948 create_options, /* create_options */
1949 dos_attr, /* file_attributes */
1950 oplock_request, /* oplock_request */
1951 NULL, /* lease */
1952 0, /* allocation_size */
1953 private_flags,
1954 NULL, /* sd */
1955 NULL, /* ea_list */
1956 &fsp, /* result */
1957 &info); /* pinfo */
1958
1959 if (!NT_STATUS_IS_OK(status)) {
1960 if (open_was_deferred(req->sconn, req->mid)) {
1961 /* We have re-scheduled this call. */
1962 goto out;
1963 }
1964 reply_openerror(req, status);
1965 goto out;
1966 }
1967
1968 /* Ensure we're pointing at the correct stat struct. */
1969 TALLOC_FREE(smb_fname);
1970 smb_fname = fsp->fsp_name;
1971
1972 size = smb_fname->st.st_ex_size;
1973 fattr = dos_mode(conn, smb_fname);
1974
1975 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1976
1977 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1978 DEBUG(3,("attempt to open a directory %s\n",
1979 fsp_str_dbg(fsp)));
1980 close_file(req, fsp, ERROR_CLOSE);
1981 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1982 ERRDOS, ERRnoaccess);
1983 goto out;
1984 }
1985
1986 reply_outbuf(req, 7, 0);
1987 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1988 SSVAL(req->outbuf,smb_vwv1,fattr);
1989 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1990 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1991 } else {
1992 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1993 }
1994 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1995 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1996
1997 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1998 SCVAL(req->outbuf,smb_flg,
1999 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2000 }
2001
2002 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2003 SCVAL(req->outbuf,smb_flg,
2004 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2005 }
2006 out:
2007 END_PROFILE(SMBopen);
2008 return;
2009 }
2010
2011 /****************************************************************************
2012 Reply to an open and X.
2013 ****************************************************************************/
2014
2015 void reply_open_and_X(struct smb_request *req)
2016 {
2017 connection_struct *conn = req->conn;
2018 struct smb_filename *smb_fname = NULL;
2019 char *fname = NULL;
2020 uint16 open_flags;
2021 int deny_mode;
2022 uint32 smb_attr;
2023 /* Breakout the oplock request bits so we can set the
2024 reply bits separately. */
2025 int ex_oplock_request;
2026 int core_oplock_request;
2027 int oplock_request;
2028 #if 0
2029 int smb_sattr = SVAL(req->vwv+4, 0);
2030 uint32 smb_time = make_unix_date3(req->vwv+6);
2031 #endif
2032 int smb_ofun;
2033 uint32 fattr=0;
2034 int mtime=0;
2035 int smb_action = 0;
2036 files_struct *fsp;
2037 NTSTATUS status;
2038 uint64_t allocation_size;
2039 ssize_t retval = -1;
2040 uint32 access_mask;
2041 uint32 share_mode;
2042 uint32 create_disposition;
2043 uint32 create_options = 0;
2044 uint32_t private_flags = 0;
2045 TALLOC_CTX *ctx = talloc_tos();
2046
2047 START_PROFILE(SMBopenX);
2048
2049 if (req->wct < 15) {
2050 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2051 goto out;
2052 }
2053
2054 open_flags = SVAL(req->vwv+2, 0);
2055 deny_mode = SVAL(req->vwv+3, 0);
2056 smb_attr = SVAL(req->vwv+5, 0);
2057 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2058 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2059 oplock_request = ex_oplock_request | core_oplock_request;
2060 smb_ofun = SVAL(req->vwv+8, 0);
2061 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2062
2063 /* If it's an IPC, pass off the pipe handler. */
2064 if (IS_IPC(conn)) {
2065 if (lp_nt_pipe_support()) {
2066 reply_open_pipe_and_X(conn, req);
2067 } else {
2068 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2069 }
2070 goto out;
2071 }
2072
2073 /* XXXX we need to handle passed times, sattr and flags */
2074 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2075 STR_TERMINATE, &status);
2076 if (!NT_STATUS_IS_OK(status)) {
2077 reply_nterror(req, status);
2078 goto out;
2079 }
2080
2081 if (!map_open_params_to_ntcreate(fname, deny_mode,
2082 smb_ofun,
2083 &access_mask, &share_mode,
2084 &create_disposition,
2085 &create_options,
2086 &private_flags)) {
2087 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2088 goto out;
2089 }
2090
2091 status = filename_convert(ctx,
2092 conn,
2093 req->flags2 & FLAGS2_DFS_PATHNAMES,
2094 fname,
2095 UCF_PREP_CREATEFILE,
2096 NULL,
2097 &smb_fname);
2098 if (!NT_STATUS_IS_OK(status)) {
2099 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2100 reply_botherror(req,
2101 NT_STATUS_PATH_NOT_COVERED,
2102 ERRSRV, ERRbadpath);
2103 goto out;
2104 }
2105 reply_nterror(req, status);
2106 goto out;
2107 }
2108
2109 status = SMB_VFS_CREATE_FILE(
2110 conn, /* conn */
2111 req, /* req */
2112 0, /* root_dir_fid */
2113 smb_fname, /* fname */
2114 access_mask, /* access_mask */
2115 share_mode, /* share_access */
2116 create_disposition, /* create_disposition*/
2117 create_options, /* create_options */
2118 smb_attr, /* file_attributes */
2119 oplock_request, /* oplock_request */
2120 NULL, /* lease */
2121 0, /* allocation_size */
2122 private_flags,
2123 NULL, /* sd */
2124 NULL, /* ea_list */
2125 &fsp, /* result */
2126 &smb_action); /* pinfo */
2127
2128 if (!NT_STATUS_IS_OK(status)) {
2129 if (open_was_deferred(req->sconn, req->mid)) {
2130 /* We have re-scheduled this call. */
2131 goto out;
2132 }
2133 reply_openerror(req, status);
2134 goto out;
2135 }
2136
2137 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2138 if the file is truncated or created. */
2139 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2140 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2141 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2142 close_file(req, fsp, ERROR_CLOSE);
2143 reply_nterror(req, NT_STATUS_DISK_FULL);
2144 goto out;
2145 }
2146 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2147 if (retval < 0) {
2148 close_file(req, fsp, ERROR_CLOSE);
2149 reply_nterror(req, NT_STATUS_DISK_FULL);
2150 goto out;
2151 }
2152 status = vfs_stat_fsp(fsp);
2153 if (!NT_STATUS_IS_OK(status)) {
2154 close_file(req, fsp, ERROR_CLOSE);
2155 reply_nterror(req, status);
2156 goto out;
2157 }
2158 }
2159
2160 fattr = dos_mode(conn, fsp->fsp_name);
2161 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2162 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2163 close_file(req, fsp, ERROR_CLOSE);
2164 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2165 goto out;
2166 }
2167
2168 /* If the caller set the extended oplock request bit
2169 and we granted one (by whatever means) - set the
2170 correct bit for extended oplock reply.
2171 */
2172
2173 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2174 smb_action |= EXTENDED_OPLOCK_GRANTED;
2175 }
2176
2177 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2178 smb_action |= EXTENDED_OPLOCK_GRANTED;
2179 }
2180
2181 /* If the caller set the core oplock request bit
2182 and we granted one (by whatever means) - set the
2183 correct bit for core oplock reply.
2184 */
2185
2186 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2187 reply_outbuf(req, 19, 0);
2188 } else {
2189 reply_outbuf(req, 15, 0);
2190 }
2191
2192 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2193 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2194
2195 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2196 SCVAL(req->outbuf, smb_flg,
2197 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2198 }
2199
2200 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2201 SCVAL(req->outbuf, smb_flg,
2202 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2203 }
2204
2205 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2206 SSVAL(req->outbuf,smb_vwv3,fattr);
2207 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2208 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2209 } else {
2210 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2211 }
2212 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2213 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2214 SSVAL(req->outbuf,smb_vwv11,smb_action);
2215
2216 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2217 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2218 }
2219
2220 out:
2221 TALLOC_FREE(smb_fname);
2222 END_PROFILE(SMBopenX);
2223 return;
2224 }
2225
2226 /****************************************************************************
2227 Reply to a SMBulogoffX.
2228 ****************************************************************************/
2229
2230 void reply_ulogoffX(struct smb_request *req)
2231 {
2232 struct smbd_server_connection *sconn = req->sconn;
2233 struct user_struct *vuser;
2234 struct smbXsrv_session *session = NULL;
2235 NTSTATUS status;
2236
2237 START_PROFILE(SMBulogoffX);
2238
2239 vuser = get_valid_user_struct(sconn, req->vuid);
2240
2241 if(vuser == NULL) {
2242 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2243 (unsigned long long)req->vuid));
2244
2245 req->vuid = UID_FIELD_INVALID;
2246 reply_force_doserror(req, ERRSRV, ERRbaduid);
2247 END_PROFILE(SMBulogoffX);
2248 return;
2249 }
2250
2251 session = vuser->session;
2252 vuser = NULL;
2253
2254 /*
2255 * TODO: cancel all outstanding requests on the session
2256 */
2257 status = smbXsrv_session_logoff(session);
2258 if (!NT_STATUS_IS_OK(status)) {
2259 DEBUG(0, ("reply_ulogoff: "
2260 "smbXsrv_session_logoff() failed: %s\n",
2261 nt_errstr(status)));
2262 /*
2263 * If we hit this case, there is something completely
2264 * wrong, so we better disconnect the transport connection.
2265 */
2266 END_PROFILE(SMBulogoffX);
2267 exit_server(__location__ ": smbXsrv_session_logoff failed");
2268 return;
2269 }
2270
2271 TALLOC_FREE(session);
2272
2273 reply_outbuf(req, 2, 0);
2274 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2275 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2276
2277 DEBUG(3, ("ulogoffX vuid=%llu\n",
2278 (unsigned long long)req->vuid));
2279
2280 END_PROFILE(SMBulogoffX);
2281 req->vuid = UID_FIELD_INVALID;
2282 }
2283
2284 /****************************************************************************
2285 Reply to a mknew or a create.
2286 ****************************************************************************/
2287
2288 void reply_mknew(struct smb_request *req)
2289 {
2290 connection_struct *conn = req->conn;
2291 struct smb_filename *smb_fname = NULL;
2292 char *fname = NULL;
2293 uint32 fattr = 0;
2294 struct smb_file_time ft;
2295 files_struct *fsp;
2296 int oplock_request = 0;
2297 NTSTATUS status;
2298 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2299 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2300 uint32 create_disposition;
2301 uint32 create_options = 0;
2302 TALLOC_CTX *ctx = talloc_tos();
2303
2304 START_PROFILE(SMBcreate);
2305 ZERO_STRUCT(ft);
2306
2307 if (req->wct < 3) {
2308 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2309 goto out;
2310 }
2311
2312 fattr = SVAL(req->vwv+0, 0);
2313 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2314
2315 /* mtime. */
2316 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2317
2318 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2319 STR_TERMINATE, &status);
2320 if (!NT_STATUS_IS_OK(status)) {
2321 reply_nterror(req, status);
2322 goto out;
2323 }
2324
2325 status = filename_convert(ctx,
2326 conn,
2327 req->flags2 & FLAGS2_DFS_PATHNAMES,
2328 fname,
2329 UCF_PREP_CREATEFILE,
2330 NULL,
2331 &smb_fname);
2332 if (!NT_STATUS_IS_OK(status)) {
2333 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2334 reply_botherror(req,
2335 NT_STATUS_PATH_NOT_COVERED,
2336 ERRSRV, ERRbadpath);
2337 goto out;
2338 }
2339 reply_nterror(req, status);
2340 goto out;
2341 }
2342
2343 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2344 DEBUG(0,("Attempt to create file (%s) with volid set - "
2345 "please report this\n",
2346 smb_fname_str_dbg(smb_fname)));
2347 }
2348
2349 if(req->cmd == SMBmknew) {
2350 /* We should fail if file exists. */
2351 create_disposition = FILE_CREATE;
2352 } else {
2353 /* Create if file doesn't exist, truncate if it does. */
2354 create_disposition = FILE_OVERWRITE_IF;
2355 }
2356
2357 status = SMB_VFS_CREATE_FILE(
2358 conn, /* conn */
2359 req, /* req */
2360 0, /* root_dir_fid */
2361 smb_fname, /* fname */
2362 access_mask, /* access_mask */
2363 share_mode, /* share_access */
2364 create_disposition, /* create_disposition*/
2365 create_options, /* create_options */
2366 fattr, /* file_attributes */
2367 oplock_request, /* oplock_request */
2368 NULL, /* lease */
2369 0, /* allocation_size */
2370 0, /* private_flags */
2371 NULL, /* sd */
2372 NULL, /* ea_list */
2373 &fsp, /* result */
2374 NULL); /* pinfo */
2375
2376 if (!NT_STATUS_IS_OK(status)) {
2377 if (open_was_deferred(req->sconn, req->mid)) {
2378 /* We have re-scheduled this call. */
2379 goto out;
2380 }
2381 reply_openerror(req, status);
2382 goto out;
2383 }
2384
2385 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2386 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2387 if (!NT_STATUS_IS_OK(status)) {
2388 END_PROFILE(SMBcreate);
2389 goto out;
2390 }
2391
2392 reply_outbuf(req, 1, 0);
2393 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2394
2395 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2396 SCVAL(req->outbuf,smb_flg,
2397 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2398 }
2399
2400 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2401 SCVAL(req->outbuf,smb_flg,
2402 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2403 }
2404
2405 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2406 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2407 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2408 (unsigned int)fattr));
2409
2410 out:
2411 TALLOC_FREE(smb_fname);
2412 END_PROFILE(SMBcreate);
2413 return;
2414 }
2415
2416 /****************************************************************************
2417 Reply to a create temporary file.
2418 ****************************************************************************/
2419
2420 void reply_ctemp(struct smb_request *req)
2421 {
2422 connection_struct *conn = req->conn;
2423 struct smb_filename *smb_fname = NULL;
2424 char *wire_name = NULL;
2425 char *fname = NULL;
2426 uint32 fattr;
2427 files_struct *fsp;
2428 int oplock_request;
2429 char *s;
2430 NTSTATUS status;
2431 int i;
2432 TALLOC_CTX *ctx = talloc_tos();
2433
2434 START_PROFILE(SMBctemp);
2435
2436 if (req->wct < 3) {
2437 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2438 goto out;
2439 }
2440
2441 fattr = SVAL(req->vwv+0, 0);
2442 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2443
2444 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2445 STR_TERMINATE, &status);
2446 if (!NT_STATUS_IS_OK(status)) {
2447 reply_nterror(req, status);
2448 goto out;
2449 }
2450
2451 for (i = 0; i < 10; i++) {
2452 if (*wire_name) {
2453 fname = talloc_asprintf(ctx,
2454 "%s/TMP%s",
2455 wire_name,
2456 generate_random_str_list(ctx, 5, "0123456789"));
2457 } else {
2458 fname = talloc_asprintf(ctx,
2459 "TMP%s",
2460 generate_random_str_list(ctx, 5, "0123456789"));
2461 }
2462
2463 if (!fname) {
2464 reply_nterror(req, NT_STATUS_NO_MEMORY);
2465 goto out;
2466 }
2467
2468 status = filename_convert(ctx, conn,
2469 req->flags2 & FLAGS2_DFS_PATHNAMES,
2470 fname,
2471 UCF_PREP_CREATEFILE,
2472 NULL,
2473 &smb_fname);
2474 if (!NT_STATUS_IS_OK(status)) {
2475 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2476 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2477 ERRSRV, ERRbadpath);
2478 goto out;
2479 }
2480 reply_nterror(req, status);
2481 goto out;
2482 }
2483
2484 /* Create the file. */
2485 status = SMB_VFS_CREATE_FILE(
2486 conn, /* conn */
2487 req, /* req */
2488 0, /* root_dir_fid */
2489 smb_fname, /* fname */
2490 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2491 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2492 FILE_CREATE, /* create_disposition*/
2493 0, /* create_options */
2494 fattr, /* file_attributes */
2495 oplock_request, /* oplock_request */
2496 NULL, /* lease */
2497 0, /* allocation_size */
2498 0, /* private_flags */
2499 NULL, /* sd */
2500 NULL, /* ea_list */
2501 &fsp, /* result */
2502 NULL); /* pinfo */
2503
2504 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2505 TALLOC_FREE(fname);
2506 TALLOC_FREE(smb_fname);
2507 continue;
2508 }
2509
2510 if (!NT_STATUS_IS_OK(status)) {
2511 if (open_was_deferred(req->sconn, req->mid)) {
2512 /* We have re-scheduled this call. */
2513 goto out;
2514 }
2515 reply_openerror(req, status);
2516 goto out;
2517 }
2518
2519 break;
2520 }
2521
2522 if (i == 10) {
2523 /* Collision after 10 times... */
2524 reply_nterror(req, status);
2525 goto out;
2526 }
2527
2528 reply_outbuf(req, 1, 0);
2529 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2530
2531 /* the returned filename is relative to the directory */
2532 s = strrchr_m(fsp->fsp_name->base_name, '/');
2533 if (!s) {
2534 s = fsp->fsp_name->base_name;
2535 } else {
2536 s++;
2537 }
2538
2539 #if 0
2540 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2541 thing in the byte section. JRA */
2542 SSVALS(p, 0, -1); /* what is this? not in spec */
2543 #endif
2544 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2545 == -1) {
2546 reply_nterror(req, NT_STATUS_NO_MEMORY);
2547 goto out;
2548 }
2549
2550 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2551 SCVAL(req->outbuf, smb_flg,
2552 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2553 }
2554
2555 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2556 SCVAL(req->outbuf, smb_flg,
2557 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2558 }
2559
2560 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2561 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2562 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2563 out:
2564 TALLOC_FREE(smb_fname);
2565 TALLOC_FREE(wire_name);
2566 END_PROFILE(SMBctemp);
2567 return;
2568 }
2569
2570 /*******************************************************************
2571 Check if a user is allowed to rename a file.
2572 ********************************************************************/
2573
2574 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2575 uint16 dirtype)
2576 {
2577 if (!CAN_WRITE(conn)) {
2578 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2579 }
2580
2581 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2582 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2583 /* Only bother to read the DOS attribute if we might deny the
2584 rename on the grounds of attribute missmatch. */
2585 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2586 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2587 return NT_STATUS_NO_SUCH_FILE;
2588 }
2589 }
2590
2591 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2592 if (fsp->posix_open) {
2593 return NT_STATUS_OK;
2594 }
2595
2596 /* If no pathnames are open below this
2597 directory, allow the rename. */
2598
2599 if (file_find_subpath(fsp)) {
2600 return NT_STATUS_ACCESS_DENIED;
2601 }
2602 return NT_STATUS_OK;
2603 }
2604
2605 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2606 return NT_STATUS_OK;
2607 }
2608
2609 return NT_STATUS_ACCESS_DENIED;
2610 }
2611
2612 /*******************************************************************
2613 * unlink a file with all relevant access checks
2614 *******************************************************************/
2615
2616 static NTSTATUS do_unlink(connection_struct *conn,
2617 struct smb_request *req,
2618 struct smb_filename *smb_fname,
2619 uint32 dirtype)
2620 {
2621 uint32 fattr;
2622 files_struct *fsp;
2623 uint32 dirtype_orig = dirtype;
2624 NTSTATUS status;
2625 int ret;
2626 bool posix_paths = lp_posix_pathnames();
2627
2628 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2629 smb_fname_str_dbg(smb_fname),
2630 dirtype));
2631
2632 if (!CAN_WRITE(conn)) {
2633 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2634 }
2635
2636 if (posix_paths) {
2637 ret = SMB_VFS_LSTAT(conn, smb_fname);
2638 } else {
2639 ret = SMB_VFS_STAT(conn, smb_fname);
2640 }
2641 if (ret != 0) {
2642 return map_nt_error_from_unix(errno);
2643 }
2644
2645 fattr = dos_mode(conn, smb_fname);
2646
2647 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2648 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2649 }
2650
2651 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2652 if (!dirtype) {
2653 return NT_STATUS_NO_SUCH_FILE;
2654 }
2655
2656 if (!dir_check_ftype(fattr, dirtype)) {
2657 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2658 return NT_STATUS_FILE_IS_A_DIRECTORY;
2659 }
2660 return NT_STATUS_NO_SUCH_FILE;
2661 }
2662
2663 if (dirtype_orig & 0x8000) {
2664 /* These will never be set for POSIX. */
2665 return NT_STATUS_NO_SUCH_FILE;
2666 }
2667
2668 #if 0
2669 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2670 return NT_STATUS_FILE_IS_A_DIRECTORY;
2671 }
2672
2673 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2674 return NT_STATUS_NO_SUCH_FILE;
2675 }
2676
2677 if (dirtype & 0xFF00) {
2678 /* These will never be set for POSIX. */
2679 return NT_STATUS_NO_SUCH_FILE;
2680 }
2681
2682 dirtype &= 0xFF;
2683 if (!dirtype) {
2684 return NT_STATUS_NO_SUCH_FILE;
2685 }
2686
2687 /* Can't delete a directory. */
2688 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2689 return NT_STATUS_FILE_IS_A_DIRECTORY;
2690 }
2691 #endif
2692
2693 #if 0 /* JRATEST */
2694 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2695 return NT_STATUS_OBJECT_NAME_INVALID;
2696 #endif /* JRATEST */
2697
2698 /* On open checks the open itself will check the share mode, so
2699 don't do it here as we'll get it wrong. */
2700
2701 status = SMB_VFS_CREATE_FILE
2702 (conn, /* conn */
2703 req, /* req */
2704 0, /* root_dir_fid */
2705 smb_fname, /* fname */
2706 DELETE_ACCESS, /* access_mask */
2707 FILE_SHARE_NONE, /* share_access */
2708 FILE_OPEN, /* create_disposition*/
2709 FILE_NON_DIRECTORY_FILE, /* create_options */
2710 /* file_attributes */
2711 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2712 FILE_ATTRIBUTE_NORMAL,
2713 0, /* oplock_request */
2714 NULL, /* lease */
2715 0, /* allocation_size */
2716 0, /* private_flags */
2717 NULL, /* sd */
2718 NULL, /* ea_list */
2719 &fsp, /* result */
2720 NULL); /* pinfo */
2721
2722 if (!NT_STATUS_IS_OK(status)) {
2723 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2724 nt_errstr(status)));
2725 return status;
2726 }
2727
2728 status = can_set_delete_on_close(fsp, fattr);
2729 if (!NT_STATUS_IS_OK(status)) {
2730 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2731 "(%s)\n",
2732 smb_fname_str_dbg(smb_fname),
2733 nt_errstr(status)));
2734 close_file(req, fsp, NORMAL_CLOSE);
2735 return status;
2736 }
2737
2738 /* The set is across all open files on this dev/inode pair. */
2739 if (!set_delete_on_close(fsp, True,
2740 conn->session_info->security_token,
2741 conn->session_info->unix_token)) {
2742 close_file(req, fsp, NORMAL_CLOSE);
2743 return NT_STATUS_ACCESS_DENIED;
2744 }
2745
2746 return close_file(req, fsp, NORMAL_CLOSE);
2747 }
2748
2749 /****************************************************************************
2750 The guts of the unlink command, split out so it may be called by the NT SMB
2751 code.
2752 ****************************************************************************/
2753
2754 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2755 uint32 dirtype, struct smb_filename *smb_fname,
2756 bool has_wild)
2757 {
2758 char *fname_dir = NULL;
2759 char *fname_mask = NULL;
2760 int count=0;
2761 NTSTATUS status = NT_STATUS_OK;
2762 TALLOC_CTX *ctx = talloc_tos();
2763
2764 /* Split up the directory from the filename/mask. */
2765 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2766 &fname_dir, &fname_mask);
2767 if (!NT_STATUS_IS_OK(status)) {
2768 goto out;
2769 }
2770
2771 /*
2772 * We should only check the mangled cache
2773 * here if unix_convert failed. This means
2774 * that the path in 'mask' doesn't exist
2775 * on the file system and so we need to look
2776 * for a possible mangle. This patch from
2777 * Tine Smukavec <valentin.smukavec@hermes.si>.
2778 */
2779
2780 if (!VALID_STAT(smb_fname->st) &&
2781 mangle_is_mangled(fname_mask, conn->params)) {
2782 char *new_mask = NULL;
2783 mangle_lookup_name_from_8_3(ctx, fname_mask,
2784 &new_mask, conn->params);
2785 if (new_mask) {
2786 TALLOC_FREE(fname_mask);
2787 fname_mask = new_mask;
2788 }
2789 }
2790
2791 if (!has_wild) {
2792
2793 /*
2794 * Only one file needs to be unlinked. Append the mask back
2795 * onto the directory.
2796 */
2797 TALLOC_FREE(smb_fname->base_name);
2798 if (ISDOT(fname_dir)) {
2799 /* Ensure we use canonical names on open. */
2800 smb_fname->base_name = talloc_asprintf(smb_fname,
2801 "%s",
2802 fname_mask);
2803 } else {
2804 smb_fname->base_name = talloc_asprintf(smb_fname,
2805 "%s/%s",
2806 fname_dir,
2807 fname_mask);
2808 }
2809 if (!smb_fname->base_name) {
2810 status = NT_STATUS_NO_MEMORY;
2811 goto out;
2812 }
2813 if (dirtype == 0) {
2814 dirtype = FILE_ATTRIBUTE_NORMAL;
2815 }
2816
2817 status = check_name(conn, smb_fname->base_name);
2818 if (!NT_STATUS_IS_OK(status)) {
2819 goto out;
2820 }
2821
2822 status = do_unlink(conn, req, smb_fname, dirtype);
2823 if (!NT_STATUS_IS_OK(status)) {
2824 goto out;
2825 }
2826
2827 count++;
2828 } else {
2829 struct smb_Dir *dir_hnd = NULL;
2830 long offset = 0;
2831 const char *dname = NULL;
2832 char *talloced = NULL;
2833
2834 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2835 status = NT_STATUS_OBJECT_NAME_INVALID;
2836 goto out;
2837 }
2838
2839 if (strequal(fname_mask,"????????.???")) {
2840 TALLOC_FREE(fname_mask);
2841 fname_mask = talloc_strdup(ctx, "*");
2842 if (!fname_mask) {
2843 status = NT_STATUS_NO_MEMORY;
2844 goto out;
2845 }
2846 }
2847
2848 status = check_name(conn, fname_dir);
2849 if (!NT_STATUS_IS_OK(status)) {
2850 goto out;
2851 }
2852
2853 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2854 dirtype);
2855 if (dir_hnd == NULL) {
2856 status = map_nt_error_from_unix(errno);
2857 goto out;
2858 }
2859
2860 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2861 the pattern matches against the long name, otherwise the short name
2862 We don't implement this yet XXXX
2863 */
2864
2865 status = NT_STATUS_NO_SUCH_FILE;
2866
2867 while ((dname = ReadDirName(dir_hnd, &offset,
2868 &smb_fname->st, &talloced))) {
2869 TALLOC_CTX *frame = talloc_stackframe();
2870
2871 if (!is_visible_file(conn, fname_dir, dname,
2872 &smb_fname->st, true)) {
2873 TALLOC_FREE(frame);
2874 TALLOC_FREE(talloced);
2875 continue;
2876 }
2877
2878 /* Quick check for "." and ".." */
2879 if (ISDOT(dname) || ISDOTDOT(dname)) {
2880 TALLOC_FREE(frame);
2881 TALLOC_FREE(talloced);
2882 continue;
2883 }
2884
2885 if(!mask_match(dname, fname_mask,
2886 conn->case_sensitive)) {
2887 TALLOC_FREE(frame);
2888 TALLOC_FREE(talloced);
2889 continue;
2890 }
2891
2892 TALLOC_FREE(smb_fname->base_name);
2893 if (ISDOT(fname_dir)) {
2894 /* Ensure we use canonical names on open. */
2895 smb_fname->base_name =
2896 talloc_asprintf(smb_fname, "%s",
2897 dname);
2898 } else {
2899 smb_fname->base_name =
2900 talloc_asprintf(smb_fname, "%s/%s",
2901 fname_dir, dname);
2902 }
2903
2904 if (!smb_fname->base_name) {
2905 TALLOC_FREE(dir_hnd);
2906 status = NT_STATUS_NO_MEMORY;
2907 TALLOC_FREE(frame);
2908 TALLOC_FREE(talloced);
2909 goto out;
2910 }
2911
2912 status = check_name(conn, smb_fname->base_name);
2913 if (!NT_STATUS_IS_OK(status)) {
2914 TALLOC_FREE(dir_hnd);
2915 TALLOC_FREE(frame);
2916 TALLOC_FREE(talloced);
2917 goto out;
2918 }
2919
2920 status = do_unlink(conn, req, smb_fname, dirtype);
2921 if (!NT_STATUS_IS_OK(status)) {
2922 TALLOC_FREE(dir_hnd);
2923 TALLOC_FREE(frame);
2924 TALLOC_FREE(talloced);
2925 goto out;
2926 }
2927
2928 count++;
2929 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2930 smb_fname->base_name));
2931
2932 TALLOC_FREE(frame);
2933 TALLOC_FREE(talloced);
2934 }
2935 TALLOC_FREE(dir_hnd);
2936 }
2937
2938 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2939 status = map_nt_error_from_unix(errno);
2940 }
2941
2942 out:
2943 TALLOC_FREE(fname_dir);
2944 TALLOC_FREE(fname_mask);
2945 return status;
2946 }
2947
2948 /****************************************************************************
2949 Reply to a unlink
2950 ****************************************************************************/
2951
2952 void reply_unlink(struct smb_request *req)
2953 {
2954 connection_struct *conn = req->conn;
2955 char *name = NULL;
2956 struct smb_filename *smb_fname = NULL;
2957 uint32 dirtype;
2958 NTSTATUS status;
2959 bool path_contains_wcard = False;
2960 TALLOC_CTX *ctx = talloc_tos();
2961
2962 START_PROFILE(SMBunlink);
2963
2964 if (req->wct < 1) {
2965 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2966 goto out;
2967 }
2968
2969 dirtype = SVAL(req->vwv+0, 0);
2970
2971 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2972 STR_TERMINATE, &status,
2973 &path_contains_wcard);
2974 if (!NT_STATUS_IS_OK(status)) {
2975 reply_nterror(req, status);
2976 goto out;
2977 }
2978
2979 status = filename_convert(ctx, conn,
2980 req->flags2 & FLAGS2_DFS_PATHNAMES,
2981 name,
2982 UCF_COND_ALLOW_WCARD_LCOMP,
2983 &path_contains_wcard,
2984 &smb_fname);
2985 if (!NT_STATUS_IS_OK(status)) {
2986 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2987 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2988 ERRSRV, ERRbadpath);
2989 goto out;
2990 }
2991 reply_nterror(req, status);
2992 goto out;
2993 }
2994
2995 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2996
2997 status = unlink_internals(conn, req, dirtype, smb_fname,
2998 path_contains_wcard);
2999 if (!NT_STATUS_IS_OK(status)) {
3000 if (open_was_deferred(req->sconn, req->mid)) {
3001 /* We have re-scheduled this call. */
3002 goto out;
3003 }
3004 reply_nterror(req, status);
3005 goto out;
3006 }
3007
3008 reply_outbuf(req, 0, 0);
3009 out:
3010 TALLOC_FREE(smb_fname);
3011 END_PROFILE(SMBunlink);
3012 return;
3013 }
3014
3015 /****************************************************************************
3016 Fail for readbraw.
3017 ****************************************************************************/
3018
3019 static void fail_readraw(void)
3020 {
3021 const char *errstr = talloc_asprintf(talloc_tos(),
3022 "FAIL ! reply_readbraw: socket write fail (%s)",
3023 strerror(errno));
3024 if (!errstr) {
3025 errstr = "";
3026 }
3027 exit_server_cleanly(errstr);
3028 }
3029
3030 /****************************************************************************
3031 Fake (read/write) sendfile. Returns -1 on read or write fail.
3032 ****************************************************************************/
3033
3034 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3035 off_t startpos, size_t nread)
3036 {
3037 size_t bufsize;
3038 size_t tosend = nread;
3039 char *buf;
3040
3041 if (nread == 0) {
3042 return 0;
3043 }
3044
3045 bufsize = MIN(nread, 65536);
3046
3047 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3048 return -1;
3049 }
3050
3051 while (tosend > 0) {
3052 ssize_t ret;
3053 size_t cur_read;
3054
3055 if (tosend > bufsize) {
3056 cur_read = bufsize;
3057 } else {
3058 cur_read = tosend;
3059 }
3060 ret = read_file(fsp,buf,startpos,cur_read);
3061 if (ret == -1) {
3062 SAFE_FREE(buf);
3063 return -1;
3064 }
3065
3066 /* If we had a short read, fill with zeros. */
3067 if (ret < cur_read) {
3068 memset(buf + ret, '\0', cur_read - ret);
3069 }
3070
3071 ret = write_data(xconn->transport.sock, buf, cur_read);
3072 if (ret != cur_read) {
3073 int saved_errno = errno;
3074 /*
3075 * Try and give an error message saying what
3076 * client failed.
3077 */
3078 DEBUG(0, ("write_data failed for client %s. "
3079 "Error %s\n",
3080 smbXsrv_connection_dbg(xconn),
3081 strerror(saved_errno)));
3082 SAFE_FREE(buf);
3083 errno = saved_errno;
3084 return -1;
3085 }
3086 tosend -= cur_read;
3087 startpos += cur_read;
3088 }
3089
3090 SAFE_FREE(buf);
3091 return (ssize_t)nread;
3092 }
3093
3094 /****************************************************************************
3095 Deal with the case of sendfile reading less bytes from the file than
3096 requested. Fill with zeros (all we can do). Returns 0 on success
3097 ****************************************************************************/
3098
3099 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3100 files_struct *fsp,
3101 ssize_t nread,
3102 size_t headersize,
3103 size_t smb_maxcnt)
3104 {
3105 #define SHORT_SEND_BUFSIZE 1024
3106 if (nread < headersize) {
3107 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3108 "header for file %s (%s). Terminating\n",
3109 fsp_str_dbg(fsp), strerror(errno)));
3110 return -1;
3111 }
3112
3113 nread -= headersize;
3114
3115 if (nread < smb_maxcnt) {
3116 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3117 if (!buf) {
3118 DEBUG(0,("sendfile_short_send: malloc failed "
3119 "for file %s (%s). Terminating\n",
3120 fsp_str_dbg(fsp), strerror(errno)));
3121 return -1;
3122 }
3123
3124 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3125 "with zeros !\n", fsp_str_dbg(fsp)));
3126
3127 while (nread < smb_maxcnt) {
3128 /*
3129 * We asked for the real file size and told sendfile
3130 * to not go beyond the end of the file. But it can
3131 * happen that in between our fstat call and the
3132 * sendfile call the file was truncated. This is very
3133 * bad because we have already announced the larger
3134 * number of bytes to the client.
3135 *
3136 * The best we can do now is to send 0-bytes, just as
3137 * a read from a hole in a sparse file would do.
3138 *
3139 * This should happen rarely enough that I don't care
3140 * about efficiency here :-)
3141 */
3142 size_t to_write;
3143 ssize_t ret;
3144
3145 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3146 ret = write_data(xconn->transport.sock, buf, to_write);
3147 if (ret != to_write) {
3148 int saved_errno = errno;
3149 /*
3150 * Try and give an error message saying what
3151 * client failed.
3152 */
3153 DEBUG(0, ("write_data failed for client %s. "
3154 "Error %s\n",
3155 smbXsrv_connection_dbg(xconn),
3156 strerror(saved_errno)));
3157 errno = saved_errno;
3158 return -1;
3159 }
3160 nread += to_write;
3161 }
3162 SAFE_FREE(buf);
3163 }
3164
3165 return 0;
3166 }
3167
3168 /****************************************************************************
3169 Return a readbraw error (4 bytes of zero).
3170 ****************************************************************************/
3171
3172 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3173 {
3174 char header[4];
3175
3176 SIVAL(header,0,0);
3177
3178 smbd_lock_socket(xconn);
3179 if (write_data(xconn->transport.sock,header,4) != 4) {
3180 int saved_errno = errno;
3181 /*
3182 * Try and give an error message saying what
3183 * client failed.
3184 */
3185 DEBUG(0, ("write_data failed for client %s. "
3186 "Error %s\n",
3187 smbXsrv_connection_dbg(xconn),
3188 strerror(saved_errno)));
3189 errno = saved_errno;
3190
3191 fail_readraw();
3192 }
3193 smbd_unlock_socket(xconn);
3194 }
3195
3196 /****************************************************************************
3197 Use sendfile in readbraw.
3198 ****************************************************************************/
3199
3200 static void send_file_readbraw(connection_struct *conn,
3201 struct smb_request *req,
3202 files_struct *fsp,
3203 off_t startpos,
3204 size_t nread,
3205 ssize_t mincount)
3206 {
3207 struct smbXsrv_connection *xconn = req->xconn;
3208 char *outbuf = NULL;
3209 ssize_t ret=0;
3210
3211 /*
3212 * We can only use sendfile on a non-chained packet
3213 * but we can use on a non-oplocked file. tridge proved this
3214 * on a train in Germany :-). JRA.
3215 * reply_readbraw has already checked the length.
3216 */
3217
3218 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3219 (fsp->wcp == NULL) &&
3220 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3221 ssize_t sendfile_read = -1;
3222 char header[4];
3223 DATA_BLOB header_blob;
3224
3225 _smb_setlen(header,nread);
3226 header_blob = data_blob_const(header, 4);
3227
3228 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3229 &header_blob, startpos,
3230 nread);
3231 if (sendfile_read == -1) {
3232 /* Returning ENOSYS means no data at all was sent.
3233 * Do this as a normal read. */
3234 if (errno == ENOSYS) {
3235 goto normal_readbraw;
3236 }
3237
3238 /*
3239 * Special hack for broken Linux with no working sendfile. If we
3240 * return EINTR we sent the header but not the rest of the data.
3241 * Fake this up by doing read/write calls.
3242 */
3243 if (errno == EINTR) {
3244 /* Ensure we don't do this again. */
3245 set_use_sendfile(SNUM(conn), False);
3246 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3247
3248 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3249 DEBUG(0,("send_file_readbraw: "
3250 "fake_sendfile failed for "
3251 "file %s (%s).\n",
3252 fsp_str_dbg(fsp),
3253 strerror(errno)));
3254 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3255 }
3256 return;
3257 }
3258
3259 DEBUG(0,("send_file_readbraw: sendfile failed for "
3260 "file %s (%s). Terminating\n",
3261 fsp_str_dbg(fsp), strerror(errno)));
3262 exit_server_cleanly("send_file_readbraw sendfile failed");
3263 } else if (sendfile_read == 0) {
3264 /*
3265 * Some sendfile implementations return 0 to indicate
3266 * that there was a short read, but nothing was
3267 * actually written to the socket. In this case,
3268 * fallback to the normal read path so the header gets
3269 * the correct byte count.
3270 */
3271 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3272 "bytes falling back to the normal read: "
3273 "%s\n", fsp_str_dbg(fsp)));
3274 goto normal_readbraw;
3275 }
3276
3277 /* Deal with possible short send. */
3278 if (sendfile_read != 4+nread) {
3279 ret = sendfile_short_send(xconn, fsp,
3280 sendfile_read, 4, nread);
3281 if (ret == -1) {
3282 fail_readraw();
3283 }
3284 }
3285 return;
3286 }
3287
3288 normal_readbraw:
3289
3290 outbuf = talloc_array(NULL, char, nread+4);
3291 if (!outbuf) {
3292 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3293 (unsigned)(nread+4)));
3294 reply_readbraw_error(xconn);
3295 return;
3296 }
3297
3298 if (nread > 0) {
3299 ret = read_file(fsp,outbuf+4,startpos,nread);
3300 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3301 if (ret < mincount)
3302 ret = 0;
3303 #else
3304 if (ret < nread)
3305 ret = 0;
3306 #endif
3307 }
3308
3309 _smb_setlen(outbuf,ret);
3310 if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3311 int saved_errno = errno;
3312 /*
3313 * Try and give an error message saying what
3314 * client failed.
3315 */
3316 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3317 smbXsrv_connection_dbg(xconn),
3318 strerror(saved_errno)));
3319 errno = saved_errno;
3320
3321 fail_readraw();
3322 }
3323
3324 TALLOC_FREE(outbuf);
3325 }
3326
3327 /****************************************************************************
3328 Reply to a readbraw (core+ protocol).
3329 ****************************************************************************/
3330
3331 void reply_readbraw(struct smb_request *req)
3332 {
3333 connection_struct *conn = req->conn;
3334 struct smbXsrv_connection *xconn = req->xconn;
3335 ssize_t maxcount,mincount;
3336 size_t nread = 0;
3337 off_t startpos;
3338 files_struct *fsp;
3339 struct lock_struct lock;
3340 off_t size = 0;
3341
3342 START_PROFILE(SMBreadbraw);
3343
3344 if (srv_is_signing_active(xconn) || req->encrypted) {
3345 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3346 "raw reads/writes are disallowed.");
3347 }
3348
3349 if (req->wct < 8) {
3350 reply_readbraw_error(xconn);
3351 END_PROFILE(SMBreadbraw);
3352 return;
3353 }
3354
3355 if (xconn->smb1.echo_handler.trusted_fde) {
3356 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3357 "'async smb echo handler = yes'\n"));
3358 reply_readbraw_error(xconn);
3359 END_PROFILE(SMBreadbraw);
3360 return;
3361 }
3362
3363 /*
3364 * Special check if an oplock break has been issued
3365 * and the readraw request croses on the wire, we must
3366 * return a zero length response here.
3367 */
3368
3369 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3370
3371 /*
3372 * We have to do a check_fsp by hand here, as
3373 * we must always return 4 zero bytes on error,
3374 * not a NTSTATUS.
3375 */
3376
3377 if (!fsp || !conn || conn != fsp->conn ||
3378 req->vuid != fsp->vuid ||
3379 fsp->is_directory || fsp->fh->fd == -1) {
3380 /*
3381 * fsp could be NULL here so use the value from the packet. JRA.
3382 */
3383 DEBUG(3,("reply_readbraw: fnum %d not valid "
3384 "- cache prime?\n",
3385 (int)SVAL(req->vwv+0, 0)));
3386 reply_readbraw_error(xconn);
3387 END_PROFILE(SMBreadbraw);
3388 return;
3389 }
3390
3391 /* Do a "by hand" version of CHECK_READ. */
3392 if (!(fsp->can_read ||
3393 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3394 (fsp->access_mask & FILE_EXECUTE)))) {
3395 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3396 (int)SVAL(req->vwv+0, 0)));
3397 reply_readbraw_error(xconn);
3398 END_PROFILE(SMBreadbraw);
3399 return;
3400 }
3401
3402 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3403
3404 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3405 if(req->wct == 10) {
3406 /*
3407 * This is a large offset (64 bit) read.
3408 */
3409
3410 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3411
3412 if(startpos < 0) {
3413 DEBUG(0,("reply_readbraw: negative 64 bit "
3414 "readraw offset (%.0f) !\n",
3415 (double)startpos ));
3416 reply_readbraw_error(xconn);
3417 END_PROFILE(SMBreadbraw);
3418 return;
3419 }
3420 }
3421
3422 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3423 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3424
3425 /* ensure we don't overrun the packet size */
3426 maxcount = MIN(65535,maxcount);
3427
3428 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3429 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3430 &lock);
3431
3432 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3433 reply_readbraw_error(xconn);
3434 END_PROFILE(SMBreadbraw);
3435 return;
3436 }
3437
3438 if (fsp_stat(fsp) == 0) {
3439 size = fsp->fsp_name->st.st_ex_size;
3440 }
3441
3442 if (startpos >= size) {
3443 nread = 0;
3444 } else {
3445 nread = MIN(maxcount,(size - startpos));
3446 }
3447
3448 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3449 if (nread < mincount)
3450 nread = 0;
3451 #endif
3452
3453 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3454 "min=%lu nread=%lu\n",
3455 fsp_fnum_dbg(fsp), (double)startpos,
3456 (unsigned long)maxcount,
3457 (unsigned long)mincount,
3458 (unsigned long)nread ) );
3459
3460 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3461
3462 DEBUG(5,("reply_readbraw finished\n"));
3463
3464 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3465
3466 END_PROFILE(SMBreadbraw);
3467 return;
3468 }
3469
3470 #undef DBGC_CLASS
3471 #define DBGC_CLASS DBGC_LOCKING
3472
3473 /****************************************************************************
3474 Reply to a lockread (core+ protocol).
3475 ****************************************************************************/
3476
3477 void reply_lockread(struct smb_request *req)
3478 {
3479 connection_struct *conn = req->conn;
3480 ssize_t nread = -1;
3481 char *data;
3482 off_t startpos;
3483 size_t numtoread;
3484 size_t maxtoread;
3485 NTSTATUS status;
3486 files_struct *fsp;
3487 struct byte_range_lock *br_lck = NULL;
3488 char *p = NULL;
3489 struct smbXsrv_connection *xconn = req->xconn;
3490
3491 START_PROFILE(SMBlockread);
3492
3493 if (req->wct < 5) {
3494 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3495 END_PROFILE(SMBlockread);
3496 return;
3497 }
3498
3499 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3500
3501 if (!check_fsp(conn, req, fsp)) {
3502 END_PROFILE(SMBlockread);
3503 return;
3504 }
3505
3506 if (!CHECK_READ(fsp,req)) {
3507 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3508 END_PROFILE(SMBlockread);
3509 return;
3510 }
3511
3512 numtoread = SVAL(req->vwv+1, 0);
3513 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3514
3515 /*
3516 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3517 * protocol request that predates the read/write lock concept.
3518 * Thus instead of asking for a read lock here we need to ask
3519 * for a write lock. JRA.
3520 * Note that the requested lock size is unaffected by max_send.
3521 */
3522
3523 br_lck = do_lock(req->sconn->msg_ctx,
3524 fsp,
3525 (uint64_t)req->smbpid,
3526 (uint64_t)numtoread,
3527 (uint64_t)startpos,
3528 WRITE_LOCK,
3529 WINDOWS_LOCK,
3530 False, /* Non-blocking lock. */
3531 &status,
3532 NULL);
3533 TALLOC_FREE(br_lck);
3534
3535 if (NT_STATUS_V(status)) {
3536 reply_nterror(req, status);
3537 END_PROFILE(SMBlockread);
3538 return;
3539 }
3540
3541 /*
3542 * However the requested READ size IS affected by max_send. Insanity.... JRA.
3543 */
3544 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3545
3546 if (numtoread > maxtoread) {
3547 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3548 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3549 (unsigned int)numtoread, (unsigned int)maxtoread,
3550 (unsigned int)xconn->smb1.sessions.max_send));
3551 numtoread = maxtoread;
3552 }
3553
3554 reply_outbuf(req, 5, numtoread + 3);
3555
3556 data = smb_buf(req->outbuf) + 3;
3557
3558 nread = read_file(fsp,data,startpos,numtoread);
3559
3560 if (nread < 0) {
3561 reply_nterror(req, map_nt_error_from_unix(errno));
3562 END_PROFILE(SMBlockread);
3563 return;
3564 }
3565
3566 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3567
3568 SSVAL(req->outbuf,smb_vwv0,nread);
3569 SSVAL(req->outbuf,smb_vwv5,nread+3);
3570 p = smb_buf(req->outbuf);
3571 SCVAL(p,0,0); /* pad byte. */
3572 SSVAL(p,1,nread);
3573
3574 DEBUG(3,("lockread %s num=%d nread=%d\n",
3575 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3576
3577 END_PROFILE(SMBlockread);
3578 return;
3579 }
3580
3581 #undef DBGC_CLASS
3582 #define DBGC_CLASS DBGC_ALL
3583
3584 /****************************************************************************
3585 Reply to a read.
3586 ****************************************************************************/
3587
3588 void reply_read(struct smb_request *req)
3589 {
3590 connection_struct *conn = req->conn;
3591 size_t numtoread;
3592 size_t maxtoread;
3593 ssize_t nread = 0;
3594 char *data;
3595 off_t startpos;
3596 files_struct *fsp;
3597 struct lock_struct lock;
3598 struct smbXsrv_connection *xconn = req->xconn;
3599
3600 START_PROFILE(SMBread);
3601
3602 if (req->wct < 3) {
3603 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3604 END_PROFILE(SMBread);
3605 return;
3606 }
3607
3608 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3609
3610 if (!check_fsp(conn, req, fsp)) {
3611 END_PROFILE(SMBread);
3612 return;
3613 }
3614
3615 if (!CHECK_READ(fsp,req)) {
3616 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3617 END_PROFILE(SMBread);
3618 return;
3619 }
3620
3621 numtoread = SVAL(req->vwv+1, 0);
3622 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3623
3624 /*
3625 * The requested read size cannot be greater than max_send. JRA.
3626 */
3627 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3628
3629 if (numtoread > maxtoread) {
3630 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3631 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3632 (unsigned int)numtoread, (unsigned int)maxtoread,
3633 (unsigned int)xconn->smb1.sessions.max_send));
3634 numtoread = maxtoread;
3635 }
3636
3637 reply_outbuf(req, 5, numtoread+3);
3638
3639 data = smb_buf(req->outbuf) + 3;
3640
3641 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3642 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3643 &lock);
3644
3645 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3646 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3647 END_PROFILE(SMBread);
3648 return;
3649 }
3650
3651 if (numtoread > 0)
3652 nread = read_file(fsp,data,startpos,numtoread);
3653
3654 if (nread < 0) {
3655 reply_nterror(req, map_nt_error_from_unix(errno));
3656 goto strict_unlock;
3657 }
3658
3659 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3660
3661 SSVAL(req->outbuf,smb_vwv0,nread);
3662 SSVAL(req->outbuf,smb_vwv5,nread+3);
3663 SCVAL(smb_buf(req->outbuf),0,1);
3664 SSVAL(smb_buf(req->outbuf),1,nread);
3665
3666 DEBUG(3, ("read %s num=%d nread=%d\n",
3667 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3668
3669 strict_unlock:
3670 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3671
3672 END_PROFILE(SMBread);
3673 return;
3674 }
3675
3676 /****************************************************************************
3677 Setup readX header.
3678 ****************************************************************************/
3679
3680 static int setup_readX_header(struct smb_request *req, char *outbuf,
3681 size_t smb_maxcnt)
3682 {
3683 int outsize;
3684
3685 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3686
3687 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3688
3689 SCVAL(outbuf,smb_vwv0,0xFF);
3690 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3691 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3692 SSVAL(outbuf,smb_vwv6,
3693 (smb_wct - 4) /* offset from smb header to wct */
3694 + 1 /* the wct field */
3695 + 12 * sizeof(uint16_t) /* vwv */
3696 + 2); /* the buflen field */
3697 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3698 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3699 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3700 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3701 return outsize;
3702 }
3703
3704 /****************************************************************************
3705 Reply to a read and X - possibly using sendfile.
3706 ****************************************************************************/
3707
3708 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3709 files_struct *fsp, off_t startpos,
3710 size_t smb_maxcnt)
3711 {
3712 struct smbXsrv_connection *xconn = req->xconn;
3713 ssize_t nread = -1;
3714 struct lock_struct lock;
3715 int saved_errno = 0;
3716
3717 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3718 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3719 &lock);
3720
3721 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3722 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3723 return;
3724 }
3725
3726 /*
3727 * We can only use sendfile on a non-chained packet
3728 * but we can use on a non-oplocked file. tridge proved this
3729 * on a train in Germany :-). JRA.
3730 */
3731
3732 if (!req_is_in_chain(req) &&
3733 !req->encrypted &&
3734 (fsp->base_fsp == NULL) &&
3735 (fsp->wcp == NULL) &&
3736 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3737 uint8 headerbuf[smb_size + 12 * 2];
3738 DATA_BLOB header;
3739
3740 if(fsp_stat(fsp) == -1) {
3741 reply_nterror(req, map_nt_error_from_unix(errno));
3742 goto strict_unlock;
3743 }
3744
3745 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3746 (startpos > fsp->fsp_name->st.st_ex_size) ||
3747 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3748 /*
3749 * We already know that we would do a short read, so don't
3750 * try the sendfile() path.
3751 */
3752 goto nosendfile_read;
3753 }
3754
3755 /*
3756 * Set up the packet header before send. We
3757 * assume here the sendfile will work (get the
3758 * correct amount of data).
3759 */
3760
3761 header = data_blob_const(headerbuf, sizeof(headerbuf));
3762
3763 construct_reply_common_req(req, (char *)headerbuf);
3764 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3765
3766 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
3767 startpos, smb_maxcnt);
3768 if (nread == -1) {
3769 saved_errno = errno;
3770
3771 /* Returning ENOSYS means no data at all was sent.
3772 Do this as a normal read. */
3773 if (errno == ENOSYS) {
3774 goto normal_read;
3775 }
3776
3777 /*
3778 * Special hack for broken Linux with no working sendfile. If we
3779 * return EINTR we sent the header but not the rest of the data.
3780 * Fake this up by doing read/write calls.
3781 */
3782
3783 if (errno == EINTR) {
3784 /* Ensure we don't do this again. */
3785 set_use_sendfile(SNUM(conn), False);
3786 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3787 nread = fake_sendfile(xconn, fsp, startpos,
3788 smb_maxcnt);
3789 if (nread == -1) {
3790 saved_errno = errno;
3791 DEBUG(0,("send_file_readX: "
3792 "fake_sendfile failed for "
3793 "file %s (%s) for client %s. "
3794 "Terminating\n",
3795 fsp_str_dbg(fsp),
3796 smbXsrv_connection_dbg(xconn),
3797 strerror(saved_errno)));
3798 errno = saved_errno;
3799 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3800 }
3801 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3802 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3803 /* No outbuf here means successful sendfile. */
3804 goto strict_unlock;
3805 }
3806
3807 DEBUG(0,("send_file_readX: sendfile failed for file "
3808 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3809 strerror(errno)));
3810 exit_server_cleanly("send_file_readX sendfile failed");
3811 } else if (nread == 0) {
3812 /*
3813 * Some sendfile implementations return 0 to indicate
3814 * that there was a short read, but nothing was
3815 * actually written to the socket. In this case,
3816 * fallback to the normal read path so the header gets
3817 * the correct byte count.
3818 */
3819 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3820 "falling back to the normal read: %s\n",
3821 fsp_str_dbg(fsp)));
3822 goto normal_read;
3823 }
3824
3825 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3826 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3827
3828 /* Deal with possible short send. */
3829 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3830 ssize_t ret;
3831
3832 ret = sendfile_short_send(xconn, fsp, nread,
3833 sizeof(headerbuf), smb_maxcnt);
3834 if (ret == -1) {
3835 const char *r;
3836 r = "send_file_readX: sendfile_short_send failed";
3837 DEBUG(0,("%s for file %s (%s).\n",
3838 r, fsp_str_dbg(fsp), strerror(errno)));
3839 exit_server_cleanly(r);
3840 }
3841 }
3842 /* No outbuf here means successful sendfile. */
3843 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3844 SMB_PERFCOUNT_END(&req->pcd);
3845 goto strict_unlock;
3846 }
3847
3848 normal_read:
3849
3850 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3851 uint8 headerbuf[smb_size + 2*12];
3852 ssize_t ret;
3853
3854 construct_reply_common_req(req, (char *)headerbuf);
3855 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3856
3857 /* Send out the header. */
3858 ret = write_data(xconn->transport.sock, (char *)headerbuf,
3859 sizeof(headerbuf));
3860 if (ret != sizeof(headerbuf)) {
3861 saved_errno = errno;
3862 /*
3863 * Try and give an error message saying what
3864 * client failed.
3865 */
3866 DEBUG(0,("send_file_readX: write_data failed for file "
3867 "%s (%s) for client %s. Terminating\n",
3868 fsp_str_dbg(fsp),
3869 smbXsrv_connection_dbg(xconn),
3870 strerror(saved_errno)));
3871 errno = saved_errno;
3872 exit_server_cleanly("send_file_readX sendfile failed");
3873 }
3874 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
3875 if (nread == -1) {
3876 saved_errno = errno;
3877 DEBUG(0,("send_file_readX: fake_sendfile failed for file "
3878 "%s (%s) for client %s. Terminating\n",
3879 fsp_str_dbg(fsp),
3880 smbXsrv_connection_dbg(xconn),
3881 strerror(saved_errno)));
3882 errno = saved_errno;
3883 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3884 }
3885 goto strict_unlock;
3886 }
3887
3888 nosendfile_read:
3889
3890 reply_outbuf(req, 12, smb_maxcnt);
3891 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3892 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3893
3894 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3895 saved_errno = errno;
3896
3897 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3898
3899 if (nread < 0) {
3900 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3901 return;
3902 }
3903
3904 setup_readX_header(req, (char *)req->outbuf, nread);
3905
3906 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3907 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3908 return;
3909
3910 strict_unlock:
3911 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3912 TALLOC_FREE(req->outbuf);
3913 return;
3914 }
3915
3916 /****************************************************************************
3917 Work out how much space we have for a read return.
3918 ****************************************************************************/
3919
3920 static size_t calc_max_read_pdu(const struct smb_request *req)
3921 {
3922 struct smbXsrv_connection *xconn = req->xconn;
3923
3924 if (xconn->protocol < PROTOCOL_NT1) {
3925 return xconn->smb1.sessions.max_send;
3926 }
3927
3928 if (!lp_large_readwrite()) {
3929 return xconn->smb1.sessions.max_send;
3930 }
3931
3932 if (req_is_in_chain(req)) {
3933 return xconn->smb1.sessions.max_send;
3934 }
3935
3936 if (req->encrypted) {
3937 /*
3938 * Don't take encrypted traffic up to the
3939 * limit. There are padding considerations
3940 * that make that tricky.
3941 */
3942 return xconn->smb1.sessions.max_send;
3943 }
3944
3945 if (srv_is_signing_active(xconn)) {
3946 return 0x1FFFF;
3947 }
3948
3949 if (!lp_unix_extensions()) {
3950 return 0x1FFFF;
3951 }
3952
3953 /*
3954 * We can do ultra-large POSIX reads.
3955 */
3956 return 0xFFFFFF;
3957 }
3958
3959 /****************************************************************************
3960 Calculate how big a read can be. Copes with all clients. It's always
3961 safe to return a short read - Windows does this.
3962 ****************************************************************************/
3963
3964 static size_t calc_read_size(const struct smb_request *req,
3965 size_t upper_size,
3966 size_t lower_size)
3967 {
3968 struct smbXsrv_connection *xconn = req->xconn;
3969 size_t max_pdu = calc_max_read_pdu(req);
3970 size_t total_size = 0;
3971 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3972 size_t max_len = max_pdu - hdr_len;
3973
3974 /*
3975 * Windows explicitly ignores upper size of 0xFFFF.
3976 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3977 * We must do the same as these will never fit even in
3978 * an extended size NetBIOS packet.
3979 */
3980 if (upper_size == 0xFFFF) {
3981 upper_size = 0;
3982 }
3983
3984 if (xconn->protocol < PROTOCOL_NT1) {
3985 upper_size = 0;
3986 }
3987
3988 total_size = ((upper_size<<16) | lower_size);
3989
3990 /*
3991 * LARGE_READX test shows it's always safe to return
3992 * a short read. Windows does so.
3993 */
3994 return MIN(total_size, max_len);
3995 }
3996
3997 /****************************************************************************
3998 Reply to a read and X.
3999 ****************************************************************************/
4000
4001 void reply_read_and_X(struct smb_request *req)
4002 {
4003 connection_struct *conn = req->conn;
4004 files_struct *fsp;
4005 off_t startpos;
4006 size_t smb_maxcnt;
4007 size_t upper_size;
4008 bool big_readX = False;
4009 #if 0
4010 size_t smb_mincnt = SVAL(req->vwv+6, 0);
4011 #endif
4012
4013 START_PROFILE(SMBreadX);
4014
4015 if ((req->wct != 10) && (req->wct != 12)) {
4016 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4017 return;
4018 }
4019
4020 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4021 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4022 smb_maxcnt = SVAL(req->vwv+5, 0);
4023
4024 /* If it's an IPC, pass off the pipe handler. */
4025 if (IS_IPC(conn)) {
4026 reply_pipe_read_and_X(req);
4027 END_PROFILE(SMBreadX);
4028 return;
4029 }
4030
4031 if (!check_fsp(conn, req, fsp)) {
4032 END_PROFILE(SMBreadX);
4033 return;
4034 }
4035
4036 if (!CHECK_READ(fsp,req)) {
4037 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4038 END_PROFILE(SMBreadX);
4039 return;
4040 }
4041
4042 upper_size = SVAL(req->vwv+7, 0);
4043 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4044 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4045 /*
4046 * This is a heuristic to avoid keeping large
4047 * outgoing buffers around over long-lived aio
4048 * requests.
4049 */
4050 big_readX = True;
4051 }
4052
4053 if (req->wct == 12) {
4054 /*
4055 * This is a large offset (64 bit) read.
4056 */
4057 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4058
4059 }
4060
4061 if (!big_readX) {
4062 NTSTATUS status = schedule_aio_read_and_X(conn,
4063 req,
4064 fsp,
4065 startpos,
4066 smb_maxcnt);
4067 if (NT_STATUS_IS_OK(status)) {
4068 /* Read scheduled - we're done. */
4069 goto out;
4070 }
4071 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4072 /* Real error - report to client. */
4073 END_PROFILE(SMBreadX);
4074 reply_nterror(req, status);
4075 return;
4076 }
4077 /* NT_STATUS_RETRY - fall back to sync read. */
4078 }
4079
4080 smbd_lock_socket(req->xconn);
4081 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4082 smbd_unlock_socket(req->xconn);
4083
4084 out:
4085 END_PROFILE(SMBreadX);
4086 return;
4087 }
4088
4089 /****************************************************************************
4090 Error replies to writebraw must have smb_wct == 1. Fix this up.
4091 ****************************************************************************/
4092
4093 void error_to_writebrawerr(struct smb_request *req)
4094 {
4095 uint8 *old_outbuf = req->outbuf;
4096
4097 reply_outbuf(req, 1, 0);
4098
4099 memcpy(req->outbuf, old_outbuf, smb_size);
4100 TALLOC_FREE(old_outbuf);
4101 }
4102
4103 /****************************************************************************
4104 Read 4 bytes of a smb packet and return the smb length of the packet.
4105 Store the result in the buffer. This version of the function will
4106 never return a session keepalive (length of zero).
4107 Timeout is in milliseconds.
4108 ****************************************************************************/
4109
4110 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4111 size_t *len)
4112 {
4113 uint8_t msgtype = NBSSkeepalive;
4114
4115 while (msgtype == NBSSkeepalive) {
4116 NTSTATUS status;
4117
4118 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4119 len);
4120 if (!NT_STATUS_IS_OK(status)) {
4121 char addr[INET6_ADDRSTRLEN];
4122 /* Try and give an error message
4123 * saying what client failed. */
4124 DEBUG(0, ("read_fd_with_timeout failed for "
4125 "client %s read error = %s.\n",
4126 get_peer_addr(fd,addr,sizeof(addr)),
4127 nt_errstr(status)));
4128 return status;
4129 }
4130
4131 msgtype = CVAL(inbuf, 0);
4132 }
4133
4134 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4135 (unsigned long)len));
4136
4137 return NT_STATUS_OK;
4138 }
4139
4140 /****************************************************************************
4141 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4142 ****************************************************************************/
4143
4144 void reply_writebraw(struct smb_request *req)
4145 {
4146 connection_struct *conn = req->conn;
4147 struct smbXsrv_connection *xconn = req->xconn;
4148 char *buf = NULL;
4149 ssize_t nwritten=0;
4150 ssize_t total_written=0;
4151 size_t numtowrite=0;
4152 size_t tcount;
4153 off_t startpos;
4154 const char *data=NULL;
4155 bool write_through;
4156 files_struct *fsp;
4157 struct lock_struct lock;
4158 NTSTATUS status;
4159
4160 START_PROFILE(SMBwritebraw);
4161
4162 /*
4163 * If we ever reply with an error, it must have the SMB command
4164 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4165 * we're finished.
4166 */
4167 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4168
4169 if (srv_is_signing_active(xconn)) {
4170 END_PROFILE(SMBwritebraw);
4171 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4172 "raw reads/writes are disallowed.");
4173 }
4174
4175 if (req->wct < 12) {
4176 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4177 error_to_writebrawerr(req);
4178 END_PROFILE(SMBwritebraw);
4179 return;
4180 }
4181
4182 if (xconn->smb1.echo_handler.trusted_fde) {
4183 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4184 "'async smb echo handler = yes'\n"));
4185 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4186 error_to_writebrawerr(req);
4187 END_PROFILE(SMBwritebraw);
4188 return;
4189 }
4190
4191 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4192 if (!check_fsp(conn, req, fsp)) {
4193 error_to_writebrawerr(req);
4194 END_PROFILE(SMBwritebraw);
4195 return;
4196 }
4197
4198 if (!CHECK_WRITE(fsp)) {
4199 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4200 error_to_writebrawerr(req);
4201 END_PROFILE(SMBwritebraw);
4202 return;
4203 }
4204
4205 tcount = IVAL(req->vwv+1, 0);
4206 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4207 write_through = BITSETW(req->vwv+7,0);
4208
4209 /* We have to deal with slightly different formats depending
4210 on whether we are using the core+ or lanman1.0 protocol */
4211
4212 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4213 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4214 data = smb_buf_const(req->inbuf);
4215 } else {
4216 numtowrite = SVAL(req->vwv+10, 0);
4217 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4218 }
4219
4220 /* Ensure we don't write bytes past the end of this packet. */
4221 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4222 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4223 error_to_writebrawerr(req);
4224 END_PROFILE(SMBwritebraw);
4225 return;
4226 }
4227
4228 if (!fsp->print_file) {
4229 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4230 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4231 &lock);
4232
4233 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4234 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4235 error_to_writebrawerr(req);
4236 END_PROFILE(SMBwritebraw);
4237 return;
4238 }
4239 }
4240
4241 if (numtowrite>0) {
4242 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4243 }
4244
4245 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4246 "wrote=%d sync=%d\n",
4247 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4248 (int)nwritten, (int)write_through));
4249
4250 if (nwritten < (ssize_t)numtowrite) {
4251 reply_nterror(req, NT_STATUS_DISK_FULL);
4252 error_to_writebrawerr(req);
4253 goto strict_unlock;
4254 }
4255
4256 total_written = nwritten;
4257
4258 /* Allocate a buffer of 64k + length. */
4259 buf = talloc_array(NULL, char, 65540);
4260 if (!buf) {
4261 reply_nterror(req, NT_STATUS_NO_MEMORY);
4262 error_to_writebrawerr(req);
4263 goto strict_unlock;
4264 }
4265
4266 /* Return a SMBwritebraw message to the redirector to tell
4267 * it to send more bytes */
4268
4269 memcpy(buf, req->inbuf, smb_size);
4270 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4271 SCVAL(buf,smb_com,SMBwritebraw);
4272 SSVALS(buf,smb_vwv0,0xFFFF);
4273 show_msg(buf);
4274 if (!srv_send_smb(req->sconn,
4275 buf,
4276 false, 0, /* no signing */
4277 IS_CONN_ENCRYPTED(conn),
4278 &req->pcd)) {
4279 exit_server_cleanly("reply_writebraw: srv_send_smb "
4280 "failed.");
4281 }
4282
4283 /* Now read the raw data into the buffer and write it */
4284 status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4285 &numtowrite);
4286 if (!NT_STATUS_IS_OK(status)) {
4287 exit_server_cleanly("secondary writebraw failed");
4288 }
4289
4290 /* Set up outbuf to return the correct size */
4291 reply_outbuf(req, 1, 0);
4292
4293 if (numtowrite != 0) {
4294
4295 if (numtowrite > 0xFFFF) {
4296 DEBUG(0,("reply_writebraw: Oversize secondary write "
4297 "raw requested (%u). Terminating\n",
4298 (unsigned int)numtowrite ));
4299 exit_server_cleanly("secondary writebraw failed");
4300 }
4301
4302 if (tcount > nwritten+numtowrite) {
4303 DEBUG(3,("reply_writebraw: Client overestimated the "
4304 "write %d %d %d\n",
4305 (int)tcount,(int)nwritten,(int)numtowrite));
4306 }
4307
4308 status = read_data(xconn->transport.sock, buf+4, numtowrite);
4309
4310 if (!NT_STATUS_IS_OK(status)) {
4311 /* Try and give an error message
4312 * saying what client failed. */
4313 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4314 "raw read failed (%s) for client %s. "
4315 "Terminating\n", nt_errstr(status),
4316 smbXsrv_connection_dbg(xconn)));
4317 exit_server_cleanly("secondary writebraw failed");
4318 }
4319
4320 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4321 if (nwritten == -1) {
4322 TALLOC_FREE(buf);
4323 reply_nterror(req, map_nt_error_from_unix(errno));
4324 error_to_writebrawerr(req);
4325 goto strict_unlock;
4326 }
4327
4328 if (nwritten < (ssize_t)numtowrite) {
4329 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4330 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4331 }
4332
4333 if (nwritten > 0) {
4334 total_written += nwritten;
4335 }
4336 }
4337
4338 TALLOC_FREE(buf);
4339 SSVAL(req->outbuf,smb_vwv0,total_written);
4340
4341 status = sync_file(conn, fsp, write_through);
4342 if (!NT_STATUS_IS_OK(status)) {
4343 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4344 fsp_str_dbg(fsp), nt_errstr(status)));
4345 reply_nterror(req, status);
4346 error_to_writebrawerr(req);
4347 goto strict_unlock;
4348 }
4349
4350 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4351 "wrote=%d\n",
4352 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4353 (int)total_written));
4354
4355 if (!fsp->print_file) {
4356 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4357 }
4358
4359 /* We won't return a status if write through is not selected - this
4360 * follows what WfWg does */
4361 END_PROFILE(SMBwritebraw);
4362
4363 if (!write_through && total_written==tcount) {
4364
4365 #if RABBIT_PELLET_FIX
4366 /*
4367 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4368 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4369 * JRA.
4370 */
4371 if (!send_keepalive(xconn->transport.sock)) {
4372 exit_server_cleanly("reply_writebraw: send of "
4373 "keepalive failed");
4374 }
4375 #endif
4376 TALLOC_FREE(req->outbuf);
4377 }
4378 return;
4379
4380 strict_unlock:
4381 if (!fsp->print_file) {
4382 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4383 }
4384
4385 END_PROFILE(SMBwritebraw);
4386 return;
4387 }
4388
4389 #undef DBGC_CLASS
4390 #define DBGC_CLASS DBGC_LOCKING
4391
4392 /****************************************************************************
4393 Reply to a writeunlock (core+).
4394 ****************************************************************************/
4395
4396 void reply_writeunlock(struct smb_request *req)
4397 {
4398 connection_struct *conn = req->conn;
4399 ssize_t nwritten = -1;
4400 size_t numtowrite;
4401 off_t startpos;
4402 const char *data;
4403 NTSTATUS status = NT_STATUS_OK;
4404 files_struct *fsp;
4405 struct lock_struct lock;
4406 int saved_errno = 0;
4407
4408 START_PROFILE(SMBwriteunlock);
4409
4410 if (req->wct < 5) {
4411 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4412 END_PROFILE(SMBwriteunlock);
4413 return;
4414 }
4415
4416 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4417
4418 if (!check_fsp(conn, req, fsp)) {
4419 END_PROFILE(SMBwriteunlock);
4420 return;
4421 }
4422
4423 if (!CHECK_WRITE(fsp)) {
4424 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4425 END_PROFILE(SMBwriteunlock);
4426 return;
4427 }
4428
4429 numtowrite = SVAL(req->vwv+1, 0);
4430 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4431 data = (const char *)req->buf + 3;
4432
4433 if (!fsp->print_file && numtowrite > 0) {
4434 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4435 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4436 &lock);
4437
4438 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4439 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4440 END_PROFILE(SMBwriteunlock);
4441 return;
4442 }
4443 }
4444
4445 /* The special X/Open SMB protocol handling of
4446 zero length writes is *NOT* done for
4447 this call */
4448 if(numtowrite == 0) {
4449 nwritten = 0;
4450 } else {
4451 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4452 saved_errno = errno;
4453 }
4454
4455 status = sync_file(conn, fsp, False /* write through */);
4456 if (!NT_STATUS_IS_OK(status)) {
4457 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4458 fsp_str_dbg(fsp), nt_errstr(status)));
4459 reply_nterror(req, status);
4460 goto strict_unlock;
4461 }
4462
4463 if(nwritten < 0) {
4464 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4465 goto strict_unlock;
4466 }
4467
4468 if((nwritten < numtowrite) && (numtowrite != 0)) {
4469 reply_nterror(req, NT_STATUS_DISK_FULL);
4470 goto strict_unlock;
4471 }
4472
4473 if (numtowrite && !fsp->print_file) {
4474 status = do_unlock(req->sconn->msg_ctx,
4475 fsp,
4476 (uint64_t)req->smbpid,
4477 (uint64_t)numtowrite,
4478 (uint64_t)startpos,
4479 WINDOWS_LOCK);
4480
4481 if (NT_STATUS_V(status)) {
4482 reply_nterror(req, status);
4483 goto strict_unlock;
4484 }
4485 }
4486
4487 reply_outbuf(req, 1, 0);
4488
4489 SSVAL(req->outbuf,smb_vwv0,nwritten);
4490
4491 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4492 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4493
4494 strict_unlock:
4495 if (numtowrite && !fsp->print_file) {
4496 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4497 }
4498
4499 END_PROFILE(SMBwriteunlock);
4500 return;
4501 }
4502
4503 #undef DBGC_CLASS
4504 #define DBGC_CLASS DBGC_ALL
4505
4506 /****************************************************************************
4507 Reply to a write.
4508 ****************************************************************************/
4509
4510 void reply_write(struct smb_request *req)
4511 {
4512 connection_struct *conn = req->conn;
4513 size_t numtowrite;
4514 ssize_t nwritten = -1;
4515 off_t startpos;
4516 const char *data;
4517 files_struct *fsp;
4518 struct lock_struct lock;
4519 NTSTATUS status;
4520 int saved_errno = 0;
4521
4522 START_PROFILE(SMBwrite);
4523
4524 if (req->wct < 5) {
4525 END_PROFILE(SMBwrite);
4526 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4527 return;
4528 }
4529
4530 /* If it's an IPC, pass off the pipe handler. */
4531 if (IS_IPC(conn)) {
4532 reply_pipe_write(req);
4533 END_PROFILE(SMBwrite);
4534 return;
4535 }
4536
4537 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4538
4539 if (!check_fsp(conn, req, fsp)) {
4540 END_PROFILE(SMBwrite);
4541 return;
4542 }
4543
4544 if (!CHECK_WRITE(fsp)) {
4545 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4546 END_PROFILE(SMBwrite);
4547 return;
4548 }
4549
4550 numtowrite = SVAL(req->vwv+1, 0);
4551 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4552 data = (const char *)req->buf + 3;
4553
4554 if (!fsp->print_file) {
4555 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4556 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4557 &lock);
4558
4559 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4560 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4561 END_PROFILE(SMBwrite);
4562 return;
4563 }
4564 }
4565
4566 /*
4567 * X/Open SMB protocol says that if smb_vwv1 is
4568 * zero then the file size should be extended or
4569 * truncated to the size given in smb_vwv[2-3].
4570 */
4571
4572 if(numtowrite == 0) {
4573 /*
4574 * This is actually an allocate call, and set EOF. JRA.
4575 */
4576 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4577 if (nwritten < 0) {
4578 reply_nterror(req, NT_STATUS_DISK_FULL);
4579 goto strict_unlock;
4580 }
4581 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4582 if (nwritten < 0) {
4583 reply_nterror(req, NT_STATUS_DISK_FULL);
4584 goto strict_unlock;
4585 }
4586 trigger_write_time_update_immediate(fsp);
4587 } else {
4588 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4589 }
4590
4591 status = sync_file(conn, fsp, False);
4592 if (!NT_STATUS_IS_OK(status)) {
4593 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4594 fsp_str_dbg(fsp), nt_errstr(status)));
4595 reply_nterror(req, status);
4596 goto strict_unlock;
4597 }
4598
4599 if(nwritten < 0) {
4600 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4601 goto strict_unlock;
4602 }
4603
4604 if((nwritten == 0) && (numtowrite != 0)) {
4605 reply_nterror(req, NT_STATUS_DISK_FULL);
4606 goto strict_unlock;
4607 }
4608
4609 reply_outbuf(req, 1, 0);
4610
4611 SSVAL(req->outbuf,smb_vwv0,nwritten);
4612
4613 if (nwritten < (ssize_t)numtowrite) {
4614 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4615 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4616 }
4617
4618 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4619
4620 strict_unlock:
4621 if (!fsp->print_file) {
4622 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4623 }
4624
4625 END_PROFILE(SMBwrite);
4626 return;
4627 }
4628
4629 /****************************************************************************
4630 Ensure a buffer is a valid writeX for recvfile purposes.
4631 ****************************************************************************/
4632
4633 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4634 (2*14) + /* word count (including bcc) */ \
4635 1 /* pad byte */)
4636
4637 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4638 const uint8_t *inbuf)
4639 {
4640 size_t numtowrite;
4641 unsigned int doff = 0;
4642 size_t len = smb_len_large(inbuf);
4643 uint16_t fnum;
4644 struct smbXsrv_open *op = NULL;
4645 struct files_struct *fsp = NULL;
4646 NTSTATUS status;
4647
4648 if (is_encrypted_packet(inbuf)) {
4649 /* Can't do this on encrypted
4650 * connections. */
4651 return false;
4652 }
4653
4654 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4655 return false;
4656 }
4657
4658 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4659 CVAL(inbuf,smb_wct) != 14) {
4660 DEBUG(10,("is_valid_writeX_buffer: chained or "
4661 "invalid word length.\n"));
4662 return false;
4663 }
4664
4665 fnum = SVAL(inbuf, smb_vwv2);
4666 status = smb1srv_open_lookup(xconn,
4667 fnum,
4668 0, /* now */
4669 &op);
4670 if (!NT_STATUS_IS_OK(status)) {
4671 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4672 return false;
4673 }
4674 fsp = op->compat;
4675 if (fsp == NULL) {
4676 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4677 return false;
4678 }
4679 if (fsp->conn == NULL) {
4680 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4681 return false;
4682 }
4683
4684 if (IS_IPC(fsp->conn)) {
4685 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4686 return false;
4687 }
4688 if (IS_PRINT(fsp->conn)) {
4689 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4690 return false;
4691 }
4692 doff = SVAL(inbuf,smb_vwv11);
4693
4694 numtowrite = SVAL(inbuf,smb_vwv10);
4695
4696 if (len > doff && len - doff > 0xFFFF) {
4697 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4698 }
4699
4700 if (numtowrite == 0) {
4701 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4702 return false;
4703 }
4704
4705 /* Ensure the sizes match up. */
4706 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4707 /* no pad byte...old smbclient :-( */
4708 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4709 (unsigned int)doff,
4710 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4711 return false;
4712 }
4713
4714 if (len - doff != numtowrite) {
4715 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4716 "len = %u, doff = %u, numtowrite = %u\n",
4717 (unsigned int)len,
4718 (unsigned int)doff,
4719 (unsigned int)numtowrite ));
4720 return false;
4721 }
4722
4723 DEBUG(10,("is_valid_writeX_buffer: true "
4724 "len = %u, doff = %u, numtowrite = %u\n",
4725 (unsigned int)len,
4726 (unsigned int)doff,
4727 (unsigned int)numtowrite ));
4728
4729 return true;
4730 }
4731
4732 /****************************************************************************
4733 Reply to a write and X.
4734 ****************************************************************************/
4735
4736 void reply_write_and_X(struct smb_request *req)
4737 {
4738 connection_struct *conn = req->conn;
4739 struct smbXsrv_connection *xconn = req->xconn;
4740 files_struct *fsp;
4741 struct lock_struct lock;
4742 off_t startpos;
4743 size_t numtowrite;
4744 bool write_through;
4745 ssize_t nwritten;
4746 unsigned int smb_doff;
4747 unsigned int smblen;
4748 const char *data;
4749 NTSTATUS status;
4750 int saved_errno = 0;
4751
4752 START_PROFILE(SMBwriteX);
4753
4754 if ((req->wct != 12) && (req->wct != 14)) {
4755 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4756 goto out;
4757 }
4758
4759 numtowrite = SVAL(req->vwv+10, 0);
4760 smb_doff = SVAL(req->vwv+11, 0);
4761 smblen = smb_len(req->inbuf);
4762
4763 if (req->unread_bytes > 0xFFFF ||
4764 (smblen > smb_doff &&
4765 smblen - smb_doff > 0xFFFF)) {
4766 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4767 }
4768
4769 if (req->unread_bytes) {
4770 /* Can't do a recvfile write on IPC$ */
4771 if (IS_IPC(conn)) {
4772 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4773 goto out;
4774 }
4775 if (numtowrite != req->unread_bytes) {
4776 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4777 goto out;
4778 }
4779 } else {
4780 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4781 smb_doff + numtowrite > smblen) {
4782 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4783 goto out;
4784 }
4785 }
4786
4787 /* If it's an IPC, pass off the pipe handler. */
4788 if (IS_IPC(conn)) {
4789 if (req->unread_bytes) {
4790 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4791 goto out;
4792 }
4793 reply_pipe_write_and_X(req);
4794 goto out;
4795 }
4796
4797 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4798 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4799 write_through = BITSETW(req->vwv+7,0);
4800
4801 if (!check_fsp(conn, req, fsp)) {
4802 goto out;
4803 }
4804
4805 if (!CHECK_WRITE(fsp)) {
4806 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4807 goto out;
4808 }
4809
4810 data = smb_base(req->inbuf) + smb_doff;
4811
4812 if(req->wct == 14) {
4813 /*
4814 * This is a large offset (64 bit) write.
4815 */
4816 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4817
4818 }
4819
4820 /* X/Open SMB protocol says that, unlike SMBwrite
4821 if the length is zero then NO truncation is
4822 done, just a write of zero. To truncate a file,
4823 use SMBwrite. */
4824
4825 if(numtowrite == 0) {
4826 nwritten = 0;
4827 } else {
4828 if (req->unread_bytes == 0) {
4829 status = schedule_aio_write_and_X(conn,
4830 req,
4831 fsp,
4832 data,
4833 startpos,
4834 numtowrite);
4835
4836 if (NT_STATUS_IS_OK(status)) {
4837 /* write scheduled - we're done. */
4838 goto out;
4839 }
4840 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4841 /* Real error - report to client. */
4842 reply_nterror(req, status);
4843 goto out;
4844 }
4845 /* NT_STATUS_RETRY - fall through to sync write. */
4846 }
4847
4848 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4849 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4850 &lock);
4851
4852 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4853 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4854 goto out;
4855 }
4856
4857 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4858 saved_errno = errno;
4859
4860 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4861 }
4862
4863 if(nwritten < 0) {
4864 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4865 goto out;
4866 }
4867
4868 if((nwritten == 0) && (numtowrite != 0)) {
4869 reply_nterror(req, NT_STATUS_DISK_FULL);
4870 goto out;
4871 }
4872
4873 reply_outbuf(req, 6, 0);
4874 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4875 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4876 SSVAL(req->outbuf,smb_vwv2,nwritten);
4877 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4878
4879 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4880 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4881
4882 status = sync_file(conn, fsp, write_through);
4883 if (!NT_STATUS_IS_OK(status)) {
4884 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4885 fsp_str_dbg(fsp), nt_errstr(status)));
4886 reply_nterror(req, status);
4887 goto out;
4888 }
4889
4890 END_PROFILE(SMBwriteX);
4891 return;
4892
4893 out:
4894 if (req->unread_bytes) {
4895 /* writeX failed. drain socket. */
4896 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
4897 req->unread_bytes) {
4898 smb_panic("failed to drain pending bytes");
4899 }
4900 req->unread_bytes = 0;
4901 }
4902
4903 END_PROFILE(SMBwriteX);
4904 return;
4905 }
4906
4907 /****************************************************************************
4908 Reply to a lseek.
4909 ****************************************************************************/
4910
4911 void reply_lseek(struct smb_request *req)
4912 {
4913 connection_struct *conn = req->conn;
4914 off_t startpos;
4915 off_t res= -1;
4916 int mode,umode;
4917 files_struct *fsp;
4918
4919 START_PROFILE(SMBlseek);
4920
4921 if (req->wct < 4) {
4922 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4923 END_PROFILE(SMBlseek);
4924 return;
4925 }
4926
4927 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4928
4929 if (!check_fsp(conn, req, fsp)) {
4930 return;
4931 }
4932
4933 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4934
4935 mode = SVAL(req->vwv+1, 0) & 3;
4936 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4937 startpos = (off_t)IVALS(req->vwv+2, 0);
4938
4939 switch (mode) {
4940 case 0:
4941 umode = SEEK_SET;
4942 res = startpos;
4943 break;
4944 case 1:
4945 umode = SEEK_CUR;
4946 res = fsp->fh->pos + startpos;
4947 break;
4948 case 2:
4949 umode = SEEK_END;
4950 break;
4951 default:
4952 umode = SEEK_SET;
4953 res = startpos;
4954 break;
4955 }
4956
4957 if (umode == SEEK_END) {
4958 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4959 if(errno == EINVAL) {
4960 off_t current_pos = startpos;
4961
4962 if(fsp_stat(fsp) == -1) {
4963 reply_nterror(req,
4964 map_nt_error_from_unix(errno));
4965 END_PROFILE(SMBlseek);
4966 return;
4967 }
4968
4969 current_pos += fsp->fsp_name->st.st_ex_size;
4970 if(current_pos < 0)
4971 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4972 }
4973 }
4974
4975 if(res == -1) {
4976 reply_nterror(req, map_nt_error_from_unix(errno));
4977 END_PROFILE(SMBlseek);
4978 return;
4979 }
4980 }
4981
4982 fsp->fh->pos = res;
4983
4984 reply_outbuf(req, 2, 0);
4985 SIVAL(req->outbuf,smb_vwv0,res);
4986
4987 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4988 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4989
4990 END_PROFILE(SMBlseek);
4991 return;
4992 }
4993
4994 /****************************************************************************
4995 Reply to a flush.
4996 ****************************************************************************/
4997
4998 void reply_flush(struct smb_request *req)
4999 {
5000 connection_struct *conn = req->conn;
5001 uint16 fnum;
5002 files_struct *fsp;
5003
5004 START_PROFILE(SMBflush);
5005
5006 if (req->wct < 1) {
5007 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5008 return;
5009 }
5010
5011 fnum = SVAL(req->vwv+0, 0);
5012 fsp = file_fsp(req, fnum);
5013
5014 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5015 return;
5016 }
5017
5018 if (!fsp) {
5019 file_sync_all(conn);
5020 } else {
5021 NTSTATUS status = sync_file(conn, fsp, True);
5022 if (!NT_STATUS_IS_OK(status)) {
5023 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5024 fsp_str_dbg(fsp), nt_errstr(status)));
5025 reply_nterror(req, status);
5026 END_PROFILE(SMBflush);
5027 return;
5028 }
5029 }
5030
5031 reply_outbuf(req, 0, 0);
5032
5033 DEBUG(3,("flush\n"));
5034 END_PROFILE(SMBflush);
5035 return;
5036 }
5037
5038 /****************************************************************************
5039 Reply to a exit.
5040 conn POINTER CAN BE NULL HERE !
5041 ****************************************************************************/
5042
5043 void reply_exit(struct smb_request *req)
5044 {
5045 START_PROFILE(SMBexit);
5046
5047 file_close_pid(req->sconn, req->smbpid, req->vuid);
5048
5049 reply_outbuf(req, 0, 0);
5050
5051 DEBUG(3,("exit\n"));
5052
5053 END_PROFILE(SMBexit);
5054 return;
5055 }
5056
5057 struct reply_close_state {
5058 files_struct *fsp;
5059 struct smb_request *smbreq;
5060 };
5061
5062 static void do_smb1_close(struct tevent_req *req);
5063
5064 void reply_close(struct smb_request *req)
5065 {
5066 connection_struct *conn = req->conn;
5067 NTSTATUS status = NT_STATUS_OK;
5068 files_struct *fsp = NULL;
5069 START_PROFILE(SMBclose);
5070
5071 if (req->wct < 3) {
5072 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5073 END_PROFILE(SMBclose);
5074 return;
5075 }
5076
5077 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5078
5079 /*
5080 * We can only use check_fsp if we know it's not a directory.
5081 */
5082
5083 if (!check_fsp_open(conn, req, fsp)) {
5084 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5085 END_PROFILE(SMBclose);
5086 return;
5087 }
5088
5089 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5090 fsp->is_directory ? "directory" : "file",
5091 fsp->fh->fd, fsp_fnum_dbg(fsp),
5092 conn->num_files_open));
5093
5094 if (!fsp->is_directory) {
5095 time_t t;
5096
5097 /*
5098 * Take care of any time sent in the close.
5099 */
5100
5101 t = srv_make_unix_date3(req->vwv+1);
5102 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5103 }
5104
5105 if (fsp->num_aio_requests != 0) {
5106
5107 struct reply_close_state *state;
5108
5109 DEBUG(10, ("closing with aio %u requests pending\n",
5110 fsp->num_aio_requests));
5111
5112 /*
5113 * We depend on the aio_extra destructor to take care of this
5114 * close request once fsp->num_aio_request drops to 0.
5115 */
5116
5117 fsp->deferred_close = tevent_wait_send(
5118 fsp, fsp->conn->sconn->ev_ctx);
5119 if (fsp->deferred_close == NULL) {
5120 status = NT_STATUS_NO_MEMORY;
5121 goto done;
5122 }
5123
5124 state = talloc(fsp, struct reply_close_state);
5125 if (state == NULL) {
5126 TALLOC_FREE(fsp->deferred_close);
5127 status = NT_STATUS_NO_MEMORY;
5128 goto done;
5129 }
5130 state->fsp = fsp;
5131 state->smbreq = talloc_move(fsp, &req);
5132 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5133 state);
5134 END_PROFILE(SMBclose);
5135 return;
5136 }
5137
5138 /*
5139 * close_file() returns the unix errno if an error was detected on
5140 * close - normally this is due to a disk full error. If not then it
5141 * was probably an I/O error.
5142 */
5143
5144 status = close_file(req, fsp, NORMAL_CLOSE);
5145 done:
5146 if (!NT_STATUS_IS_OK(status)) {
5147 reply_nterror(req, status);
5148 END_PROFILE(SMBclose);
5149 return;
5150 }
5151
5152 reply_outbuf(req, 0, 0);
5153 END_PROFILE(SMBclose);
5154 return;
5155 }
5156
5157 static void do_smb1_close(struct tevent_req *req)
5158 {
5159 struct reply_close_state *state = tevent_req_callback_data(
5160 req, struct reply_close_state);
5161 struct smb_request *smbreq;
5162 NTSTATUS status;
5163 int ret;
5164
5165 ret = tevent_wait_recv(req);
5166 TALLOC_FREE(req);
5167 if (ret != 0) {
5168 DEBUG(10, ("tevent_wait_recv returned %s\n",
5169 strerror(ret)));
5170 /*
5171 * Continue anyway, this should never happen
5172 */
5173 }
5174
5175 /*
5176 * fsp->smb2_close_request right now is a talloc grandchild of
5177 * fsp. When we close_file(fsp), it would go with it. No chance to
5178 * reply...
5179 */
5180 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5181
5182 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5183 if (NT_STATUS_IS_OK(status)) {
5184 reply_outbuf(smbreq, 0, 0);
5185 } else {
5186 reply_nterror(smbreq, status);
5187 }
5188 if (!srv_send_smb(smbreq->sconn,
5189 (char *)smbreq->outbuf,
5190 true,
5191 smbreq->seqnum+1,
5192 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5193 NULL)) {
5194 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5195 "failed.");
5196 }
5197 TALLOC_FREE(smbreq);
5198 }
5199
5200 /****************************************************************************
5201 Reply to a writeclose (Core+ protocol).
5202 ****************************************************************************/
5203
5204 void reply_writeclose(struct smb_request *req)
5205 {
5206 connection_struct *conn = req->conn;
5207 size_t numtowrite;
5208 ssize_t nwritten = -1;
5209 NTSTATUS close_status = NT_STATUS_OK;
5210 off_t startpos;
5211 const char *data;
5212 struct timespec mtime;
5213 files_struct *fsp;
5214 struct lock_struct lock;
5215
5216 START_PROFILE(SMBwriteclose);
5217
5218 if (req->wct < 6) {
5219 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5220 END_PROFILE(SMBwriteclose);
5221 return;
5222 }
5223
5224 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5225
5226 if (!check_fsp(conn, req, fsp)) {
5227 END_PROFILE(SMBwriteclose);
5228 return;
5229 }
5230 if (!CHECK_WRITE(fsp)) {
5231 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5232 END_PROFILE(SMBwriteclose);
5233 return;
5234 }
5235
5236 numtowrite = SVAL(req->vwv+1, 0);
5237 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5238 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5239 data = (const char *)req->buf + 1;
5240
5241 if (fsp->print_file == NULL) {
5242 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5243 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5244 &lock);
5245
5246 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5247 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5248 END_PROFILE(SMBwriteclose);
5249 return;
5250 }
5251 }
5252
5253 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5254
5255 if (fsp->print_file == NULL) {
5256 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5257 }
5258
5259 set_close_write_time(fsp, mtime);
5260
5261 /*
5262 * More insanity. W2K only closes the file if writelen > 0.
5263 * JRA.
5264 */
5265
5266 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5267 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5268 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5269
5270 if (numtowrite) {
5271 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5272 "file %s\n", fsp_str_dbg(fsp)));
5273 close_status = close_file(req, fsp, NORMAL_CLOSE);
5274 fsp = NULL;
5275 }
5276
5277 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5278 reply_nterror(req, NT_STATUS_DISK_FULL);
5279 goto out;
5280 }
5281
5282 if(!NT_STATUS_IS_OK(close_status)) {
5283 reply_nterror(req, close_status);
5284 goto out;
5285 }
5286
5287 reply_outbuf(req, 1, 0);
5288
5289 SSVAL(req->outbuf,smb_vwv0,nwritten);
5290
5291 out:
5292
5293 END_PROFILE(SMBwriteclose);
5294 return;
5295 }
5296
5297 #undef DBGC_CLASS
5298 #define DBGC_CLASS DBGC_LOCKING
5299
5300 /****************************************************************************
5301 Reply to a lock.
5302 ****************************************************************************/
5303
5304 void reply_lock(struct smb_request *req)
5305 {
5306 connection_struct *conn = req->conn;
5307 uint64_t count,offset;
5308 NTSTATUS status;
5309 files_struct *fsp;
5310 struct byte_range_lock *br_lck = NULL;
5311
5312 START_PROFILE(SMBlock);
5313
5314 if (req->wct < 5) {
5315 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5316 END_PROFILE(SMBlock);
5317 return;
5318 }
5319
5320 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5321
5322 if (!check_fsp(conn, req, fsp)) {
5323 END_PROFILE(SMBlock);
5324 return;
5325 }
5326
5327 count = (uint64_t)IVAL(req->vwv+1, 0);
5328 offset = (uint64_t)IVAL(req->vwv+3, 0);
5329
5330 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5331 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5332
5333 br_lck = do_lock(req->sconn->msg_ctx,
5334 fsp,
5335 (uint64_t)req->smbpid,
5336 count,
5337 offset,
5338 WRITE_LOCK,
5339 WINDOWS_LOCK,
5340 False, /* Non-blocking lock. */
5341 &status,
5342 NULL);
5343
5344 TALLOC_FREE(br_lck);
5345
5346 if (NT_STATUS_V(status)) {
5347 reply_nterror(req, status);
5348 END_PROFILE(SMBlock);
5349 return;
5350 }
5351
5352 reply_outbuf(req, 0, 0);
5353
5354 END_PROFILE(SMBlock);
5355 return;
5356 }
5357
5358 /****************************************************************************
5359 Reply to a unlock.
5360 ****************************************************************************/
5361
5362 void reply_unlock(struct smb_request *req)
5363 {
5364 connection_struct *conn = req->conn;
5365 uint64_t count,offset;
5366 NTSTATUS status;
5367 files_struct *fsp;
5368
5369 START_PROFILE(SMBunlock);
5370
5371 if (req->wct < 5) {
5372 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5373 END_PROFILE(SMBunlock);
5374 return;
5375 }
5376
5377 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5378
5379 if (!check_fsp(conn, req, fsp)) {
5380 END_PROFILE(SMBunlock);
5381 return;
5382 }
5383
5384 count = (uint64_t)IVAL(req->vwv+1, 0);
5385 offset = (uint64_t)IVAL(req->vwv+3, 0);
5386
5387 status = do_unlock(req->sconn->msg_ctx,
5388 fsp,
5389 (uint64_t)req->smbpid,
5390 count,
5391 offset,
5392 WINDOWS_LOCK);
5393
5394 if (NT_STATUS_V(status)) {
5395 reply_nterror(req, status);
5396 END_PROFILE(SMBunlock);
5397 return;
5398 }
5399
5400 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5401 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5402
5403 reply_outbuf(req, 0, 0);
5404
5405 END_PROFILE(SMBunlock);
5406 return;
5407 }
5408
5409 #undef DBGC_CLASS
5410 #define DBGC_CLASS DBGC_ALL
5411
5412 /****************************************************************************
5413 Reply to a tdis.
5414 conn POINTER CAN BE NULL HERE !
5415 ****************************************************************************/
5416
5417 void reply_tdis(struct smb_request *req)
5418 {
5419 NTSTATUS status;
5420 connection_struct *conn = req->conn;
5421 struct smbXsrv_tcon *tcon;
5422
5423 START_PROFILE(SMBtdis);
5424
5425 if (!conn) {
5426 DEBUG(4,("Invalid connection in tdis\n"));
5427 reply_force_doserror(req, ERRSRV, ERRinvnid);
5428 END_PROFILE(SMBtdis);
5429 return;
5430 }
5431
5432 tcon = conn->tcon;
5433 req->conn = NULL;
5434
5435 /*
5436 * TODO: cancel all outstanding requests on the tcon
5437 */
5438 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5439 if (!NT_STATUS_IS_OK(status)) {
5440 DEBUG(0, ("reply_tdis: "
5441 "smbXsrv_tcon_disconnect() failed: %s\n",
5442 nt_errstr(status)));
5443 /*
5444 * If we hit this case, there is something completely
5445 * wrong, so we better disconnect the transport connection.
5446 */
5447 END_PROFILE(SMBtdis);
5448 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5449 return;
5450 }
5451
5452 TALLOC_FREE(tcon);
5453
5454 reply_outbuf(req, 0, 0);
5455 END_PROFILE(SMBtdis);
5456 return;
5457 }
5458
5459 /****************************************************************************
5460 Reply to a echo.
5461 conn POINTER CAN BE NULL HERE !
5462 ****************************************************************************/
5463
5464 void reply_echo(struct smb_request *req)
5465 {
5466 connection_struct *conn = req->conn;
5467 struct smb_perfcount_data local_pcd;
5468 struct smb_perfcount_data *cur_pcd;
5469 int smb_reverb;
5470 int seq_num;
5471
5472 START_PROFILE(SMBecho);
5473
5474 smb_init_perfcount_data(&local_pcd);
5475
5476 if (req->wct < 1) {
5477 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5478 END_PROFILE(SMBecho);
5479 return;
5480 }
5481
5482 smb_reverb = SVAL(req->vwv+0, 0);
5483
5484 reply_outbuf(req, 1, req->buflen);
5485
5486 /* copy any incoming data back out */
5487 if (req->buflen > 0) {
5488 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5489 }
5490
5491 if (smb_reverb > 100) {
5492 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5493 smb_reverb = 100;
5494 }
5495
5496 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5497
5498 /* this makes sure we catch the request pcd */
5499 if (seq_num == smb_reverb) {
5500 cur_pcd = &req->pcd;
5501 } else {
5502 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5503 cur_pcd = &local_pcd;
5504 }
5505
5506 SSVAL(req->outbuf,smb_vwv0,seq_num);
5507
5508 show_msg((char *)req->outbuf);
5509 if (!srv_send_smb(req->sconn,
5510 (char *)req->outbuf,
5511 true, req->seqnum+1,
5512 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5513 cur_pcd))
5514 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5515 }
5516
5517 DEBUG(3,("echo %d times\n", smb_reverb));
5518
5519 TALLOC_FREE(req->outbuf);
5520
5521 END_PROFILE(SMBecho);
5522 return;
5523 }
5524
5525 /****************************************************************************
5526 Reply to a printopen.
5527 ****************************************************************************/
5528
5529 void reply_printopen(struct smb_request *req)
5530 {
5531 connection_struct *conn = req->conn;
5532 files_struct *fsp;
5533 NTSTATUS status;
5534
5535 START_PROFILE(SMBsplopen);
5536
5537 if (req->wct < 2) {
5538 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5539 END_PROFILE(SMBsplopen);
5540 return;
5541 }
5542
5543 if (!CAN_PRINT(conn)) {
5544 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5545 END_PROFILE(SMBsplopen);
5546 return;
5547 }
5548
5549 status = file_new(req, conn, &fsp);
5550 if(!NT_STATUS_IS_OK(status)) {
5551 reply_nterror(req, status);
5552 END_PROFILE(SMBsplopen);
5553 return;
5554 }
5555
5556 /* Open for exclusive use, write only. */
5557 status = print_spool_open(fsp, NULL, req->vuid);
5558
5559 if (!NT_STATUS_IS_OK(status)) {
5560 file_free(req, fsp);
5561 reply_nterror(req, status);
5562 END_PROFILE(SMBsplopen);
5563 return;
5564 }
5565
5566 reply_outbuf(req, 1, 0);
5567 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5568
5569 DEBUG(3,("openprint fd=%d %s\n",
5570 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5571
5572 END_PROFILE(SMBsplopen);
5573 return;
5574 }
5575
5576 /****************************************************************************
5577 Reply to a printclose.
5578 ****************************************************************************/
5579
5580 void reply_printclose(struct smb_request *req)
5581 {
5582 connection_struct *conn = req->conn;
5583 files_struct *fsp;
5584 NTSTATUS status;
5585
5586 START_PROFILE(SMBsplclose);
5587
5588 if (req->wct < 1) {
5589 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5590 END_PROFILE(SMBsplclose);
5591 return;
5592 }
5593
5594 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5595
5596 if (!check_fsp(conn, req, fsp)) {
5597 END_PROFILE(SMBsplclose);
5598 return;
5599 }
5600
5601 if (!CAN_PRINT(conn)) {
5602 reply_force_doserror(req, ERRSRV, ERRerror);
5603 END_PROFILE(SMBsplclose);
5604 return;
5605 }
5606
5607 DEBUG(3,("printclose fd=%d %s\n",
5608 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5609
5610 status = close_file(req, fsp, NORMAL_CLOSE);
5611
5612 if(!NT_STATUS_IS_OK(status)) {
5613 reply_nterror(req, status);
5614 END_PROFILE(SMBsplclose);
5615 return;
5616 }
5617
5618 reply_outbuf(req, 0, 0);
5619
5620 END_PROFILE(SMBsplclose);
5621 return;
5622 }
5623
5624 /****************************************************************************
5625 Reply to a printqueue.
5626 ****************************************************************************/
5627
5628 void reply_printqueue(struct smb_request *req)
5629 {
5630 connection_struct *conn = req->conn;
5631 int max_count;
5632 int start_index;
5633
5634 START_PROFILE(SMBsplretq);
5635
5636 if (req->wct < 2) {
5637 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5638 END_PROFILE(SMBsplretq);
5639 return;
5640 }
5641
5642 max_count = SVAL(req->vwv+0, 0);
5643 start_index = SVAL(req->vwv+1, 0);
5644
5645 /* we used to allow the client to get the cnum wrong, but that
5646 is really quite gross and only worked when there was only
5647 one printer - I think we should now only accept it if they
5648 get it right (tridge) */
5649 if (!CAN_PRINT(conn)) {
5650 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5651 END_PROFILE(SMBsplretq);
5652 return;
5653 }
5654
5655 reply_outbuf(req, 2, 3);
5656 SSVAL(req->outbuf,smb_vwv0,0);
5657 SSVAL(req->outbuf,smb_vwv1,0);
5658 SCVAL(smb_buf(req->outbuf),0,1);
5659 SSVAL(smb_buf(req->outbuf),1,0);
5660
5661 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5662 start_index, max_count));
5663
5664 {
5665 TALLOC_CTX *mem_ctx = talloc_tos();
5666 NTSTATUS status;
5667 WERROR werr;
5668 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5669 struct rpc_pipe_client *cli = NULL;
5670 struct dcerpc_binding_handle *b = NULL;
5671 struct policy_handle handle;
5672 struct spoolss_DevmodeContainer devmode_ctr;
5673 union spoolss_JobInfo *info;
5674 uint32_t count;
5675 uint32_t num_to_get;
5676 uint32_t first;
5677 uint32_t i;
5678
5679 ZERO_STRUCT(handle);
5680
5681 status = rpc_pipe_open_interface(conn,
5682 &ndr_table_spoolss,
5683 conn->session_info,
5684 conn->sconn->remote_address,
5685 conn->sconn->msg_ctx,
5686 &cli);
5687 if (!NT_STATUS_IS_OK(status)) {
5688 DEBUG(0, ("reply_printqueue: "
5689 "could not connect to spoolss: %s\n",
5690 nt_errstr(status)));
5691 reply_nterror(req, status);
5692 goto out;
5693 }
5694 b = cli->binding_handle;
5695
5696 ZERO_STRUCT(devmode_ctr);
5697
5698 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5699 sharename,
5700 NULL, devmode_ctr,
5701 SEC_FLAG_MAXIMUM_ALLOWED,
5702 &handle,
5703 &werr);
5704 if (!NT_STATUS_IS_OK(status)) {
5705 reply_nterror(req, status);
5706 goto out;
5707 }
5708 if (!W_ERROR_IS_OK(werr)) {
5709 reply_nterror(req, werror_to_ntstatus(werr));
5710 goto out;
5711 }
5712
5713 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5714 &handle,
5715 0, /* firstjob */
5716 0xff, /* numjobs */
5717 2, /* level */
5718 0, /* offered */
5719 &count,
5720 &info);
5721 if (!W_ERROR_IS_OK(werr)) {
5722 reply_nterror(req, werror_to_ntstatus(werr));
5723 goto out;
5724 }
5725
5726 if (max_count > 0) {
5727 first = start_index;
5728 } else {
5729 first = start_index + max_count + 1;
5730 }
5731
5732 if (first >= count) {
5733 num_to_get = first;
5734 } else {
5735 num_to_get = first + MIN(ABS(max_count), count - first);
5736 }
5737
5738 for (i = first; i < num_to_get; i++) {
5739 char blob[28];
5740 char *p = blob;
5741 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5742 int qstatus;
5743 uint16_t qrapjobid = pjobid_to_rap(sharename,
5744 info[i].info2.job_id);
5745
5746 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5747 qstatus = 2;
5748 } else {
5749 qstatus = 3;
5750 }
5751
5752 srv_put_dos_date2(p, 0, qtime);
5753 SCVAL(p, 4, qstatus);
5754 SSVAL(p, 5, qrapjobid);
5755 SIVAL(p, 7, info[i].info2.size);
5756 SCVAL(p, 11, 0);
5757 srvstr_push(blob, req->flags2, p+12,
5758 info[i].info2.notify_name, 16, STR_ASCII);
5759
5760 if (message_push_blob(
5761 &req->outbuf,
5762 data_blob_const(
5763 blob, sizeof(blob))) == -1) {
5764 reply_nterror(req, NT_STATUS_NO_MEMORY);
5765 goto out;
5766 }
5767 }
5768
5769 if (count > 0) {
5770 SSVAL(req->outbuf,smb_vwv0,count);
5771 SSVAL(req->outbuf,smb_vwv1,
5772 (max_count>0?first+count:first-1));
5773 SCVAL(smb_buf(req->outbuf),0,1);
5774 SSVAL(smb_buf(req->outbuf),1,28*count);
5775 }
5776
5777
5778 DEBUG(3, ("%u entries returned in queue\n",
5779 (unsigned)count));
5780
5781 out:
5782 if (b && is_valid_policy_hnd(&handle)) {
5783 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5784 }
5785
5786 }
5787
5788 END_PROFILE(SMBsplretq);
5789 return;
5790 }
5791
5792 /****************************************************************************
5793 Reply to a printwrite.
5794 ****************************************************************************/
5795
5796 void reply_printwrite(struct smb_request *req)
5797 {
5798 connection_struct *conn = req->conn;
5799 int numtowrite;
5800 const char *data;
5801 files_struct *fsp;
5802
5803 START_PROFILE(SMBsplwr);
5804
5805 if (req->wct < 1) {
5806 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5807 END_PROFILE(SMBsplwr);
5808 return;
5809 }
5810
5811 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5812
5813 if (!check_fsp(conn, req, fsp)) {
5814 END_PROFILE(SMBsplwr);
5815 return;
5816 }
5817
5818 if (!fsp->print_file) {
5819 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5820 END_PROFILE(SMBsplwr);
5821 return;
5822 }
5823
5824 if (!CHECK_WRITE(fsp)) {
5825 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5826 END_PROFILE(SMBsplwr);
5827 return;
5828 }
5829
5830 numtowrite = SVAL(req->buf, 1);
5831
5832 if (req->buflen < numtowrite + 3) {
5833 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5834 END_PROFILE(SMBsplwr);
5835 return;
5836 }
5837
5838 data = (const char *)req->buf + 3;
5839
5840 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5841 reply_nterror(req, map_nt_error_from_unix(errno));
5842 END_PROFILE(SMBsplwr);
5843 return;
5844 }
5845
5846 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5847
5848 END_PROFILE(SMBsplwr);
5849 return;
5850 }
5851
5852 /****************************************************************************
5853 Reply to a mkdir.
5854 ****************************************************************************/
5855
5856 void reply_mkdir(struct smb_request *req)
5857 {
5858 connection_struct *conn = req->conn;
5859 struct smb_filename *smb_dname = NULL;
5860 char *directory = NULL;
5861 NTSTATUS status;
5862 TALLOC_CTX *ctx = talloc_tos();
5863
5864 START_PROFILE(SMBmkdir);
5865
5866 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5867 STR_TERMINATE, &status);
5868 if (!NT_STATUS_IS_OK(status)) {
5869 reply_nterror(req, status);
5870 goto out;
5871 }
5872
5873 status = filename_convert(ctx, conn,
5874 req->flags2 & FLAGS2_DFS_PATHNAMES,
5875 directory,
5876 UCF_PREP_CREATEFILE,
5877 NULL,
5878 &smb_dname);
5879 if (!NT_STATUS_IS_OK(status)) {
5880 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5881 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5882 ERRSRV, ERRbadpath);
5883 goto out;
5884 }
5885 reply_nterror(req, status);
5886 goto out;
5887 }
5888
5889 status = create_directory(conn, req, smb_dname);
5890
5891 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5892
5893 if (!NT_STATUS_IS_OK(status)) {
5894
5895 if (!use_nt_status()
5896 && NT_STATUS_EQUAL(status,
5897 NT_STATUS_OBJECT_NAME_COLLISION)) {
5898 /*
5899 * Yes, in the DOS error code case we get a
5900 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5901 * samba4 torture test.
5902 */
5903 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5904 }
5905
5906 reply_nterror(req, status);
5907 goto out;
5908 }
5909
5910 reply_outbuf(req, 0, 0);
5911
5912 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5913 out:
5914 TALLOC_FREE(smb_dname);
5915 END_PROFILE(SMBmkdir);
5916 return;
5917 }
5918
5919 /****************************************************************************
5920 Reply to a rmdir.
5921 ****************************************************************************/
5922
5923 void reply_rmdir(struct smb_request *req)
5924 {
5925 connection_struct *conn = req->conn;
5926 struct smb_filename *smb_dname = NULL;
5927 char *directory = NULL;
5928 NTSTATUS status;
5929 TALLOC_CTX *ctx = talloc_tos();
5930 files_struct *fsp = NULL;
5931 int info = 0;
5932 struct smbd_server_connection *sconn = req->sconn;
5933
5934 START_PROFILE(SMBrmdir);
5935
5936 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5937 STR_TERMINATE, &status);
5938 if (!NT_STATUS_IS_OK(status)) {
5939 reply_nterror(req, status);
5940 goto out;
5941 }
5942
5943 status = filename_convert(ctx, conn,
5944 req->flags2 & FLAGS2_DFS_PATHNAMES,
5945 directory,
5946 0,
5947 NULL,
5948 &smb_dname);
5949 if (!NT_STATUS_IS_OK(status)) {
5950 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5951 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5952 ERRSRV, ERRbadpath);
5953 goto out;
5954 }
5955 reply_nterror(req, status);
5956 goto out;
5957 }
5958
5959 if (is_ntfs_stream_smb_fname(smb_dname)) {
5960 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5961 goto out;
5962 }
5963
5964 status = SMB_VFS_CREATE_FILE(
5965 conn, /* conn */
5966 req, /* req */
5967 0, /* root_dir_fid */
5968 smb_dname, /* fname */
5969 DELETE_ACCESS, /* access_mask */
5970 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5971 FILE_SHARE_DELETE),
5972 FILE_OPEN, /* create_disposition*/
5973 FILE_DIRECTORY_FILE, /* create_options */
5974 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5975 0, /* oplock_request */
5976 NULL, /* lease */
5977 0, /* allocation_size */
5978 0, /* private_flags */
5979 NULL, /* sd */
5980 NULL, /* ea_list */
5981 &fsp, /* result */
5982 &info); /* pinfo */
5983
5984 if (!NT_STATUS_IS_OK(status)) {
5985 if (open_was_deferred(req->sconn, req->mid)) {
5986 /* We have re-scheduled this call. */
5987 goto out;
5988 }
5989 reply_nterror(req, status);
5990 goto out;
5991 }
5992
5993 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5994 if (!NT_STATUS_IS_OK(status)) {
5995 close_file(req, fsp, ERROR_CLOSE);
5996 reply_nterror(req, status);
5997 goto out;
5998 }
5999
6000 if (!set_delete_on_close(fsp, true,
6001 conn->session_info->security_token,
6002 conn->session_info->unix_token)) {
6003 close_file(req, fsp, ERROR_CLOSE);
6004 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6005 goto out;
6006 }
6007
6008 status = close_file(req, fsp, NORMAL_CLOSE);
6009 if (!NT_STATUS_IS_OK(status)) {
6010 reply_nterror(req, status);
6011 } else {
6012 reply_outbuf(req, 0, 0);
6013 }
6014
6015 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6016
6017 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6018 out:
6019 TALLOC_FREE(smb_dname);
6020 END_PROFILE(SMBrmdir);
6021 return;
6022 }
6023
6024 /*******************************************************************
6025 Resolve wildcards in a filename rename.
6026 ********************************************************************/
6027
6028 static bool resolve_wildcards(TALLOC_CTX *ctx,
6029 const char *name1,
6030 const char *name2,
6031 char **pp_newname)
6032 {
6033 char *name2_copy = NULL;
6034 char *root1 = NULL;
6035 char *root2 = NULL;
6036 char *ext1 = NULL;
6037 char *ext2 = NULL;
6038 char *p,*p2, *pname1, *pname2;
6039
6040 name2_copy = talloc_strdup(ctx, name2);
6041 if (!name2_copy) {
6042 return False;
6043 }
6044
6045 pname1 = strrchr_m(name1,'/');
6046 pname2 = strrchr_m(name2_copy,'/');
6047
6048 if (!pname1 || !pname2) {
6049 return False;
6050 }
6051
6052 /* Truncate the copy of name2 at the last '/' */
6053 *pname2 = '\0';
6054
6055 /* Now go past the '/' */
6056 pname1++;
6057 pname2++;
6058
6059 root1 = talloc_strdup(ctx, pname1);
6060 root2 = talloc_strdup(ctx, pname2);
6061
6062 if (!root1 || !root2) {
6063 return False;
6064 }
6065
6066 p = strrchr_m(root1,'.');
6067 if (p) {
6068 *p = 0;
6069 ext1 = talloc_strdup(ctx, p+1);
6070 } else {
6071 ext1 = talloc_strdup(ctx, "");
6072 }
6073 p = strrchr_m(root2,'.');
6074 if (p) {
6075 *p = 0;
6076 ext2 = talloc_strdup(ctx, p+1);
6077 } else {
6078 ext2 = talloc_strdup(ctx, "");
6079 }
6080
6081 if (!ext1 || !ext2) {
6082 return False;
6083 }
6084
6085 p = root1;
6086 p2 = root2;
6087 while (*p2) {
6088 if (*p2 == '?') {
6089 /* Hmmm. Should this be mb-aware ? */
6090 *p2 = *p;
6091 p2++;
6092 } else if (*p2 == '*') {
6093 *p2 = '\0';
6094 root2 = talloc_asprintf(ctx, "%s%s",
6095 root2,
6096 p);
6097 if (!root2) {
6098 return False;
6099 }
6100 break;
6101 } else {
6102 p2++;
6103 }
6104 if (*p) {
6105 p++;
6106 }
6107 }
6108
6109 p = ext1;
6110 p2 = ext2;
6111 while (*p2) {
6112 if (*p2 == '?') {
6113 /* Hmmm. Should this be mb-aware ? */
6114 *p2 = *p;
6115 p2++;
6116 } else if (*p2 == '*') {
6117 *p2 = '\0';
6118 ext2 = talloc_asprintf(ctx, "%s%s",
6119 ext2,
6120 p);
6121 if (!ext2) {
6122 return False;
6123 }
6124 break;
6125 } else {
6126 p2++;
6127 }
6128 if (*p) {
6129 p++;
6130 }
6131 }
6132
6133 if (*ext2) {
6134 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6135 name2_copy,
6136 root2,
6137 ext2);
6138 } else {
6139 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6140 name2_copy,
6141 root2);
6142 }
6143
6144 if (!*pp_newname) {
6145 return False;
6146 }
6147
6148 return True;
6149 }
6150
6151 /****************************************************************************
6152 Ensure open files have their names updated. Updated to notify other smbd's
6153 asynchronously.
6154 ****************************************************************************/
6155
6156 static void rename_open_files(connection_struct *conn,
6157 struct share_mode_lock *lck,
6158 struct file_id id,
6159 uint32_t orig_name_hash,
6160 const struct smb_filename *smb_fname_dst)
6161 {
6162 files_struct *fsp;
6163 bool did_rename = False;
6164 NTSTATUS status;
6165 uint32_t new_name_hash = 0;
6166
6167 for(fsp = file_find_di_first(conn->sconn, id); fsp;
6168 fsp = file_find_di_next(fsp)) {
6169 /* fsp_name is a relative path under the fsp. To change this for other
6170 sharepaths we need to manipulate relative paths. */
6171 /* TODO - create the absolute path and manipulate the newname
6172 relative to the sharepath. */
6173 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6174 continue;
6175 }
6176 if (fsp->name_hash != orig_name_hash) {
6177 continue;
6178 }
6179 DEBUG(10, ("rename_open_files: renaming file %s "
6180 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6181 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6182 smb_fname_str_dbg(smb_fname_dst)));
6183
6184 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6185 if (NT_STATUS_IS_OK(status)) {
6186 did_rename = True;
6187 new_name_hash = fsp->name_hash;
6188 }
6189 }
6190
6191 if (!did_rename) {
6192 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6193 "for %s\n", file_id_string_tos(&id),
6194 smb_fname_str_dbg(smb_fname_dst)));
6195 }
6196
6197 /* Send messages to all smbd's (not ourself) that the name has changed. */
6198 rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6199 orig_name_hash, new_name_hash,
6200 smb_fname_dst);
6201
6202 }
6203
6204 /****************************************************************************
6205 We need to check if the source path is a parent directory of the destination
6206 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6207 refuse the rename with a sharing violation. Under UNIX the above call can
6208 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6209 probably need to check that the client is a Windows one before disallowing
6210 this as a UNIX client (one with UNIX extensions) can know the source is a
6211 symlink and make this decision intelligently. Found by an excellent bug
6212 report from <AndyLiebman@aol.com>.
6213 ****************************************************************************/
6214
6215 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6216 const struct smb_filename *smb_fname_dst)
6217 {
6218 const char *psrc = smb_fname_src->base_name;
6219 const char *pdst = smb_fname_dst->base_name;
6220 size_t slen;
6221
6222 if (psrc[0] == '.' && psrc[1] == '/') {
6223 psrc += 2;
6224 }
6225 if (pdst[0] == '.' && pdst[1] == '/') {
6226 pdst += 2;
6227 }
6228 if ((slen = strlen(psrc)) > strlen(pdst)) {
6229 return False;
6230 }
6231 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6232 }
6233
6234 /*
6235 * Do the notify calls from a rename
6236 */
6237
6238 static void notify_rename(connection_struct *conn, bool is_dir,
6239 const struct smb_filename *smb_fname_src,
6240 const struct smb_filename *smb_fname_dst)
6241 {
6242 char *parent_dir_src = NULL;
6243 char *parent_dir_dst = NULL;
6244 uint32 mask;
6245
6246 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6247 : FILE_NOTIFY_CHANGE_FILE_NAME;
6248
6249 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6250 &parent_dir_src, NULL) ||
6251 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6252 &parent_dir_dst, NULL)) {
6253 goto out;
6254 }
6255
6256 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6257 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6258 smb_fname_src->base_name);
6259 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6260 smb_fname_dst->base_name);
6261 }
6262 else {
6263 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6264 smb_fname_src->base_name);
6265 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6266 smb_fname_dst->base_name);
6267 }
6268
6269 /* this is a strange one. w2k3 gives an additional event for
6270 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6271 files, but not directories */
6272 if (!is_dir) {
6273 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6274 FILE_NOTIFY_CHANGE_ATTRIBUTES
6275 |FILE_NOTIFY_CHANGE_CREATION,
6276 smb_fname_dst->base_name);
6277 }
6278 out:
6279 TALLOC_FREE(parent_dir_src);
6280 TALLOC_FREE(parent_dir_dst);
6281 }
6282
6283 /****************************************************************************
6284 Returns an error if the parent directory for a filename is open in an
6285 incompatible way.
6286 ****************************************************************************/
6287
6288 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6289 const struct smb_filename *smb_fname_dst_in)
6290 {
6291 char *parent_dir = NULL;
6292 struct smb_filename smb_fname_parent;
6293 struct file_id id;
6294 files_struct *fsp = NULL;
6295 int ret;
6296
6297 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6298 &parent_dir, NULL)) {
6299 return NT_STATUS_NO_MEMORY;
6300 }
6301 ZERO_STRUCT(smb_fname_parent);
6302 smb_fname_parent.base_name = parent_dir;
6303
6304 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6305 if (ret == -1) {
6306 return map_nt_error_from_unix(errno);
6307 }
6308
6309 /*
6310 * We're only checking on this smbd here, mostly good
6311 * enough.. and will pass tests.
6312 */
6313
6314 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6315 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6316 fsp = file_find_di_next(fsp)) {
6317 if (fsp->access_mask & DELETE_ACCESS) {
6318 return NT_STATUS_SHARING_VIOLATION;
6319 }
6320 }
6321 return NT_STATUS_OK;
6322 }
6323
6324 /****************************************************************************
6325 Rename an open file - given an fsp.
6326 ****************************************************************************/
6327
6328 NTSTATUS rename_internals_fsp(connection_struct *conn,
6329 files_struct *fsp,
6330 const struct smb_filename *smb_fname_dst_in,
6331 uint32 attrs,
6332 bool replace_if_exists)
6333 {
6334 TALLOC_CTX *ctx = talloc_tos();
6335 struct smb_filename *smb_fname_dst = NULL;
6336 NTSTATUS status = NT_STATUS_OK;
6337 struct share_mode_lock *lck = NULL;
6338 bool dst_exists, old_is_stream, new_is_stream;
6339
6340 status = check_name(conn, smb_fname_dst_in->base_name);
6341 if (!NT_STATUS_IS_OK(status)) {
6342 return status;
6343 }
6344
6345 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6346 if (!NT_STATUS_IS_OK(status)) {
6347 return status;
6348 }
6349
6350 /* Make a copy of the dst smb_fname structs */
6351
6352 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6353 if (smb_fname_dst == NULL) {
6354 status = NT_STATUS_NO_MEMORY;
6355 goto out;
6356 }
6357
6358 /*
6359 * Check for special case with case preserving and not
6360 * case sensitive. If the old last component differs from the original
6361 * last component only by case, then we should allow
6362 * the rename (user is trying to change the case of the
6363 * filename).
6364 */
6365 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6366 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6367 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6368 char *last_slash;
6369 char *fname_dst_lcomp_base_mod = NULL;
6370 struct smb_filename *smb_fname_orig_lcomp = NULL;
6371
6372 /*
6373 * Get the last component of the destination name.
6374 */
6375 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6376 if (last_slash) {
6377 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6378 } else {
6379 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6380 }
6381 if (!fname_dst_lcomp_base_mod) {
6382 status = NT_STATUS_NO_MEMORY;
6383 goto out;
6384 }
6385
6386 /*
6387 * Create an smb_filename struct using the original last
6388 * component of the destination.
6389 */
6390 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6391 ctx, smb_fname_dst->original_lcomp, NULL);
6392 if (smb_fname_orig_lcomp == NULL) {
6393 status = NT_STATUS_NO_MEMORY;
6394 TALLOC_FREE(fname_dst_lcomp_base_mod);
6395 goto out;
6396 }
6397
6398 /* If the base names only differ by case, use original. */
6399 if(!strcsequal(fname_dst_lcomp_base_mod,
6400 smb_fname_orig_lcomp->base_name)) {
6401 char *tmp;
6402 /*
6403 * Replace the modified last component with the
6404 * original.
6405 */
6406 if (last_slash) {
6407 *last_slash = '\0'; /* Truncate at the '/' */
6408 tmp = talloc_asprintf(smb_fname_dst,
6409 "%s/%s",
6410 smb_fname_dst->base_name,
6411 smb_fname_orig_lcomp->base_name);
6412 } else {
6413 tmp = talloc_asprintf(smb_fname_dst,
6414 "%s",
6415 smb_fname_orig_lcomp->base_name);
6416 }
6417 if (tmp == NULL) {
6418 status = NT_STATUS_NO_MEMORY;
6419 TALLOC_FREE(fname_dst_lcomp_base_mod);
6420 TALLOC_FREE(smb_fname_orig_lcomp);
6421 goto out;
6422 }
6423 TALLOC_FREE(smb_fname_dst->base_name);
6424 smb_fname_dst->base_name = tmp;
6425 }
6426
6427 /* If the stream_names only differ by case, use original. */
6428 if(!strcsequal(smb_fname_dst->stream_name,
6429 smb_fname_orig_lcomp->stream_name)) {
6430 char *tmp = NULL;
6431 /* Use the original stream. */
6432 tmp = talloc_strdup(smb_fname_dst,
6433 smb_fname_orig_lcomp->stream_name);
6434 if (tmp == NULL) {
6435 status = NT_STATUS_NO_MEMORY;
6436 TALLOC_FREE(fname_dst_lcomp_base_mod);
6437 TALLOC_FREE(smb_fname_orig_lcomp);
6438 goto out;
6439 }
6440 TALLOC_FREE(smb_fname_dst->stream_name);
6441 smb_fname_dst->stream_name = tmp;
6442 }
6443 TALLOC_FREE(fname_dst_lcomp_base_mod);
6444 TALLOC_FREE(smb_fname_orig_lcomp);
6445 }
6446
6447 /*
6448 * If the src and dest names are identical - including case,
6449 * don't do the rename, just return success.
6450 */
6451
6452 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6453 strcsequal(fsp->fsp_name->stream_name,
6454 smb_fname_dst->stream_name)) {
6455 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6456 "- returning success\n",
6457 smb_fname_str_dbg(smb_fname_dst)));
6458 status = NT_STATUS_OK;
6459 goto out;
6460 }
6461
6462 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6463 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6464
6465 /* Return the correct error code if both names aren't streams. */
6466 if (!old_is_stream && new_is_stream) {
6467 status = NT_STATUS_OBJECT_NAME_INVALID;
6468 goto out;
6469 }
6470
6471 if (old_is_stream && !new_is_stream) {
6472 status = NT_STATUS_INVALID_PARAMETER;
6473 goto out;
6474 }
6475
6476 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6477
6478 if(!replace_if_exists && dst_exists) {
6479 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6480 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6481 smb_fname_str_dbg(smb_fname_dst)));
6482 status = NT_STATUS_OBJECT_NAME_COLLISION;
6483 goto out;
6484 }
6485
6486 if (dst_exists) {
6487 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6488 &smb_fname_dst->st);
6489 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6490 fileid);
6491 /* The file can be open when renaming a stream */
6492 if (dst_fsp && !new_is_stream) {
6493 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6494 status = NT_STATUS_ACCESS_DENIED;
6495 goto out;
6496 }
6497 }
6498
6499 /* Ensure we have a valid stat struct for the source. */
6500 status = vfs_stat_fsp(fsp);
6501 if (!NT_STATUS_IS_OK(status)) {
6502 goto out;
6503 }
6504
6505 status = can_rename(conn, fsp, attrs);
6506
6507 if (!NT_STATUS_IS_OK(status)) {
6508 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6509 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6510 smb_fname_str_dbg(smb_fname_dst)));
6511 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6512 status = NT_STATUS_ACCESS_DENIED;
6513 goto out;
6514 }
6515
6516 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6517 status = NT_STATUS_ACCESS_DENIED;
6518 }
6519
6520 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6521
6522 /*
6523 * We have the file open ourselves, so not being able to get the
6524 * corresponding share mode lock is a fatal error.
6525 */
6526
6527 SMB_ASSERT(lck != NULL);
6528
6529 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6530 uint32 create_options = fsp->fh->private_options;
6531
6532 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6533 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6534 smb_fname_str_dbg(smb_fname_dst)));
6535
6536 if (!fsp->is_directory &&
6537 !lp_posix_pathnames() &&
6538 (lp_map_archive(SNUM(conn)) ||
6539 lp_store_dos_attributes(SNUM(conn)))) {
6540 /* We must set the archive bit on the newly
6541 renamed file. */
6542 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6543 uint32_t old_dosmode = dos_mode(conn,
6544 smb_fname_dst);
6545 file_set_dosmode(conn,
6546 smb_fname_dst,
6547 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6548 NULL,
6549 true);
6550 }
6551 }
6552
6553 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6554 smb_fname_dst);
6555
6556 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6557 smb_fname_dst);
6558
6559 /*
6560 * A rename acts as a new file create w.r.t. allowing an initial delete
6561 * on close, probably because in Windows there is a new handle to the
6562 * new file. If initial delete on close was requested but not
6563 * originally set, we need to set it here. This is probably not 100% correct,
6564 * but will work for the CIFSFS client which in non-posix mode
6565 * depends on these semantics. JRA.
6566 */
6567
6568 if (create_options & FILE_DELETE_ON_CLOSE) {
6569 status = can_set_delete_on_close(fsp, 0);
6570
6571 if (NT_STATUS_IS_OK(status)) {
6572 /* Note that here we set the *inital* delete on close flag,
6573 * not the regular one. The magic gets handled in close. */
6574 fsp->initial_delete_on_close = True;
6575 }
6576 }
6577 TALLOC_FREE(lck);
6578 status = NT_STATUS_OK;
6579 goto out;
6580 }
6581
6582 TALLOC_FREE(lck);
6583
6584 if (errno == ENOTDIR || errno == EISDIR) {
6585 status = NT_STATUS_OBJECT_NAME_COLLISION;
6586 } else {
6587 status = map_nt_error_from_unix(errno);
6588 }
6589
6590 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6591 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6592 smb_fname_str_dbg(smb_fname_dst)));
6593
6594 out:
6595 TALLOC_FREE(smb_fname_dst);
6596
6597 return status;
6598 }
6599
6600 /****************************************************************************
6601 The guts of the rename command, split out so it may be called by the NT SMB
6602 code.
6603 ****************************************************************************/
6604
6605 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6606 connection_struct *conn,
6607 struct smb_request *req,
6608 struct smb_filename *smb_fname_src,
6609 struct smb_filename *smb_fname_dst,
6610 uint32 attrs,
6611 bool replace_if_exists,
6612 bool src_has_wild,
6613 bool dest_has_wild,
6614 uint32_t access_mask)
6615 {
6616 char *fname_src_dir = NULL;
6617 char *fname_src_mask = NULL;
6618 int count=0;
6619 NTSTATUS status = NT_STATUS_OK;
6620 struct smb_Dir *dir_hnd = NULL;
6621 const char *dname = NULL;
6622 char *talloced = NULL;
6623 long offset = 0;
6624 int create_options = 0;
6625 bool posix_pathnames = lp_posix_pathnames();
6626 int rc;
6627
6628 /*
6629 * Split the old name into directory and last component
6630 * strings. Note that unix_convert may have stripped off a
6631 * leading ./ from both name and newname if the rename is
6632 * at the root of the share. We need to make sure either both
6633 * name and newname contain a / character or neither of them do
6634 * as this is checked in resolve_wildcards().
6635 */
6636
6637 /* Split up the directory from the filename/mask. */
6638 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6639 &fname_src_dir, &fname_src_mask);
6640 if (!NT_STATUS_IS_OK(status)) {
6641 status = NT_STATUS_NO_MEMORY;
6642 goto out;
6643 }
6644
6645 /*
6646 * We should only check the mangled cache
6647 * here if unix_convert failed. This means
6648 * that the path in 'mask' doesn't exist
6649 * on the file system and so we need to look
6650 * for a possible mangle. This patch from
6651 * Tine Smukavec <valentin.smukavec@hermes.si>.
6652 */
6653
6654 if (!VALID_STAT(smb_fname_src->st) &&
6655 mangle_is_mangled(fname_src_mask, conn->params)) {
6656 char *new_mask = NULL;
6657 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6658 conn->params);
6659 if (new_mask) {
6660 TALLOC_FREE(fname_src_mask);
6661 fname_src_mask = new_mask;
6662 }
6663 }
6664
6665 if (!src_has_wild) {
6666 files_struct *fsp;
6667
6668 /*
6669 * Only one file needs to be renamed. Append the mask back
6670 * onto the directory.
6671 */
6672 TALLOC_FREE(smb_fname_src->base_name);
6673 if (ISDOT(fname_src_dir)) {
6674 /* Ensure we use canonical names on open. */
6675 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6676 "%s",
6677 fname_src_mask);
6678 } else {
6679 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6680 "%s/%s",
6681 fname_src_dir,
6682 fname_src_mask);
6683 }
6684 if (!smb_fname_src->base_name) {
6685 status = NT_STATUS_NO_MEMORY;
6686 goto out;
6687 }
6688
6689 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6690 "case_preserve = %d, short case preserve = %d, "
6691 "directory = %s, newname = %s, "
6692 "last_component_dest = %s\n",
6693 conn->case_sensitive, conn->case_preserve,
6694 conn->short_case_preserve,
6695 smb_fname_str_dbg(smb_fname_src),
6696 smb_fname_str_dbg(smb_fname_dst),
6697 smb_fname_dst->original_lcomp));
6698
6699 /* The dest name still may have wildcards. */
6700 if (dest_has_wild) {
6701 char *fname_dst_mod = NULL;
6702 if (!resolve_wildcards(smb_fname_dst,
6703 smb_fname_src->base_name,
6704 smb_fname_dst->base_name,
6705 &fname_dst_mod)) {
6706 DEBUG(6, ("rename_internals: resolve_wildcards "
6707 "%s %s failed\n",
6708 smb_fname_src->base_name,
6709 smb_fname_dst->base_name));
6710 status = NT_STATUS_NO_MEMORY;
6711 goto out;
6712 }
6713 TALLOC_FREE(smb_fname_dst->base_name);
6714 smb_fname_dst->base_name = fname_dst_mod;
6715 }
6716
6717 ZERO_STRUCT(smb_fname_src->st);
6718 if (posix_pathnames) {
6719 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6720 } else {
6721 rc = SMB_VFS_STAT(conn, smb_fname_src);
6722 }
6723 if (rc == -1) {
6724 status = map_nt_error_from_unix_common(errno);
6725 goto out;
6726 }
6727
6728 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6729 create_options |= FILE_DIRECTORY_FILE;
6730 }
6731
6732 status = SMB_VFS_CREATE_FILE(
6733 conn, /* conn */
6734 req, /* req */
6735 0, /* root_dir_fid */
6736 smb_fname_src, /* fname */
6737 access_mask, /* access_mask */
6738 (FILE_SHARE_READ | /* share_access */
6739 FILE_SHARE_WRITE),
6740 FILE_OPEN, /* create_disposition*/
6741 create_options, /* create_options */
6742 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6743 0, /* oplock_request */
6744 NULL, /* lease */
6745 0, /* allocation_size */
6746 0, /* private_flags */
6747 NULL, /* sd */
6748 NULL, /* ea_list */
6749 &fsp, /* result */
6750 NULL); /* pinfo */
6751
6752 if (!NT_STATUS_IS_OK(status)) {
6753 DEBUG(3, ("Could not open rename source %s: %s\n",
6754 smb_fname_str_dbg(smb_fname_src),
6755 nt_errstr(status)));
6756 goto out;
6757 }
6758
6759 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6760 attrs, replace_if_exists);
6761
6762 close_file(req, fsp, NORMAL_CLOSE);
6763
6764 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6765 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6766 smb_fname_str_dbg(smb_fname_dst)));
6767
6768 goto out;
6769 }
6770
6771 /*
6772 * Wildcards - process each file that matches.
6773 */
6774 if (strequal(fname_src_mask, "????????.???")) {
6775 TALLOC_FREE(fname_src_mask);
6776 fname_src_mask = talloc_strdup(ctx, "*");
6777 if (!fname_src_mask) {
6778 status = NT_STATUS_NO_MEMORY;
6779 goto out;
6780 }
6781 }
6782
6783 status = check_name(conn, fname_src_dir);
6784 if (!NT_STATUS_IS_OK(status)) {
6785 goto out;
6786 }
6787
6788 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6789 attrs);
6790 if (dir_hnd == NULL) {
6791 status = map_nt_error_from_unix(errno);
6792 goto out;
6793 }
6794
6795 status = NT_STATUS_NO_SUCH_FILE;
6796 /*
6797 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6798 * - gentest fix. JRA
6799 */
6800
6801 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6802 &talloced))) {
6803 files_struct *fsp = NULL;
6804 char *destname = NULL;
6805 bool sysdir_entry = False;
6806
6807 /* Quick check for "." and ".." */
6808 if (ISDOT(dname) || ISDOTDOT(dname)) {
6809 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6810 sysdir_entry = True;
6811 } else {
6812 TALLOC_FREE(talloced);
6813 continue;
6814 }
6815 }
6816
6817 if (!is_visible_file(conn, fname_src_dir, dname,
6818 &smb_fname_src->st, false)) {
6819 TALLOC_FREE(talloced);
6820 continue;
6821 }
6822
6823 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6824 TALLOC_FREE(talloced);
6825 continue;
6826 }
6827
6828 if (sysdir_entry) {
6829 status = NT_STATUS_OBJECT_NAME_INVALID;
6830 break;
6831 }
6832
6833 TALLOC_FREE(smb_fname_src->base_name);
6834 if (ISDOT(fname_src_dir)) {
6835 /* Ensure we use canonical names on open. */
6836 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6837 "%s",
6838 dname);
6839 } else {
6840 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6841 "%s/%s",
6842 fname_src_dir,
6843 dname);
6844 }
6845 if (!smb_fname_src->base_name) {
6846 status = NT_STATUS_NO_MEMORY;
6847 goto out;
6848 }
6849
6850 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6851 smb_fname_dst->base_name,
6852 &destname)) {
6853 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6854 smb_fname_src->base_name, destname));
6855 TALLOC_FREE(talloced);
6856 continue;
6857 }
6858 if (!destname) {
6859 status = NT_STATUS_NO_MEMORY;
6860 goto out;
6861 }
6862
6863 TALLOC_FREE(smb_fname_dst->base_name);
6864 smb_fname_dst->base_name = destname;
6865
6866 ZERO_STRUCT(smb_fname_src->st);
6867 if (posix_pathnames) {
6868 SMB_VFS_LSTAT(conn, smb_fname_src);
6869 } else {
6870 SMB_VFS_STAT(conn, smb_fname_src);
6871 }
6872
6873 create_options = 0;
6874
6875 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6876 create_options |= FILE_DIRECTORY_FILE;
6877 }
6878
6879 status = SMB_VFS_CREATE_FILE(
6880 conn, /* conn */
6881 req, /* req */
6882 0, /* root_dir_fid */
6883 smb_fname_src, /* fname */
6884 access_mask, /* access_mask */
6885 (FILE_SHARE_READ | /* share_access */
6886 FILE_SHARE_WRITE),
6887 FILE_OPEN, /* create_disposition*/
6888 create_options, /* create_options */
6889 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6890 0, /* oplock_request */
6891 NULL, /* lease */
6892 0, /* allocation_size */
6893 0, /* private_flags */
6894 NULL, /* sd */
6895 NULL, /* ea_list */
6896 &fsp, /* result */
6897 NULL); /* pinfo */
6898
6899 if (!NT_STATUS_IS_OK(status)) {
6900 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6901 "returned %s rename %s -> %s\n",
6902 nt_errstr(status),
6903 smb_fname_str_dbg(smb_fname_src),
6904 smb_fname_str_dbg(smb_fname_dst)));
6905 break;
6906 }
6907
6908 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6909 dname);
6910 if (!smb_fname_dst->original_lcomp) {
6911 status = NT_STATUS_NO_MEMORY;
6912 goto out;
6913 }
6914
6915 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6916 attrs, replace_if_exists);
6917
6918 close_file(req, fsp, NORMAL_CLOSE);
6919
6920 if (!NT_STATUS_IS_OK(status)) {
6921 DEBUG(3, ("rename_internals_fsp returned %s for "
6922 "rename %s -> %s\n", nt_errstr(status),
6923 smb_fname_str_dbg(smb_fname_src),
6924 smb_fname_str_dbg(smb_fname_dst)));
6925 break;
6926 }
6927
6928 count++;
6929
6930 DEBUG(3,("rename_internals: doing rename on %s -> "
6931 "%s\n", smb_fname_str_dbg(smb_fname_src),
6932 smb_fname_str_dbg(smb_fname_src)));
6933 TALLOC_FREE(talloced);
6934 }
6935 TALLOC_FREE(dir_hnd);
6936
6937 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6938 status = map_nt_error_from_unix(errno);
6939 }
6940
6941 out:
6942 TALLOC_FREE(talloced);
6943 TALLOC_FREE(fname_src_dir);
6944 TALLOC_FREE(fname_src_mask);
6945 return status;
6946 }
6947
6948 /****************************************************************************
6949 Reply to a mv.
6950 ****************************************************************************/
6951
6952 void reply_mv(struct smb_request *req)
6953 {
6954 connection_struct *conn = req->conn;
6955 char *name = NULL;
6956 char *newname = NULL;
6957 const char *p;
6958 uint32 attrs;
6959 NTSTATUS status;
6960 bool src_has_wcard = False;
6961 bool dest_has_wcard = False;
6962 TALLOC_CTX *ctx = talloc_tos();
6963 struct smb_filename *smb_fname_src = NULL;
6964 struct smb_filename *smb_fname_dst = NULL;
6965 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6966 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6967 bool stream_rename = false;
6968
6969 START_PROFILE(SMBmv);
6970
6971 if (req->wct < 1) {
6972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6973 goto out;
6974 }
6975
6976 attrs = SVAL(req->vwv+0, 0);
6977
6978 p = (const char *)req->buf + 1;
6979 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6980 &status, &src_has_wcard);
6981 if (!NT_STATUS_IS_OK(status)) {
6982 reply_nterror(req, status);
6983 goto out;
6984 }
6985 p++;
6986 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6987 &status, &dest_has_wcard);
6988 if (!NT_STATUS_IS_OK(status)) {
6989 reply_nterror(req, status);
6990 goto out;
6991 }
6992
6993 if (!lp_posix_pathnames()) {
6994 /* The newname must begin with a ':' if the
6995 name contains a ':'. */
6996 if (strchr_m(name, ':')) {
6997 if (newname[0] != ':') {
6998 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6999 goto out;
7000 }
7001 stream_rename = true;
7002 }
7003 }
7004
7005 status = filename_convert(ctx,
7006 conn,
7007 req->flags2 & FLAGS2_DFS_PATHNAMES,
7008 name,
7009 src_ucf_flags,
7010 &src_has_wcard,
7011 &smb_fname_src);
7012
7013 if (!NT_STATUS_IS_OK(status)) {
7014 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7015 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7016 ERRSRV, ERRbadpath);
7017 goto out;
7018 }
7019 reply_nterror(req, status);
7020 goto out;
7021 }
7022
7023 status = filename_convert(ctx,
7024 conn,
7025 req->flags2 & FLAGS2_DFS_PATHNAMES,
7026 newname,
7027 dst_ucf_flags,
7028 &dest_has_wcard,
7029 &smb_fname_dst);
7030
7031 if (!NT_STATUS_IS_OK(status)) {
7032 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7033 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7034 ERRSRV, ERRbadpath);
7035 goto out;
7036 }
7037 reply_nterror(req, status);
7038 goto out;
7039 }
7040
7041 if (stream_rename) {
7042 /* smb_fname_dst->base_name must be the same as
7043 smb_fname_src->base_name. */
7044 TALLOC_FREE(smb_fname_dst->base_name);
7045 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7046 smb_fname_src->base_name);
7047 if (!smb_fname_dst->base_name) {
7048 reply_nterror(req, NT_STATUS_NO_MEMORY);
7049 goto out;
7050 }
7051 }
7052
7053 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7054 smb_fname_str_dbg(smb_fname_dst)));
7055
7056 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7057 attrs, False, src_has_wcard, dest_has_wcard,
7058 DELETE_ACCESS);
7059 if (!NT_STATUS_IS_OK(status)) {
7060 if (open_was_deferred(req->sconn, req->mid)) {
7061 /* We have re-scheduled this call. */
7062 goto out;
7063 }
7064 reply_nterror(req, status);
7065 goto out;
7066 }
7067
7068 reply_outbuf(req, 0, 0);
7069 out:
7070 TALLOC_FREE(smb_fname_src);
7071 TALLOC_FREE(smb_fname_dst);
7072 END_PROFILE(SMBmv);
7073 return;
7074 }
7075
7076 /*******************************************************************
7077 Copy a file as part of a reply_copy.
7078 ******************************************************************/
7079
7080 /*
7081 * TODO: check error codes on all callers
7082 */
7083
7084 NTSTATUS copy_file(TALLOC_CTX *ctx,
7085 connection_struct *conn,
7086 struct smb_filename *smb_fname_src,
7087 struct smb_filename *smb_fname_dst,
7088 int ofun,
7089 int count,
7090 bool target_is_directory)
7091 {
7092 struct smb_filename *smb_fname_dst_tmp = NULL;
7093 off_t ret=-1;
7094 files_struct *fsp1,*fsp2;
7095 uint32 dosattrs;
7096 uint32 new_create_disposition;
7097 NTSTATUS status;
7098
7099
7100 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7101 if (smb_fname_dst_tmp == NULL) {
7102 return NT_STATUS_NO_MEMORY;
7103 }
7104
7105 /*
7106 * If the target is a directory, extract the last component from the
7107 * src filename and append it to the dst filename
7108 */
7109 if (target_is_directory) {
7110 const char *p;
7111
7112 /* dest/target can't be a stream if it's a directory. */
7113 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7114
7115 p = strrchr_m(smb_fname_src->base_name,'/');
7116 if (p) {
7117 p++;
7118 } else {
7119 p = smb_fname_src->base_name;
7120 }
7121 smb_fname_dst_tmp->base_name =
7122 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7123 p);
7124 if (!smb_fname_dst_tmp->base_name) {
7125 status = NT_STATUS_NO_MEMORY;
7126 goto out;
7127 }
7128 }
7129
7130 status = vfs_file_exist(conn, smb_fname_src);
7131 if (!NT_STATUS_IS_OK(status)) {
7132 goto out;
7133 }
7134
7135 if (!target_is_directory && count) {
7136 new_create_disposition = FILE_OPEN;
7137 } else {
7138 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7139 0, ofun,
7140 NULL, NULL,
7141 &new_create_disposition,
7142 NULL,
7143 NULL)) {
7144 status = NT_STATUS_INVALID_PARAMETER;
7145 goto out;
7146 }
7147 }
7148
7149 /* Open the src file for reading. */
7150 status = SMB_VFS_CREATE_FILE(
7151 conn, /* conn */
7152 NULL, /* req */
7153 0, /* root_dir_fid */
7154 smb_fname_src, /* fname */
7155 FILE_GENERIC_READ, /* access_mask */
7156 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7157 FILE_OPEN, /* create_disposition*/
7158 0, /* create_options */
7159 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7160 INTERNAL_OPEN_ONLY, /* oplock_request */
7161 NULL, /* lease */
7162 0, /* allocation_size */
7163 0, /* private_flags */
7164 NULL, /* sd */
7165 NULL, /* ea_list */
7166 &fsp1, /* result */
7167 NULL); /* psbuf */
7168
7169 if (!NT_STATUS_IS_OK(status)) {
7170 goto out;
7171 }
7172
7173 dosattrs = dos_mode(conn, smb_fname_src);
7174
7175 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7176 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7177 }
7178
7179 /* Open the dst file for writing. */
7180 status = SMB_VFS_CREATE_FILE(
7181 conn, /* conn */
7182 NULL, /* req */
7183 0, /* root_dir_fid */
7184 smb_fname_dst, /* fname */
7185 FILE_GENERIC_WRITE, /* access_mask */
7186 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7187 new_create_disposition, /* create_disposition*/
7188 0, /* create_options */
7189 dosattrs, /* file_attributes */
7190 INTERNAL_OPEN_ONLY, /* oplock_request */
7191 NULL, /* lease */
7192 0, /* allocation_size */
7193 0, /* private_flags */
7194 NULL, /* sd */
7195 NULL, /* ea_list */
7196 &fsp2, /* result */
7197 NULL); /* psbuf */
7198
7199 if (!NT_STATUS_IS_OK(status)) {
7200 close_file(NULL, fsp1, ERROR_CLOSE);
7201 goto out;
7202 }
7203
7204 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7205 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7206 if (ret == -1) {
7207 DEBUG(0, ("error - vfs lseek returned error %s\n",
7208 strerror(errno)));
7209 status = map_nt_error_from_unix(errno);
7210 close_file(NULL, fsp1, ERROR_CLOSE);
7211 close_file(NULL, fsp2, ERROR_CLOSE);
7212 goto out;
7213 }
7214 }
7215
7216 /* Do the actual copy. */
7217 if (smb_fname_src->st.st_ex_size) {
7218 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7219 } else {
7220 ret = 0;
7221 }
7222
7223 close_file(NULL, fsp1, NORMAL_CLOSE);
7224
7225 /* Ensure the modtime is set correctly on the destination file. */
7226 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7227
7228 /*
7229 * As we are opening fsp1 read-only we only expect
7230 * an error on close on fsp2 if we are out of space.
7231 * Thus we don't look at the error return from the
7232 * close of fsp1.
7233 */
7234 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7235
7236 if (!NT_STATUS_IS_OK(status)) {
7237 goto out;
7238 }
7239
7240 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7241 status = NT_STATUS_DISK_FULL;
7242 goto out;
7243 }
7244
7245 status = NT_STATUS_OK;
7246
7247 out:
7248 TALLOC_FREE(smb_fname_dst_tmp);
7249 return status;
7250 }
7251
7252 /****************************************************************************
7253 Reply to a file copy.
7254 ****************************************************************************/
7255
7256 void reply_copy(struct smb_request *req)
7257 {
7258 connection_struct *conn = req->conn;
7259 struct smb_filename *smb_fname_src = NULL;
7260 struct smb_filename *smb_fname_dst = NULL;
7261 char *fname_src = NULL;
7262 char *fname_dst = NULL;
7263 char *fname_src_mask = NULL;
7264 char *fname_src_dir = NULL;
7265 const char *p;
7266 int count=0;
7267 int error = ERRnoaccess;
7268 int tid2;
7269 int ofun;
7270 int flags;
7271 bool target_is_directory=False;
7272 bool source_has_wild = False;
7273 bool dest_has_wild = False;
7274 NTSTATUS status;
7275 TALLOC_CTX *ctx = talloc_tos();
7276
7277 START_PROFILE(SMBcopy);
7278
7279 if (req->wct < 3) {
7280 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7281 goto out;
7282 }
7283
7284 tid2 = SVAL(req->vwv+0, 0);
7285 ofun = SVAL(req->vwv+1, 0);
7286 flags = SVAL(req->vwv+2, 0);
7287
7288 p = (const char *)req->buf;
7289 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7290 &status, &source_has_wild);
7291 if (!NT_STATUS_IS_OK(status)) {
7292 reply_nterror(req, status);
7293 goto out;
7294 }
7295 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7296 &status, &dest_has_wild);
7297 if (!NT_STATUS_IS_OK(status)) {
7298 reply_nterror(req, status);
7299 goto out;
7300 }
7301
7302 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7303
7304 if (tid2 != conn->cnum) {
7305 /* can't currently handle inter share copies XXXX */
7306 DEBUG(3,("Rejecting inter-share copy\n"));
7307 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7308 goto out;
7309 }
7310
7311 status = filename_convert(ctx, conn,
7312 req->flags2 & FLAGS2_DFS_PATHNAMES,
7313 fname_src,
7314 UCF_COND_ALLOW_WCARD_LCOMP,
7315 &source_has_wild,
7316 &smb_fname_src);
7317 if (!NT_STATUS_IS_OK(status)) {
7318 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7319 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7320 ERRSRV, ERRbadpath);
7321 goto out;
7322 }
7323 reply_nterror(req, status);
7324 goto out;
7325 }
7326
7327 status = filename_convert(ctx, conn,
7328 req->flags2 & FLAGS2_DFS_PATHNAMES,
7329 fname_dst,
7330 UCF_COND_ALLOW_WCARD_LCOMP,
7331 &dest_has_wild,
7332 &smb_fname_dst);
7333 if (!NT_STATUS_IS_OK(status)) {
7334 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7335 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7336 ERRSRV, ERRbadpath);
7337 goto out;
7338 }
7339 reply_nterror(req, status);
7340 goto out;
7341 }
7342
7343 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7344
7345 if ((flags&1) && target_is_directory) {
7346 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7347 goto out;
7348 }
7349
7350 if ((flags&2) && !target_is_directory) {
7351 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7352 goto out;
7353 }
7354
7355 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7356 /* wants a tree copy! XXXX */
7357 DEBUG(3,("Rejecting tree copy\n"));
7358 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7359 goto out;
7360 }
7361
7362 /* Split up the directory from the filename/mask. */
7363 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7364 &fname_src_dir, &fname_src_mask);
7365 if (!NT_STATUS_IS_OK(status)) {
7366 reply_nterror(req, NT_STATUS_NO_MEMORY);
7367 goto out;
7368 }
7369
7370 /*
7371 * We should only check the mangled cache
7372 * here if unix_convert failed. This means
7373 * that the path in 'mask' doesn't exist
7374 * on the file system and so we need to look
7375 * for a possible mangle. This patch from
7376 * Tine Smukavec <valentin.smukavec@hermes.si>.
7377 */
7378 if (!VALID_STAT(smb_fname_src->st) &&
7379 mangle_is_mangled(fname_src_mask, conn->params)) {
7380 char *new_mask = NULL;
7381 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7382 &new_mask, conn->params);
7383
7384 /* Use demangled name if one was successfully found. */
7385 if (new_mask) {
7386 TALLOC_FREE(fname_src_mask);
7387 fname_src_mask = new_mask;
7388 }
7389 }
7390
7391 if (!source_has_wild) {
7392
7393 /*
7394 * Only one file needs to be copied. Append the mask back onto
7395 * the directory.
7396 */
7397 TALLOC_FREE(smb_fname_src->base_name);
7398 if (ISDOT(fname_src_dir)) {
7399 /* Ensure we use canonical names on open. */
7400 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7401 "%s",
7402 fname_src_mask);
7403 } else {
7404 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7405 "%s/%s",
7406 fname_src_dir,
7407 fname_src_mask);
7408 }
7409 if (!smb_fname_src->base_name) {
7410 reply_nterror(req, NT_STATUS_NO_MEMORY);
7411 goto out;
7412 }
7413
7414 if (dest_has_wild) {
7415 char *fname_dst_mod = NULL;
7416 if (!resolve_wildcards(smb_fname_dst,
7417 smb_fname_src->base_name,
7418 smb_fname_dst->base_name,
7419 &fname_dst_mod)) {
7420 reply_nterror(req, NT_STATUS_NO_MEMORY);
7421 goto out;
7422 }
7423 TALLOC_FREE(smb_fname_dst->base_name);
7424 smb_fname_dst->base_name = fname_dst_mod;
7425 }
7426
7427 status = check_name(conn, smb_fname_src->base_name);
7428 if (!NT_STATUS_IS_OK(status)) {
7429 reply_nterror(req, status);
7430 goto out;
7431 }
7432
7433 status = check_name(conn, smb_fname_dst->base_name);
7434 if (!NT_STATUS_IS_OK(status)) {
7435 reply_nterror(req, status);
7436 goto out;
7437 }
7438
7439 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7440 ofun, count, target_is_directory);
7441
7442 if(!NT_STATUS_IS_OK(status)) {
7443 reply_nterror(req, status);
7444 goto out;
7445 } else {
7446 count++;
7447 }
7448 } else {
7449 struct smb_Dir *dir_hnd = NULL;
7450 const char *dname = NULL;
7451 char *talloced = NULL;
7452 long offset = 0;
7453
7454 /*
7455 * There is a wildcard that requires us to actually read the
7456 * src dir and copy each file matching the mask to the dst.
7457 * Right now streams won't be copied, but this could
7458 * presumably be added with a nested loop for reach dir entry.
7459 */
7460 SMB_ASSERT(!smb_fname_src->stream_name);
7461 SMB_ASSERT(!smb_fname_dst->stream_name);
7462
7463 smb_fname_src->stream_name = NULL;
7464 smb_fname_dst->stream_name = NULL;
7465
7466 if (strequal(fname_src_mask,"????????.???")) {
7467 TALLOC_FREE(fname_src_mask);
7468 fname_src_mask = talloc_strdup(ctx, "*");
7469 if (!fname_src_mask) {
7470 reply_nterror(req, NT_STATUS_NO_MEMORY);
7471 goto out;
7472 }
7473 }
7474
7475 status = check_name(conn, fname_src_dir);
7476 if (!NT_STATUS_IS_OK(status)) {
7477 reply_nterror(req, status);
7478 goto out;
7479 }
7480
7481 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7482 if (dir_hnd == NULL) {
7483 status = map_nt_error_from_unix(errno);
7484 reply_nterror(req, status);
7485 goto out;
7486 }
7487
7488 error = ERRbadfile;
7489
7490 /* Iterate over the src dir copying each entry to the dst. */
7491 while ((dname = ReadDirName(dir_hnd, &offset,
7492 &smb_fname_src->st, &talloced))) {
7493 char *destname = NULL;
7494
7495 if (ISDOT(dname) || ISDOTDOT(dname)) {
7496 TALLOC_FREE(talloced);
7497 continue;
7498 }
7499
7500 if (!is_visible_file(conn, fname_src_dir, dname,
7501 &smb_fname_src->st, false)) {
7502 TALLOC_FREE(talloced);
7503 continue;
7504 }
7505
7506 if(!mask_match(dname, fname_src_mask,
7507 conn->case_sensitive)) {
7508 TALLOC_FREE(talloced);
7509 continue;
7510 }
7511
7512 error = ERRnoaccess;
7513
7514 /* Get the src smb_fname struct setup. */
7515 TALLOC_FREE(smb_fname_src->base_name);
7516 if (ISDOT(fname_src_dir)) {
7517 /* Ensure we use canonical names on open. */
7518 smb_fname_src->base_name =
7519 talloc_asprintf(smb_fname_src, "%s",
7520 dname);
7521 } else {
7522 smb_fname_src->base_name =
7523 talloc_asprintf(smb_fname_src, "%s/%s",
7524 fname_src_dir, dname);
7525 }
7526
7527 if (!smb_fname_src->base_name) {
7528 TALLOC_FREE(dir_hnd);
7529 TALLOC_FREE(talloced);
7530 reply_nterror(req, NT_STATUS_NO_MEMORY);
7531 goto out;
7532 }
7533
7534 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7535 smb_fname_dst->base_name,
7536 &destname)) {
7537 TALLOC_FREE(talloced);
7538 continue;
7539 }
7540 if (!destname) {
7541 TALLOC_FREE(dir_hnd);
7542 TALLOC_FREE(talloced);
7543 reply_nterror(req, NT_STATUS_NO_MEMORY);
7544 goto out;
7545 }
7546
7547 TALLOC_FREE(smb_fname_dst->base_name);
7548 smb_fname_dst->base_name = destname;
7549
7550 status = check_name(conn, smb_fname_src->base_name);
7551 if (!NT_STATUS_IS_OK(status)) {
7552 TALLOC_FREE(dir_hnd);
7553 TALLOC_FREE(talloced);
7554 reply_nterror(req, status);
7555 goto out;
7556 }
7557
7558 status = check_name(conn, smb_fname_dst->base_name);
7559 if (!NT_STATUS_IS_OK(status)) {
7560 TALLOC_FREE(dir_hnd);
7561 TALLOC_FREE(talloced);
7562 reply_nterror(req, status);
7563 goto out;
7564 }
7565
7566 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7567 smb_fname_src->base_name,
7568 smb_fname_dst->base_name));
7569
7570 status = copy_file(ctx, conn, smb_fname_src,
7571 smb_fname_dst, ofun, count,
7572 target_is_directory);
7573 if (NT_STATUS_IS_OK(status)) {
7574 count++;
7575 }
7576
7577 TALLOC_FREE(talloced);
7578 }
7579 TALLOC_FREE(dir_hnd);
7580 }
7581
7582 if (count == 0) {
7583 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7584 goto out;
7585 }
7586
7587 reply_outbuf(req, 1, 0);
7588 SSVAL(req->outbuf,smb_vwv0,count);
7589 out:
7590 TALLOC_FREE(smb_fname_src);
7591 TALLOC_FREE(smb_fname_dst);
7592 TALLOC_FREE(fname_src);
7593 TALLOC_FREE(fname_dst);
7594 TALLOC_FREE(fname_src_mask);
7595 TALLOC_FREE(fname_src_dir);
7596
7597 END_PROFILE(SMBcopy);
7598 return;
7599 }
7600
7601 #undef DBGC_CLASS
7602 #define DBGC_CLASS DBGC_LOCKING
7603
7604 /****************************************************************************
7605 Get a lock pid, dealing with large count requests.
7606 ****************************************************************************/
7607
7608 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7609 bool large_file_format)
7610 {
7611 if(!large_file_format)
7612 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7613 else
7614 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7615 }
7616
7617 /****************************************************************************
7618 Get a lock count, dealing with large count requests.
7619 ****************************************************************************/
7620
7621 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7622 bool large_file_format)
7623 {
7624 uint64_t count = 0;
7625
7626 if(!large_file_format) {
7627 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7628 } else {
7629 /*
7630 * No BVAL, this is reversed!
7631 */
7632 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7633 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7634 }
7635
7636 return count;
7637 }
7638
7639 /****************************************************************************
7640 Get a lock offset, dealing with large offset requests.
7641 ****************************************************************************/
7642
7643 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7644 bool large_file_format)
7645 {
7646 uint64_t offset = 0;
7647
7648 if(!large_file_format) {
7649 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7650 } else {
7651 /*
7652 * No BVAL, this is reversed!
7653 */
7654 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7655 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7656 }
7657
7658 return offset;
7659 }
7660
7661 NTSTATUS smbd_do_locking(struct smb_request *req,
7662 files_struct *fsp,
7663 uint8_t type,
7664 int32_t timeout,
7665 uint16_t num_locks,
7666 struct smbd_lock_element *locks,
7667 bool *async)
7668 {
7669 connection_struct *conn = req->conn;
7670 int i;
7671 NTSTATUS status = NT_STATUS_OK;
7672
7673 *async = false;
7674
7675 /* Setup the timeout in seconds. */
7676
7677 if (!lp_blocking_locks(SNUM(conn))) {
7678 timeout = 0;
7679 }
7680
7681 for(i = 0; i < (int)num_locks; i++) {
7682 struct smbd_lock_element *e = &locks[i];
7683
7684 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7685 "%llu, file %s timeout = %d\n",
7686 (double)e->offset,
7687 (double)e->count,
7688 (unsigned long long)e->smblctx,
7689 fsp_str_dbg(fsp),
7690 (int)timeout));
7691
7692 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7693 struct blocking_lock_record *blr = NULL;
7694
7695 if (num_locks > 1) {
7696 /*
7697 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7698 * if the lock vector contains one entry. When given multiple cancel
7699 * requests in a single PDU we expect the server to return an
7700 * error. Windows servers seem to accept the request but only
7701 * cancel the first lock.
7702 * JRA - Do what Windows does (tm) :-).
7703 */
7704
7705 #if 0
7706 /* MS-CIFS (2.2.4.32.1) behavior. */
7707 return NT_STATUS_DOS(ERRDOS,
7708 ERRcancelviolation);
7709 #else
7710 /* Windows behavior. */
7711 if (i != 0) {
7712 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7713 "cancel request\n"));
7714 continue;
7715 }
7716 #endif
7717 }
7718
7719 if (lp_blocking_locks(SNUM(conn))) {
7720
7721 /* Schedule a message to ourselves to
7722 remove the blocking lock record and
7723 return the right error. */
7724
7725 blr = blocking_lock_cancel_smb1(fsp,
7726 e->smblctx,
7727 e->offset,
7728 e->count,
7729 WINDOWS_LOCK,
7730 type,
7731 NT_STATUS_FILE_LOCK_CONFLICT);
7732 if (blr == NULL) {
7733 return NT_STATUS_DOS(
7734 ERRDOS,
7735 ERRcancelviolation);
7736 }
7737 }
7738 /* Remove a matching pending lock. */
7739 status = do_lock_cancel(fsp,
7740 e->smblctx,
7741 e->count,
7742 e->offset,
7743 WINDOWS_LOCK);
7744 } else {
7745 bool blocking_lock = timeout ? true : false;
7746 bool defer_lock = false;
7747 struct byte_range_lock *br_lck;
7748 uint64_t block_smblctx;
7749
7750 br_lck = do_lock(req->sconn->msg_ctx,
7751 fsp,
7752 e->smblctx,
7753 e->count,
7754 e->offset,
7755 e->brltype,
7756 WINDOWS_LOCK,
7757 blocking_lock,
7758 &status,
7759 &block_smblctx);
7760
7761 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7762 /* Windows internal resolution for blocking locks seems
7763 to be about 200ms... Don't wait for less than that. JRA. */
7764 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7765 timeout = lp_lock_spin_time();
7766 }
7767 defer_lock = true;
7768 }
7769
7770 /* If a lock sent with timeout of zero would fail, and
7771 * this lock has been requested multiple times,
7772 * according to brl_lock_failed() we convert this
7773 * request to a blocking lock with a timeout of between
7774 * 150 - 300 milliseconds.
7775 *
7776 * If lp_lock_spin_time() has been set to 0, we skip
7777 * this blocking retry and fail immediately.
7778 *
7779 * Replacement for do_lock_spin(). JRA. */
7780
7781 if (!req->sconn->using_smb2 &&
7782 br_lck && lp_blocking_locks(SNUM(conn)) &&
7783 lp_lock_spin_time() && !blocking_lock &&
7784 NT_STATUS_EQUAL((status),
7785 NT_STATUS_FILE_LOCK_CONFLICT))
7786 {
7787 defer_lock = true;
7788 timeout = lp_lock_spin_time();
7789 }
7790
7791 if (br_lck && defer_lock) {
7792 /*
7793 * A blocking lock was requested. Package up
7794 * this smb into a queued request and push it
7795 * onto the blocking lock queue.
7796 */
7797 if(push_blocking_lock_request(br_lck,
7798 req,
7799 fsp,
7800 timeout,
7801 i,
7802 e->smblctx,
7803 e->brltype,
7804 WINDOWS_LOCK,
7805 e->offset,
7806 e->count,
7807 block_smblctx)) {
7808 TALLOC_FREE(br_lck);
7809 *async = true;
7810 return NT_STATUS_OK;
7811 }
7812 }
7813
7814 TALLOC_FREE(br_lck);
7815 }
7816
7817 if (!NT_STATUS_IS_OK(status)) {
7818 break;
7819 }
7820 }
7821
7822 /* If any of the above locks failed, then we must unlock
7823 all of the previous locks (X/Open spec). */
7824
7825 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7826
7827 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7828 i = -1; /* we want to skip the for loop */
7829 }
7830
7831 /*
7832 * Ensure we don't do a remove on the lock that just failed,
7833 * as under POSIX rules, if we have a lock already there, we
7834 * will delete it (and we shouldn't) .....
7835 */
7836 for(i--; i >= 0; i--) {
7837 struct smbd_lock_element *e = &locks[i];
7838
7839 do_unlock(req->sconn->msg_ctx,
7840 fsp,
7841 e->smblctx,
7842 e->count,
7843 e->offset,
7844 WINDOWS_LOCK);
7845 }
7846 return status;
7847 }
7848
7849 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
7850 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
7851
7852 return NT_STATUS_OK;
7853 }
7854
7855 NTSTATUS smbd_do_unlocking(struct smb_request *req,
7856 files_struct *fsp,
7857 uint16_t num_ulocks,
7858 struct smbd_lock_element *ulocks)
7859 {
7860 int i;
7861
7862 for(i = 0; i < (int)num_ulocks; i++) {
7863 struct smbd_lock_element *e = &ulocks[i];
7864 NTSTATUS status;
7865
7866 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
7867 "pid %u, file %s\n", __func__,
7868 (double)e->offset,
7869 (double)e->count,
7870 (unsigned int)e->smblctx,
7871 fsp_str_dbg(fsp)));
7872
7873 if (e->brltype != UNLOCK_LOCK) {
7874 /* this can only happen with SMB2 */
7875 return NT_STATUS_INVALID_PARAMETER;
7876 }
7877
7878 status = do_unlock(req->sconn->msg_ctx,
7879 fsp,
7880 e->smblctx,
7881 e->count,
7882 e->offset,
7883 WINDOWS_LOCK);
7884
7885 DEBUG(10, ("%s: unlock returned %s\n", __func__,
7886 nt_errstr(status)));
7887
7888 if (!NT_STATUS_IS_OK(status)) {
7889 return status;
7890 }
7891 }
7892
7893 DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
7894 num_ulocks));
7895
7896 return NT_STATUS_OK;
7897 }
7898
7899 /****************************************************************************
7900 Reply to a lockingX request.
7901 ****************************************************************************/
7902
7903 void reply_lockingX(struct smb_request *req)
7904 {
7905 connection_struct *conn = req->conn;
7906 files_struct *fsp;
7907 unsigned char locktype;
7908 unsigned char oplocklevel;
7909 uint16 num_ulocks;
7910 uint16 num_locks;
7911 int32 lock_timeout;
7912 int i;
7913 const uint8_t *data;
7914 bool large_file_format;
7915 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7916 struct smbd_lock_element *ulocks;
7917 struct smbd_lock_element *locks;
7918 bool async = false;
7919
7920 START_PROFILE(SMBlockingX);
7921
7922 if (req->wct < 8) {
7923 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7924 END_PROFILE(SMBlockingX);
7925 return;
7926 }
7927
7928 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7929 locktype = CVAL(req->vwv+3, 0);
7930 oplocklevel = CVAL(req->vwv+3, 1);
7931 num_ulocks = SVAL(req->vwv+6, 0);
7932 num_locks = SVAL(req->vwv+7, 0);
7933 lock_timeout = IVAL(req->vwv+4, 0);
7934 large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
7935
7936 if (!check_fsp(conn, req, fsp)) {
7937 END_PROFILE(SMBlockingX);
7938 return;
7939 }
7940
7941 data = req->buf;
7942
7943 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7944 /* we don't support these - and CANCEL_LOCK makes w2k
7945 and XP reboot so I don't really want to be
7946 compatible! (tridge) */
7947 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7948 END_PROFILE(SMBlockingX);
7949 return;
7950 }
7951
7952 /* Check if this is an oplock break on a file
7953 we have granted an oplock on.
7954 */
7955 if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
7956 /* Client can insist on breaking to none. */
7957 bool break_to_none = (oplocklevel == 0);
7958 bool result;
7959
7960 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7961 "for %s\n", (unsigned int)oplocklevel,
7962 fsp_fnum_dbg(fsp)));
7963
7964 /*
7965 * Make sure we have granted an exclusive or batch oplock on
7966 * this file.
7967 */
7968
7969 if (fsp->oplock_type == 0) {
7970
7971 /* The Samba4 nbench simulator doesn't understand
7972 the difference between break to level2 and break
7973 to none from level2 - it sends oplock break
7974 replies in both cases. Don't keep logging an error
7975 message here - just ignore it. JRA. */
7976
7977 DEBUG(5,("reply_lockingX: Error : oplock break from "
7978 "client for %s (oplock=%d) and no "
7979 "oplock granted on this file (%s).\n",
7980 fsp_fnum_dbg(fsp), fsp->oplock_type,
7981 fsp_str_dbg(fsp)));
7982
7983 /* if this is a pure oplock break request then don't
7984 * send a reply */
7985 if (num_locks == 0 && num_ulocks == 0) {
7986 END_PROFILE(SMBlockingX);
7987 return;
7988 } else {
7989 END_PROFILE(SMBlockingX);
7990 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7991 return;
7992 }
7993 }
7994
7995 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7996 (break_to_none)) {
7997 result = remove_oplock(fsp);
7998 } else {
7999 result = downgrade_oplock(fsp);
8000 }
8001
8002 if (!result) {
8003 DEBUG(0, ("reply_lockingX: error in removing "
8004 "oplock on file %s\n", fsp_str_dbg(fsp)));
8005 /* Hmmm. Is this panic justified? */
8006 smb_panic("internal tdb error");
8007 }
8008
8009 /* if this is a pure oplock break request then don't send a
8010 * reply */
8011 if (num_locks == 0 && num_ulocks == 0) {
8012 /* Sanity check - ensure a pure oplock break is not a
8013 chained request. */
8014 if (CVAL(req->vwv+0, 0) != 0xff) {
8015 DEBUG(0,("reply_lockingX: Error : pure oplock "
8016 "break is a chained %d request !\n",
8017 (unsigned int)CVAL(req->vwv+0, 0)));
8018 }
8019 END_PROFILE(SMBlockingX);
8020 return;
8021 }
8022 }
8023
8024 if (req->buflen <
8025 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8026 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8027 END_PROFILE(SMBlockingX);
8028 return;
8029 }
8030
8031 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8032 if (ulocks == NULL) {
8033 reply_nterror(req, NT_STATUS_NO_MEMORY);
8034 END_PROFILE(SMBlockingX);
8035 return;
8036 }
8037
8038 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8039 if (locks == NULL) {
8040 reply_nterror(req, NT_STATUS_NO_MEMORY);
8041 END_PROFILE(SMBlockingX);
8042 return;
8043 }
8044
8045 /* Data now points at the beginning of the list
8046 of smb_unlkrng structs */
8047 for(i = 0; i < (int)num_ulocks; i++) {
8048 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8049 ulocks[i].count = get_lock_count(data, i, large_file_format);
8050 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8051 ulocks[i].brltype = UNLOCK_LOCK;
8052 }
8053
8054 /* Now do any requested locks */
8055 data += ((large_file_format ? 20 : 10)*num_ulocks);
8056
8057 /* Data now points at the beginning of the list
8058 of smb_lkrng structs */
8059
8060 for(i = 0; i < (int)num_locks; i++) {
8061 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8062 locks[i].count = get_lock_count(data, i, large_file_format);
8063 locks[i].offset = get_lock_offset(data, i, large_file_format);
8064
8065 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8066 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8067 locks[i].brltype = PENDING_READ_LOCK;
8068 } else {
8069 locks[i].brltype = READ_LOCK;
8070 }
8071 } else {
8072 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8073 locks[i].brltype = PENDING_WRITE_LOCK;
8074 } else {
8075 locks[i].brltype = WRITE_LOCK;
8076 }
8077 }
8078 }
8079
8080 status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8081 if (!NT_STATUS_IS_OK(status)) {
8082 END_PROFILE(SMBlockingX);
8083 reply_nterror(req, status);
8084 return;
8085 }
8086
8087 status = smbd_do_locking(req, fsp,
8088 locktype, lock_timeout,
8089 num_locks, locks,
8090 &async);
8091 if (!NT_STATUS_IS_OK(status)) {
8092 END_PROFILE(SMBlockingX);
8093 reply_nterror(req, status);
8094 return;
8095 }
8096 if (async) {
8097 END_PROFILE(SMBlockingX);
8098 return;
8099 }
8100
8101 reply_outbuf(req, 2, 0);
8102 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8103 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8104
8105 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8106 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8107
8108 END_PROFILE(SMBlockingX);
8109 }
8110
8111 #undef DBGC_CLASS
8112 #define DBGC_CLASS DBGC_ALL
8113
8114 /****************************************************************************
8115 Reply to a SMBreadbmpx (read block multiplex) request.
8116 Always reply with an error, if someone has a platform really needs this,
8117 please contact vl@samba.org
8118 ****************************************************************************/
8119
8120 void reply_readbmpx(struct smb_request *req)
8121 {
8122 START_PROFILE(SMBreadBmpx);
8123 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8124 END_PROFILE(SMBreadBmpx);
8125 return;
8126 }
8127
8128 /****************************************************************************
8129 Reply to a SMBreadbs (read block multiplex secondary) request.
8130 Always reply with an error, if someone has a platform really needs this,
8131 please contact vl@samba.org
8132 ****************************************************************************/
8133
8134 void reply_readbs(struct smb_request *req)
8135 {
8136 START_PROFILE(SMBreadBs);
8137 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8138 END_PROFILE(SMBreadBs);
8139 return;
8140 }
8141
8142 /****************************************************************************
8143 Reply to a SMBsetattrE.
8144 ****************************************************************************/
8145
8146 void reply_setattrE(struct smb_request *req)
8147 {
8148 connection_struct *conn = req->conn;
8149 struct smb_file_time ft;
8150 files_struct *fsp;
8151 NTSTATUS status;
8152
8153 START_PROFILE(SMBsetattrE);
8154 ZERO_STRUCT(ft);
8155
8156 if (req->wct < 7) {
8157 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8158 goto out;
8159 }
8160
8161 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8162
8163 if(!fsp || (fsp->conn != conn)) {
8164 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8165 goto out;
8166 }
8167
8168 /*
8169 * Convert the DOS times into unix times.
8170 */
8171
8172 ft.atime = convert_time_t_to_timespec(
8173 srv_make_unix_date2(req->vwv+3));
8174 ft.mtime = convert_time_t_to_timespec(
8175 srv_make_unix_date2(req->vwv+5));
8176 ft.create_time = convert_time_t_to_timespec(
8177 srv_make_unix_date2(req->vwv+1));
8178
8179 reply_outbuf(req, 0, 0);
8180
8181 /*
8182 * Patch from Ray Frush <frush@engr.colostate.edu>
8183 * Sometimes times are sent as zero - ignore them.
8184 */
8185
8186 /* Ensure we have a valid stat struct for the source. */
8187 status = vfs_stat_fsp(fsp);
8188 if (!NT_STATUS_IS_OK(status)) {
8189 reply_nterror(req, status);
8190 goto out;
8191 }
8192
8193 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8194 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8195 goto out;
8196 }
8197
8198 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8199 if (!NT_STATUS_IS_OK(status)) {
8200 reply_nterror(req, status);
8201 goto out;
8202 }
8203
8204 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8205 " createtime=%u\n",
8206 fsp_fnum_dbg(fsp),
8207 (unsigned int)ft.atime.tv_sec,
8208 (unsigned int)ft.mtime.tv_sec,
8209 (unsigned int)ft.create_time.tv_sec
8210 ));
8211 out:
8212 END_PROFILE(SMBsetattrE);
8213 return;
8214 }
8215
8216
8217 /* Back from the dead for OS/2..... JRA. */
8218
8219 /****************************************************************************
8220 Reply to a SMBwritebmpx (write block multiplex primary) request.
8221 Always reply with an error, if someone has a platform really needs this,
8222 please contact vl@samba.org
8223 ****************************************************************************/
8224
8225 void reply_writebmpx(struct smb_request *req)
8226 {
8227 START_PROFILE(SMBwriteBmpx);
8228 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8229 END_PROFILE(SMBwriteBmpx);
8230 return;
8231 }
8232
8233 /****************************************************************************
8234 Reply to a SMBwritebs (write block multiplex secondary) request.
8235 Always reply with an error, if someone has a platform really needs this,
8236 please contact vl@samba.org
8237 ****************************************************************************/
8238
8239 void reply_writebs(struct smb_request *req)
8240 {
8241 START_PROFILE(SMBwriteBs);
8242 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8243 END_PROFILE(SMBwriteBs);
8244 return;
8245 }
8246
8247 /****************************************************************************
8248 Reply to a SMBgetattrE.
8249 ****************************************************************************/
8250
8251 void reply_getattrE(struct smb_request *req)
8252 {
8253 connection_struct *conn = req->conn;
8254 int mode;
8255 files_struct *fsp;
8256 struct timespec create_ts;
8257
8258 START_PROFILE(SMBgetattrE);
8259
8260 if (req->wct < 1) {
8261 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8262 END_PROFILE(SMBgetattrE);
8263 return;
8264 }
8265
8266 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8267
8268 if(!fsp || (fsp->conn != conn)) {
8269 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8270 END_PROFILE(SMBgetattrE);
8271 return;
8272 }
8273
8274 /* Do an fstat on this file */
8275 if(fsp_stat(fsp)) {
8276 reply_nterror(req, map_nt_error_from_unix(errno));
8277 END_PROFILE(SMBgetattrE);
8278 return;
8279 }
8280
8281 mode = dos_mode(conn, fsp->fsp_name);
8282
8283 /*
8284 * Convert the times into dos times. Set create
8285 * date to be last modify date as UNIX doesn't save
8286 * this.
8287 */
8288
8289 reply_outbuf(req, 11, 0);
8290
8291 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8292 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8293 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8294 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8295 /* Should we check pending modtime here ? JRA */
8296 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8297 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8298
8299 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8300 SIVAL(req->outbuf, smb_vwv6, 0);
8301 SIVAL(req->outbuf, smb_vwv8, 0);
8302 } else {
8303 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8304 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8305 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8306 }
8307 SSVAL(req->outbuf,smb_vwv10, mode);
8308
8309 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8310
8311 END_PROFILE(SMBgetattrE);
8312 return;
8313 }
Samba GIT mirror