?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
spoolss: use nstring_array in spoolss_EnumPrinterKey.
[Samba.git] / source3 / smbd / reply.c
bloba743385f7f51fa7c454f66875ba4fd7a19ba1104
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* stream names allow more characters than file names */
80 stream_started = true;
81 start_of_name_component = false;
82 posix_path = true;
83
84 if (s[1] == '\0') {
85 return NT_STATUS_OBJECT_NAME_INVALID;
86 }
87 }
88
89 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
90 /*
91 * Safe to assume is not the second part of a mb char
92 * as this is handled below.
93 */
94 /* Eat multiple '/' or '\\' */
95 while (IS_PATH_SEP(*s,posix_path)) {
96 s++;
97 }
98 if ((d != path) && (*s != '\0')) {
99 /* We only care about non-leading or trailing '/' or '\\' */
100 *d++ = '/';
101 }
102
103 start_of_name_component = True;
104 /* New component. */
105 *p_last_component_contains_wcard = False;
106 continue;
107 }
108
109 if (start_of_name_component) {
110 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
111 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
112
113 /*
114 * No mb char starts with '.' so we're safe checking the directory separator here.
115 */
116
117 /* If we just added a '/' - delete it */
118 if ((d > path) && (*(d-1) == '/')) {
119 *(d-1) = '\0';
120 d--;
121 }
122
123 /* Are we at the start ? Can't go back further if so. */
124 if (d <= path) {
125 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
126 break;
127 }
128 /* Go back one level... */
129 /* We know this is safe as '/' cannot be part of a mb sequence. */
130 /* NOTE - if this assumption is invalid we are not in good shape... */
131 /* Decrement d first as d points to the *next* char to write into. */
132 for (d--; d > path; d--) {
133 if (*d == '/')
134 break;
135 }
136 s += 2; /* Else go past the .. */
137 /* We're still at the start of a name component, just the previous one. */
138 continue;
139
140 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
141 if (posix_path) {
142 /* Eat the '.' */
143 s++;
144 continue;
145 }
146 }
147
148 }
149
150 if (!(*s & 0x80)) {
151 if (!posix_path) {
152 if (*s <= 0x1f || *s == '|') {
153 return NT_STATUS_OBJECT_NAME_INVALID;
154 }
155 switch (*s) {
156 case '*':
157 case '?':
158 case '<':
159 case '>':
160 case '"':
161 *p_last_component_contains_wcard = True;
162 break;
163 default:
164 break;
165 }
166 }
167 *d++ = *s++;
168 } else {
169 size_t siz;
170 /* Get the size of the next MB character. */
171 next_codepoint(s,&siz);
172 switch(siz) {
173 case 5:
174 *d++ = *s++;
175 /*fall through*/
176 case 4:
177 *d++ = *s++;
178 /*fall through*/
179 case 3:
180 *d++ = *s++;
181 /*fall through*/
182 case 2:
183 *d++ = *s++;
184 /*fall through*/
185 case 1:
186 *d++ = *s++;
187 break;
188 default:
189 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
190 *d = '\0';
191 return NT_STATUS_INVALID_PARAMETER;
192 }
193 }
194 start_of_name_component = False;
195 }
196
197 *d = '\0';
198
199 return ret;
200 }
201
202 /****************************************************************************
203 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
204 No wildcards allowed.
205 ****************************************************************************/
206
207 NTSTATUS check_path_syntax(char *path)
208 {
209 bool ignore;
210 return check_path_syntax_internal(path, False, &ignore);
211 }
212
213 /****************************************************************************
214 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
215 Wildcards allowed - p_contains_wcard returns true if the last component contained
216 a wildcard.
217 ****************************************************************************/
218
219 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
220 {
221 return check_path_syntax_internal(path, False, p_contains_wcard);
222 }
223
224 /****************************************************************************
225 Check the path for a POSIX client.
226 We're assuming here that '/' is not the second byte in any multibyte char
227 set (a safe assumption).
228 ****************************************************************************/
229
230 NTSTATUS check_path_syntax_posix(char *path)
231 {
232 bool ignore;
233 return check_path_syntax_internal(path, True, &ignore);
234 }
235
236 /****************************************************************************
237 Pull a string and check the path allowing a wilcard - provide for error return.
238 ****************************************************************************/
239
240 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
241 const char *base_ptr,
242 uint16 smb_flags2,
243 char **pp_dest,
244 const char *src,
245 size_t src_len,
246 int flags,
247 NTSTATUS *err,
248 bool *contains_wcard)
249 {
250 size_t ret;
251
252 *pp_dest = NULL;
253
254 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
255 src_len, flags);
256
257 if (!*pp_dest) {
258 *err = NT_STATUS_INVALID_PARAMETER;
259 return ret;
260 }
261
262 *contains_wcard = False;
263
264 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
265 /*
266 * For a DFS path the function parse_dfs_path()
267 * will do the path processing, just make a copy.
268 */
269 *err = NT_STATUS_OK;
270 return ret;
271 }
272
273 if (lp_posix_pathnames()) {
274 *err = check_path_syntax_posix(*pp_dest);
275 } else {
276 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
277 }
278
279 return ret;
280 }
281
282 /****************************************************************************
283 Pull a string and check the path - provide for error return.
284 ****************************************************************************/
285
286 size_t srvstr_get_path(TALLOC_CTX *ctx,
287 const char *base_ptr,
288 uint16 smb_flags2,
289 char **pp_dest,
290 const char *src,
291 size_t src_len,
292 int flags,
293 NTSTATUS *err)
294 {
295 bool ignore;
296 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
297 src_len, flags, err, &ignore);
298 }
299
300 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
301 char **pp_dest, const char *src, int flags,
302 NTSTATUS *err, bool *contains_wcard)
303 {
304 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
305 pp_dest, src, smbreq_bufrem(req, src),
306 flags, err, contains_wcard);
307 }
308
309 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
310 char **pp_dest, const char *src, int flags,
311 NTSTATUS *err)
312 {
313 bool ignore;
314 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
315 flags, err, &ignore);
316 }
317
318 /****************************************************************************
319 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
320 ****************************************************************************/
321
322 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
323 files_struct *fsp)
324 {
325 if (!(fsp) || !(conn)) {
326 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
327 return False;
328 }
329 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
330 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
331 return False;
332 }
333 return True;
334 }
335
336 /****************************************************************************
337 Check if we have a correct fsp pointing to a file.
338 ****************************************************************************/
339
340 bool check_fsp(connection_struct *conn, struct smb_request *req,
341 files_struct *fsp)
342 {
343 if (!check_fsp_open(conn, req, fsp)) {
344 return False;
345 }
346 if ((fsp)->is_directory) {
347 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
348 return False;
349 }
350 if ((fsp)->fh->fd == -1) {
351 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
352 return False;
353 }
354 (fsp)->num_smb_operations++;
355 return True;
356 }
357
358 /****************************************************************************
359 Check if we have a correct fsp pointing to a quota fake file. Replacement for
360 the CHECK_NTQUOTA_HANDLE_OK macro.
361 ****************************************************************************/
362
363 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
364 files_struct *fsp)
365 {
366 if (!check_fsp_open(conn, req, fsp)) {
367 return false;
368 }
369
370 if (fsp->is_directory) {
371 return false;
372 }
373
374 if (fsp->fake_file_handle == NULL) {
375 return false;
376 }
377
378 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
379 return false;
380 }
381
382 if (fsp->fake_file_handle->private_data == NULL) {
383 return false;
384 }
385
386 return true;
387 }
388
389 /****************************************************************************
390 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
391 ****************************************************************************/
392
393 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
394 files_struct *fsp)
395 {
396 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
397 && (req->vuid == (fsp)->vuid)) {
398 return True;
399 }
400
401 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
402 return False;
403 }
404
405 /****************************************************************************
406 Reply to a (netbios-level) special message.
407 ****************************************************************************/
408
409 void reply_special(char *inbuf)
410 {
411 int msg_type = CVAL(inbuf,0);
412 int msg_flags = CVAL(inbuf,1);
413 fstring name1,name2;
414 char name_type = 0;
415
416 /*
417 * We only really use 4 bytes of the outbuf, but for the smb_setlen
418 * calculation & friends (srv_send_smb uses that) we need the full smb
419 * header.
420 */
421 char outbuf[smb_size];
422
423 *name1 = *name2 = 0;
424
425 memset(outbuf, '\0', sizeof(outbuf));
426
427 smb_setlen(outbuf,0);
428
429 switch (msg_type) {
430 case 0x81: /* session request */
431
432 if (already_got_session) {
433 exit_server_cleanly("multiple session request not permitted");
434 }
435
436 SCVAL(outbuf,0,0x82);
437 SCVAL(outbuf,3,0);
438 if (name_len(inbuf+4) > 50 ||
439 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
440 DEBUG(0,("Invalid name length in session request\n"));
441 return;
442 }
443 name_extract(inbuf,4,name1);
444 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
445 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
446 name1,name2));
447
448 set_local_machine_name(name1, True);
449 set_remote_machine_name(name2, True);
450
451 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
452 get_local_machine_name(), get_remote_machine_name(),
453 name_type));
454
455 if (name_type == 'R') {
456 /* We are being asked for a pathworks session ---
457 no thanks! */
458 SCVAL(outbuf, 0,0x83);
459 break;
460 }
461
462 /* only add the client's machine name to the list
463 of possibly valid usernames if we are operating
464 in share mode security */
465 if (lp_security() == SEC_SHARE) {
466 add_session_user(get_remote_machine_name());
467 }
468
469 reload_services(True);
470 reopen_logs();
471
472 already_got_session = True;
473 break;
474
475 case 0x89: /* session keepalive request
476 (some old clients produce this?) */
477 SCVAL(outbuf,0,SMBkeepalive);
478 SCVAL(outbuf,3,0);
479 break;
480
481 case 0x82: /* positive session response */
482 case 0x83: /* negative session response */
483 case 0x84: /* retarget session response */
484 DEBUG(0,("Unexpected session response\n"));
485 break;
486
487 case SMBkeepalive: /* session keepalive */
488 default:
489 return;
490 }
491
492 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
493 msg_type, msg_flags));
494
495 srv_send_smb(smbd_server_fd(), outbuf, false, NULL);
496 return;
497 }
498
499 /****************************************************************************
500 Reply to a tcon.
501 conn POINTER CAN BE NULL HERE !
502 ****************************************************************************/
503
504 void reply_tcon(struct smb_request *req)
505 {
506 connection_struct *conn = req->conn;
507 const char *service;
508 char *service_buf = NULL;
509 char *password = NULL;
510 char *dev = NULL;
511 int pwlen=0;
512 NTSTATUS nt_status;
513 const char *p;
514 DATA_BLOB password_blob;
515 TALLOC_CTX *ctx = talloc_tos();
516
517 START_PROFILE(SMBtcon);
518
519 if (req->buflen < 4) {
520 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
521 END_PROFILE(SMBtcon);
522 return;
523 }
524
525 p = (const char *)req->buf + 1;
526 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
527 p += 1;
528 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
529 p += pwlen+1;
530 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
531 p += 1;
532
533 if (service_buf == NULL || password == NULL || dev == NULL) {
534 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
535 END_PROFILE(SMBtcon);
536 return;
537 }
538 p = strrchr_m(service_buf,'\\');
539 if (p) {
540 service = p+1;
541 } else {
542 service = service_buf;
543 }
544
545 password_blob = data_blob(password, pwlen+1);
546
547 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
548 req->conn = conn;
549
550 data_blob_clear_free(&password_blob);
551
552 if (!conn) {
553 reply_nterror(req, nt_status);
554 END_PROFILE(SMBtcon);
555 return;
556 }
557
558 reply_outbuf(req, 2, 0);
559 SSVAL(req->outbuf,smb_vwv0,max_recv);
560 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
561 SSVAL(req->outbuf,smb_tid,conn->cnum);
562
563 DEBUG(3,("tcon service=%s cnum=%d\n",
564 service, conn->cnum));
565
566 END_PROFILE(SMBtcon);
567 return;
568 }
569
570 /****************************************************************************
571 Reply to a tcon and X.
572 conn POINTER CAN BE NULL HERE !
573 ****************************************************************************/
574
575 void reply_tcon_and_X(struct smb_request *req)
576 {
577 connection_struct *conn = req->conn;
578 const char *service = NULL;
579 DATA_BLOB password;
580 TALLOC_CTX *ctx = talloc_tos();
581 /* what the cleint thinks the device is */
582 char *client_devicetype = NULL;
583 /* what the server tells the client the share represents */
584 const char *server_devicetype;
585 NTSTATUS nt_status;
586 int passlen;
587 char *path = NULL;
588 const char *p, *q;
589 uint16 tcon_flags;
590
591 START_PROFILE(SMBtconX);
592
593 if (req->wct < 4) {
594 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
595 END_PROFILE(SMBtconX);
596 return;
597 }
598
599 passlen = SVAL(req->vwv+3, 0);
600 tcon_flags = SVAL(req->vwv+2, 0);
601
602 /* we might have to close an old one */
603 if ((tcon_flags & 0x1) && conn) {
604 close_cnum(conn,req->vuid);
605 req->conn = NULL;
606 conn = NULL;
607 }
608
609 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
610 reply_doserror(req, ERRDOS, ERRbuftoosmall);
611 END_PROFILE(SMBtconX);
612 return;
613 }
614
615 if (global_encrypted_passwords_negotiated) {
616 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
617 if (lp_security() == SEC_SHARE) {
618 /*
619 * Security = share always has a pad byte
620 * after the password.
621 */
622 p = (const char *)req->buf + passlen + 1;
623 } else {
624 p = (const char *)req->buf + passlen;
625 }
626 } else {
627 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
628 /* Ensure correct termination */
629 password.data[passlen]=0;
630 p = (const char *)req->buf + passlen + 1;
631 }
632
633 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
634
635 if (path == NULL) {
636 data_blob_clear_free(&password);
637 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
638 END_PROFILE(SMBtconX);
639 return;
640 }
641
642 /*
643 * the service name can be either: \\server\share
644 * or share directly like on the DELL PowerVault 705
645 */
646 if (*path=='\\') {
647 q = strchr_m(path+2,'\\');
648 if (!q) {
649 data_blob_clear_free(&password);
650 reply_doserror(req, ERRDOS, ERRnosuchshare);
651 END_PROFILE(SMBtconX);
652 return;
653 }
654 service = q+1;
655 } else {
656 service = path;
657 }
658
659 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
660 &client_devicetype, p,
661 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
662
663 if (client_devicetype == NULL) {
664 data_blob_clear_free(&password);
665 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
666 END_PROFILE(SMBtconX);
667 return;
668 }
669
670 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
671
672 conn = make_connection(service, password, client_devicetype,
673 req->vuid, &nt_status);
674 req->conn =conn;
675
676 data_blob_clear_free(&password);
677
678 if (!conn) {
679 reply_nterror(req, nt_status);
680 END_PROFILE(SMBtconX);
681 return;
682 }
683
684 if ( IS_IPC(conn) )
685 server_devicetype = "IPC";
686 else if ( IS_PRINT(conn) )
687 server_devicetype = "LPT1:";
688 else
689 server_devicetype = "A:";
690
691 if (Protocol < PROTOCOL_NT1) {
692 reply_outbuf(req, 2, 0);
693 if (message_push_string(&req->outbuf, server_devicetype,
694 STR_TERMINATE|STR_ASCII) == -1) {
695 reply_nterror(req, NT_STATUS_NO_MEMORY);
696 END_PROFILE(SMBtconX);
697 return;
698 }
699 } else {
700 /* NT sets the fstype of IPC$ to the null string */
701 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
702
703 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
704 /* Return permissions. */
705 uint32 perm1 = 0;
706 uint32 perm2 = 0;
707
708 reply_outbuf(req, 7, 0);
709
710 if (IS_IPC(conn)) {
711 perm1 = FILE_ALL_ACCESS;
712 perm2 = FILE_ALL_ACCESS;
713 } else {
714 perm1 = CAN_WRITE(conn) ?
715 SHARE_ALL_ACCESS :
716 SHARE_READ_ONLY;
717 }
718
719 SIVAL(req->outbuf, smb_vwv3, perm1);
720 SIVAL(req->outbuf, smb_vwv5, perm2);
721 } else {
722 reply_outbuf(req, 3, 0);
723 }
724
725 if ((message_push_string(&req->outbuf, server_devicetype,
726 STR_TERMINATE|STR_ASCII) == -1)
727 || (message_push_string(&req->outbuf, fstype,
728 STR_TERMINATE) == -1)) {
729 reply_nterror(req, NT_STATUS_NO_MEMORY);
730 END_PROFILE(SMBtconX);
731 return;
732 }
733
734 /* what does setting this bit do? It is set by NT4 and
735 may affect the ability to autorun mounted cdroms */
736 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
737 (lp_csc_policy(SNUM(conn)) << 2));
738
739 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
740 DEBUG(2,("Serving %s as a Dfs root\n",
741 lp_servicename(SNUM(conn)) ));
742 SSVAL(req->outbuf, smb_vwv2,
743 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
744 }
745 }
746
747
748 DEBUG(3,("tconX service=%s \n",
749 service));
750
751 /* set the incoming and outgoing tid to the just created one */
752 SSVAL(req->inbuf,smb_tid,conn->cnum);
753 SSVAL(req->outbuf,smb_tid,conn->cnum);
754
755 END_PROFILE(SMBtconX);
756
757 chain_reply(req);
758 return;
759 }
760
761 /****************************************************************************
762 Reply to an unknown type.
763 ****************************************************************************/
764
765 void reply_unknown_new(struct smb_request *req, uint8 type)
766 {
767 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
768 smb_fn_name(type), type, type));
769 reply_doserror(req, ERRSRV, ERRunknownsmb);
770 return;
771 }
772
773 /****************************************************************************
774 Reply to an ioctl.
775 conn POINTER CAN BE NULL HERE !
776 ****************************************************************************/
777
778 void reply_ioctl(struct smb_request *req)
779 {
780 connection_struct *conn = req->conn;
781 uint16 device;
782 uint16 function;
783 uint32 ioctl_code;
784 int replysize;
785 char *p;
786
787 START_PROFILE(SMBioctl);
788
789 if (req->wct < 3) {
790 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
791 END_PROFILE(SMBioctl);
792 return;
793 }
794
795 device = SVAL(req->vwv+1, 0);
796 function = SVAL(req->vwv+2, 0);
797 ioctl_code = (device << 16) + function;
798
799 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
800
801 switch (ioctl_code) {
802 case IOCTL_QUERY_JOB_INFO:
803 replysize = 32;
804 break;
805 default:
806 reply_doserror(req, ERRSRV, ERRnosupport);
807 END_PROFILE(SMBioctl);
808 return;
809 }
810
811 reply_outbuf(req, 8, replysize+1);
812 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
813 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
814 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
815 p = smb_buf(req->outbuf);
816 memset(p, '\0', replysize+1); /* valgrind-safe. */
817 p += 1; /* Allow for alignment */
818
819 switch (ioctl_code) {
820 case IOCTL_QUERY_JOB_INFO:
821 {
822 files_struct *fsp = file_fsp(
823 req, SVAL(req->vwv+0, 0));
824 if (!fsp) {
825 reply_doserror(req, ERRDOS, ERRbadfid);
826 END_PROFILE(SMBioctl);
827 return;
828 }
829 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
830 srvstr_push((char *)req->outbuf, req->flags2, p+2,
831 global_myname(), 15,
832 STR_TERMINATE|STR_ASCII);
833 if (conn) {
834 srvstr_push((char *)req->outbuf, req->flags2,
835 p+18, lp_servicename(SNUM(conn)),
836 13, STR_TERMINATE|STR_ASCII);
837 } else {
838 memset(p+18, 0, 13);
839 }
840 break;
841 }
842 }
843
844 END_PROFILE(SMBioctl);
845 return;
846 }
847
848 /****************************************************************************
849 Strange checkpath NTSTATUS mapping.
850 ****************************************************************************/
851
852 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
853 {
854 /* Strange DOS error code semantics only for checkpath... */
855 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
856 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
857 /* We need to map to ERRbadpath */
858 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
859 }
860 }
861 return status;
862 }
863
864 /****************************************************************************
865 Reply to a checkpath.
866 ****************************************************************************/
867
868 void reply_checkpath(struct smb_request *req)
869 {
870 connection_struct *conn = req->conn;
871 char *name = NULL;
872 SMB_STRUCT_STAT sbuf;
873 NTSTATUS status;
874 TALLOC_CTX *ctx = talloc_tos();
875
876 START_PROFILE(SMBcheckpath);
877
878 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
879 STR_TERMINATE, &status);
880
881 if (!NT_STATUS_IS_OK(status)) {
882 status = map_checkpath_error(req->flags2, status);
883 reply_nterror(req, status);
884 END_PROFILE(SMBcheckpath);
885 return;
886 }
887
888 status = resolve_dfspath(ctx, conn,
889 req->flags2 & FLAGS2_DFS_PATHNAMES,
890 name,
891 &name);
892 if (!NT_STATUS_IS_OK(status)) {
893 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
894 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
895 ERRSRV, ERRbadpath);
896 END_PROFILE(SMBcheckpath);
897 return;
898 }
899 goto path_err;
900 }
901
902 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
903
904 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
905 if (!NT_STATUS_IS_OK(status)) {
906 goto path_err;
907 }
908
909 status = check_name(conn, name);
910 if (!NT_STATUS_IS_OK(status)) {
911 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
912 goto path_err;
913 }
914
915 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
916 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
917 status = map_nt_error_from_unix(errno);
918 goto path_err;
919 }
920
921 if (!S_ISDIR(sbuf.st_mode)) {
922 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
923 ERRDOS, ERRbadpath);
924 END_PROFILE(SMBcheckpath);
925 return;
926 }
927
928 reply_outbuf(req, 0, 0);
929
930 END_PROFILE(SMBcheckpath);
931 return;
932
933 path_err:
934
935 END_PROFILE(SMBcheckpath);
936
937 /* We special case this - as when a Windows machine
938 is parsing a path is steps through the components
939 one at a time - if a component fails it expects
940 ERRbadpath, not ERRbadfile.
941 */
942 status = map_checkpath_error(req->flags2, status);
943 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
944 /*
945 * Windows returns different error codes if
946 * the parent directory is valid but not the
947 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
948 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
949 * if the path is invalid.
950 */
951 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
952 ERRDOS, ERRbadpath);
953 return;
954 }
955
956 reply_nterror(req, status);
957 }
958
959 /****************************************************************************
960 Reply to a getatr.
961 ****************************************************************************/
962
963 void reply_getatr(struct smb_request *req)
964 {
965 connection_struct *conn = req->conn;
966 char *fname = NULL;
967 SMB_STRUCT_STAT sbuf;
968 int mode=0;
969 SMB_OFF_T size=0;
970 time_t mtime=0;
971 const char *p;
972 NTSTATUS status;
973 TALLOC_CTX *ctx = talloc_tos();
974
975 START_PROFILE(SMBgetatr);
976
977 p = (const char *)req->buf + 1;
978 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
979 if (!NT_STATUS_IS_OK(status)) {
980 reply_nterror(req, status);
981 END_PROFILE(SMBgetatr);
982 return;
983 }
984
985 status = resolve_dfspath(ctx, conn,
986 req->flags2 & FLAGS2_DFS_PATHNAMES,
987 fname,
988 &fname);
989 if (!NT_STATUS_IS_OK(status)) {
990 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
991 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
992 ERRSRV, ERRbadpath);
993 END_PROFILE(SMBgetatr);
994 return;
995 }
996 reply_nterror(req, status);
997 END_PROFILE(SMBgetatr);
998 return;
999 }
1000
1001 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1002 under WfWg - weird! */
1003 if (*fname == '\0') {
1004 mode = aHIDDEN | aDIR;
1005 if (!CAN_WRITE(conn)) {
1006 mode |= aRONLY;
1007 }
1008 size = 0;
1009 mtime = 0;
1010 } else {
1011 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1012 if (!NT_STATUS_IS_OK(status)) {
1013 reply_nterror(req, status);
1014 END_PROFILE(SMBgetatr);
1015 return;
1016 }
1017 status = check_name(conn, fname);
1018 if (!NT_STATUS_IS_OK(status)) {
1019 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1020 reply_nterror(req, status);
1021 END_PROFILE(SMBgetatr);
1022 return;
1023 }
1024 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1025 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1026 reply_unixerror(req, ERRDOS,ERRbadfile);
1027 END_PROFILE(SMBgetatr);
1028 return;
1029 }
1030
1031 mode = dos_mode(conn,fname,&sbuf);
1032 size = sbuf.st_size;
1033 mtime = sbuf.st_mtime;
1034 if (mode & aDIR) {
1035 size = 0;
1036 }
1037 }
1038
1039 reply_outbuf(req, 10, 0);
1040
1041 SSVAL(req->outbuf,smb_vwv0,mode);
1042 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1043 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1044 } else {
1045 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1046 }
1047 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1048
1049 if (Protocol >= PROTOCOL_NT1) {
1050 SSVAL(req->outbuf, smb_flg2,
1051 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1052 }
1053
1054 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1055
1056 END_PROFILE(SMBgetatr);
1057 return;
1058 }
1059
1060 /****************************************************************************
1061 Reply to a setatr.
1062 ****************************************************************************/
1063
1064 void reply_setatr(struct smb_request *req)
1065 {
1066 struct smb_file_time ft;
1067 connection_struct *conn = req->conn;
1068 char *fname = NULL;
1069 int mode;
1070 time_t mtime;
1071 SMB_STRUCT_STAT sbuf;
1072 const char *p;
1073 NTSTATUS status;
1074 TALLOC_CTX *ctx = talloc_tos();
1075
1076 START_PROFILE(SMBsetatr);
1077
1078 ZERO_STRUCT(ft);
1079
1080 if (req->wct < 2) {
1081 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1082 return;
1083 }
1084
1085 p = (const char *)req->buf + 1;
1086 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1087 if (!NT_STATUS_IS_OK(status)) {
1088 reply_nterror(req, status);
1089 END_PROFILE(SMBsetatr);
1090 return;
1091 }
1092
1093 status = resolve_dfspath(ctx, conn,
1094 req->flags2 & FLAGS2_DFS_PATHNAMES,
1095 fname,
1096 &fname);
1097 if (!NT_STATUS_IS_OK(status)) {
1098 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1099 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1100 ERRSRV, ERRbadpath);
1101 END_PROFILE(SMBsetatr);
1102 return;
1103 }
1104 reply_nterror(req, status);
1105 END_PROFILE(SMBsetatr);
1106 return;
1107 }
1108
1109 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1110 if (!NT_STATUS_IS_OK(status)) {
1111 reply_nterror(req, status);
1112 END_PROFILE(SMBsetatr);
1113 return;
1114 }
1115
1116 status = check_name(conn, fname);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 reply_nterror(req, status);
1119 END_PROFILE(SMBsetatr);
1120 return;
1121 }
1122
1123 if (fname[0] == '.' && fname[1] == '\0') {
1124 /*
1125 * Not sure here is the right place to catch this
1126 * condition. Might be moved to somewhere else later -- vl
1127 */
1128 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1129 END_PROFILE(SMBsetatr);
1130 return;
1131 }
1132
1133 mode = SVAL(req->vwv+0, 0);
1134 mtime = srv_make_unix_date3(req->vwv+1);
1135
1136 ft.mtime = convert_time_t_to_timespec(mtime);
1137 status = smb_set_file_time(conn, NULL, fname,
1138 &sbuf, &ft, true);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 reply_unixerror(req, ERRDOS, ERRnoaccess);
1141 END_PROFILE(SMBsetatr);
1142 return;
1143 }
1144
1145 if (mode != FILE_ATTRIBUTE_NORMAL) {
1146 if (VALID_STAT_OF_DIR(sbuf))
1147 mode |= aDIR;
1148 else
1149 mode &= ~aDIR;
1150
1151 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1152 reply_unixerror(req, ERRDOS, ERRnoaccess);
1153 END_PROFILE(SMBsetatr);
1154 return;
1155 }
1156 }
1157
1158 reply_outbuf(req, 0, 0);
1159
1160 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1161
1162 END_PROFILE(SMBsetatr);
1163 return;
1164 }
1165
1166 /****************************************************************************
1167 Reply to a dskattr.
1168 ****************************************************************************/
1169
1170 void reply_dskattr(struct smb_request *req)
1171 {
1172 connection_struct *conn = req->conn;
1173 uint64_t dfree,dsize,bsize;
1174 START_PROFILE(SMBdskattr);
1175
1176 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1177 reply_unixerror(req, ERRHRD, ERRgeneral);
1178 END_PROFILE(SMBdskattr);
1179 return;
1180 }
1181
1182 reply_outbuf(req, 5, 0);
1183
1184 if (Protocol <= PROTOCOL_LANMAN2) {
1185 double total_space, free_space;
1186 /* we need to scale this to a number that DOS6 can handle. We
1187 use floating point so we can handle large drives on systems
1188 that don't have 64 bit integers
1189
1190 we end up displaying a maximum of 2G to DOS systems
1191 */
1192 total_space = dsize * (double)bsize;
1193 free_space = dfree * (double)bsize;
1194
1195 dsize = (uint64_t)((total_space+63*512) / (64*512));
1196 dfree = (uint64_t)((free_space+63*512) / (64*512));
1197
1198 if (dsize > 0xFFFF) dsize = 0xFFFF;
1199 if (dfree > 0xFFFF) dfree = 0xFFFF;
1200
1201 SSVAL(req->outbuf,smb_vwv0,dsize);
1202 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1203 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1204 SSVAL(req->outbuf,smb_vwv3,dfree);
1205 } else {
1206 SSVAL(req->outbuf,smb_vwv0,dsize);
1207 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1208 SSVAL(req->outbuf,smb_vwv2,512);
1209 SSVAL(req->outbuf,smb_vwv3,dfree);
1210 }
1211
1212 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1213
1214 END_PROFILE(SMBdskattr);
1215 return;
1216 }
1217
1218 /****************************************************************************
1219 Reply to a search.
1220 Can be called from SMBsearch, SMBffirst or SMBfunique.
1221 ****************************************************************************/
1222
1223 void reply_search(struct smb_request *req)
1224 {
1225 connection_struct *conn = req->conn;
1226 const char *mask = NULL;
1227 char *directory = NULL;
1228 char *fname = NULL;
1229 SMB_OFF_T size;
1230 uint32 mode;
1231 time_t date;
1232 uint32 dirtype;
1233 unsigned int numentries = 0;
1234 unsigned int maxentries = 0;
1235 bool finished = False;
1236 const char *p;
1237 int status_len;
1238 char *path = NULL;
1239 char status[21];
1240 int dptr_num= -1;
1241 bool check_descend = False;
1242 bool expect_close = False;
1243 NTSTATUS nt_status;
1244 bool mask_contains_wcard = False;
1245 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1246 TALLOC_CTX *ctx = talloc_tos();
1247 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1248
1249 START_PROFILE(SMBsearch);
1250
1251 if (req->wct < 2) {
1252 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1253 END_PROFILE(SMBsearch);
1254 return;
1255 }
1256
1257 if (lp_posix_pathnames()) {
1258 reply_unknown_new(req, req->cmd);
1259 END_PROFILE(SMBsearch);
1260 return;
1261 }
1262
1263 /* If we were called as SMBffirst then we must expect close. */
1264 if(req->cmd == SMBffirst) {
1265 expect_close = True;
1266 }
1267
1268 reply_outbuf(req, 1, 3);
1269 maxentries = SVAL(req->vwv+0, 0);
1270 dirtype = SVAL(req->vwv+1, 0);
1271 p = (const char *)req->buf + 1;
1272 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1273 &nt_status, &mask_contains_wcard);
1274 if (!NT_STATUS_IS_OK(nt_status)) {
1275 reply_nterror(req, nt_status);
1276 END_PROFILE(SMBsearch);
1277 return;
1278 }
1279
1280 nt_status = resolve_dfspath_wcard(ctx, conn,
1281 req->flags2 & FLAGS2_DFS_PATHNAMES,
1282 path,
1283 &path,
1284 &mask_contains_wcard);
1285 if (!NT_STATUS_IS_OK(nt_status)) {
1286 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1287 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1288 ERRSRV, ERRbadpath);
1289 END_PROFILE(SMBsearch);
1290 return;
1291 }
1292 reply_nterror(req, nt_status);
1293 END_PROFILE(SMBsearch);
1294 return;
1295 }
1296
1297 p++;
1298 status_len = SVAL(p, 0);
1299 p += 2;
1300
1301 /* dirtype &= ~aDIR; */
1302
1303 if (status_len == 0) {
1304 SMB_STRUCT_STAT sbuf;
1305
1306 nt_status = unix_convert(ctx, conn, path, True,
1307 &directory, NULL, &sbuf);
1308 if (!NT_STATUS_IS_OK(nt_status)) {
1309 reply_nterror(req, nt_status);
1310 END_PROFILE(SMBsearch);
1311 return;
1312 }
1313
1314 nt_status = check_name(conn, directory);
1315 if (!NT_STATUS_IS_OK(nt_status)) {
1316 reply_nterror(req, nt_status);
1317 END_PROFILE(SMBsearch);
1318 return;
1319 }
1320
1321 p = strrchr_m(directory,'/');
1322 if ((p != NULL) && (*directory != '/')) {
1323 mask = p + 1;
1324 directory = talloc_strndup(ctx, directory,
1325 PTR_DIFF(p, directory));
1326 } else {
1327 mask = directory;
1328 directory = talloc_strdup(ctx,".");
1329 }
1330
1331 if (!directory) {
1332 reply_nterror(req, NT_STATUS_NO_MEMORY);
1333 END_PROFILE(SMBsearch);
1334 return;
1335 }
1336
1337 memset((char *)status,'\0',21);
1338 SCVAL(status,0,(dirtype & 0x1F));
1339
1340 nt_status = dptr_create(conn,
1341 directory,
1342 True,
1343 expect_close,
1344 req->smbpid,
1345 mask,
1346 mask_contains_wcard,
1347 dirtype,
1348 &conn->dirptr);
1349 if (!NT_STATUS_IS_OK(nt_status)) {
1350 reply_nterror(req, nt_status);
1351 END_PROFILE(SMBsearch);
1352 return;
1353 }
1354 dptr_num = dptr_dnum(conn->dirptr);
1355 } else {
1356 int status_dirtype;
1357
1358 memcpy(status,p,21);
1359 status_dirtype = CVAL(status,0) & 0x1F;
1360 if (status_dirtype != (dirtype & 0x1F)) {
1361 dirtype = status_dirtype;
1362 }
1363
1364 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1365 if (!conn->dirptr) {
1366 goto SearchEmpty;
1367 }
1368 string_set(&conn->dirpath,dptr_path(dptr_num));
1369 mask = dptr_wcard(dptr_num);
1370 if (!mask) {
1371 goto SearchEmpty;
1372 }
1373 /*
1374 * For a 'continue' search we have no string. So
1375 * check from the initial saved string.
1376 */
1377 mask_contains_wcard = ms_has_wild(mask);
1378 dirtype = dptr_attr(dptr_num);
1379 }
1380
1381 DEBUG(4,("dptr_num is %d\n",dptr_num));
1382
1383 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1384 dptr_init_search_op(conn->dirptr);
1385
1386 if ((dirtype&0x1F) == aVOLID) {
1387 char buf[DIR_STRUCT_SIZE];
1388 memcpy(buf,status,21);
1389 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1390 0,aVOLID,0,!allow_long_path_components)) {
1391 reply_nterror(req, NT_STATUS_NO_MEMORY);
1392 END_PROFILE(SMBsearch);
1393 return;
1394 }
1395 dptr_fill(buf+12,dptr_num);
1396 if (dptr_zero(buf+12) && (status_len==0)) {
1397 numentries = 1;
1398 } else {
1399 numentries = 0;
1400 }
1401 if (message_push_blob(&req->outbuf,
1402 data_blob_const(buf, sizeof(buf)))
1403 == -1) {
1404 reply_nterror(req, NT_STATUS_NO_MEMORY);
1405 END_PROFILE(SMBsearch);
1406 return;
1407 }
1408 } else {
1409 unsigned int i;
1410 maxentries = MIN(
1411 maxentries,
1412 ((BUFFER_SIZE -
1413 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1414 /DIR_STRUCT_SIZE));
1415
1416 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1417 conn->dirpath,lp_dontdescend(SNUM(conn))));
1418 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1419 check_descend = True;
1420 }
1421
1422 for (i=numentries;(i<maxentries) && !finished;i++) {
1423 finished = !get_dir_entry(ctx,
1424 conn,
1425 mask,
1426 dirtype,
1427 &fname,
1428 &size,
1429 &mode,
1430 &date,
1431 check_descend,
1432 ask_sharemode);
1433 if (!finished) {
1434 char buf[DIR_STRUCT_SIZE];
1435 memcpy(buf,status,21);
1436 if (!make_dir_struct(ctx,
1437 buf,
1438 mask,
1439 fname,
1440 size,
1441 mode,
1442 date,
1443 !allow_long_path_components)) {
1444 reply_nterror(req, NT_STATUS_NO_MEMORY);
1445 END_PROFILE(SMBsearch);
1446 return;
1447 }
1448 if (!dptr_fill(buf+12,dptr_num)) {
1449 break;
1450 }
1451 if (message_push_blob(&req->outbuf,
1452 data_blob_const(buf, sizeof(buf)))
1453 == -1) {
1454 reply_nterror(req, NT_STATUS_NO_MEMORY);
1455 END_PROFILE(SMBsearch);
1456 return;
1457 }
1458 numentries++;
1459 }
1460 }
1461 }
1462
1463 SearchEmpty:
1464
1465 /* If we were called as SMBffirst with smb_search_id == NULL
1466 and no entries were found then return error and close dirptr
1467 (X/Open spec) */
1468
1469 if (numentries == 0) {
1470 dptr_close(&dptr_num);
1471 } else if(expect_close && status_len == 0) {
1472 /* Close the dptr - we know it's gone */
1473 dptr_close(&dptr_num);
1474 }
1475
1476 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1477 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1478 dptr_close(&dptr_num);
1479 }
1480
1481 if ((numentries == 0) && !mask_contains_wcard) {
1482 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1483 END_PROFILE(SMBsearch);
1484 return;
1485 }
1486
1487 SSVAL(req->outbuf,smb_vwv0,numentries);
1488 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1489 SCVAL(smb_buf(req->outbuf),0,5);
1490 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1491
1492 /* The replies here are never long name. */
1493 SSVAL(req->outbuf, smb_flg2,
1494 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1495 if (!allow_long_path_components) {
1496 SSVAL(req->outbuf, smb_flg2,
1497 SVAL(req->outbuf, smb_flg2)
1498 & (~FLAGS2_LONG_PATH_COMPONENTS));
1499 }
1500
1501 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1502 SSVAL(req->outbuf, smb_flg2,
1503 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1504
1505 if (!directory) {
1506 directory = dptr_path(dptr_num);
1507 }
1508
1509 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1510 smb_fn_name(req->cmd),
1511 mask,
1512 directory ? directory : "./",
1513 dirtype,
1514 numentries,
1515 maxentries ));
1516
1517 END_PROFILE(SMBsearch);
1518 return;
1519 }
1520
1521 /****************************************************************************
1522 Reply to a fclose (stop directory search).
1523 ****************************************************************************/
1524
1525 void reply_fclose(struct smb_request *req)
1526 {
1527 int status_len;
1528 char status[21];
1529 int dptr_num= -2;
1530 const char *p;
1531 char *path = NULL;
1532 NTSTATUS err;
1533 bool path_contains_wcard = False;
1534 TALLOC_CTX *ctx = talloc_tos();
1535
1536 START_PROFILE(SMBfclose);
1537
1538 if (lp_posix_pathnames()) {
1539 reply_unknown_new(req, req->cmd);
1540 END_PROFILE(SMBfclose);
1541 return;
1542 }
1543
1544 p = (const char *)req->buf + 1;
1545 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1546 &err, &path_contains_wcard);
1547 if (!NT_STATUS_IS_OK(err)) {
1548 reply_nterror(req, err);
1549 END_PROFILE(SMBfclose);
1550 return;
1551 }
1552 p++;
1553 status_len = SVAL(p,0);
1554 p += 2;
1555
1556 if (status_len == 0) {
1557 reply_doserror(req, ERRSRV, ERRsrverror);
1558 END_PROFILE(SMBfclose);
1559 return;
1560 }
1561
1562 memcpy(status,p,21);
1563
1564 if(dptr_fetch(status+12,&dptr_num)) {
1565 /* Close the dptr - we know it's gone */
1566 dptr_close(&dptr_num);
1567 }
1568
1569 reply_outbuf(req, 1, 0);
1570 SSVAL(req->outbuf,smb_vwv0,0);
1571
1572 DEBUG(3,("search close\n"));
1573
1574 END_PROFILE(SMBfclose);
1575 return;
1576 }
1577
1578 /****************************************************************************
1579 Reply to an open.
1580 ****************************************************************************/
1581
1582 void reply_open(struct smb_request *req)
1583 {
1584 connection_struct *conn = req->conn;
1585 char *fname = NULL;
1586 uint32 fattr=0;
1587 SMB_OFF_T size = 0;
1588 time_t mtime=0;
1589 int info;
1590 SMB_STRUCT_STAT sbuf;
1591 files_struct *fsp;
1592 int oplock_request;
1593 int deny_mode;
1594 uint32 dos_attr;
1595 uint32 access_mask;
1596 uint32 share_mode;
1597 uint32 create_disposition;
1598 uint32 create_options = 0;
1599 NTSTATUS status;
1600 TALLOC_CTX *ctx = talloc_tos();
1601
1602 START_PROFILE(SMBopen);
1603
1604 if (req->wct < 2) {
1605 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1606 END_PROFILE(SMBopen);
1607 return;
1608 }
1609
1610 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1611 deny_mode = SVAL(req->vwv+0, 0);
1612 dos_attr = SVAL(req->vwv+1, 0);
1613
1614 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1615 STR_TERMINATE, &status);
1616 if (!NT_STATUS_IS_OK(status)) {
1617 reply_nterror(req, status);
1618 END_PROFILE(SMBopen);
1619 return;
1620 }
1621
1622 if (!map_open_params_to_ntcreate(
1623 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1624 &share_mode, &create_disposition, &create_options)) {
1625 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1626 END_PROFILE(SMBopen);
1627 return;
1628 }
1629
1630 status = SMB_VFS_CREATE_FILE(
1631 conn, /* conn */
1632 req, /* req */
1633 0, /* root_dir_fid */
1634 fname, /* fname */
1635 CFF_DOS_PATH, /* create_file_flags */
1636 access_mask, /* access_mask */
1637 share_mode, /* share_access */
1638 create_disposition, /* create_disposition*/
1639 create_options, /* create_options */
1640 dos_attr, /* file_attributes */
1641 oplock_request, /* oplock_request */
1642 0, /* allocation_size */
1643 NULL, /* sd */
1644 NULL, /* ea_list */
1645 &fsp, /* result */
1646 &info, /* pinfo */
1647 &sbuf); /* psbuf */
1648
1649 if (!NT_STATUS_IS_OK(status)) {
1650 if (open_was_deferred(req->mid)) {
1651 /* We have re-scheduled this call. */
1652 END_PROFILE(SMBopen);
1653 return;
1654 }
1655 reply_openerror(req, status);
1656 END_PROFILE(SMBopen);
1657 return;
1658 }
1659
1660 size = sbuf.st_size;
1661 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1662 mtime = sbuf.st_mtime;
1663
1664 if (fattr & aDIR) {
1665 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1666 close_file(req, fsp, ERROR_CLOSE);
1667 reply_doserror(req, ERRDOS,ERRnoaccess);
1668 END_PROFILE(SMBopen);
1669 return;
1670 }
1671
1672 reply_outbuf(req, 7, 0);
1673 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1674 SSVAL(req->outbuf,smb_vwv1,fattr);
1675 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1676 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1677 } else {
1678 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1679 }
1680 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1681 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1682
1683 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1684 SCVAL(req->outbuf,smb_flg,
1685 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1686 }
1687
1688 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1689 SCVAL(req->outbuf,smb_flg,
1690 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1691 }
1692 END_PROFILE(SMBopen);
1693 return;
1694 }
1695
1696 /****************************************************************************
1697 Reply to an open and X.
1698 ****************************************************************************/
1699
1700 void reply_open_and_X(struct smb_request *req)
1701 {
1702 connection_struct *conn = req->conn;
1703 char *fname = NULL;
1704 uint16 open_flags;
1705 int deny_mode;
1706 uint32 smb_attr;
1707 /* Breakout the oplock request bits so we can set the
1708 reply bits separately. */
1709 int ex_oplock_request;
1710 int core_oplock_request;
1711 int oplock_request;
1712 #if 0
1713 int smb_sattr = SVAL(req->vwv+4, 0);
1714 uint32 smb_time = make_unix_date3(req->vwv+6);
1715 #endif
1716 int smb_ofun;
1717 uint32 fattr=0;
1718 int mtime=0;
1719 SMB_STRUCT_STAT sbuf;
1720 int smb_action = 0;
1721 files_struct *fsp;
1722 NTSTATUS status;
1723 uint64_t allocation_size;
1724 ssize_t retval = -1;
1725 uint32 access_mask;
1726 uint32 share_mode;
1727 uint32 create_disposition;
1728 uint32 create_options = 0;
1729 TALLOC_CTX *ctx = talloc_tos();
1730
1731 START_PROFILE(SMBopenX);
1732
1733 if (req->wct < 15) {
1734 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1735 END_PROFILE(SMBopenX);
1736 return;
1737 }
1738
1739 open_flags = SVAL(req->vwv+2, 0);
1740 deny_mode = SVAL(req->vwv+3, 0);
1741 smb_attr = SVAL(req->vwv+5, 0);
1742 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1743 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1744 oplock_request = ex_oplock_request | core_oplock_request;
1745 smb_ofun = SVAL(req->vwv+8, 0);
1746 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1747
1748 /* If it's an IPC, pass off the pipe handler. */
1749 if (IS_IPC(conn)) {
1750 if (lp_nt_pipe_support()) {
1751 reply_open_pipe_and_X(conn, req);
1752 } else {
1753 reply_doserror(req, ERRSRV, ERRaccess);
1754 }
1755 END_PROFILE(SMBopenX);
1756 return;
1757 }
1758
1759 /* XXXX we need to handle passed times, sattr and flags */
1760 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1761 STR_TERMINATE, &status);
1762 if (!NT_STATUS_IS_OK(status)) {
1763 reply_nterror(req, status);
1764 END_PROFILE(SMBopenX);
1765 return;
1766 }
1767
1768 if (!map_open_params_to_ntcreate(
1769 fname, deny_mode, smb_ofun, &access_mask,
1770 &share_mode, &create_disposition, &create_options)) {
1771 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1772 END_PROFILE(SMBopenX);
1773 return;
1774 }
1775
1776 status = SMB_VFS_CREATE_FILE(
1777 conn, /* conn */
1778 req, /* req */
1779 0, /* root_dir_fid */
1780 fname, /* fname */
1781 CFF_DOS_PATH, /* create_file_flags */
1782 access_mask, /* access_mask */
1783 share_mode, /* share_access */
1784 create_disposition, /* create_disposition*/
1785 create_options, /* create_options */
1786 smb_attr, /* file_attributes */
1787 oplock_request, /* oplock_request */
1788 0, /* allocation_size */
1789 NULL, /* sd */
1790 NULL, /* ea_list */
1791 &fsp, /* result */
1792 &smb_action, /* pinfo */
1793 &sbuf); /* psbuf */
1794
1795 if (!NT_STATUS_IS_OK(status)) {
1796 END_PROFILE(SMBopenX);
1797 if (open_was_deferred(req->mid)) {
1798 /* We have re-scheduled this call. */
1799 return;
1800 }
1801 reply_openerror(req, status);
1802 return;
1803 }
1804
1805 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1806 if the file is truncated or created. */
1807 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1808 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1809 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1810 close_file(req, fsp, ERROR_CLOSE);
1811 reply_nterror(req, NT_STATUS_DISK_FULL);
1812 END_PROFILE(SMBopenX);
1813 return;
1814 }
1815 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1816 if (retval < 0) {
1817 close_file(req, fsp, ERROR_CLOSE);
1818 reply_nterror(req, NT_STATUS_DISK_FULL);
1819 END_PROFILE(SMBopenX);
1820 return;
1821 }
1822 sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1823 }
1824
1825 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1826 mtime = sbuf.st_mtime;
1827 if (fattr & aDIR) {
1828 close_file(req, fsp, ERROR_CLOSE);
1829 reply_doserror(req, ERRDOS, ERRnoaccess);
1830 END_PROFILE(SMBopenX);
1831 return;
1832 }
1833
1834 /* If the caller set the extended oplock request bit
1835 and we granted one (by whatever means) - set the
1836 correct bit for extended oplock reply.
1837 */
1838
1839 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1840 smb_action |= EXTENDED_OPLOCK_GRANTED;
1841 }
1842
1843 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1844 smb_action |= EXTENDED_OPLOCK_GRANTED;
1845 }
1846
1847 /* If the caller set the core oplock request bit
1848 and we granted one (by whatever means) - set the
1849 correct bit for core oplock reply.
1850 */
1851
1852 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1853 reply_outbuf(req, 19, 0);
1854 } else {
1855 reply_outbuf(req, 15, 0);
1856 }
1857
1858 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1859 SCVAL(req->outbuf, smb_flg,
1860 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1861 }
1862
1863 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1864 SCVAL(req->outbuf, smb_flg,
1865 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1866 }
1867
1868 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1869 SSVAL(req->outbuf,smb_vwv3,fattr);
1870 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1871 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1872 } else {
1873 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1874 }
1875 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1876 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1877 SSVAL(req->outbuf,smb_vwv11,smb_action);
1878
1879 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1880 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1881 }
1882
1883 END_PROFILE(SMBopenX);
1884 chain_reply(req);
1885 return;
1886 }
1887
1888 /****************************************************************************
1889 Reply to a SMBulogoffX.
1890 ****************************************************************************/
1891
1892 void reply_ulogoffX(struct smb_request *req)
1893 {
1894 user_struct *vuser;
1895
1896 START_PROFILE(SMBulogoffX);
1897
1898 vuser = get_valid_user_struct(req->vuid);
1899
1900 if(vuser == NULL) {
1901 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1902 req->vuid));
1903 }
1904
1905 /* in user level security we are supposed to close any files
1906 open by this user */
1907 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1908 file_close_user(req->vuid);
1909 }
1910
1911 invalidate_vuid(req->vuid);
1912
1913 reply_outbuf(req, 2, 0);
1914
1915 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1916
1917 END_PROFILE(SMBulogoffX);
1918 chain_reply(req);
1919 }
1920
1921 /****************************************************************************
1922 Reply to a mknew or a create.
1923 ****************************************************************************/
1924
1925 void reply_mknew(struct smb_request *req)
1926 {
1927 connection_struct *conn = req->conn;
1928 char *fname = NULL;
1929 uint32 fattr = 0;
1930 struct smb_file_time ft;
1931 files_struct *fsp;
1932 int oplock_request = 0;
1933 SMB_STRUCT_STAT sbuf;
1934 NTSTATUS status;
1935 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1936 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1937 uint32 create_disposition;
1938 uint32 create_options = 0;
1939 TALLOC_CTX *ctx = talloc_tos();
1940
1941 START_PROFILE(SMBcreate);
1942 ZERO_STRUCT(ft);
1943
1944 if (req->wct < 3) {
1945 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1946 END_PROFILE(SMBcreate);
1947 return;
1948 }
1949
1950 fattr = SVAL(req->vwv+0, 0);
1951 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1952
1953 /* mtime. */
1954 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
1955
1956 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
1957 STR_TERMINATE, &status);
1958 if (!NT_STATUS_IS_OK(status)) {
1959 reply_nterror(req, status);
1960 END_PROFILE(SMBcreate);
1961 return;
1962 }
1963
1964 if (fattr & aVOLID) {
1965 DEBUG(0,("Attempt to create file (%s) with volid set - "
1966 "please report this\n", fname));
1967 }
1968
1969 if(req->cmd == SMBmknew) {
1970 /* We should fail if file exists. */
1971 create_disposition = FILE_CREATE;
1972 } else {
1973 /* Create if file doesn't exist, truncate if it does. */
1974 create_disposition = FILE_OVERWRITE_IF;
1975 }
1976
1977 status = SMB_VFS_CREATE_FILE(
1978 conn, /* conn */
1979 req, /* req */
1980 0, /* root_dir_fid */
1981 fname, /* fname */
1982 CFF_DOS_PATH, /* create_file_flags */
1983 access_mask, /* access_mask */
1984 share_mode, /* share_access */
1985 create_disposition, /* create_disposition*/
1986 create_options, /* create_options */
1987 fattr, /* file_attributes */
1988 oplock_request, /* oplock_request */
1989 0, /* allocation_size */
1990 NULL, /* sd */
1991 NULL, /* ea_list */
1992 &fsp, /* result */
1993 NULL, /* pinfo */
1994 &sbuf); /* psbuf */
1995
1996 if (!NT_STATUS_IS_OK(status)) {
1997 END_PROFILE(SMBcreate);
1998 if (open_was_deferred(req->mid)) {
1999 /* We have re-scheduled this call. */
2000 return;
2001 }
2002 reply_openerror(req, status);
2003 return;
2004 }
2005
2006 ft.atime = get_atimespec(&sbuf); /* atime. */
2007 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2008 if (!NT_STATUS_IS_OK(status)) {
2009 END_PROFILE(SMBcreate);
2010 reply_openerror(req, status);
2011 return;
2012 }
2013
2014 reply_outbuf(req, 1, 0);
2015 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2016
2017 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2018 SCVAL(req->outbuf,smb_flg,
2019 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2020 }
2021
2022 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2023 SCVAL(req->outbuf,smb_flg,
2024 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2025 }
2026
2027 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2028 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2029 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2030
2031 END_PROFILE(SMBcreate);
2032 return;
2033 }
2034
2035 /****************************************************************************
2036 Reply to a create temporary file.
2037 ****************************************************************************/
2038
2039 void reply_ctemp(struct smb_request *req)
2040 {
2041 connection_struct *conn = req->conn;
2042 char *fname = NULL;
2043 uint32 fattr;
2044 files_struct *fsp;
2045 int oplock_request;
2046 int tmpfd;
2047 SMB_STRUCT_STAT sbuf;
2048 char *s;
2049 NTSTATUS status;
2050 TALLOC_CTX *ctx = talloc_tos();
2051
2052 START_PROFILE(SMBctemp);
2053
2054 if (req->wct < 3) {
2055 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2056 END_PROFILE(SMBctemp);
2057 return;
2058 }
2059
2060 fattr = SVAL(req->vwv+0, 0);
2061 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2062
2063 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2064 STR_TERMINATE, &status);
2065 if (!NT_STATUS_IS_OK(status)) {
2066 reply_nterror(req, status);
2067 END_PROFILE(SMBctemp);
2068 return;
2069 }
2070 if (*fname) {
2071 fname = talloc_asprintf(ctx,
2072 "%s/TMXXXXXX",
2073 fname);
2074 } else {
2075 fname = talloc_strdup(ctx, "TMXXXXXX");
2076 }
2077
2078 if (!fname) {
2079 reply_nterror(req, NT_STATUS_NO_MEMORY);
2080 END_PROFILE(SMBctemp);
2081 return;
2082 }
2083
2084 status = resolve_dfspath(ctx, conn,
2085 req->flags2 & FLAGS2_DFS_PATHNAMES,
2086 fname,
2087 &fname);
2088 if (!NT_STATUS_IS_OK(status)) {
2089 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2090 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2091 ERRSRV, ERRbadpath);
2092 END_PROFILE(SMBctemp);
2093 return;
2094 }
2095 reply_nterror(req, status);
2096 END_PROFILE(SMBctemp);
2097 return;
2098 }
2099
2100 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2101 if (!NT_STATUS_IS_OK(status)) {
2102 reply_nterror(req, status);
2103 END_PROFILE(SMBctemp);
2104 return;
2105 }
2106
2107 status = check_name(conn, fname);
2108 if (!NT_STATUS_IS_OK(status)) {
2109 reply_nterror(req, status);
2110 END_PROFILE(SMBctemp);
2111 return;
2112 }
2113
2114 tmpfd = smb_mkstemp(fname);
2115 if (tmpfd == -1) {
2116 reply_unixerror(req, ERRDOS, ERRnoaccess);
2117 END_PROFILE(SMBctemp);
2118 return;
2119 }
2120
2121 SMB_VFS_STAT(conn,fname,&sbuf);
2122
2123 /* We should fail if file does not exist. */
2124 status = SMB_VFS_CREATE_FILE(
2125 conn, /* conn */
2126 req, /* req */
2127 0, /* root_dir_fid */
2128 fname, /* fname */
2129 0, /* create_file_flags */
2130 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2131 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2132 FILE_OPEN, /* create_disposition*/
2133 0, /* create_options */
2134 fattr, /* file_attributes */
2135 oplock_request, /* oplock_request */
2136 0, /* allocation_size */
2137 NULL, /* sd */
2138 NULL, /* ea_list */
2139 &fsp, /* result */
2140 NULL, /* pinfo */
2141 &sbuf); /* psbuf */
2142
2143 /* close fd from smb_mkstemp() */
2144 close(tmpfd);
2145
2146 if (!NT_STATUS_IS_OK(status)) {
2147 if (open_was_deferred(req->mid)) {
2148 /* We have re-scheduled this call. */
2149 END_PROFILE(SMBctemp);
2150 return;
2151 }
2152 reply_openerror(req, status);
2153 END_PROFILE(SMBctemp);
2154 return;
2155 }
2156
2157 reply_outbuf(req, 1, 0);
2158 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2159
2160 /* the returned filename is relative to the directory */
2161 s = strrchr_m(fsp->fsp_name, '/');
2162 if (!s) {
2163 s = fsp->fsp_name;
2164 } else {
2165 s++;
2166 }
2167
2168 #if 0
2169 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2170 thing in the byte section. JRA */
2171 SSVALS(p, 0, -1); /* what is this? not in spec */
2172 #endif
2173 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2174 == -1) {
2175 reply_nterror(req, NT_STATUS_NO_MEMORY);
2176 END_PROFILE(SMBctemp);
2177 return;
2178 }
2179
2180 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2181 SCVAL(req->outbuf, smb_flg,
2182 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2183 }
2184
2185 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2186 SCVAL(req->outbuf, smb_flg,
2187 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2188 }
2189
2190 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2191 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2192 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2193
2194 END_PROFILE(SMBctemp);
2195 return;
2196 }
2197
2198 /*******************************************************************
2199 Check if a user is allowed to rename a file.
2200 ********************************************************************/
2201
2202 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2203 uint16 dirtype, SMB_STRUCT_STAT *pst)
2204 {
2205 uint32 fmode;
2206
2207 if (!CAN_WRITE(conn)) {
2208 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2209 }
2210
2211 fmode = dos_mode(conn, fsp->fsp_name, pst);
2212 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2213 return NT_STATUS_NO_SUCH_FILE;
2214 }
2215
2216 if (S_ISDIR(pst->st_mode)) {
2217 if (fsp->posix_open) {
2218 return NT_STATUS_OK;
2219 }
2220
2221 /* If no pathnames are open below this
2222 directory, allow the rename. */
2223
2224 if (file_find_subpath(fsp)) {
2225 return NT_STATUS_ACCESS_DENIED;
2226 }
2227 return NT_STATUS_OK;
2228 }
2229
2230 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2231 return NT_STATUS_OK;
2232 }
2233
2234 return NT_STATUS_ACCESS_DENIED;
2235 }
2236
2237 /*******************************************************************
2238 * unlink a file with all relevant access checks
2239 *******************************************************************/
2240
2241 static NTSTATUS do_unlink(connection_struct *conn,
2242 struct smb_request *req,
2243 const char *fname,
2244 uint32 dirtype)
2245 {
2246 SMB_STRUCT_STAT sbuf;
2247 uint32 fattr;
2248 files_struct *fsp;
2249 uint32 dirtype_orig = dirtype;
2250 NTSTATUS status;
2251
2252 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2253
2254 if (!CAN_WRITE(conn)) {
2255 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2256 }
2257
2258 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2259 return map_nt_error_from_unix(errno);
2260 }
2261
2262 fattr = dos_mode(conn,fname,&sbuf);
2263
2264 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2265 dirtype = aDIR|aARCH|aRONLY;
2266 }
2267
2268 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2269 if (!dirtype) {
2270 return NT_STATUS_NO_SUCH_FILE;
2271 }
2272
2273 if (!dir_check_ftype(conn, fattr, dirtype)) {
2274 if (fattr & aDIR) {
2275 return NT_STATUS_FILE_IS_A_DIRECTORY;
2276 }
2277 return NT_STATUS_NO_SUCH_FILE;
2278 }
2279
2280 if (dirtype_orig & 0x8000) {
2281 /* These will never be set for POSIX. */
2282 return NT_STATUS_NO_SUCH_FILE;
2283 }
2284
2285 #if 0
2286 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2287 return NT_STATUS_FILE_IS_A_DIRECTORY;
2288 }
2289
2290 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2291 return NT_STATUS_NO_SUCH_FILE;
2292 }
2293
2294 if (dirtype & 0xFF00) {
2295 /* These will never be set for POSIX. */
2296 return NT_STATUS_NO_SUCH_FILE;
2297 }
2298
2299 dirtype &= 0xFF;
2300 if (!dirtype) {
2301 return NT_STATUS_NO_SUCH_FILE;
2302 }
2303
2304 /* Can't delete a directory. */
2305 if (fattr & aDIR) {
2306 return NT_STATUS_FILE_IS_A_DIRECTORY;
2307 }
2308 #endif
2309
2310 #if 0 /* JRATEST */
2311 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2312 return NT_STATUS_OBJECT_NAME_INVALID;
2313 #endif /* JRATEST */
2314
2315 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2316
2317 On a Windows share, a file with read-only dosmode can be opened with
2318 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2319 fails with NT_STATUS_CANNOT_DELETE error.
2320
2321 This semantic causes a problem that a user can not
2322 rename a file with read-only dosmode on a Samba share
2323 from a Windows command prompt (i.e. cmd.exe, but can rename
2324 from Windows Explorer).
2325 */
2326
2327 if (!lp_delete_readonly(SNUM(conn))) {
2328 if (fattr & aRONLY) {
2329 return NT_STATUS_CANNOT_DELETE;
2330 }
2331 }
2332
2333 /* On open checks the open itself will check the share mode, so
2334 don't do it here as we'll get it wrong. */
2335
2336 status = SMB_VFS_CREATE_FILE
2337 (conn, /* conn */
2338 req, /* req */
2339 0, /* root_dir_fid */
2340 fname, /* fname */
2341 0, /* create_file_flags */
2342 DELETE_ACCESS, /* access_mask */
2343 FILE_SHARE_NONE, /* share_access */
2344 FILE_OPEN, /* create_disposition*/
2345 FILE_NON_DIRECTORY_FILE, /* create_options */
2346 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2347 0, /* oplock_request */
2348 0, /* allocation_size */
2349 NULL, /* sd */
2350 NULL, /* ea_list */
2351 &fsp, /* result */
2352 NULL, /* pinfo */
2353 &sbuf); /* psbuf */
2354
2355 if (!NT_STATUS_IS_OK(status)) {
2356 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2357 nt_errstr(status)));
2358 return status;
2359 }
2360
2361 /* The set is across all open files on this dev/inode pair. */
2362 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2363 close_file(req, fsp, NORMAL_CLOSE);
2364 return NT_STATUS_ACCESS_DENIED;
2365 }
2366
2367 return close_file(req, fsp, NORMAL_CLOSE);
2368 }
2369
2370 /****************************************************************************
2371 The guts of the unlink command, split out so it may be called by the NT SMB
2372 code.
2373 ****************************************************************************/
2374
2375 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2376 uint32 dirtype, const char *name_in, bool has_wild)
2377 {
2378 const char *directory = NULL;
2379 char *mask = NULL;
2380 char *name = NULL;
2381 char *p = NULL;
2382 int count=0;
2383 NTSTATUS status = NT_STATUS_OK;
2384 SMB_STRUCT_STAT sbuf, st;
2385 TALLOC_CTX *ctx = talloc_tos();
2386
2387 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2388 if (!NT_STATUS_IS_OK(status)) {
2389 return status;
2390 }
2391
2392 p = strrchr_m(name,'/');
2393 if (!p) {
2394 directory = talloc_strdup(ctx, ".");
2395 if (!directory) {
2396 return NT_STATUS_NO_MEMORY;
2397 }
2398 mask = name;
2399 } else {
2400 *p = 0;
2401 directory = name;
2402 mask = p+1;
2403 }
2404
2405 /*
2406 * We should only check the mangled cache
2407 * here if unix_convert failed. This means
2408 * that the path in 'mask' doesn't exist
2409 * on the file system and so we need to look
2410 * for a possible mangle. This patch from
2411 * Tine Smukavec <valentin.smukavec@hermes.si>.
2412 */
2413
2414 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2415 char *new_mask = NULL;
2416 mangle_lookup_name_from_8_3(ctx,
2417 mask,
2418 &new_mask,
2419 conn->params );
2420 if (new_mask) {
2421 mask = new_mask;
2422 }
2423 }
2424
2425 if (!has_wild) {
2426 directory = talloc_asprintf(ctx,
2427 "%s/%s",
2428 directory,
2429 mask);
2430 if (!directory) {
2431 return NT_STATUS_NO_MEMORY;
2432 }
2433 if (dirtype == 0) {
2434 dirtype = FILE_ATTRIBUTE_NORMAL;
2435 }
2436
2437 status = check_name(conn, directory);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 return status;
2440 }
2441
2442 status = do_unlink(conn, req, directory, dirtype);
2443 if (!NT_STATUS_IS_OK(status)) {
2444 return status;
2445 }
2446
2447 count++;
2448 } else {
2449 struct smb_Dir *dir_hnd = NULL;
2450 long offset = 0;
2451 const char *dname;
2452
2453 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2454 return NT_STATUS_OBJECT_NAME_INVALID;
2455 }
2456
2457 if (strequal(mask,"????????.???")) {
2458 mask[0] = '*';
2459 mask[1] = '\0';
2460 }
2461
2462 status = check_name(conn, directory);
2463 if (!NT_STATUS_IS_OK(status)) {
2464 return status;
2465 }
2466
2467 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2468 dirtype);
2469 if (dir_hnd == NULL) {
2470 return map_nt_error_from_unix(errno);
2471 }
2472
2473 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2474 the pattern matches against the long name, otherwise the short name
2475 We don't implement this yet XXXX
2476 */
2477
2478 status = NT_STATUS_NO_SUCH_FILE;
2479
2480 while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
2481 char *fname = NULL;
2482
2483 if (!is_visible_file(conn, directory, dname, &st,
2484 true))
2485 {
2486 continue;
2487 }
2488
2489 /* Quick check for "." and ".." */
2490 if (ISDOT(dname) || ISDOTDOT(dname)) {
2491 continue;
2492 }
2493
2494 if(!mask_match(dname, mask, conn->case_sensitive)) {
2495 continue;
2496 }
2497
2498 fname = talloc_asprintf(ctx, "%s/%s",
2499 directory,
2500 dname);
2501 if (!fname) {
2502 return NT_STATUS_NO_MEMORY;
2503 }
2504
2505 status = check_name(conn, fname);
2506 if (!NT_STATUS_IS_OK(status)) {
2507 TALLOC_FREE(dir_hnd);
2508 return status;
2509 }
2510
2511 status = do_unlink(conn, req, fname, dirtype);
2512 if (!NT_STATUS_IS_OK(status)) {
2513 TALLOC_FREE(fname);
2514 continue;
2515 }
2516
2517 count++;
2518 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2519 fname));
2520
2521 TALLOC_FREE(fname);
2522 }
2523 TALLOC_FREE(dir_hnd);
2524 }
2525
2526 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2527 status = map_nt_error_from_unix(errno);
2528 }
2529
2530 return status;
2531 }
2532
2533 /****************************************************************************
2534 Reply to a unlink
2535 ****************************************************************************/
2536
2537 void reply_unlink(struct smb_request *req)
2538 {
2539 connection_struct *conn = req->conn;
2540 char *name = NULL;
2541 uint32 dirtype;
2542 NTSTATUS status;
2543 bool path_contains_wcard = False;
2544 TALLOC_CTX *ctx = talloc_tos();
2545
2546 START_PROFILE(SMBunlink);
2547
2548 if (req->wct < 1) {
2549 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2550 END_PROFILE(SMBunlink);
2551 return;
2552 }
2553
2554 dirtype = SVAL(req->vwv+0, 0);
2555
2556 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2557 STR_TERMINATE, &status,
2558 &path_contains_wcard);
2559 if (!NT_STATUS_IS_OK(status)) {
2560 reply_nterror(req, status);
2561 END_PROFILE(SMBunlink);
2562 return;
2563 }
2564
2565 status = resolve_dfspath_wcard(ctx, conn,
2566 req->flags2 & FLAGS2_DFS_PATHNAMES,
2567 name,
2568 &name,
2569 &path_contains_wcard);
2570 if (!NT_STATUS_IS_OK(status)) {
2571 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2572 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2573 ERRSRV, ERRbadpath);
2574 END_PROFILE(SMBunlink);
2575 return;
2576 }
2577 reply_nterror(req, status);
2578 END_PROFILE(SMBunlink);
2579 return;
2580 }
2581
2582 DEBUG(3,("reply_unlink : %s\n",name));
2583
2584 status = unlink_internals(conn, req, dirtype, name,
2585 path_contains_wcard);
2586 if (!NT_STATUS_IS_OK(status)) {
2587 if (open_was_deferred(req->mid)) {
2588 /* We have re-scheduled this call. */
2589 END_PROFILE(SMBunlink);
2590 return;
2591 }
2592 reply_nterror(req, status);
2593 END_PROFILE(SMBunlink);
2594 return;
2595 }
2596
2597 reply_outbuf(req, 0, 0);
2598 END_PROFILE(SMBunlink);
2599
2600 return;
2601 }
2602
2603 /****************************************************************************
2604 Fail for readbraw.
2605 ****************************************************************************/
2606
2607 static void fail_readraw(void)
2608 {
2609 const char *errstr = talloc_asprintf(talloc_tos(),
2610 "FAIL ! reply_readbraw: socket write fail (%s)",
2611 strerror(errno));
2612 if (!errstr) {
2613 errstr = "";
2614 }
2615 exit_server_cleanly(errstr);
2616 }
2617
2618 /****************************************************************************
2619 Fake (read/write) sendfile. Returns -1 on read or write fail.
2620 ****************************************************************************/
2621
2622 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2623 size_t nread)
2624 {
2625 size_t bufsize;
2626 size_t tosend = nread;
2627 char *buf;
2628
2629 if (nread == 0) {
2630 return 0;
2631 }
2632
2633 bufsize = MIN(nread, 65536);
2634
2635 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2636 return -1;
2637 }
2638
2639 while (tosend > 0) {
2640 ssize_t ret;
2641 size_t cur_read;
2642
2643 if (tosend > bufsize) {
2644 cur_read = bufsize;
2645 } else {
2646 cur_read = tosend;
2647 }
2648 ret = read_file(fsp,buf,startpos,cur_read);
2649 if (ret == -1) {
2650 SAFE_FREE(buf);
2651 return -1;
2652 }
2653
2654 /* If we had a short read, fill with zeros. */
2655 if (ret < cur_read) {
2656 memset(buf, '\0', cur_read - ret);
2657 }
2658
2659 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2660 SAFE_FREE(buf);
2661 return -1;
2662 }
2663 tosend -= cur_read;
2664 startpos += cur_read;
2665 }
2666
2667 SAFE_FREE(buf);
2668 return (ssize_t)nread;
2669 }
2670
2671 /****************************************************************************
2672 Deal with the case of sendfile reading less bytes from the file than
2673 requested. Fill with zeros (all we can do).
2674 ****************************************************************************/
2675
2676 static void sendfile_short_send(files_struct *fsp,
2677 ssize_t nread,
2678 size_t headersize,
2679 size_t smb_maxcnt)
2680 {
2681 if (nread < headersize) {
2682 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2683 "header for file %s (%s). Terminating\n",
2684 fsp->fsp_name, strerror(errno) ));
2685 exit_server_cleanly("sendfile_short_send failed");
2686 }
2687
2688 nread -= headersize;
2689
2690 if (nread < smb_maxcnt) {
2691 char *buf = SMB_CALLOC_ARRAY(char, 1024);
2692 if (!buf) {
2693 exit_server_cleanly("sendfile_short_send: "
2694 "malloc failed");
2695 }
2696
2697 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2698 "with zeros !\n", fsp->fsp_name));
2699
2700 while (nread < smb_maxcnt) {
2701 /*
2702 * We asked for the real file size and told sendfile
2703 * to not go beyond the end of the file. But it can
2704 * happen that in between our fstat call and the
2705 * sendfile call the file was truncated. This is very
2706 * bad because we have already announced the larger
2707 * number of bytes to the client.
2708 *
2709 * The best we can do now is to send 0-bytes, just as
2710 * a read from a hole in a sparse file would do.
2711 *
2712 * This should happen rarely enough that I don't care
2713 * about efficiency here :-)
2714 */
2715 size_t to_write;
2716
2717 to_write = MIN(sizeof(buf), smb_maxcnt - nread);
2718 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2719 exit_server_cleanly("sendfile_short_send: "
2720 "write_data failed");
2721 }
2722 nread += to_write;
2723 }
2724 SAFE_FREE(buf);
2725 }
2726 }
2727
2728 /****************************************************************************
2729 Return a readbraw error (4 bytes of zero).
2730 ****************************************************************************/
2731
2732 static void reply_readbraw_error(void)
2733 {
2734 char header[4];
2735 SIVAL(header,0,0);
2736 if (write_data(smbd_server_fd(),header,4) != 4) {
2737 fail_readraw();
2738 }
2739 }
2740
2741 /****************************************************************************
2742 Use sendfile in readbraw.
2743 ****************************************************************************/
2744
2745 static void send_file_readbraw(connection_struct *conn,
2746 struct smb_request *req,
2747 files_struct *fsp,
2748 SMB_OFF_T startpos,
2749 size_t nread,
2750 ssize_t mincount)
2751 {
2752 char *outbuf = NULL;
2753 ssize_t ret=0;
2754
2755 #if defined(WITH_SENDFILE)
2756 /*
2757 * We can only use sendfile on a non-chained packet
2758 * but we can use on a non-oplocked file. tridge proved this
2759 * on a train in Germany :-). JRA.
2760 * reply_readbraw has already checked the length.
2761 */
2762
2763 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2764 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2765 ssize_t sendfile_read = -1;
2766 char header[4];
2767 DATA_BLOB header_blob;
2768
2769 _smb_setlen(header,nread);
2770 header_blob = data_blob_const(header, 4);
2771
2772 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2773 &header_blob, startpos, nread)) == -1) {
2774 /* Returning ENOSYS means no data at all was sent.
2775 * Do this as a normal read. */
2776 if (errno == ENOSYS) {
2777 goto normal_readbraw;
2778 }
2779
2780 /*
2781 * Special hack for broken Linux with no working sendfile. If we
2782 * return EINTR we sent the header but not the rest of the data.
2783 * Fake this up by doing read/write calls.
2784 */
2785 if (errno == EINTR) {
2786 /* Ensure we don't do this again. */
2787 set_use_sendfile(SNUM(conn), False);
2788 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2789
2790 if (fake_sendfile(fsp, startpos, nread) == -1) {
2791 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2792 fsp->fsp_name, strerror(errno) ));
2793 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2794 }
2795 return;
2796 }
2797
2798 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2799 fsp->fsp_name, strerror(errno) ));
2800 exit_server_cleanly("send_file_readbraw sendfile failed");
2801 } else if (sendfile_read == 0) {
2802 /*
2803 * Some sendfile implementations return 0 to indicate
2804 * that there was a short read, but nothing was
2805 * actually written to the socket. In this case,
2806 * fallback to the normal read path so the header gets
2807 * the correct byte count.
2808 */
2809 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2810 "bytes falling back to the normal read: "
2811 "%s\n", fsp->fsp_name));
2812 goto normal_readbraw;
2813 }
2814
2815 /* Deal with possible short send. */
2816 if (sendfile_read != 4+nread) {
2817 sendfile_short_send(fsp, sendfile_read, 4, nread);
2818 }
2819 return;
2820 }
2821
2822 normal_readbraw:
2823 #endif
2824
2825 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2826 if (!outbuf) {
2827 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2828 (unsigned)(nread+4)));
2829 reply_readbraw_error();
2830 return;
2831 }
2832
2833 if (nread > 0) {
2834 ret = read_file(fsp,outbuf+4,startpos,nread);
2835 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2836 if (ret < mincount)
2837 ret = 0;
2838 #else
2839 if (ret < nread)
2840 ret = 0;
2841 #endif
2842 }
2843
2844 _smb_setlen(outbuf,ret);
2845 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2846 fail_readraw();
2847
2848 TALLOC_FREE(outbuf);
2849 }
2850
2851 /****************************************************************************
2852 Reply to a readbraw (core+ protocol).
2853 ****************************************************************************/
2854
2855 void reply_readbraw(struct smb_request *req)
2856 {
2857 connection_struct *conn = req->conn;
2858 ssize_t maxcount,mincount;
2859 size_t nread = 0;
2860 SMB_OFF_T startpos;
2861 files_struct *fsp;
2862 struct lock_struct lock;
2863 SMB_STRUCT_STAT st;
2864 SMB_OFF_T size = 0;
2865
2866 START_PROFILE(SMBreadbraw);
2867
2868 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2869 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2870 "raw reads/writes are disallowed.");
2871 }
2872
2873 if (req->wct < 8) {
2874 reply_readbraw_error();
2875 END_PROFILE(SMBreadbraw);
2876 return;
2877 }
2878
2879 /*
2880 * Special check if an oplock break has been issued
2881 * and the readraw request croses on the wire, we must
2882 * return a zero length response here.
2883 */
2884
2885 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
2886
2887 /*
2888 * We have to do a check_fsp by hand here, as
2889 * we must always return 4 zero bytes on error,
2890 * not a NTSTATUS.
2891 */
2892
2893 if (!fsp || !conn || conn != fsp->conn ||
2894 req->vuid != fsp->vuid ||
2895 fsp->is_directory || fsp->fh->fd == -1) {
2896 /*
2897 * fsp could be NULL here so use the value from the packet. JRA.
2898 */
2899 DEBUG(3,("reply_readbraw: fnum %d not valid "
2900 "- cache prime?\n",
2901 (int)SVAL(req->vwv+0, 0)));
2902 reply_readbraw_error();
2903 END_PROFILE(SMBreadbraw);
2904 return;
2905 }
2906
2907 /* Do a "by hand" version of CHECK_READ. */
2908 if (!(fsp->can_read ||
2909 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2910 (fsp->access_mask & FILE_EXECUTE)))) {
2911 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2912 (int)SVAL(req->vwv+0, 0)));
2913 reply_readbraw_error();
2914 END_PROFILE(SMBreadbraw);
2915 return;
2916 }
2917
2918 flush_write_cache(fsp, READRAW_FLUSH);
2919
2920 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
2921 if(req->wct == 10) {
2922 /*
2923 * This is a large offset (64 bit) read.
2924 */
2925 #ifdef LARGE_SMB_OFF_T
2926
2927 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
2928
2929 #else /* !LARGE_SMB_OFF_T */
2930
2931 /*
2932 * Ensure we haven't been sent a >32 bit offset.
2933 */
2934
2935 if(IVAL(req->vwv+8, 0) != 0) {
2936 DEBUG(0,("reply_readbraw: large offset "
2937 "(%x << 32) used and we don't support "
2938 "64 bit offsets.\n",
2939 (unsigned int)IVAL(req->vwv+8, 0) ));
2940 reply_readbraw_error();
2941 END_PROFILE(SMBreadbraw);
2942 return;
2943 }
2944
2945 #endif /* LARGE_SMB_OFF_T */
2946
2947 if(startpos < 0) {
2948 DEBUG(0,("reply_readbraw: negative 64 bit "
2949 "readraw offset (%.0f) !\n",
2950 (double)startpos ));
2951 reply_readbraw_error();
2952 END_PROFILE(SMBreadbraw);
2953 return;
2954 }
2955 }
2956
2957 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
2958 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
2959
2960 /* ensure we don't overrun the packet size */
2961 maxcount = MIN(65535,maxcount);
2962
2963 init_strict_lock_struct(fsp, (uint32)req->smbpid,
2964 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
2965 &lock);
2966
2967 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
2968 reply_readbraw_error();
2969 END_PROFILE(SMBreadbraw);
2970 return;
2971 }
2972
2973 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2974 size = st.st_size;
2975 }
2976
2977 if (startpos >= size) {
2978 nread = 0;
2979 } else {
2980 nread = MIN(maxcount,(size - startpos));
2981 }
2982
2983 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2984 if (nread < mincount)
2985 nread = 0;
2986 #endif
2987
2988 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2989 "min=%lu nread=%lu\n",
2990 fsp->fnum, (double)startpos,
2991 (unsigned long)maxcount,
2992 (unsigned long)mincount,
2993 (unsigned long)nread ) );
2994
2995 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
2996
2997 DEBUG(5,("reply_readbraw finished\n"));
2998
2999 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3000
3001 END_PROFILE(SMBreadbraw);
3002 return;
3003 }
3004
3005 #undef DBGC_CLASS
3006 #define DBGC_CLASS DBGC_LOCKING
3007
3008 /****************************************************************************
3009 Reply to a lockread (core+ protocol).
3010 ****************************************************************************/
3011
3012 void reply_lockread(struct smb_request *req)
3013 {
3014 connection_struct *conn = req->conn;
3015 ssize_t nread = -1;
3016 char *data;
3017 SMB_OFF_T startpos;
3018 size_t numtoread;
3019 NTSTATUS status;
3020 files_struct *fsp;
3021 struct byte_range_lock *br_lck = NULL;
3022 char *p = NULL;
3023
3024 START_PROFILE(SMBlockread);
3025
3026 if (req->wct < 5) {
3027 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3028 END_PROFILE(SMBlockread);
3029 return;
3030 }
3031
3032 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3033
3034 if (!check_fsp(conn, req, fsp)) {
3035 END_PROFILE(SMBlockread);
3036 return;
3037 }
3038
3039 if (!CHECK_READ(fsp,req)) {
3040 reply_doserror(req, ERRDOS, ERRbadaccess);
3041 END_PROFILE(SMBlockread);
3042 return;
3043 }
3044
3045 numtoread = SVAL(req->vwv+1, 0);
3046 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3047
3048 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3049
3050 reply_outbuf(req, 5, numtoread + 3);
3051
3052 data = smb_buf(req->outbuf) + 3;
3053
3054 /*
3055 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3056 * protocol request that predates the read/write lock concept.
3057 * Thus instead of asking for a read lock here we need to ask
3058 * for a write lock. JRA.
3059 * Note that the requested lock size is unaffected by max_recv.
3060 */
3061
3062 br_lck = do_lock(smbd_messaging_context(),
3063 fsp,
3064 req->smbpid,
3065 (uint64_t)numtoread,
3066 (uint64_t)startpos,
3067 WRITE_LOCK,
3068 WINDOWS_LOCK,
3069 False, /* Non-blocking lock. */
3070 &status,
3071 NULL,
3072 NULL);
3073 TALLOC_FREE(br_lck);
3074
3075 if (NT_STATUS_V(status)) {
3076 reply_nterror(req, status);
3077 END_PROFILE(SMBlockread);
3078 return;
3079 }
3080
3081 /*
3082 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3083 */
3084
3085 if (numtoread > max_recv) {
3086 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3087 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3088 (unsigned int)numtoread, (unsigned int)max_recv ));
3089 numtoread = MIN(numtoread,max_recv);
3090 }
3091 nread = read_file(fsp,data,startpos,numtoread);
3092
3093 if (nread < 0) {
3094 reply_unixerror(req, ERRDOS, ERRnoaccess);
3095 END_PROFILE(SMBlockread);
3096 return;
3097 }
3098
3099 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3100
3101 SSVAL(req->outbuf,smb_vwv0,nread);
3102 SSVAL(req->outbuf,smb_vwv5,nread+3);
3103 p = smb_buf(req->outbuf);
3104 SCVAL(p,0,0); /* pad byte. */
3105 SSVAL(p,1,nread);
3106
3107 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3108 fsp->fnum, (int)numtoread, (int)nread));
3109
3110 END_PROFILE(SMBlockread);
3111 return;
3112 }
3113
3114 #undef DBGC_CLASS
3115 #define DBGC_CLASS DBGC_ALL
3116
3117 /****************************************************************************
3118 Reply to a read.
3119 ****************************************************************************/
3120
3121 void reply_read(struct smb_request *req)
3122 {
3123 connection_struct *conn = req->conn;
3124 size_t numtoread;
3125 ssize_t nread = 0;
3126 char *data;
3127 SMB_OFF_T startpos;
3128 int outsize = 0;
3129 files_struct *fsp;
3130 struct lock_struct lock;
3131
3132 START_PROFILE(SMBread);
3133
3134 if (req->wct < 3) {
3135 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3136 END_PROFILE(SMBread);
3137 return;
3138 }
3139
3140 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3141
3142 if (!check_fsp(conn, req, fsp)) {
3143 END_PROFILE(SMBread);
3144 return;
3145 }
3146
3147 if (!CHECK_READ(fsp,req)) {
3148 reply_doserror(req, ERRDOS, ERRbadaccess);
3149 END_PROFILE(SMBread);
3150 return;
3151 }
3152
3153 numtoread = SVAL(req->vwv+1, 0);
3154 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3155
3156 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3157
3158 /*
3159 * The requested read size cannot be greater than max_recv. JRA.
3160 */
3161 if (numtoread > max_recv) {
3162 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3163 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3164 (unsigned int)numtoread, (unsigned int)max_recv ));
3165 numtoread = MIN(numtoread,max_recv);
3166 }
3167
3168 reply_outbuf(req, 5, numtoread+3);
3169
3170 data = smb_buf(req->outbuf) + 3;
3171
3172 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3173 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3174 &lock);
3175
3176 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3177 reply_doserror(req, ERRDOS,ERRlock);
3178 END_PROFILE(SMBread);
3179 return;
3180 }
3181
3182 if (numtoread > 0)
3183 nread = read_file(fsp,data,startpos,numtoread);
3184
3185 if (nread < 0) {
3186 reply_unixerror(req, ERRDOS,ERRnoaccess);
3187 goto strict_unlock;
3188 }
3189
3190 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3191
3192 SSVAL(req->outbuf,smb_vwv0,nread);
3193 SSVAL(req->outbuf,smb_vwv5,nread+3);
3194 SCVAL(smb_buf(req->outbuf),0,1);
3195 SSVAL(smb_buf(req->outbuf),1,nread);
3196
3197 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3198 fsp->fnum, (int)numtoread, (int)nread ) );
3199
3200 strict_unlock:
3201 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3202
3203 END_PROFILE(SMBread);
3204 return;
3205 }
3206
3207 /****************************************************************************
3208 Setup readX header.
3209 ****************************************************************************/
3210
3211 static int setup_readX_header(struct smb_request *req, char *outbuf,
3212 size_t smb_maxcnt)
3213 {
3214 int outsize;
3215 char *data;
3216
3217 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3218 data = smb_buf(outbuf);
3219
3220 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3221
3222 SCVAL(outbuf,smb_vwv0,0xFF);
3223 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3224 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3225 SSVAL(outbuf,smb_vwv6,
3226 req_wct_ofs(req)
3227 + 1 /* the wct field */
3228 + 12 * sizeof(uint16_t) /* vwv */
3229 + 2); /* the buflen field */
3230 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3231 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3232 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3233 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3234 return outsize;
3235 }
3236
3237 /****************************************************************************
3238 Reply to a read and X - possibly using sendfile.
3239 ****************************************************************************/
3240
3241 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3242 files_struct *fsp, SMB_OFF_T startpos,
3243 size_t smb_maxcnt)
3244 {
3245 SMB_STRUCT_STAT sbuf;
3246 ssize_t nread = -1;
3247
3248 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3249 reply_unixerror(req, ERRDOS, ERRnoaccess);
3250 return;
3251 }
3252
3253 if (startpos > sbuf.st_size) {
3254 smb_maxcnt = 0;
3255 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3256 smb_maxcnt = (sbuf.st_size - startpos);
3257 }
3258
3259 if (smb_maxcnt == 0) {
3260 goto normal_read;
3261 }
3262
3263 #if defined(WITH_SENDFILE)
3264 /*
3265 * We can only use sendfile on a non-chained packet
3266 * but we can use on a non-oplocked file. tridge proved this
3267 * on a train in Germany :-). JRA.
3268 */
3269
3270 if (!req_is_in_chain(req) &&
3271 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3272 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3273 uint8 headerbuf[smb_size + 12 * 2];
3274 DATA_BLOB header;
3275
3276 /*
3277 * Set up the packet header before send. We
3278 * assume here the sendfile will work (get the
3279 * correct amount of data).
3280 */
3281
3282 header = data_blob_const(headerbuf, sizeof(headerbuf));
3283
3284 construct_reply_common_req(req, (char *)headerbuf);
3285 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3286
3287 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3288 /* Returning ENOSYS means no data at all was sent.
3289 Do this as a normal read. */
3290 if (errno == ENOSYS) {
3291 goto normal_read;
3292 }
3293
3294 /*
3295 * Special hack for broken Linux with no working sendfile. If we
3296 * return EINTR we sent the header but not the rest of the data.
3297 * Fake this up by doing read/write calls.
3298 */
3299
3300 if (errno == EINTR) {
3301 /* Ensure we don't do this again. */
3302 set_use_sendfile(SNUM(conn), False);
3303 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3304 nread = fake_sendfile(fsp, startpos,
3305 smb_maxcnt);
3306 if (nread == -1) {
3307 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3308 fsp->fsp_name, strerror(errno) ));
3309 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3310 }
3311 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3312 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3313 /* No outbuf here means successful sendfile. */
3314 TALLOC_FREE(req->outbuf);
3315 return;
3316 }
3317
3318 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3319 fsp->fsp_name, strerror(errno) ));
3320 exit_server_cleanly("send_file_readX sendfile failed");
3321 } else if (nread == 0) {
3322 /*
3323 * Some sendfile implementations return 0 to indicate
3324 * that there was a short read, but nothing was
3325 * actually written to the socket. In this case,
3326 * fallback to the normal read path so the header gets
3327 * the correct byte count.
3328 */
3329 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3330 "falling back to the normal read: %s\n",
3331 fsp->fsp_name));
3332 goto normal_read;
3333 }
3334
3335 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3336 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3337
3338 /* Deal with possible short send. */
3339 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3340 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3341 }
3342
3343 /* No outbuf here means successful sendfile. */
3344 TALLOC_FREE(req->outbuf);
3345 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3346 SMB_PERFCOUNT_END(&req->pcd);
3347 return;
3348 }
3349 #endif
3350
3351 normal_read:
3352
3353 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3354 uint8 headerbuf[smb_size + 2*12];
3355
3356 construct_reply_common_req(req, (char *)headerbuf);
3357 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3358
3359 /* Send out the header. */
3360 if (write_data(smbd_server_fd(), (char *)headerbuf,
3361 sizeof(headerbuf)) != sizeof(headerbuf)) {
3362 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3363 fsp->fsp_name, strerror(errno) ));
3364 exit_server_cleanly("send_file_readX sendfile failed");
3365 }
3366 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3367 if (nread == -1) {
3368 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3369 fsp->fsp_name, strerror(errno) ));
3370 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3371 }
3372 TALLOC_FREE(req->outbuf);
3373 return;
3374 }
3375
3376 reply_outbuf(req, 12, smb_maxcnt);
3377
3378 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3379 if (nread < 0) {
3380 reply_unixerror(req, ERRDOS, ERRnoaccess);
3381 return;
3382 }
3383
3384 setup_readX_header(req, (char *)req->outbuf, nread);
3385
3386 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3387 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3388
3389 chain_reply(req);
3390 }
3391
3392 /****************************************************************************
3393 Reply to a read and X.
3394 ****************************************************************************/
3395
3396 void reply_read_and_X(struct smb_request *req)
3397 {
3398 connection_struct *conn = req->conn;
3399 files_struct *fsp;
3400 SMB_OFF_T startpos;
3401 size_t smb_maxcnt;
3402 struct lock_struct lock;
3403 bool big_readX = False;
3404 #if 0
3405 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3406 #endif
3407
3408 START_PROFILE(SMBreadX);
3409
3410 if ((req->wct != 10) && (req->wct != 12)) {
3411 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3412 return;
3413 }
3414
3415 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3416 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3417 smb_maxcnt = SVAL(req->vwv+5, 0);
3418
3419 /* If it's an IPC, pass off the pipe handler. */
3420 if (IS_IPC(conn)) {
3421 reply_pipe_read_and_X(req);
3422 END_PROFILE(SMBreadX);
3423 return;
3424 }
3425
3426 if (!check_fsp(conn, req, fsp)) {
3427 END_PROFILE(SMBreadX);
3428 return;
3429 }
3430
3431 if (!CHECK_READ(fsp,req)) {
3432 reply_doserror(req, ERRDOS,ERRbadaccess);
3433 END_PROFILE(SMBreadX);
3434 return;
3435 }
3436
3437 if (global_client_caps & CAP_LARGE_READX) {
3438 size_t upper_size = SVAL(req->vwv+7, 0);
3439 smb_maxcnt |= (upper_size<<16);
3440 if (upper_size > 1) {
3441 /* Can't do this on a chained packet. */
3442 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3443 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3444 END_PROFILE(SMBreadX);
3445 return;
3446 }
3447 /* We currently don't do this on signed or sealed data. */
3448 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3449 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3450 END_PROFILE(SMBreadX);
3451 return;
3452 }
3453 /* Is there room in the reply for this data ? */
3454 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3455 reply_nterror(req,
3456 NT_STATUS_INVALID_PARAMETER);
3457 END_PROFILE(SMBreadX);
3458 return;
3459 }
3460 big_readX = True;
3461 }
3462 }
3463
3464 if (req->wct == 12) {
3465 #ifdef LARGE_SMB_OFF_T
3466 /*
3467 * This is a large offset (64 bit) read.
3468 */
3469 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3470
3471 #else /* !LARGE_SMB_OFF_T */
3472
3473 /*
3474 * Ensure we haven't been sent a >32 bit offset.
3475 */
3476
3477 if(IVAL(req->vwv+10, 0) != 0) {
3478 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3479 "used and we don't support 64 bit offsets.\n",
3480 (unsigned int)IVAL(req->vwv+10, 0) ));
3481 END_PROFILE(SMBreadX);
3482 reply_doserror(req, ERRDOS, ERRbadaccess);
3483 return;
3484 }
3485
3486 #endif /* LARGE_SMB_OFF_T */
3487
3488 }
3489
3490 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3491 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3492 &lock);
3493
3494 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3495 END_PROFILE(SMBreadX);
3496 reply_doserror(req, ERRDOS, ERRlock);
3497 return;
3498 }
3499
3500 if (!big_readX &&
3501 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3502 goto strict_unlock;
3503 }
3504
3505 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3506
3507 strict_unlock:
3508 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3509
3510 END_PROFILE(SMBreadX);
3511 return;
3512 }
3513
3514 /****************************************************************************
3515 Error replies to writebraw must have smb_wct == 1. Fix this up.
3516 ****************************************************************************/
3517
3518 void error_to_writebrawerr(struct smb_request *req)
3519 {
3520 uint8 *old_outbuf = req->outbuf;
3521
3522 reply_outbuf(req, 1, 0);
3523
3524 memcpy(req->outbuf, old_outbuf, smb_size);
3525 TALLOC_FREE(old_outbuf);
3526 }
3527
3528 /****************************************************************************
3529 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3530 ****************************************************************************/
3531
3532 void reply_writebraw(struct smb_request *req)
3533 {
3534 connection_struct *conn = req->conn;
3535 char *buf = NULL;
3536 ssize_t nwritten=0;
3537 ssize_t total_written=0;
3538 size_t numtowrite=0;
3539 size_t tcount;
3540 SMB_OFF_T startpos;
3541 char *data=NULL;
3542 bool write_through;
3543 files_struct *fsp;
3544 struct lock_struct lock;
3545 NTSTATUS status;
3546
3547 START_PROFILE(SMBwritebraw);
3548
3549 /*
3550 * If we ever reply with an error, it must have the SMB command
3551 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3552 * we're finished.
3553 */
3554 SCVAL(req->inbuf,smb_com,SMBwritec);
3555
3556 if (srv_is_signing_active()) {
3557 END_PROFILE(SMBwritebraw);
3558 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3559 "raw reads/writes are disallowed.");
3560 }
3561
3562 if (req->wct < 12) {
3563 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3564 error_to_writebrawerr(req);
3565 END_PROFILE(SMBwritebraw);
3566 return;
3567 }
3568
3569 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3570 if (!check_fsp(conn, req, fsp)) {
3571 error_to_writebrawerr(req);
3572 END_PROFILE(SMBwritebraw);
3573 return;
3574 }
3575
3576 if (!CHECK_WRITE(fsp)) {
3577 reply_doserror(req, ERRDOS, ERRbadaccess);
3578 error_to_writebrawerr(req);
3579 END_PROFILE(SMBwritebraw);
3580 return;
3581 }
3582
3583 tcount = IVAL(req->vwv+1, 0);
3584 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3585 write_through = BITSETW(req->vwv+7,0);
3586
3587 /* We have to deal with slightly different formats depending
3588 on whether we are using the core+ or lanman1.0 protocol */
3589
3590 if(Protocol <= PROTOCOL_COREPLUS) {
3591 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3592 data = smb_buf(req->inbuf);
3593 } else {
3594 numtowrite = SVAL(req->vwv+10, 0);
3595 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3596 }
3597
3598 /* Ensure we don't write bytes past the end of this packet. */
3599 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3600 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3601 error_to_writebrawerr(req);
3602 END_PROFILE(SMBwritebraw);
3603 return;
3604 }
3605
3606 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3607 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3608 &lock);
3609
3610 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3611 reply_doserror(req, ERRDOS, ERRlock);
3612 error_to_writebrawerr(req);
3613 END_PROFILE(SMBwritebraw);
3614 return;
3615 }
3616
3617 if (numtowrite>0) {
3618 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3619 }
3620
3621 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3622 "wrote=%d sync=%d\n",
3623 fsp->fnum, (double)startpos, (int)numtowrite,
3624 (int)nwritten, (int)write_through));
3625
3626 if (nwritten < (ssize_t)numtowrite) {
3627 reply_unixerror(req, ERRHRD, ERRdiskfull);
3628 error_to_writebrawerr(req);
3629 goto strict_unlock;
3630 }
3631
3632 total_written = nwritten;
3633
3634 /* Allocate a buffer of 64k + length. */
3635 buf = TALLOC_ARRAY(NULL, char, 65540);
3636 if (!buf) {
3637 reply_doserror(req, ERRDOS, ERRnomem);
3638 error_to_writebrawerr(req);
3639 goto strict_unlock;
3640 }
3641
3642 /* Return a SMBwritebraw message to the redirector to tell
3643 * it to send more bytes */
3644
3645 memcpy(buf, req->inbuf, smb_size);
3646 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3647 SCVAL(buf,smb_com,SMBwritebraw);
3648 SSVALS(buf,smb_vwv0,0xFFFF);
3649 show_msg(buf);
3650 if (!srv_send_smb(smbd_server_fd(),
3651 buf,
3652 IS_CONN_ENCRYPTED(conn),
3653 &req->pcd)) {
3654 exit_server_cleanly("reply_writebraw: srv_send_smb "
3655 "failed.");
3656 }
3657
3658 /* Now read the raw data into the buffer and write it */
3659 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3660 &numtowrite);
3661 if (!NT_STATUS_IS_OK(status)) {
3662 exit_server_cleanly("secondary writebraw failed");
3663 }
3664
3665 /* Set up outbuf to return the correct size */
3666 reply_outbuf(req, 1, 0);
3667
3668 if (numtowrite != 0) {
3669
3670 if (numtowrite > 0xFFFF) {
3671 DEBUG(0,("reply_writebraw: Oversize secondary write "
3672 "raw requested (%u). Terminating\n",
3673 (unsigned int)numtowrite ));
3674 exit_server_cleanly("secondary writebraw failed");
3675 }
3676
3677 if (tcount > nwritten+numtowrite) {
3678 DEBUG(3,("reply_writebraw: Client overestimated the "
3679 "write %d %d %d\n",
3680 (int)tcount,(int)nwritten,(int)numtowrite));
3681 }
3682
3683 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3684
3685 if (!NT_STATUS_IS_OK(status)) {
3686 DEBUG(0,("reply_writebraw: Oversize secondary write "
3687 "raw read failed (%s). Terminating\n",
3688 nt_errstr(status)));
3689 exit_server_cleanly("secondary writebraw failed");
3690 }
3691
3692 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3693 if (nwritten == -1) {
3694 TALLOC_FREE(buf);
3695 reply_unixerror(req, ERRHRD, ERRdiskfull);
3696 error_to_writebrawerr(req);
3697 goto strict_unlock;
3698 }
3699
3700 if (nwritten < (ssize_t)numtowrite) {
3701 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3702 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3703 }
3704
3705 if (nwritten > 0) {
3706 total_written += nwritten;
3707 }
3708 }
3709
3710 TALLOC_FREE(buf);
3711 SSVAL(req->outbuf,smb_vwv0,total_written);
3712
3713 status = sync_file(conn, fsp, write_through);
3714 if (!NT_STATUS_IS_OK(status)) {
3715 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3716 fsp->fsp_name, nt_errstr(status) ));
3717 reply_nterror(req, status);
3718 error_to_writebrawerr(req);
3719 goto strict_unlock;
3720 }
3721
3722 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3723 "wrote=%d\n",
3724 fsp->fnum, (double)startpos, (int)numtowrite,
3725 (int)total_written));
3726
3727 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3728
3729 /* We won't return a status if write through is not selected - this
3730 * follows what WfWg does */
3731 END_PROFILE(SMBwritebraw);
3732
3733 if (!write_through && total_written==tcount) {
3734
3735 #if RABBIT_PELLET_FIX
3736 /*
3737 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3738 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3739 * JRA.
3740 */
3741 if (!send_keepalive(smbd_server_fd())) {
3742 exit_server_cleanly("reply_writebraw: send of "
3743 "keepalive failed");
3744 }
3745 #endif
3746 TALLOC_FREE(req->outbuf);
3747 }
3748 return;
3749
3750 strict_unlock:
3751 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3752
3753 END_PROFILE(SMBwritebraw);
3754 return;
3755 }
3756
3757 #undef DBGC_CLASS
3758 #define DBGC_CLASS DBGC_LOCKING
3759
3760 /****************************************************************************
3761 Reply to a writeunlock (core+).
3762 ****************************************************************************/
3763
3764 void reply_writeunlock(struct smb_request *req)
3765 {
3766 connection_struct *conn = req->conn;
3767 ssize_t nwritten = -1;
3768 size_t numtowrite;
3769 SMB_OFF_T startpos;
3770 const char *data;
3771 NTSTATUS status = NT_STATUS_OK;
3772 files_struct *fsp;
3773 struct lock_struct lock;
3774
3775 START_PROFILE(SMBwriteunlock);
3776
3777 if (req->wct < 5) {
3778 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3779 END_PROFILE(SMBwriteunlock);
3780 return;
3781 }
3782
3783 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3784
3785 if (!check_fsp(conn, req, fsp)) {
3786 END_PROFILE(SMBwriteunlock);
3787 return;
3788 }
3789
3790 if (!CHECK_WRITE(fsp)) {
3791 reply_doserror(req, ERRDOS,ERRbadaccess);
3792 END_PROFILE(SMBwriteunlock);
3793 return;
3794 }
3795
3796 numtowrite = SVAL(req->vwv+1, 0);
3797 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3798 data = (const char *)req->buf + 3;
3799
3800 if (numtowrite) {
3801 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3802 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3803 &lock);
3804
3805 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3806 reply_doserror(req, ERRDOS, ERRlock);
3807 END_PROFILE(SMBwriteunlock);
3808 return;
3809 }
3810 }
3811
3812 /* The special X/Open SMB protocol handling of
3813 zero length writes is *NOT* done for
3814 this call */
3815 if(numtowrite == 0) {
3816 nwritten = 0;
3817 } else {
3818 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3819 }
3820
3821 status = sync_file(conn, fsp, False /* write through */);
3822 if (!NT_STATUS_IS_OK(status)) {
3823 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3824 fsp->fsp_name, nt_errstr(status) ));
3825 reply_nterror(req, status);
3826 goto strict_unlock;
3827 }
3828
3829 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3830 reply_unixerror(req, ERRHRD, ERRdiskfull);
3831 goto strict_unlock;
3832 }
3833
3834 if (numtowrite) {
3835 status = do_unlock(smbd_messaging_context(),
3836 fsp,
3837 req->smbpid,
3838 (uint64_t)numtowrite,
3839 (uint64_t)startpos,
3840 WINDOWS_LOCK);
3841
3842 if (NT_STATUS_V(status)) {
3843 reply_nterror(req, status);
3844 goto strict_unlock;
3845 }
3846 }
3847
3848 reply_outbuf(req, 1, 0);
3849
3850 SSVAL(req->outbuf,smb_vwv0,nwritten);
3851
3852 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3853 fsp->fnum, (int)numtowrite, (int)nwritten));
3854
3855 strict_unlock:
3856 if (numtowrite) {
3857 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3858 }
3859
3860 END_PROFILE(SMBwriteunlock);
3861 return;
3862 }
3863
3864 #undef DBGC_CLASS
3865 #define DBGC_CLASS DBGC_ALL
3866
3867 /****************************************************************************
3868 Reply to a write.
3869 ****************************************************************************/
3870
3871 void reply_write(struct smb_request *req)
3872 {
3873 connection_struct *conn = req->conn;
3874 size_t numtowrite;
3875 ssize_t nwritten = -1;
3876 SMB_OFF_T startpos;
3877 const char *data;
3878 files_struct *fsp;
3879 struct lock_struct lock;
3880 NTSTATUS status;
3881
3882 START_PROFILE(SMBwrite);
3883
3884 if (req->wct < 5) {
3885 END_PROFILE(SMBwrite);
3886 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3887 return;
3888 }
3889
3890 /* If it's an IPC, pass off the pipe handler. */
3891 if (IS_IPC(conn)) {
3892 reply_pipe_write(req);
3893 END_PROFILE(SMBwrite);
3894 return;
3895 }
3896
3897 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3898
3899 if (!check_fsp(conn, req, fsp)) {
3900 END_PROFILE(SMBwrite);
3901 return;
3902 }
3903
3904 if (!CHECK_WRITE(fsp)) {
3905 reply_doserror(req, ERRDOS, ERRbadaccess);
3906 END_PROFILE(SMBwrite);
3907 return;
3908 }
3909
3910 numtowrite = SVAL(req->vwv+1, 0);
3911 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3912 data = (const char *)req->buf + 3;
3913
3914 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3915 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3916 &lock);
3917
3918 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3919 reply_doserror(req, ERRDOS, ERRlock);
3920 END_PROFILE(SMBwrite);
3921 return;
3922 }
3923
3924 /*
3925 * X/Open SMB protocol says that if smb_vwv1 is
3926 * zero then the file size should be extended or
3927 * truncated to the size given in smb_vwv[2-3].
3928 */
3929
3930 if(numtowrite == 0) {
3931 /*
3932 * This is actually an allocate call, and set EOF. JRA.
3933 */
3934 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3935 if (nwritten < 0) {
3936 reply_nterror(req, NT_STATUS_DISK_FULL);
3937 goto strict_unlock;
3938 }
3939 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3940 if (nwritten < 0) {
3941 reply_nterror(req, NT_STATUS_DISK_FULL);
3942 goto strict_unlock;
3943 }
3944 trigger_write_time_update_immediate(fsp);
3945 } else {
3946 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3947 }
3948
3949 status = sync_file(conn, fsp, False);
3950 if (!NT_STATUS_IS_OK(status)) {
3951 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3952 fsp->fsp_name, nt_errstr(status) ));
3953 reply_nterror(req, status);
3954 goto strict_unlock;
3955 }
3956
3957 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3958 reply_unixerror(req, ERRHRD, ERRdiskfull);
3959 goto strict_unlock;
3960 }
3961
3962 reply_outbuf(req, 1, 0);
3963
3964 SSVAL(req->outbuf,smb_vwv0,nwritten);
3965
3966 if (nwritten < (ssize_t)numtowrite) {
3967 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3968 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3969 }
3970
3971 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3972
3973 strict_unlock:
3974 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3975
3976 END_PROFILE(SMBwrite);
3977 return;
3978 }
3979
3980 /****************************************************************************
3981 Ensure a buffer is a valid writeX for recvfile purposes.
3982 ****************************************************************************/
3983
3984 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3985 (2*14) + /* word count (including bcc) */ \
3986 1 /* pad byte */)
3987
3988 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3989 {
3990 size_t numtowrite;
3991 connection_struct *conn = NULL;
3992 unsigned int doff = 0;
3993 size_t len = smb_len_large(inbuf);
3994
3995 if (is_encrypted_packet(inbuf)) {
3996 /* Can't do this on encrypted
3997 * connections. */
3998 return false;
3999 }
4000
4001 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4002 return false;
4003 }
4004
4005 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4006 CVAL(inbuf,smb_wct) != 14) {
4007 DEBUG(10,("is_valid_writeX_buffer: chained or "
4008 "invalid word length.\n"));
4009 return false;
4010 }
4011
4012 conn = conn_find(SVAL(inbuf, smb_tid));
4013 if (conn == NULL) {
4014 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4015 return false;
4016 }
4017 if (IS_IPC(conn)) {
4018 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4019 return false;
4020 }
4021 if (IS_PRINT(conn)) {
4022 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4023 return false;
4024 }
4025 doff = SVAL(inbuf,smb_vwv11);
4026
4027 numtowrite = SVAL(inbuf,smb_vwv10);
4028
4029 if (len > doff && len - doff > 0xFFFF) {
4030 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4031 }
4032
4033 if (numtowrite == 0) {
4034 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4035 return false;
4036 }
4037
4038 /* Ensure the sizes match up. */
4039 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4040 /* no pad byte...old smbclient :-( */
4041 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4042 (unsigned int)doff,
4043 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4044 return false;
4045 }
4046
4047 if (len - doff != numtowrite) {
4048 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4049 "len = %u, doff = %u, numtowrite = %u\n",
4050 (unsigned int)len,
4051 (unsigned int)doff,
4052 (unsigned int)numtowrite ));
4053 return false;
4054 }
4055
4056 DEBUG(10,("is_valid_writeX_buffer: true "
4057 "len = %u, doff = %u, numtowrite = %u\n",
4058 (unsigned int)len,
4059 (unsigned int)doff,
4060 (unsigned int)numtowrite ));
4061
4062 return true;
4063 }
4064
4065 /****************************************************************************
4066 Reply to a write and X.
4067 ****************************************************************************/
4068
4069 void reply_write_and_X(struct smb_request *req)
4070 {
4071 connection_struct *conn = req->conn;
4072 files_struct *fsp;
4073 struct lock_struct lock;
4074 SMB_OFF_T startpos;
4075 size_t numtowrite;
4076 bool write_through;
4077 ssize_t nwritten;
4078 unsigned int smb_doff;
4079 unsigned int smblen;
4080 char *data;
4081 NTSTATUS status;
4082
4083 START_PROFILE(SMBwriteX);
4084
4085 if ((req->wct != 12) && (req->wct != 14)) {
4086 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4087 END_PROFILE(SMBwriteX);
4088 return;
4089 }
4090
4091 numtowrite = SVAL(req->vwv+10, 0);
4092 smb_doff = SVAL(req->vwv+11, 0);
4093 smblen = smb_len(req->inbuf);
4094
4095 if (req->unread_bytes > 0xFFFF ||
4096 (smblen > smb_doff &&
4097 smblen - smb_doff > 0xFFFF)) {
4098 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4099 }
4100
4101 if (req->unread_bytes) {
4102 /* Can't do a recvfile write on IPC$ */
4103 if (IS_IPC(conn)) {
4104 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4105 END_PROFILE(SMBwriteX);
4106 return;
4107 }
4108 if (numtowrite != req->unread_bytes) {
4109 reply_doserror(req, ERRDOS, ERRbadmem);
4110 END_PROFILE(SMBwriteX);
4111 return;
4112 }
4113 } else {
4114 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4115 smb_doff + numtowrite > smblen) {
4116 reply_doserror(req, ERRDOS, ERRbadmem);
4117 END_PROFILE(SMBwriteX);
4118 return;
4119 }
4120 }
4121
4122 /* If it's an IPC, pass off the pipe handler. */
4123 if (IS_IPC(conn)) {
4124 if (req->unread_bytes) {
4125 reply_doserror(req, ERRDOS, ERRbadmem);
4126 END_PROFILE(SMBwriteX);
4127 return;
4128 }
4129 reply_pipe_write_and_X(req);
4130 END_PROFILE(SMBwriteX);
4131 return;
4132 }
4133
4134 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4135 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4136 write_through = BITSETW(req->vwv+7,0);
4137
4138 if (!check_fsp(conn, req, fsp)) {
4139 END_PROFILE(SMBwriteX);
4140 return;
4141 }
4142
4143 if (!CHECK_WRITE(fsp)) {
4144 reply_doserror(req, ERRDOS, ERRbadaccess);
4145 END_PROFILE(SMBwriteX);
4146 return;
4147 }
4148
4149 data = smb_base(req->inbuf) + smb_doff;
4150
4151 if(req->wct == 14) {
4152 #ifdef LARGE_SMB_OFF_T
4153 /*
4154 * This is a large offset (64 bit) write.
4155 */
4156 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4157
4158 #else /* !LARGE_SMB_OFF_T */
4159
4160 /*
4161 * Ensure we haven't been sent a >32 bit offset.
4162 */
4163
4164 if(IVAL(req->vwv+12, 0) != 0) {
4165 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4166 "used and we don't support 64 bit offsets.\n",
4167 (unsigned int)IVAL(req->vwv+12, 0) ));
4168 reply_doserror(req, ERRDOS, ERRbadaccess);
4169 END_PROFILE(SMBwriteX);
4170 return;
4171 }
4172
4173 #endif /* LARGE_SMB_OFF_T */
4174 }
4175
4176 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4177 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4178 &lock);
4179
4180 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4181 reply_doserror(req, ERRDOS, ERRlock);
4182 END_PROFILE(SMBwriteX);
4183 return;
4184 }
4185
4186 /* X/Open SMB protocol says that, unlike SMBwrite
4187 if the length is zero then NO truncation is
4188 done, just a write of zero. To truncate a file,
4189 use SMBwrite. */
4190
4191 if(numtowrite == 0) {
4192 nwritten = 0;
4193 } else {
4194
4195 if ((req->unread_bytes == 0) &&
4196 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4197 numtowrite)) {
4198 goto strict_unlock;
4199 }
4200
4201 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4202 }
4203
4204 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4205 reply_unixerror(req, ERRHRD, ERRdiskfull);
4206 goto strict_unlock;
4207 }
4208
4209 reply_outbuf(req, 6, 0);
4210 SSVAL(req->outbuf,smb_vwv2,nwritten);
4211 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4212
4213 if (nwritten < (ssize_t)numtowrite) {
4214 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4215 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4216 }
4217
4218 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4219 fsp->fnum, (int)numtowrite, (int)nwritten));
4220
4221 status = sync_file(conn, fsp, write_through);
4222 if (!NT_STATUS_IS_OK(status)) {
4223 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4224 fsp->fsp_name, nt_errstr(status) ));
4225 reply_nterror(req, status);
4226 goto strict_unlock;
4227 }
4228
4229 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4230
4231 END_PROFILE(SMBwriteX);
4232 chain_reply(req);
4233 return;
4234
4235 strict_unlock:
4236 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4237
4238 END_PROFILE(SMBwriteX);
4239 return;
4240 }
4241
4242 /****************************************************************************
4243 Reply to a lseek.
4244 ****************************************************************************/
4245
4246 void reply_lseek(struct smb_request *req)
4247 {
4248 connection_struct *conn = req->conn;
4249 SMB_OFF_T startpos;
4250 SMB_OFF_T res= -1;
4251 int mode,umode;
4252 files_struct *fsp;
4253
4254 START_PROFILE(SMBlseek);
4255
4256 if (req->wct < 4) {
4257 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4258 END_PROFILE(SMBlseek);
4259 return;
4260 }
4261
4262 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4263
4264 if (!check_fsp(conn, req, fsp)) {
4265 return;
4266 }
4267
4268 flush_write_cache(fsp, SEEK_FLUSH);
4269
4270 mode = SVAL(req->vwv+1, 0) & 3;
4271 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4272 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4273
4274 switch (mode) {
4275 case 0:
4276 umode = SEEK_SET;
4277 res = startpos;
4278 break;
4279 case 1:
4280 umode = SEEK_CUR;
4281 res = fsp->fh->pos + startpos;
4282 break;
4283 case 2:
4284 umode = SEEK_END;
4285 break;
4286 default:
4287 umode = SEEK_SET;
4288 res = startpos;
4289 break;
4290 }
4291
4292 if (umode == SEEK_END) {
4293 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4294 if(errno == EINVAL) {
4295 SMB_OFF_T current_pos = startpos;
4296 SMB_STRUCT_STAT sbuf;
4297
4298 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4299 reply_unixerror(req, ERRDOS,
4300 ERRnoaccess);
4301 END_PROFILE(SMBlseek);
4302 return;
4303 }
4304
4305 current_pos += sbuf.st_size;
4306 if(current_pos < 0)
4307 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4308 }
4309 }
4310
4311 if(res == -1) {
4312 reply_unixerror(req, ERRDOS, ERRnoaccess);
4313 END_PROFILE(SMBlseek);
4314 return;
4315 }
4316 }
4317
4318 fsp->fh->pos = res;
4319
4320 reply_outbuf(req, 2, 0);
4321 SIVAL(req->outbuf,smb_vwv0,res);
4322
4323 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4324 fsp->fnum, (double)startpos, (double)res, mode));
4325
4326 END_PROFILE(SMBlseek);
4327 return;
4328 }
4329
4330 /****************************************************************************
4331 Reply to a flush.
4332 ****************************************************************************/
4333
4334 void reply_flush(struct smb_request *req)
4335 {
4336 connection_struct *conn = req->conn;
4337 uint16 fnum;
4338 files_struct *fsp;
4339
4340 START_PROFILE(SMBflush);
4341
4342 if (req->wct < 1) {
4343 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4344 return;
4345 }
4346
4347 fnum = SVAL(req->vwv+0, 0);
4348 fsp = file_fsp(req, fnum);
4349
4350 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4351 return;
4352 }
4353
4354 if (!fsp) {
4355 file_sync_all(conn);
4356 } else {
4357 NTSTATUS status = sync_file(conn, fsp, True);
4358 if (!NT_STATUS_IS_OK(status)) {
4359 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4360 fsp->fsp_name, nt_errstr(status) ));
4361 reply_nterror(req, status);
4362 END_PROFILE(SMBflush);
4363 return;
4364 }
4365 }
4366
4367 reply_outbuf(req, 0, 0);
4368
4369 DEBUG(3,("flush\n"));
4370 END_PROFILE(SMBflush);
4371 return;
4372 }
4373
4374 /****************************************************************************
4375 Reply to a exit.
4376 conn POINTER CAN BE NULL HERE !
4377 ****************************************************************************/
4378
4379 void reply_exit(struct smb_request *req)
4380 {
4381 START_PROFILE(SMBexit);
4382
4383 file_close_pid(req->smbpid, req->vuid);
4384
4385 reply_outbuf(req, 0, 0);
4386
4387 DEBUG(3,("exit\n"));
4388
4389 END_PROFILE(SMBexit);
4390 return;
4391 }
4392
4393 /****************************************************************************
4394 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4395 ****************************************************************************/
4396
4397 void reply_close(struct smb_request *req)
4398 {
4399 connection_struct *conn = req->conn;
4400 NTSTATUS status = NT_STATUS_OK;
4401 files_struct *fsp = NULL;
4402 START_PROFILE(SMBclose);
4403
4404 if (req->wct < 3) {
4405 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4406 END_PROFILE(SMBclose);
4407 return;
4408 }
4409
4410 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4411
4412 /*
4413 * We can only use check_fsp if we know it's not a directory.
4414 */
4415
4416 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4417 reply_doserror(req, ERRDOS, ERRbadfid);
4418 END_PROFILE(SMBclose);
4419 return;
4420 }
4421
4422 if(fsp->is_directory) {
4423 /*
4424 * Special case - close NT SMB directory handle.
4425 */
4426 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4427 status = close_file(req, fsp, NORMAL_CLOSE);
4428 } else {
4429 time_t t;
4430 /*
4431 * Close ordinary file.
4432 */
4433
4434 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4435 fsp->fh->fd, fsp->fnum,
4436 conn->num_files_open));
4437
4438 /*
4439 * Take care of any time sent in the close.
4440 */
4441
4442 t = srv_make_unix_date3(req->vwv+1);
4443 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4444
4445 /*
4446 * close_file() returns the unix errno if an error
4447 * was detected on close - normally this is due to
4448 * a disk full error. If not then it was probably an I/O error.
4449 */
4450
4451 status = close_file(req, fsp, NORMAL_CLOSE);
4452 }
4453
4454 if (!NT_STATUS_IS_OK(status)) {
4455 reply_nterror(req, status);
4456 END_PROFILE(SMBclose);
4457 return;
4458 }
4459
4460 reply_outbuf(req, 0, 0);
4461 END_PROFILE(SMBclose);
4462 return;
4463 }
4464
4465 /****************************************************************************
4466 Reply to a writeclose (Core+ protocol).
4467 ****************************************************************************/
4468
4469 void reply_writeclose(struct smb_request *req)
4470 {
4471 connection_struct *conn = req->conn;
4472 size_t numtowrite;
4473 ssize_t nwritten = -1;
4474 NTSTATUS close_status = NT_STATUS_OK;
4475 SMB_OFF_T startpos;
4476 const char *data;
4477 struct timespec mtime;
4478 files_struct *fsp;
4479 struct lock_struct lock;
4480
4481 START_PROFILE(SMBwriteclose);
4482
4483 if (req->wct < 6) {
4484 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485 END_PROFILE(SMBwriteclose);
4486 return;
4487 }
4488
4489 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4490
4491 if (!check_fsp(conn, req, fsp)) {
4492 END_PROFILE(SMBwriteclose);
4493 return;
4494 }
4495 if (!CHECK_WRITE(fsp)) {
4496 reply_doserror(req, ERRDOS,ERRbadaccess);
4497 END_PROFILE(SMBwriteclose);
4498 return;
4499 }
4500
4501 numtowrite = SVAL(req->vwv+1, 0);
4502 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4503 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4504 data = (const char *)req->buf + 1;
4505
4506 if (numtowrite) {
4507 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4508 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4509 &lock);
4510
4511 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4512 reply_doserror(req, ERRDOS,ERRlock);
4513 END_PROFILE(SMBwriteclose);
4514 return;
4515 }
4516 }
4517
4518 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4519
4520 set_close_write_time(fsp, mtime);
4521
4522 /*
4523 * More insanity. W2K only closes the file if writelen > 0.
4524 * JRA.
4525 */
4526
4527 if (numtowrite) {
4528 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4529 fsp->fsp_name ));
4530 close_status = close_file(req, fsp, NORMAL_CLOSE);
4531 }
4532
4533 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4534 fsp->fnum, (int)numtowrite, (int)nwritten,
4535 conn->num_files_open));
4536
4537 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4538 reply_doserror(req, ERRHRD, ERRdiskfull);
4539 goto strict_unlock;
4540 }
4541
4542 if(!NT_STATUS_IS_OK(close_status)) {
4543 reply_nterror(req, close_status);
4544 goto strict_unlock;
4545 }
4546
4547 reply_outbuf(req, 1, 0);
4548
4549 SSVAL(req->outbuf,smb_vwv0,nwritten);
4550
4551 strict_unlock:
4552 if (numtowrite) {
4553 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4554 }
4555
4556 END_PROFILE(SMBwriteclose);
4557 return;
4558 }
4559
4560 #undef DBGC_CLASS
4561 #define DBGC_CLASS DBGC_LOCKING
4562
4563 /****************************************************************************
4564 Reply to a lock.
4565 ****************************************************************************/
4566
4567 void reply_lock(struct smb_request *req)
4568 {
4569 connection_struct *conn = req->conn;
4570 uint64_t count,offset;
4571 NTSTATUS status;
4572 files_struct *fsp;
4573 struct byte_range_lock *br_lck = NULL;
4574
4575 START_PROFILE(SMBlock);
4576
4577 if (req->wct < 5) {
4578 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4579 END_PROFILE(SMBlock);
4580 return;
4581 }
4582
4583 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4584
4585 if (!check_fsp(conn, req, fsp)) {
4586 END_PROFILE(SMBlock);
4587 return;
4588 }
4589
4590 count = (uint64_t)IVAL(req->vwv+1, 0);
4591 offset = (uint64_t)IVAL(req->vwv+3, 0);
4592
4593 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4594 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4595
4596 br_lck = do_lock(smbd_messaging_context(),
4597 fsp,
4598 req->smbpid,
4599 count,
4600 offset,
4601 WRITE_LOCK,
4602 WINDOWS_LOCK,
4603 False, /* Non-blocking lock. */
4604 &status,
4605 NULL,
4606 NULL);
4607
4608 TALLOC_FREE(br_lck);
4609
4610 if (NT_STATUS_V(status)) {
4611 reply_nterror(req, status);
4612 END_PROFILE(SMBlock);
4613 return;
4614 }
4615
4616 reply_outbuf(req, 0, 0);
4617
4618 END_PROFILE(SMBlock);
4619 return;
4620 }
4621
4622 /****************************************************************************
4623 Reply to a unlock.
4624 ****************************************************************************/
4625
4626 void reply_unlock(struct smb_request *req)
4627 {
4628 connection_struct *conn = req->conn;
4629 uint64_t count,offset;
4630 NTSTATUS status;
4631 files_struct *fsp;
4632
4633 START_PROFILE(SMBunlock);
4634
4635 if (req->wct < 5) {
4636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4637 END_PROFILE(SMBunlock);
4638 return;
4639 }
4640
4641 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4642
4643 if (!check_fsp(conn, req, fsp)) {
4644 END_PROFILE(SMBunlock);
4645 return;
4646 }
4647
4648 count = (uint64_t)IVAL(req->vwv+1, 0);
4649 offset = (uint64_t)IVAL(req->vwv+3, 0);
4650
4651 status = do_unlock(smbd_messaging_context(),
4652 fsp,
4653 req->smbpid,
4654 count,
4655 offset,
4656 WINDOWS_LOCK);
4657
4658 if (NT_STATUS_V(status)) {
4659 reply_nterror(req, status);
4660 END_PROFILE(SMBunlock);
4661 return;
4662 }
4663
4664 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4665 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4666
4667 reply_outbuf(req, 0, 0);
4668
4669 END_PROFILE(SMBunlock);
4670 return;
4671 }
4672
4673 #undef DBGC_CLASS
4674 #define DBGC_CLASS DBGC_ALL
4675
4676 /****************************************************************************
4677 Reply to a tdis.
4678 conn POINTER CAN BE NULL HERE !
4679 ****************************************************************************/
4680
4681 void reply_tdis(struct smb_request *req)
4682 {
4683 connection_struct *conn = req->conn;
4684 START_PROFILE(SMBtdis);
4685
4686 if (!conn) {
4687 DEBUG(4,("Invalid connection in tdis\n"));
4688 reply_doserror(req, ERRSRV, ERRinvnid);
4689 END_PROFILE(SMBtdis);
4690 return;
4691 }
4692
4693 conn->used = False;
4694
4695 close_cnum(conn,req->vuid);
4696 req->conn = NULL;
4697
4698 reply_outbuf(req, 0, 0);
4699 END_PROFILE(SMBtdis);
4700 return;
4701 }
4702
4703 /****************************************************************************
4704 Reply to a echo.
4705 conn POINTER CAN BE NULL HERE !
4706 ****************************************************************************/
4707
4708 void reply_echo(struct smb_request *req)
4709 {
4710 connection_struct *conn = req->conn;
4711 struct smb_perfcount_data local_pcd;
4712 struct smb_perfcount_data *cur_pcd;
4713 int smb_reverb;
4714 int seq_num;
4715
4716 START_PROFILE(SMBecho);
4717
4718 smb_init_perfcount_data(&local_pcd);
4719
4720 if (req->wct < 1) {
4721 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4722 END_PROFILE(SMBecho);
4723 return;
4724 }
4725
4726 smb_reverb = SVAL(req->vwv+0, 0);
4727
4728 reply_outbuf(req, 1, req->buflen);
4729
4730 /* copy any incoming data back out */
4731 if (req->buflen > 0) {
4732 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4733 }
4734
4735 if (smb_reverb > 100) {
4736 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4737 smb_reverb = 100;
4738 }
4739
4740 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4741
4742 /* this makes sure we catch the request pcd */
4743 if (seq_num == smb_reverb) {
4744 cur_pcd = &req->pcd;
4745 } else {
4746 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4747 cur_pcd = &local_pcd;
4748 }
4749
4750 SSVAL(req->outbuf,smb_vwv0,seq_num);
4751
4752 show_msg((char *)req->outbuf);
4753 if (!srv_send_smb(smbd_server_fd(),
4754 (char *)req->outbuf,
4755 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4756 cur_pcd))
4757 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4758 }
4759
4760 DEBUG(3,("echo %d times\n", smb_reverb));
4761
4762 TALLOC_FREE(req->outbuf);
4763
4764 END_PROFILE(SMBecho);
4765 return;
4766 }
4767
4768 /****************************************************************************
4769 Reply to a printopen.
4770 ****************************************************************************/
4771
4772 void reply_printopen(struct smb_request *req)
4773 {
4774 connection_struct *conn = req->conn;
4775 files_struct *fsp;
4776 SMB_STRUCT_STAT sbuf;
4777 NTSTATUS status;
4778
4779 START_PROFILE(SMBsplopen);
4780
4781 if (req->wct < 2) {
4782 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4783 END_PROFILE(SMBsplopen);
4784 return;
4785 }
4786
4787 if (!CAN_PRINT(conn)) {
4788 reply_doserror(req, ERRDOS, ERRnoaccess);
4789 END_PROFILE(SMBsplopen);
4790 return;
4791 }
4792
4793 status = file_new(req, conn, &fsp);
4794 if(!NT_STATUS_IS_OK(status)) {
4795 reply_nterror(req, status);
4796 END_PROFILE(SMBsplopen);
4797 return;
4798 }
4799
4800 /* Open for exclusive use, write only. */
4801 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4802
4803 if (!NT_STATUS_IS_OK(status)) {
4804 reply_nterror(req, status);
4805 END_PROFILE(SMBsplopen);
4806 return;
4807 }
4808
4809 reply_outbuf(req, 1, 0);
4810 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4811
4812 DEBUG(3,("openprint fd=%d fnum=%d\n",
4813 fsp->fh->fd, fsp->fnum));
4814
4815 END_PROFILE(SMBsplopen);
4816 return;
4817 }
4818
4819 /****************************************************************************
4820 Reply to a printclose.
4821 ****************************************************************************/
4822
4823 void reply_printclose(struct smb_request *req)
4824 {
4825 connection_struct *conn = req->conn;
4826 files_struct *fsp;
4827 NTSTATUS status;
4828
4829 START_PROFILE(SMBsplclose);
4830
4831 if (req->wct < 1) {
4832 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4833 END_PROFILE(SMBsplclose);
4834 return;
4835 }
4836
4837 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4838
4839 if (!check_fsp(conn, req, fsp)) {
4840 END_PROFILE(SMBsplclose);
4841 return;
4842 }
4843
4844 if (!CAN_PRINT(conn)) {
4845 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4846 END_PROFILE(SMBsplclose);
4847 return;
4848 }
4849
4850 DEBUG(3,("printclose fd=%d fnum=%d\n",
4851 fsp->fh->fd,fsp->fnum));
4852
4853 status = close_file(req, fsp, NORMAL_CLOSE);
4854
4855 if(!NT_STATUS_IS_OK(status)) {
4856 reply_nterror(req, status);
4857 END_PROFILE(SMBsplclose);
4858 return;
4859 }
4860
4861 reply_outbuf(req, 0, 0);
4862
4863 END_PROFILE(SMBsplclose);
4864 return;
4865 }
4866
4867 /****************************************************************************
4868 Reply to a printqueue.
4869 ****************************************************************************/
4870
4871 void reply_printqueue(struct smb_request *req)
4872 {
4873 connection_struct *conn = req->conn;
4874 int max_count;
4875 int start_index;
4876
4877 START_PROFILE(SMBsplretq);
4878
4879 if (req->wct < 2) {
4880 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4881 END_PROFILE(SMBsplretq);
4882 return;
4883 }
4884
4885 max_count = SVAL(req->vwv+0, 0);
4886 start_index = SVAL(req->vwv+1, 0);
4887
4888 /* we used to allow the client to get the cnum wrong, but that
4889 is really quite gross and only worked when there was only
4890 one printer - I think we should now only accept it if they
4891 get it right (tridge) */
4892 if (!CAN_PRINT(conn)) {
4893 reply_doserror(req, ERRDOS, ERRnoaccess);
4894 END_PROFILE(SMBsplretq);
4895 return;
4896 }
4897
4898 reply_outbuf(req, 2, 3);
4899 SSVAL(req->outbuf,smb_vwv0,0);
4900 SSVAL(req->outbuf,smb_vwv1,0);
4901 SCVAL(smb_buf(req->outbuf),0,1);
4902 SSVAL(smb_buf(req->outbuf),1,0);
4903
4904 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4905 start_index, max_count));
4906
4907 {
4908 print_queue_struct *queue = NULL;
4909 print_status_struct status;
4910 int count = print_queue_status(SNUM(conn), &queue, &status);
4911 int num_to_get = ABS(max_count);
4912 int first = (max_count>0?start_index:start_index+max_count+1);
4913 int i;
4914
4915 if (first >= count)
4916 num_to_get = 0;
4917 else
4918 num_to_get = MIN(num_to_get,count-first);
4919
4920
4921 for (i=first;i<first+num_to_get;i++) {
4922 char blob[28];
4923 char *p = blob;
4924
4925 srv_put_dos_date2(p,0,queue[i].time);
4926 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4927 SSVAL(p,5, queue[i].job);
4928 SIVAL(p,7,queue[i].size);
4929 SCVAL(p,11,0);
4930 srvstr_push(blob, req->flags2, p+12,
4931 queue[i].fs_user, 16, STR_ASCII);
4932
4933 if (message_push_blob(
4934 &req->outbuf,
4935 data_blob_const(
4936 blob, sizeof(blob))) == -1) {
4937 reply_nterror(req, NT_STATUS_NO_MEMORY);
4938 END_PROFILE(SMBsplretq);
4939 return;
4940 }
4941 }
4942
4943 if (count > 0) {
4944 SSVAL(req->outbuf,smb_vwv0,count);
4945 SSVAL(req->outbuf,smb_vwv1,
4946 (max_count>0?first+count:first-1));
4947 SCVAL(smb_buf(req->outbuf),0,1);
4948 SSVAL(smb_buf(req->outbuf),1,28*count);
4949 }
4950
4951 SAFE_FREE(queue);
4952
4953 DEBUG(3,("%d entries returned in queue\n",count));
4954 }
4955
4956 END_PROFILE(SMBsplretq);
4957 return;
4958 }
4959
4960 /****************************************************************************
4961 Reply to a printwrite.
4962 ****************************************************************************/
4963
4964 void reply_printwrite(struct smb_request *req)
4965 {
4966 connection_struct *conn = req->conn;
4967 int numtowrite;
4968 const char *data;
4969 files_struct *fsp;
4970
4971 START_PROFILE(SMBsplwr);
4972
4973 if (req->wct < 1) {
4974 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4975 END_PROFILE(SMBsplwr);
4976 return;
4977 }
4978
4979 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4980
4981 if (!check_fsp(conn, req, fsp)) {
4982 END_PROFILE(SMBsplwr);
4983 return;
4984 }
4985
4986 if (!CAN_PRINT(conn)) {
4987 reply_doserror(req, ERRDOS, ERRnoaccess);
4988 END_PROFILE(SMBsplwr);
4989 return;
4990 }
4991
4992 if (!CHECK_WRITE(fsp)) {
4993 reply_doserror(req, ERRDOS, ERRbadaccess);
4994 END_PROFILE(SMBsplwr);
4995 return;
4996 }
4997
4998 numtowrite = SVAL(req->buf, 1);
4999
5000 if (req->buflen < numtowrite + 3) {
5001 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5002 END_PROFILE(SMBsplwr);
5003 return;
5004 }
5005
5006 data = (const char *)req->buf + 3;
5007
5008 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5009 reply_unixerror(req, ERRHRD, ERRdiskfull);
5010 END_PROFILE(SMBsplwr);
5011 return;
5012 }
5013
5014 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5015
5016 END_PROFILE(SMBsplwr);
5017 return;
5018 }
5019
5020 /****************************************************************************
5021 Reply to a mkdir.
5022 ****************************************************************************/
5023
5024 void reply_mkdir(struct smb_request *req)
5025 {
5026 connection_struct *conn = req->conn;
5027 char *directory = NULL;
5028 NTSTATUS status;
5029 SMB_STRUCT_STAT sbuf;
5030 TALLOC_CTX *ctx = talloc_tos();
5031
5032 START_PROFILE(SMBmkdir);
5033
5034 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5035 STR_TERMINATE, &status);
5036 if (!NT_STATUS_IS_OK(status)) {
5037 reply_nterror(req, status);
5038 END_PROFILE(SMBmkdir);
5039 return;
5040 }
5041
5042 status = resolve_dfspath(ctx, conn,
5043 req->flags2 & FLAGS2_DFS_PATHNAMES,
5044 directory,
5045 &directory);
5046 if (!NT_STATUS_IS_OK(status)) {
5047 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5048 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5049 ERRSRV, ERRbadpath);
5050 END_PROFILE(SMBmkdir);
5051 return;
5052 }
5053 reply_nterror(req, status);
5054 END_PROFILE(SMBmkdir);
5055 return;
5056 }
5057
5058 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
5059 if (!NT_STATUS_IS_OK(status)) {
5060 reply_nterror(req, status);
5061 END_PROFILE(SMBmkdir);
5062 return;
5063 }
5064
5065 status = check_name(conn, directory);
5066 if (!NT_STATUS_IS_OK(status)) {
5067 reply_nterror(req, status);
5068 END_PROFILE(SMBmkdir);
5069 return;
5070 }
5071
5072 status = create_directory(conn, req, directory);
5073
5074 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5075
5076 if (!NT_STATUS_IS_OK(status)) {
5077
5078 if (!use_nt_status()
5079 && NT_STATUS_EQUAL(status,
5080 NT_STATUS_OBJECT_NAME_COLLISION)) {
5081 /*
5082 * Yes, in the DOS error code case we get a
5083 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5084 * samba4 torture test.
5085 */
5086 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5087 }
5088
5089 reply_nterror(req, status);
5090 END_PROFILE(SMBmkdir);
5091 return;
5092 }
5093
5094 reply_outbuf(req, 0, 0);
5095
5096 DEBUG( 3, ( "mkdir %s\n", directory ) );
5097
5098 END_PROFILE(SMBmkdir);
5099 return;
5100 }
5101
5102 /****************************************************************************
5103 Static function used by reply_rmdir to delete an entire directory
5104 tree recursively. Return True on ok, False on fail.
5105 ****************************************************************************/
5106
5107 static bool recursive_rmdir(TALLOC_CTX *ctx,
5108 connection_struct *conn,
5109 char *directory)
5110 {
5111 const char *dname = NULL;
5112 bool ret = True;
5113 long offset = 0;
5114 SMB_STRUCT_STAT st;
5115 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5116 NULL, 0);
5117
5118 if(dir_hnd == NULL)
5119 return False;
5120
5121 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5122 char *fullname = NULL;
5123
5124 if (ISDOT(dname) || ISDOTDOT(dname)) {
5125 continue;
5126 }
5127
5128 if (!is_visible_file(conn, directory, dname, &st, False)) {
5129 continue;
5130 }
5131
5132 /* Construct the full name. */
5133 fullname = talloc_asprintf(ctx,
5134 "%s/%s",
5135 directory,
5136 dname);
5137 if (!fullname) {
5138 errno = ENOMEM;
5139 ret = False;
5140 break;
5141 }
5142
5143 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5144 ret = False;
5145 break;
5146 }
5147
5148 if(st.st_mode & S_IFDIR) {
5149 if(!recursive_rmdir(ctx, conn, fullname)) {
5150 ret = False;
5151 break;
5152 }
5153 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5154 ret = False;
5155 break;
5156 }
5157 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5158 ret = False;
5159 break;
5160 }
5161 TALLOC_FREE(fullname);
5162 }
5163 TALLOC_FREE(dir_hnd);
5164 return ret;
5165 }
5166
5167 /****************************************************************************
5168 The internals of the rmdir code - called elsewhere.
5169 ****************************************************************************/
5170
5171 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5172 connection_struct *conn,
5173 const char *directory)
5174 {
5175 int ret;
5176 SMB_STRUCT_STAT st;
5177
5178 /* Might be a symlink. */
5179 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5180 return map_nt_error_from_unix(errno);
5181 }
5182
5183 if (S_ISLNK(st.st_mode)) {
5184 /* Is what it points to a directory ? */
5185 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5186 return map_nt_error_from_unix(errno);
5187 }
5188 if (!(S_ISDIR(st.st_mode))) {
5189 return NT_STATUS_NOT_A_DIRECTORY;
5190 }
5191 ret = SMB_VFS_UNLINK(conn,directory);
5192 } else {
5193 ret = SMB_VFS_RMDIR(conn,directory);
5194 }
5195 if (ret == 0) {
5196 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5197 FILE_NOTIFY_CHANGE_DIR_NAME,
5198 directory);
5199 return NT_STATUS_OK;
5200 }
5201
5202 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5203 /*
5204 * Check to see if the only thing in this directory are
5205 * vetoed files/directories. If so then delete them and
5206 * retry. If we fail to delete any of them (and we *don't*
5207 * do a recursive delete) then fail the rmdir.
5208 */
5209 const char *dname;
5210 long dirpos = 0;
5211 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5212 directory, NULL, 0);
5213
5214 if(dir_hnd == NULL) {
5215 errno = ENOTEMPTY;
5216 goto err;
5217 }
5218
5219 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5220 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5221 continue;
5222 if (!is_visible_file(conn, directory, dname, &st, False))
5223 continue;
5224 if(!IS_VETO_PATH(conn, dname)) {
5225 TALLOC_FREE(dir_hnd);
5226 errno = ENOTEMPTY;
5227 goto err;
5228 }
5229 }
5230
5231 /* We only have veto files/directories.
5232 * Are we allowed to delete them ? */
5233
5234 if(!lp_recursive_veto_delete(SNUM(conn))) {
5235 TALLOC_FREE(dir_hnd);
5236 errno = ENOTEMPTY;
5237 goto err;
5238 }
5239
5240 /* Do a recursive delete. */
5241 RewindDir(dir_hnd,&dirpos);
5242 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5243 char *fullname = NULL;
5244
5245 if (ISDOT(dname) || ISDOTDOT(dname)) {
5246 continue;
5247 }
5248 if (!is_visible_file(conn, directory, dname, &st, False)) {
5249 continue;
5250 }
5251
5252 fullname = talloc_asprintf(ctx,
5253 "%s/%s",
5254 directory,
5255 dname);
5256
5257 if(!fullname) {
5258 errno = ENOMEM;
5259 break;
5260 }
5261
5262 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5263 break;
5264 }
5265 if(st.st_mode & S_IFDIR) {
5266 if(!recursive_rmdir(ctx, conn, fullname)) {
5267 break;
5268 }
5269 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5270 break;
5271 }
5272 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5273 break;
5274 }
5275 TALLOC_FREE(fullname);
5276 }
5277 TALLOC_FREE(dir_hnd);
5278 /* Retry the rmdir */
5279 ret = SMB_VFS_RMDIR(conn,directory);
5280 }
5281
5282 err:
5283
5284 if (ret != 0) {
5285 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5286 "%s\n", directory,strerror(errno)));
5287 return map_nt_error_from_unix(errno);
5288 }
5289
5290 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5291 FILE_NOTIFY_CHANGE_DIR_NAME,
5292 directory);
5293
5294 return NT_STATUS_OK;
5295 }
5296
5297 /****************************************************************************
5298 Reply to a rmdir.
5299 ****************************************************************************/
5300
5301 void reply_rmdir(struct smb_request *req)
5302 {
5303 connection_struct *conn = req->conn;
5304 char *directory = NULL;
5305 SMB_STRUCT_STAT sbuf;
5306 NTSTATUS status;
5307 TALLOC_CTX *ctx = talloc_tos();
5308
5309 START_PROFILE(SMBrmdir);
5310
5311 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5312 STR_TERMINATE, &status);
5313 if (!NT_STATUS_IS_OK(status)) {
5314 reply_nterror(req, status);
5315 END_PROFILE(SMBrmdir);
5316 return;
5317 }
5318
5319 status = resolve_dfspath(ctx, conn,
5320 req->flags2 & FLAGS2_DFS_PATHNAMES,
5321 directory,
5322 &directory);
5323 if (!NT_STATUS_IS_OK(status)) {
5324 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5325 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5326 ERRSRV, ERRbadpath);
5327 END_PROFILE(SMBrmdir);
5328 return;
5329 }
5330 reply_nterror(req, status);
5331 END_PROFILE(SMBrmdir);
5332 return;
5333 }
5334
5335 status = unix_convert(ctx, conn, directory, False, &directory,
5336 NULL, &sbuf);
5337 if (!NT_STATUS_IS_OK(status)) {
5338 reply_nterror(req, status);
5339 END_PROFILE(SMBrmdir);
5340 return;
5341 }
5342
5343 status = check_name(conn, directory);
5344 if (!NT_STATUS_IS_OK(status)) {
5345 reply_nterror(req, status);
5346 END_PROFILE(SMBrmdir);
5347 return;
5348 }
5349
5350 dptr_closepath(directory, req->smbpid);
5351 status = rmdir_internals(ctx, conn, directory);
5352 if (!NT_STATUS_IS_OK(status)) {
5353 reply_nterror(req, status);
5354 END_PROFILE(SMBrmdir);
5355 return;
5356 }
5357
5358 reply_outbuf(req, 0, 0);
5359
5360 DEBUG( 3, ( "rmdir %s\n", directory ) );
5361
5362 END_PROFILE(SMBrmdir);
5363 return;
5364 }
5365
5366 /*******************************************************************
5367 Resolve wildcards in a filename rename.
5368 ********************************************************************/
5369
5370 static bool resolve_wildcards(TALLOC_CTX *ctx,
5371 const char *name1,
5372 const char *name2,
5373 char **pp_newname)
5374 {
5375 char *name2_copy = NULL;
5376 char *root1 = NULL;
5377 char *root2 = NULL;
5378 char *ext1 = NULL;
5379 char *ext2 = NULL;
5380 char *p,*p2, *pname1, *pname2;
5381
5382 name2_copy = talloc_strdup(ctx, name2);
5383 if (!name2_copy) {
5384 return False;
5385 }
5386
5387 pname1 = strrchr_m(name1,'/');
5388 pname2 = strrchr_m(name2_copy,'/');
5389
5390 if (!pname1 || !pname2) {
5391 return False;
5392 }
5393
5394 /* Truncate the copy of name2 at the last '/' */
5395 *pname2 = '\0';
5396
5397 /* Now go past the '/' */
5398 pname1++;
5399 pname2++;
5400
5401 root1 = talloc_strdup(ctx, pname1);
5402 root2 = talloc_strdup(ctx, pname2);
5403
5404 if (!root1 || !root2) {
5405 return False;
5406 }
5407
5408 p = strrchr_m(root1,'.');
5409 if (p) {
5410 *p = 0;
5411 ext1 = talloc_strdup(ctx, p+1);
5412 } else {
5413 ext1 = talloc_strdup(ctx, "");
5414 }
5415 p = strrchr_m(root2,'.');
5416 if (p) {
5417 *p = 0;
5418 ext2 = talloc_strdup(ctx, p+1);
5419 } else {
5420 ext2 = talloc_strdup(ctx, "");
5421 }
5422
5423 if (!ext1 || !ext2) {
5424 return False;
5425 }
5426
5427 p = root1;
5428 p2 = root2;
5429 while (*p2) {
5430 if (*p2 == '?') {
5431 /* Hmmm. Should this be mb-aware ? */
5432 *p2 = *p;
5433 p2++;
5434 } else if (*p2 == '*') {
5435 *p2 = '\0';
5436 root2 = talloc_asprintf(ctx, "%s%s",
5437 root2,
5438 p);
5439 if (!root2) {
5440 return False;
5441 }
5442 break;
5443 } else {
5444 p2++;
5445 }
5446 if (*p) {
5447 p++;
5448 }
5449 }
5450
5451 p = ext1;
5452 p2 = ext2;
5453 while (*p2) {
5454 if (*p2 == '?') {
5455 /* Hmmm. Should this be mb-aware ? */
5456 *p2 = *p;
5457 p2++;
5458 } else if (*p2 == '*') {
5459 *p2 = '\0';
5460 ext2 = talloc_asprintf(ctx, "%s%s",
5461 ext2,
5462 p);
5463 if (!ext2) {
5464 return False;
5465 }
5466 break;
5467 } else {
5468 p2++;
5469 }
5470 if (*p) {
5471 p++;
5472 }
5473 }
5474
5475 if (*ext2) {
5476 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5477 name2_copy,
5478 root2,
5479 ext2);
5480 } else {
5481 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5482 name2_copy,
5483 root2);
5484 }
5485
5486 if (!*pp_newname) {
5487 return False;
5488 }
5489
5490 return True;
5491 }
5492
5493 /****************************************************************************
5494 Ensure open files have their names updated. Updated to notify other smbd's
5495 asynchronously.
5496 ****************************************************************************/
5497
5498 static void rename_open_files(connection_struct *conn,
5499 struct share_mode_lock *lck,
5500 const char *newname)
5501 {
5502 files_struct *fsp;
5503 bool did_rename = False;
5504
5505 for(fsp = file_find_di_first(lck->id); fsp;
5506 fsp = file_find_di_next(fsp)) {
5507 /* fsp_name is a relative path under the fsp. To change this for other
5508 sharepaths we need to manipulate relative paths. */
5509 /* TODO - create the absolute path and manipulate the newname
5510 relative to the sharepath. */
5511 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5512 continue;
5513 }
5514 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5515 fsp->fnum, file_id_string_tos(&fsp->file_id),
5516 fsp->fsp_name, newname ));
5517 string_set(&fsp->fsp_name, newname);
5518 did_rename = True;
5519 }
5520
5521 if (!did_rename) {
5522 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5523 file_id_string_tos(&lck->id), newname ));
5524 }
5525
5526 /* Send messages to all smbd's (not ourself) that the name has changed. */
5527 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5528 newname);
5529 }
5530
5531 /****************************************************************************
5532 We need to check if the source path is a parent directory of the destination
5533 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5534 refuse the rename with a sharing violation. Under UNIX the above call can
5535 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5536 probably need to check that the client is a Windows one before disallowing
5537 this as a UNIX client (one with UNIX extensions) can know the source is a
5538 symlink and make this decision intelligently. Found by an excellent bug
5539 report from <AndyLiebman@aol.com>.
5540 ****************************************************************************/
5541
5542 static bool rename_path_prefix_equal(const char *src, const char *dest)
5543 {
5544 const char *psrc = src;
5545 const char *pdst = dest;
5546 size_t slen;
5547
5548 if (psrc[0] == '.' && psrc[1] == '/') {
5549 psrc += 2;
5550 }
5551 if (pdst[0] == '.' && pdst[1] == '/') {
5552 pdst += 2;
5553 }
5554 if ((slen = strlen(psrc)) > strlen(pdst)) {
5555 return False;
5556 }
5557 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5558 }
5559
5560 /*
5561 * Do the notify calls from a rename
5562 */
5563
5564 static void notify_rename(connection_struct *conn, bool is_dir,
5565 const char *oldpath, const char *newpath)
5566 {
5567 char *olddir, *newdir;
5568 const char *oldname, *newname;
5569 uint32 mask;
5570
5571 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5572 : FILE_NOTIFY_CHANGE_FILE_NAME;
5573
5574 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5575 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5576 TALLOC_FREE(olddir);
5577 return;
5578 }
5579
5580 if (strcmp(olddir, newdir) == 0) {
5581 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5582 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5583 }
5584 else {
5585 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5586 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5587 }
5588 TALLOC_FREE(olddir);
5589 TALLOC_FREE(newdir);
5590
5591 /* this is a strange one. w2k3 gives an additional event for
5592 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5593 files, but not directories */
5594 if (!is_dir) {
5595 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5596 FILE_NOTIFY_CHANGE_ATTRIBUTES
5597 |FILE_NOTIFY_CHANGE_CREATION,
5598 newpath);
5599 }
5600 }
5601
5602 /****************************************************************************
5603 Rename an open file - given an fsp.
5604 ****************************************************************************/
5605
5606 NTSTATUS rename_internals_fsp(connection_struct *conn,
5607 files_struct *fsp,
5608 char *newname,
5609 const char *newname_last_component,
5610 uint32 attrs,
5611 bool replace_if_exists)
5612 {
5613 TALLOC_CTX *ctx = talloc_tos();
5614 SMB_STRUCT_STAT sbuf, sbuf1;
5615 NTSTATUS status = NT_STATUS_OK;
5616 struct share_mode_lock *lck = NULL;
5617 bool dst_exists, old_is_stream, new_is_stream;
5618
5619 ZERO_STRUCT(sbuf);
5620
5621 status = check_name(conn, newname);
5622 if (!NT_STATUS_IS_OK(status)) {
5623 return status;
5624 }
5625
5626 /* Ensure newname contains a '/' */
5627 if(strrchr_m(newname,'/') == 0) {
5628 newname = talloc_asprintf(ctx,
5629 "./%s",
5630 newname);
5631 if (!newname) {
5632 return NT_STATUS_NO_MEMORY;
5633 }
5634 }
5635
5636 /*
5637 * Check for special case with case preserving and not
5638 * case sensitive. If the old last component differs from the original
5639 * last component only by case, then we should allow
5640 * the rename (user is trying to change the case of the
5641 * filename).
5642 */
5643
5644 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5645 strequal(newname, fsp->fsp_name)) {
5646 char *p;
5647 char *newname_modified_last_component = NULL;
5648
5649 /*
5650 * Get the last component of the modified name.
5651 * Note that we guarantee that newname contains a '/'
5652 * character above.
5653 */
5654 p = strrchr_m(newname,'/');
5655 newname_modified_last_component = talloc_strdup(ctx,
5656 p+1);
5657 if (!newname_modified_last_component) {
5658 return NT_STATUS_NO_MEMORY;
5659 }
5660
5661 if(strcsequal(newname_modified_last_component,
5662 newname_last_component) == False) {
5663 /*
5664 * Replace the modified last component with
5665 * the original.
5666 */
5667 *p = '\0'; /* Truncate at the '/' */
5668 newname = talloc_asprintf(ctx,
5669 "%s/%s",
5670 newname,
5671 newname_last_component);
5672 }
5673 }
5674
5675 /*
5676 * If the src and dest names are identical - including case,
5677 * don't do the rename, just return success.
5678 */
5679
5680 if (strcsequal(fsp->fsp_name, newname)) {
5681 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5682 newname));
5683 return NT_STATUS_OK;
5684 }
5685
5686 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5687 new_is_stream = is_ntfs_stream_name(newname);
5688
5689 /* Return the correct error code if both names aren't streams. */
5690 if (!old_is_stream && new_is_stream) {
5691 return NT_STATUS_OBJECT_NAME_INVALID;
5692 }
5693
5694 if (old_is_stream && !new_is_stream) {
5695 return NT_STATUS_INVALID_PARAMETER;
5696 }
5697
5698 /*
5699 * Have vfs_object_exist also fill sbuf1
5700 */
5701 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5702
5703 if(!replace_if_exists && dst_exists) {
5704 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5705 fsp->fsp_name,newname));
5706 return NT_STATUS_OBJECT_NAME_COLLISION;
5707 }
5708
5709 if (dst_exists) {
5710 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5711 files_struct *dst_fsp = file_find_di_first(fileid);
5712 /* The file can be open when renaming a stream */
5713 if (dst_fsp && !new_is_stream) {
5714 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5715 return NT_STATUS_ACCESS_DENIED;
5716 }
5717 }
5718
5719 /* Ensure we have a valid stat struct for the source. */
5720 if (fsp->fh->fd != -1) {
5721 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5722 return map_nt_error_from_unix(errno);
5723 }
5724 } else {
5725 int ret = -1;
5726 if (fsp->posix_open) {
5727 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5728 } else {
5729 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5730 }
5731 if (ret == -1) {
5732 return map_nt_error_from_unix(errno);
5733 }
5734 }
5735
5736 status = can_rename(conn, fsp, attrs, &sbuf);
5737
5738 if (!NT_STATUS_IS_OK(status)) {
5739 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5740 nt_errstr(status), fsp->fsp_name,newname));
5741 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5742 status = NT_STATUS_ACCESS_DENIED;
5743 return status;
5744 }
5745
5746 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5747 return NT_STATUS_ACCESS_DENIED;
5748 }
5749
5750 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5751 NULL);
5752
5753 /*
5754 * We have the file open ourselves, so not being able to get the
5755 * corresponding share mode lock is a fatal error.
5756 */
5757
5758 SMB_ASSERT(lck != NULL);
5759
5760 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5761 uint32 create_options = fsp->fh->private_options;
5762
5763 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5764 fsp->fsp_name,newname));
5765
5766 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5767
5768 rename_open_files(conn, lck, newname);
5769
5770 /*
5771 * A rename acts as a new file create w.r.t. allowing an initial delete
5772 * on close, probably because in Windows there is a new handle to the
5773 * new file. If initial delete on close was requested but not
5774 * originally set, we need to set it here. This is probably not 100% correct,
5775 * but will work for the CIFSFS client which in non-posix mode
5776 * depends on these semantics. JRA.
5777 */
5778
5779 if (create_options & FILE_DELETE_ON_CLOSE) {
5780 status = can_set_delete_on_close(fsp, True, 0);
5781
5782 if (NT_STATUS_IS_OK(status)) {
5783 /* Note that here we set the *inital* delete on close flag,
5784 * not the regular one. The magic gets handled in close. */
5785 fsp->initial_delete_on_close = True;
5786 }
5787 }
5788 TALLOC_FREE(lck);
5789 return NT_STATUS_OK;
5790 }
5791
5792 TALLOC_FREE(lck);
5793
5794 if (errno == ENOTDIR || errno == EISDIR) {
5795 status = NT_STATUS_OBJECT_NAME_COLLISION;
5796 } else {
5797 status = map_nt_error_from_unix(errno);
5798 }
5799
5800 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5801 nt_errstr(status), fsp->fsp_name,newname));
5802
5803 return status;
5804 }
5805
5806 /****************************************************************************
5807 The guts of the rename command, split out so it may be called by the NT SMB
5808 code.
5809 ****************************************************************************/
5810
5811 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5812 connection_struct *conn,
5813 struct smb_request *req,
5814 const char *name_in,
5815 const char *newname_in,
5816 uint32 attrs,
5817 bool replace_if_exists,
5818 bool src_has_wild,
5819 bool dest_has_wild,
5820 uint32_t access_mask)
5821 {
5822 char *directory = NULL;
5823 char *mask = NULL;
5824 char *last_component_src = NULL;
5825 char *last_component_dest = NULL;
5826 char *name = NULL;
5827 char *newname = NULL;
5828 char *p;
5829 int count=0;
5830 NTSTATUS status = NT_STATUS_OK;
5831 SMB_STRUCT_STAT sbuf1, sbuf2;
5832 struct smb_Dir *dir_hnd = NULL;
5833 const char *dname;
5834 long offset = 0;
5835 int create_options = 0;
5836 bool posix_pathnames = lp_posix_pathnames();
5837
5838 ZERO_STRUCT(sbuf1);
5839 ZERO_STRUCT(sbuf2);
5840
5841 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5842 &last_component_src, &sbuf1);
5843 if (!NT_STATUS_IS_OK(status)) {
5844 return status;
5845 }
5846
5847 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5848 &last_component_dest, &sbuf2);
5849 if (!NT_STATUS_IS_OK(status)) {
5850 return status;
5851 }
5852
5853 /*
5854 * Split the old name into directory and last component
5855 * strings. Note that unix_convert may have stripped off a
5856 * leading ./ from both name and newname if the rename is
5857 * at the root of the share. We need to make sure either both
5858 * name and newname contain a / character or neither of them do
5859 * as this is checked in resolve_wildcards().
5860 */
5861
5862 p = strrchr_m(name,'/');
5863 if (!p) {
5864 directory = talloc_strdup(ctx, ".");
5865 if (!directory) {
5866 return NT_STATUS_NO_MEMORY;
5867 }
5868 mask = name;
5869 } else {
5870 *p = 0;
5871 directory = talloc_strdup(ctx, name);
5872 if (!directory) {
5873 return NT_STATUS_NO_MEMORY;
5874 }
5875 mask = p+1;
5876 *p = '/'; /* Replace needed for exceptional test below. */
5877 }
5878
5879 /*
5880 * We should only check the mangled cache
5881 * here if unix_convert failed. This means
5882 * that the path in 'mask' doesn't exist
5883 * on the file system and so we need to look
5884 * for a possible mangle. This patch from
5885 * Tine Smukavec <valentin.smukavec@hermes.si>.
5886 */
5887
5888 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5889 char *new_mask = NULL;
5890 mangle_lookup_name_from_8_3(ctx,
5891 mask,
5892 &new_mask,
5893 conn->params );
5894 if (new_mask) {
5895 mask = new_mask;
5896 }
5897 }
5898
5899 if (!src_has_wild) {
5900 files_struct *fsp;
5901
5902 /*
5903 * No wildcards - just process the one file.
5904 */
5905 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5906
5907 /* Add a terminating '/' to the directory name. */
5908 directory = talloc_asprintf_append(directory,
5909 "/%s",
5910 mask);
5911 if (!directory) {
5912 return NT_STATUS_NO_MEMORY;
5913 }
5914
5915 /* Ensure newname contains a '/' also */
5916 if(strrchr_m(newname,'/') == 0) {
5917 newname = talloc_asprintf(ctx,
5918 "./%s",
5919 newname);
5920 if (!newname) {
5921 return NT_STATUS_NO_MEMORY;
5922 }
5923 }
5924
5925 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5926 "case_preserve = %d, short case preserve = %d, "
5927 "directory = %s, newname = %s, "
5928 "last_component_dest = %s, is_8_3 = %d\n",
5929 conn->case_sensitive, conn->case_preserve,
5930 conn->short_case_preserve, directory,
5931 newname, last_component_dest, is_short_name));
5932
5933 /* The dest name still may have wildcards. */
5934 if (dest_has_wild) {
5935 char *mod_newname = NULL;
5936 if (!resolve_wildcards(ctx,
5937 directory,newname,&mod_newname)) {
5938 DEBUG(6, ("rename_internals: resolve_wildcards "
5939 "%s %s failed\n",
5940 directory,
5941 newname));
5942 return NT_STATUS_NO_MEMORY;
5943 }
5944 newname = mod_newname;
5945 }
5946
5947 ZERO_STRUCT(sbuf1);
5948 if (posix_pathnames) {
5949 SMB_VFS_LSTAT(conn, directory, &sbuf1);
5950 } else {
5951 SMB_VFS_STAT(conn, directory, &sbuf1);
5952 }
5953
5954 if (S_ISDIR(sbuf1.st_mode)) {
5955 create_options |= FILE_DIRECTORY_FILE;
5956 }
5957
5958 status = SMB_VFS_CREATE_FILE(
5959 conn, /* conn */
5960 req, /* req */
5961 0, /* root_dir_fid */
5962 directory, /* fname */
5963 0, /* create_file_flags */
5964 access_mask, /* access_mask */
5965 (FILE_SHARE_READ | /* share_access */
5966 FILE_SHARE_WRITE),
5967 FILE_OPEN, /* create_disposition*/
5968 create_options, /* create_options */
5969 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
5970 0, /* oplock_request */
5971 0, /* allocation_size */
5972 NULL, /* sd */
5973 NULL, /* ea_list */
5974 &fsp, /* result */
5975 NULL, /* pinfo */
5976 &sbuf1); /* psbuf */
5977
5978 if (!NT_STATUS_IS_OK(status)) {
5979 DEBUG(3, ("Could not open rename source %s: %s\n",
5980 directory, nt_errstr(status)));
5981 return status;
5982 }
5983
5984 status = rename_internals_fsp(conn, fsp, newname,
5985 last_component_dest,
5986 attrs, replace_if_exists);
5987
5988 close_file(req, fsp, NORMAL_CLOSE);
5989
5990 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5991 nt_errstr(status), directory,newname));
5992
5993 return status;
5994 }
5995
5996 /*
5997 * Wildcards - process each file that matches.
5998 */
5999 if (strequal(mask,"????????.???")) {
6000 mask[0] = '*';
6001 mask[1] = '\0';
6002 }
6003
6004 status = check_name(conn, directory);
6005 if (!NT_STATUS_IS_OK(status)) {
6006 return status;
6007 }
6008
6009 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
6010 if (dir_hnd == NULL) {
6011 return map_nt_error_from_unix(errno);
6012 }
6013
6014 status = NT_STATUS_NO_SUCH_FILE;
6015 /*
6016 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6017 * - gentest fix. JRA
6018 */
6019
6020 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6021 files_struct *fsp = NULL;
6022 char *fname = NULL;
6023 char *destname = NULL;
6024 bool sysdir_entry = False;
6025
6026 /* Quick check for "." and ".." */
6027 if (ISDOT(dname) || ISDOTDOT(dname)) {
6028 if (attrs & aDIR) {
6029 sysdir_entry = True;
6030 } else {
6031 continue;
6032 }
6033 }
6034
6035 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6036 continue;
6037 }
6038
6039 if(!mask_match(dname, mask, conn->case_sensitive)) {
6040 continue;
6041 }
6042
6043 if (sysdir_entry) {
6044 status = NT_STATUS_OBJECT_NAME_INVALID;
6045 break;
6046 }
6047
6048 fname = talloc_asprintf(ctx,
6049 "%s/%s",
6050 directory,
6051 dname);
6052 if (!fname) {
6053 return NT_STATUS_NO_MEMORY;
6054 }
6055
6056 if (!resolve_wildcards(ctx,
6057 fname,newname,&destname)) {
6058 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6059 fname, destname));
6060 TALLOC_FREE(fname);
6061 continue;
6062 }
6063 if (!destname) {
6064 return NT_STATUS_NO_MEMORY;
6065 }
6066
6067 ZERO_STRUCT(sbuf1);
6068 if (posix_pathnames) {
6069 SMB_VFS_LSTAT(conn, fname, &sbuf1);
6070 } else {
6071 SMB_VFS_STAT(conn, fname, &sbuf1);
6072 }
6073
6074 create_options = 0;
6075
6076 if (S_ISDIR(sbuf1.st_mode)) {
6077 create_options |= FILE_DIRECTORY_FILE;
6078 }
6079
6080 status = SMB_VFS_CREATE_FILE(
6081 conn, /* conn */
6082 req, /* req */
6083 0, /* root_dir_fid */
6084 fname, /* fname */
6085 0, /* create_file_flags */
6086 access_mask, /* access_mask */
6087 (FILE_SHARE_READ | /* share_access */
6088 FILE_SHARE_WRITE),
6089 FILE_OPEN, /* create_disposition*/
6090 create_options, /* create_options */
6091 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6092 0, /* oplock_request */
6093 0, /* allocation_size */
6094 NULL, /* sd */
6095 NULL, /* ea_list */
6096 &fsp, /* result */
6097 NULL, /* pinfo */
6098 &sbuf1); /* psbuf */
6099
6100 if (!NT_STATUS_IS_OK(status)) {
6101 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6102 "returned %s rename %s -> %s\n",
6103 nt_errstr(status), directory, newname));
6104 break;
6105 }
6106
6107 status = rename_internals_fsp(conn, fsp, destname, dname,
6108 attrs, replace_if_exists);
6109
6110 close_file(req, fsp, NORMAL_CLOSE);
6111
6112 if (!NT_STATUS_IS_OK(status)) {
6113 DEBUG(3, ("rename_internals_fsp returned %s for "
6114 "rename %s -> %s\n", nt_errstr(status),
6115 directory, newname));
6116 break;
6117 }
6118
6119 count++;
6120
6121 DEBUG(3,("rename_internals: doing rename on %s -> "
6122 "%s\n",fname,destname));
6123
6124 TALLOC_FREE(fname);
6125 TALLOC_FREE(destname);
6126 }
6127 TALLOC_FREE(dir_hnd);
6128
6129 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6130 status = map_nt_error_from_unix(errno);
6131 }
6132
6133 return status;
6134 }
6135
6136 /****************************************************************************
6137 Reply to a mv.
6138 ****************************************************************************/
6139
6140 void reply_mv(struct smb_request *req)
6141 {
6142 connection_struct *conn = req->conn;
6143 char *name = NULL;
6144 char *newname = NULL;
6145 const char *p;
6146 uint32 attrs;
6147 NTSTATUS status;
6148 bool src_has_wcard = False;
6149 bool dest_has_wcard = False;
6150 TALLOC_CTX *ctx = talloc_tos();
6151
6152 START_PROFILE(SMBmv);
6153
6154 if (req->wct < 1) {
6155 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6156 END_PROFILE(SMBmv);
6157 return;
6158 }
6159
6160 attrs = SVAL(req->vwv+0, 0);
6161
6162 p = (const char *)req->buf + 1;
6163 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6164 &status, &src_has_wcard);
6165 if (!NT_STATUS_IS_OK(status)) {
6166 reply_nterror(req, status);
6167 END_PROFILE(SMBmv);
6168 return;
6169 }
6170 p++;
6171 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6172 &status, &dest_has_wcard);
6173 if (!NT_STATUS_IS_OK(status)) {
6174 reply_nterror(req, status);
6175 END_PROFILE(SMBmv);
6176 return;
6177 }
6178
6179 status = resolve_dfspath_wcard(ctx, conn,
6180 req->flags2 & FLAGS2_DFS_PATHNAMES,
6181 name,
6182 &name,
6183 &src_has_wcard);
6184 if (!NT_STATUS_IS_OK(status)) {
6185 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6186 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6187 ERRSRV, ERRbadpath);
6188 END_PROFILE(SMBmv);
6189 return;
6190 }
6191 reply_nterror(req, status);
6192 END_PROFILE(SMBmv);
6193 return;
6194 }
6195
6196 status = resolve_dfspath_wcard(ctx, conn,
6197 req->flags2 & FLAGS2_DFS_PATHNAMES,
6198 newname,
6199 &newname,
6200 &dest_has_wcard);
6201 if (!NT_STATUS_IS_OK(status)) {
6202 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6203 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6204 ERRSRV, ERRbadpath);
6205 END_PROFILE(SMBmv);
6206 return;
6207 }
6208 reply_nterror(req, status);
6209 END_PROFILE(SMBmv);
6210 return;
6211 }
6212
6213 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6214
6215 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6216 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6217 if (!NT_STATUS_IS_OK(status)) {
6218 if (open_was_deferred(req->mid)) {
6219 /* We have re-scheduled this call. */
6220 END_PROFILE(SMBmv);
6221 return;
6222 }
6223 reply_nterror(req, status);
6224 END_PROFILE(SMBmv);
6225 return;
6226 }
6227
6228 reply_outbuf(req, 0, 0);
6229
6230 END_PROFILE(SMBmv);
6231 return;
6232 }
6233
6234 /*******************************************************************
6235 Copy a file as part of a reply_copy.
6236 ******************************************************************/
6237
6238 /*
6239 * TODO: check error codes on all callers
6240 */
6241
6242 NTSTATUS copy_file(TALLOC_CTX *ctx,
6243 connection_struct *conn,
6244 const char *src,
6245 const char *dest1,
6246 int ofun,
6247 int count,
6248 bool target_is_directory)
6249 {
6250 SMB_STRUCT_STAT src_sbuf, sbuf2;
6251 SMB_OFF_T ret=-1;
6252 files_struct *fsp1,*fsp2;
6253 char *dest = NULL;
6254 uint32 dosattrs;
6255 uint32 new_create_disposition;
6256 NTSTATUS status;
6257
6258 dest = talloc_strdup(ctx, dest1);
6259 if (!dest) {
6260 return NT_STATUS_NO_MEMORY;
6261 }
6262 if (target_is_directory) {
6263 const char *p = strrchr_m(src,'/');
6264 if (p) {
6265 p++;
6266 } else {
6267 p = src;
6268 }
6269 dest = talloc_asprintf_append(dest,
6270 "/%s",
6271 p);
6272 if (!dest) {
6273 return NT_STATUS_NO_MEMORY;
6274 }
6275 }
6276
6277 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6278 TALLOC_FREE(dest);
6279 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6280 }
6281
6282 if (!target_is_directory && count) {
6283 new_create_disposition = FILE_OPEN;
6284 } else {
6285 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6286 NULL, NULL, &new_create_disposition, NULL)) {
6287 TALLOC_FREE(dest);
6288 return NT_STATUS_INVALID_PARAMETER;
6289 }
6290 }
6291
6292 status = SMB_VFS_CREATE_FILE(
6293 conn, /* conn */
6294 NULL, /* req */
6295 0, /* root_dir_fid */
6296 src, /* fname */
6297 0, /* create_file_flags */
6298 FILE_GENERIC_READ, /* access_mask */
6299 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6300 FILE_OPEN, /* create_disposition*/
6301 0, /* create_options */
6302 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6303 INTERNAL_OPEN_ONLY, /* oplock_request */
6304 0, /* allocation_size */
6305 NULL, /* sd */
6306 NULL, /* ea_list */
6307 &fsp1, /* result */
6308 NULL, /* pinfo */
6309 &src_sbuf); /* psbuf */
6310
6311 if (!NT_STATUS_IS_OK(status)) {
6312 TALLOC_FREE(dest);
6313 return status;
6314 }
6315
6316 dosattrs = dos_mode(conn, src, &src_sbuf);
6317 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6318 ZERO_STRUCTP(&sbuf2);
6319 }
6320
6321 status = SMB_VFS_CREATE_FILE(
6322 conn, /* conn */
6323 NULL, /* req */
6324 0, /* root_dir_fid */
6325 dest, /* fname */
6326 0, /* create_file_flags */
6327 FILE_GENERIC_WRITE, /* access_mask */
6328 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6329 new_create_disposition, /* create_disposition*/
6330 0, /* create_options */
6331 dosattrs, /* file_attributes */
6332 INTERNAL_OPEN_ONLY, /* oplock_request */
6333 0, /* allocation_size */
6334 NULL, /* sd */
6335 NULL, /* ea_list */
6336 &fsp2, /* result */
6337 NULL, /* pinfo */
6338 &sbuf2); /* psbuf */
6339
6340 TALLOC_FREE(dest);
6341
6342 if (!NT_STATUS_IS_OK(status)) {
6343 close_file(NULL, fsp1, ERROR_CLOSE);
6344 return status;
6345 }
6346
6347 if ((ofun&3) == 1) {
6348 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6349 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6350 /*
6351 * Stop the copy from occurring.
6352 */
6353 ret = -1;
6354 src_sbuf.st_size = 0;
6355 }
6356 }
6357
6358 if (src_sbuf.st_size) {
6359 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6360 }
6361
6362 close_file(NULL, fsp1, NORMAL_CLOSE);
6363
6364 /* Ensure the modtime is set correctly on the destination file. */
6365 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6366
6367 /*
6368 * As we are opening fsp1 read-only we only expect
6369 * an error on close on fsp2 if we are out of space.
6370 * Thus we don't look at the error return from the
6371 * close of fsp1.
6372 */
6373 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6374
6375 if (!NT_STATUS_IS_OK(status)) {
6376 return status;
6377 }
6378
6379 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6380 return NT_STATUS_DISK_FULL;
6381 }
6382
6383 return NT_STATUS_OK;
6384 }
6385
6386 /****************************************************************************
6387 Reply to a file copy.
6388 ****************************************************************************/
6389
6390 void reply_copy(struct smb_request *req)
6391 {
6392 connection_struct *conn = req->conn;
6393 char *name = NULL;
6394 char *newname = NULL;
6395 char *directory = NULL;
6396 const char *mask = NULL;
6397 const char mask_star[] = "*";
6398 const char *p;
6399 int count=0;
6400 int error = ERRnoaccess;
6401 int err = 0;
6402 int tid2;
6403 int ofun;
6404 int flags;
6405 bool target_is_directory=False;
6406 bool source_has_wild = False;
6407 bool dest_has_wild = False;
6408 SMB_STRUCT_STAT sbuf1, sbuf2;
6409 NTSTATUS status;
6410 TALLOC_CTX *ctx = talloc_tos();
6411
6412 START_PROFILE(SMBcopy);
6413
6414 if (req->wct < 3) {
6415 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6416 END_PROFILE(SMBcopy);
6417 return;
6418 }
6419
6420 tid2 = SVAL(req->vwv+0, 0);
6421 ofun = SVAL(req->vwv+1, 0);
6422 flags = SVAL(req->vwv+2, 0);
6423
6424 p = (const char *)req->buf;
6425 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6426 &status, &source_has_wild);
6427 if (!NT_STATUS_IS_OK(status)) {
6428 reply_nterror(req, status);
6429 END_PROFILE(SMBcopy);
6430 return;
6431 }
6432 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6433 &status, &dest_has_wild);
6434 if (!NT_STATUS_IS_OK(status)) {
6435 reply_nterror(req, status);
6436 END_PROFILE(SMBcopy);
6437 return;
6438 }
6439
6440 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6441
6442 if (tid2 != conn->cnum) {
6443 /* can't currently handle inter share copies XXXX */
6444 DEBUG(3,("Rejecting inter-share copy\n"));
6445 reply_doserror(req, ERRSRV, ERRinvdevice);
6446 END_PROFILE(SMBcopy);
6447 return;
6448 }
6449
6450 status = resolve_dfspath_wcard(ctx, conn,
6451 req->flags2 & FLAGS2_DFS_PATHNAMES,
6452 name,
6453 &name,
6454 &source_has_wild);
6455 if (!NT_STATUS_IS_OK(status)) {
6456 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6457 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6458 ERRSRV, ERRbadpath);
6459 END_PROFILE(SMBcopy);
6460 return;
6461 }
6462 reply_nterror(req, status);
6463 END_PROFILE(SMBcopy);
6464 return;
6465 }
6466
6467 status = resolve_dfspath_wcard(ctx, conn,
6468 req->flags2 & FLAGS2_DFS_PATHNAMES,
6469 newname,
6470 &newname,
6471 &dest_has_wild);
6472 if (!NT_STATUS_IS_OK(status)) {
6473 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6474 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6475 ERRSRV, ERRbadpath);
6476 END_PROFILE(SMBcopy);
6477 return;
6478 }
6479 reply_nterror(req, status);
6480 END_PROFILE(SMBcopy);
6481 return;
6482 }
6483
6484 status = unix_convert(ctx, conn, name, source_has_wild,
6485 &name, NULL, &sbuf1);
6486 if (!NT_STATUS_IS_OK(status)) {
6487 reply_nterror(req, status);
6488 END_PROFILE(SMBcopy);
6489 return;
6490 }
6491
6492 status = unix_convert(ctx, conn, newname, dest_has_wild,
6493 &newname, NULL, &sbuf2);
6494 if (!NT_STATUS_IS_OK(status)) {
6495 reply_nterror(req, status);
6496 END_PROFILE(SMBcopy);
6497 return;
6498 }
6499
6500 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6501
6502 if ((flags&1) && target_is_directory) {
6503 reply_doserror(req, ERRDOS, ERRbadfile);
6504 END_PROFILE(SMBcopy);
6505 return;
6506 }
6507
6508 if ((flags&2) && !target_is_directory) {
6509 reply_doserror(req, ERRDOS, ERRbadpath);
6510 END_PROFILE(SMBcopy);
6511 return;
6512 }
6513
6514 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6515 /* wants a tree copy! XXXX */
6516 DEBUG(3,("Rejecting tree copy\n"));
6517 reply_doserror(req, ERRSRV, ERRerror);
6518 END_PROFILE(SMBcopy);
6519 return;
6520 }
6521
6522 p = strrchr_m(name,'/');
6523 if (p != NULL) {
6524 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6525 mask = p+1;
6526 } else {
6527 directory = talloc_strdup(ctx, "./");
6528 mask = name;
6529 }
6530
6531 if (!directory) {
6532 reply_nterror(req, NT_STATUS_NO_MEMORY);
6533 END_PROFILE(SMBcopy);
6534 return;
6535 }
6536
6537 /*
6538 * We should only check the mangled cache
6539 * here if unix_convert failed. This means
6540 * that the path in 'mask' doesn't exist
6541 * on the file system and so we need to look
6542 * for a possible mangle. This patch from
6543 * Tine Smukavec <valentin.smukavec@hermes.si>.
6544 */
6545
6546 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6547 char *new_mask = NULL;
6548 mangle_lookup_name_from_8_3(ctx,
6549 mask,
6550 &new_mask,
6551 conn->params );
6552 if (new_mask) {
6553 mask = new_mask;
6554 }
6555 }
6556
6557 if (!source_has_wild) {
6558 directory = talloc_asprintf_append(directory,
6559 "/%s",
6560 mask);
6561 if (dest_has_wild) {
6562 char *mod_newname = NULL;
6563 if (!resolve_wildcards(ctx,
6564 directory,newname,&mod_newname)) {
6565 reply_nterror(req, NT_STATUS_NO_MEMORY);
6566 END_PROFILE(SMBcopy);
6567 return;
6568 }
6569 newname = mod_newname;
6570 }
6571
6572 status = check_name(conn, directory);
6573 if (!NT_STATUS_IS_OK(status)) {
6574 reply_nterror(req, status);
6575 END_PROFILE(SMBcopy);
6576 return;
6577 }
6578
6579 status = check_name(conn, newname);
6580 if (!NT_STATUS_IS_OK(status)) {
6581 reply_nterror(req, status);
6582 END_PROFILE(SMBcopy);
6583 return;
6584 }
6585
6586 status = copy_file(ctx,conn,directory,newname,ofun,
6587 count,target_is_directory);
6588
6589 if(!NT_STATUS_IS_OK(status)) {
6590 reply_nterror(req, status);
6591 END_PROFILE(SMBcopy);
6592 return;
6593 } else {
6594 count++;
6595 }
6596 } else {
6597 struct smb_Dir *dir_hnd = NULL;
6598 const char *dname = NULL;
6599 long offset = 0;
6600
6601 if (strequal(mask,"????????.???")) {
6602 mask = mask_star;
6603 }
6604
6605 status = check_name(conn, directory);
6606 if (!NT_STATUS_IS_OK(status)) {
6607 reply_nterror(req, status);
6608 END_PROFILE(SMBcopy);
6609 return;
6610 }
6611
6612 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6613 if (dir_hnd == NULL) {
6614 status = map_nt_error_from_unix(errno);
6615 reply_nterror(req, status);
6616 END_PROFILE(SMBcopy);
6617 return;
6618 }
6619
6620 error = ERRbadfile;
6621
6622 while ((dname = ReadDirName(dir_hnd, &offset, &sbuf1))) {
6623 char *destname = NULL;
6624 char *fname = NULL;
6625
6626 if (ISDOT(dname) || ISDOTDOT(dname)) {
6627 continue;
6628 }
6629
6630 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6631 continue;
6632 }
6633
6634 if(!mask_match(dname, mask, conn->case_sensitive)) {
6635 continue;
6636 }
6637
6638 error = ERRnoaccess;
6639 fname = talloc_asprintf(ctx,
6640 "%s/%s",
6641 directory,
6642 dname);
6643 if (!fname) {
6644 TALLOC_FREE(dir_hnd);
6645 reply_nterror(req, NT_STATUS_NO_MEMORY);
6646 END_PROFILE(SMBcopy);
6647 return;
6648 }
6649
6650 if (!resolve_wildcards(ctx,
6651 fname,newname,&destname)) {
6652 continue;
6653 }
6654 if (!destname) {
6655 TALLOC_FREE(dir_hnd);
6656 reply_nterror(req, NT_STATUS_NO_MEMORY);
6657 END_PROFILE(SMBcopy);
6658 return;
6659 }
6660
6661 status = check_name(conn, fname);
6662 if (!NT_STATUS_IS_OK(status)) {
6663 TALLOC_FREE(dir_hnd);
6664 reply_nterror(req, status);
6665 END_PROFILE(SMBcopy);
6666 return;
6667 }
6668
6669 status = check_name(conn, destname);
6670 if (!NT_STATUS_IS_OK(status)) {
6671 TALLOC_FREE(dir_hnd);
6672 reply_nterror(req, status);
6673 END_PROFILE(SMBcopy);
6674 return;
6675 }
6676
6677 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6678
6679 status = copy_file(ctx,conn,fname,destname,ofun,
6680 count,target_is_directory);
6681 if (NT_STATUS_IS_OK(status)) {
6682 count++;
6683 }
6684 TALLOC_FREE(fname);
6685 TALLOC_FREE(destname);
6686 }
6687 TALLOC_FREE(dir_hnd);
6688 }
6689
6690 if (count == 0) {
6691 if(err) {
6692 /* Error on close... */
6693 errno = err;
6694 reply_unixerror(req, ERRHRD, ERRgeneral);
6695 END_PROFILE(SMBcopy);
6696 return;
6697 }
6698
6699 reply_doserror(req, ERRDOS, error);
6700 END_PROFILE(SMBcopy);
6701 return;
6702 }
6703
6704 reply_outbuf(req, 1, 0);
6705 SSVAL(req->outbuf,smb_vwv0,count);
6706
6707 END_PROFILE(SMBcopy);
6708 return;
6709 }
6710
6711 #undef DBGC_CLASS
6712 #define DBGC_CLASS DBGC_LOCKING
6713
6714 /****************************************************************************
6715 Get a lock pid, dealing with large count requests.
6716 ****************************************************************************/
6717
6718 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6719 bool large_file_format)
6720 {
6721 if(!large_file_format)
6722 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6723 else
6724 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6725 }
6726
6727 /****************************************************************************
6728 Get a lock count, dealing with large count requests.
6729 ****************************************************************************/
6730
6731 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6732 bool large_file_format)
6733 {
6734 uint64_t count = 0;
6735
6736 if(!large_file_format) {
6737 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6738 } else {
6739
6740 #if defined(HAVE_LONGLONG)
6741 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6742 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6743 #else /* HAVE_LONGLONG */
6744
6745 /*
6746 * NT4.x seems to be broken in that it sends large file (64 bit)
6747 * lockingX calls even if the CAP_LARGE_FILES was *not*
6748 * negotiated. For boxes without large unsigned ints truncate the
6749 * lock count by dropping the top 32 bits.
6750 */
6751
6752 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6753 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6754 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6755 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6756 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6757 }
6758
6759 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6760 #endif /* HAVE_LONGLONG */
6761 }
6762
6763 return count;
6764 }
6765
6766 #if !defined(HAVE_LONGLONG)
6767 /****************************************************************************
6768 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6769 ****************************************************************************/
6770
6771 static uint32 map_lock_offset(uint32 high, uint32 low)
6772 {
6773 unsigned int i;
6774 uint32 mask = 0;
6775 uint32 highcopy = high;
6776
6777 /*
6778 * Try and find out how many significant bits there are in high.
6779 */
6780
6781 for(i = 0; highcopy; i++)
6782 highcopy >>= 1;
6783
6784 /*
6785 * We use 31 bits not 32 here as POSIX
6786 * lock offsets may not be negative.
6787 */
6788
6789 mask = (~0) << (31 - i);
6790
6791 if(low & mask)
6792 return 0; /* Fail. */
6793
6794 high <<= (31 - i);
6795
6796 return (high|low);
6797 }
6798 #endif /* !defined(HAVE_LONGLONG) */
6799
6800 /****************************************************************************
6801 Get a lock offset, dealing with large offset requests.
6802 ****************************************************************************/
6803
6804 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6805 bool large_file_format, bool *err)
6806 {
6807 uint64_t offset = 0;
6808
6809 *err = False;
6810
6811 if(!large_file_format) {
6812 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6813 } else {
6814
6815 #if defined(HAVE_LONGLONG)
6816 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6817 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6818 #else /* HAVE_LONGLONG */
6819
6820 /*
6821 * NT4.x seems to be broken in that it sends large file (64 bit)
6822 * lockingX calls even if the CAP_LARGE_FILES was *not*
6823 * negotiated. For boxes without large unsigned ints mangle the
6824 * lock offset by mapping the top 32 bits onto the lower 32.
6825 */
6826
6827 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6828 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6829 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6830 uint32 new_low = 0;
6831
6832 if((new_low = map_lock_offset(high, low)) == 0) {
6833 *err = True;
6834 return (uint64_t)-1;
6835 }
6836
6837 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6838 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6839 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6840 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6841 }
6842
6843 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6844 #endif /* HAVE_LONGLONG */
6845 }
6846
6847 return offset;
6848 }
6849
6850 /****************************************************************************
6851 Reply to a lockingX request.
6852 ****************************************************************************/
6853
6854 void reply_lockingX(struct smb_request *req)
6855 {
6856 connection_struct *conn = req->conn;
6857 files_struct *fsp;
6858 unsigned char locktype;
6859 unsigned char oplocklevel;
6860 uint16 num_ulocks;
6861 uint16 num_locks;
6862 uint64_t count = 0, offset = 0;
6863 uint32 lock_pid;
6864 int32 lock_timeout;
6865 int i;
6866 const uint8_t *data;
6867 bool large_file_format;
6868 bool err;
6869 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6870
6871 START_PROFILE(SMBlockingX);
6872
6873 if (req->wct < 8) {
6874 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6875 END_PROFILE(SMBlockingX);
6876 return;
6877 }
6878
6879 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
6880 locktype = CVAL(req->vwv+3, 0);
6881 oplocklevel = CVAL(req->vwv+3, 1);
6882 num_ulocks = SVAL(req->vwv+6, 0);
6883 num_locks = SVAL(req->vwv+7, 0);
6884 lock_timeout = IVAL(req->vwv+4, 0);
6885 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6886
6887 if (!check_fsp(conn, req, fsp)) {
6888 END_PROFILE(SMBlockingX);
6889 return;
6890 }
6891
6892 data = req->buf;
6893
6894 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6895 /* we don't support these - and CANCEL_LOCK makes w2k
6896 and XP reboot so I don't really want to be
6897 compatible! (tridge) */
6898 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6899 END_PROFILE(SMBlockingX);
6900 return;
6901 }
6902
6903 /* Check if this is an oplock break on a file
6904 we have granted an oplock on.
6905 */
6906 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6907 /* Client can insist on breaking to none. */
6908 bool break_to_none = (oplocklevel == 0);
6909 bool result;
6910
6911 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6912 "for fnum = %d\n", (unsigned int)oplocklevel,
6913 fsp->fnum ));
6914
6915 /*
6916 * Make sure we have granted an exclusive or batch oplock on
6917 * this file.
6918 */
6919
6920 if (fsp->oplock_type == 0) {
6921
6922 /* The Samba4 nbench simulator doesn't understand
6923 the difference between break to level2 and break
6924 to none from level2 - it sends oplock break
6925 replies in both cases. Don't keep logging an error
6926 message here - just ignore it. JRA. */
6927
6928 DEBUG(5,("reply_lockingX: Error : oplock break from "
6929 "client for fnum = %d (oplock=%d) and no "
6930 "oplock granted on this file (%s).\n",
6931 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6932
6933 /* if this is a pure oplock break request then don't
6934 * send a reply */
6935 if (num_locks == 0 && num_ulocks == 0) {
6936 END_PROFILE(SMBlockingX);
6937 return;
6938 } else {
6939 END_PROFILE(SMBlockingX);
6940 reply_doserror(req, ERRDOS, ERRlock);
6941 return;
6942 }
6943 }
6944
6945 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6946 (break_to_none)) {
6947 result = remove_oplock(fsp);
6948 } else {
6949 result = downgrade_oplock(fsp);
6950 }
6951
6952 if (!result) {
6953 DEBUG(0, ("reply_lockingX: error in removing "
6954 "oplock on file %s\n", fsp->fsp_name));
6955 /* Hmmm. Is this panic justified? */
6956 smb_panic("internal tdb error");
6957 }
6958
6959 reply_to_oplock_break_requests(fsp);
6960
6961 /* if this is a pure oplock break request then don't send a
6962 * reply */
6963 if (num_locks == 0 && num_ulocks == 0) {
6964 /* Sanity check - ensure a pure oplock break is not a
6965 chained request. */
6966 if(CVAL(req->vwv+0, 0) != 0xff)
6967 DEBUG(0,("reply_lockingX: Error : pure oplock "
6968 "break is a chained %d request !\n",
6969 (unsigned int)CVAL(req->vwv+0, 0)));
6970 END_PROFILE(SMBlockingX);
6971 return;
6972 }
6973 }
6974
6975 if (req->buflen <
6976 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6977 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6978 END_PROFILE(SMBlockingX);
6979 return;
6980 }
6981
6982 /* Data now points at the beginning of the list
6983 of smb_unlkrng structs */
6984 for(i = 0; i < (int)num_ulocks; i++) {
6985 lock_pid = get_lock_pid( data, i, large_file_format);
6986 count = get_lock_count( data, i, large_file_format);
6987 offset = get_lock_offset( data, i, large_file_format, &err);
6988
6989 /*
6990 * There is no error code marked "stupid client bug".... :-).
6991 */
6992 if(err) {
6993 END_PROFILE(SMBlockingX);
6994 reply_doserror(req, ERRDOS, ERRnoaccess);
6995 return;
6996 }
6997
6998 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6999 "pid %u, file %s\n", (double)offset, (double)count,
7000 (unsigned int)lock_pid, fsp->fsp_name ));
7001
7002 status = do_unlock(smbd_messaging_context(),
7003 fsp,
7004 lock_pid,
7005 count,
7006 offset,
7007 WINDOWS_LOCK);
7008
7009 DEBUG(10, ("reply_lockingX: unlock returned %s\n",
7010 nt_errstr(status)));
7011
7012 if (NT_STATUS_V(status)) {
7013 END_PROFILE(SMBlockingX);
7014 reply_nterror(req, status);
7015 return;
7016 }
7017 }
7018
7019 /* Setup the timeout in seconds. */
7020
7021 if (!lp_blocking_locks(SNUM(conn))) {
7022 lock_timeout = 0;
7023 }
7024
7025 /* Now do any requested locks */
7026 data += ((large_file_format ? 20 : 10)*num_ulocks);
7027
7028 /* Data now points at the beginning of the list
7029 of smb_lkrng structs */
7030
7031 for(i = 0; i < (int)num_locks; i++) {
7032 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
7033 READ_LOCK:WRITE_LOCK);
7034 lock_pid = get_lock_pid( data, i, large_file_format);
7035 count = get_lock_count( data, i, large_file_format);
7036 offset = get_lock_offset( data, i, large_file_format, &err);
7037
7038 /*
7039 * There is no error code marked "stupid client bug".... :-).
7040 */
7041 if(err) {
7042 END_PROFILE(SMBlockingX);
7043 reply_doserror(req, ERRDOS, ERRnoaccess);
7044 return;
7045 }
7046
7047 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
7048 "%u, file %s timeout = %d\n", (double)offset,
7049 (double)count, (unsigned int)lock_pid,
7050 fsp->fsp_name, (int)lock_timeout ));
7051
7052 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7053 struct blocking_lock_record *blr = NULL;
7054
7055 if (lp_blocking_locks(SNUM(conn))) {
7056
7057 /* Schedule a message to ourselves to
7058 remove the blocking lock record and
7059 return the right error. */
7060
7061 blr = blocking_lock_cancel(fsp,
7062 lock_pid,
7063 offset,
7064 count,
7065 WINDOWS_LOCK,
7066 locktype,
7067 NT_STATUS_FILE_LOCK_CONFLICT);
7068 if (blr == NULL) {
7069 END_PROFILE(SMBlockingX);
7070 reply_nterror(
7071 req,
7072 NT_STATUS_DOS(
7073 ERRDOS,
7074 ERRcancelviolation));
7075 return;
7076 }
7077 }
7078 /* Remove a matching pending lock. */
7079 status = do_lock_cancel(fsp,
7080 lock_pid,
7081 count,
7082 offset,
7083 WINDOWS_LOCK,
7084 blr);
7085 } else {
7086 bool blocking_lock = lock_timeout ? True : False;
7087 bool defer_lock = False;
7088 struct byte_range_lock *br_lck;
7089 uint32 block_smbpid;
7090
7091 br_lck = do_lock(smbd_messaging_context(),
7092 fsp,
7093 lock_pid,
7094 count,
7095 offset,
7096 lock_type,
7097 WINDOWS_LOCK,
7098 blocking_lock,
7099 &status,
7100 &block_smbpid,
7101 NULL);
7102
7103 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7104 /* Windows internal resolution for blocking locks seems
7105 to be about 200ms... Don't wait for less than that. JRA. */
7106 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7107 lock_timeout = lp_lock_spin_time();
7108 }
7109 defer_lock = True;
7110 }
7111
7112 /* This heuristic seems to match W2K3 very well. If a
7113 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7114 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7115 far as I can tell. Replacement for do_lock_spin(). JRA. */
7116
7117 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7118 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7119 defer_lock = True;
7120 lock_timeout = lp_lock_spin_time();
7121 }
7122
7123 if (br_lck && defer_lock) {
7124 /*
7125 * A blocking lock was requested. Package up
7126 * this smb into a queued request and push it
7127 * onto the blocking lock queue.
7128 */
7129 if(push_blocking_lock_request(br_lck,
7130 req,
7131 fsp,
7132 lock_timeout,
7133 i,
7134 lock_pid,
7135 lock_type,
7136 WINDOWS_LOCK,
7137 offset,
7138 count,
7139 block_smbpid)) {
7140 TALLOC_FREE(br_lck);
7141 END_PROFILE(SMBlockingX);
7142 return;
7143 }
7144 }
7145
7146 TALLOC_FREE(br_lck);
7147 }
7148
7149 if (NT_STATUS_V(status)) {
7150 END_PROFILE(SMBlockingX);
7151 reply_nterror(req, status);
7152 return;
7153 }
7154 }
7155
7156 /* If any of the above locks failed, then we must unlock
7157 all of the previous locks (X/Open spec). */
7158
7159 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7160 (i != num_locks) &&
7161 (num_locks != 0)) {
7162 /*
7163 * Ensure we don't do a remove on the lock that just failed,
7164 * as under POSIX rules, if we have a lock already there, we
7165 * will delete it (and we shouldn't) .....
7166 */
7167 for(i--; i >= 0; i--) {
7168 lock_pid = get_lock_pid( data, i, large_file_format);
7169 count = get_lock_count( data, i, large_file_format);
7170 offset = get_lock_offset( data, i, large_file_format,
7171 &err);
7172
7173 /*
7174 * There is no error code marked "stupid client
7175 * bug".... :-).
7176 */
7177 if(err) {
7178 END_PROFILE(SMBlockingX);
7179 reply_doserror(req, ERRDOS, ERRnoaccess);
7180 return;
7181 }
7182
7183 do_unlock(smbd_messaging_context(),
7184 fsp,
7185 lock_pid,
7186 count,
7187 offset,
7188 WINDOWS_LOCK);
7189 }
7190 END_PROFILE(SMBlockingX);
7191 reply_nterror(req, status);
7192 return;
7193 }
7194
7195 reply_outbuf(req, 2, 0);
7196
7197 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7198 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7199
7200 END_PROFILE(SMBlockingX);
7201 chain_reply(req);
7202 }
7203
7204 #undef DBGC_CLASS
7205 #define DBGC_CLASS DBGC_ALL
7206
7207 /****************************************************************************
7208 Reply to a SMBreadbmpx (read block multiplex) request.
7209 Always reply with an error, if someone has a platform really needs this,
7210 please contact vl@samba.org
7211 ****************************************************************************/
7212
7213 void reply_readbmpx(struct smb_request *req)
7214 {
7215 START_PROFILE(SMBreadBmpx);
7216 reply_doserror(req, ERRSRV, ERRuseSTD);
7217 END_PROFILE(SMBreadBmpx);
7218 return;
7219 }
7220
7221 /****************************************************************************
7222 Reply to a SMBreadbs (read block multiplex secondary) request.
7223 Always reply with an error, if someone has a platform really needs this,
7224 please contact vl@samba.org
7225 ****************************************************************************/
7226
7227 void reply_readbs(struct smb_request *req)
7228 {
7229 START_PROFILE(SMBreadBs);
7230 reply_doserror(req, ERRSRV, ERRuseSTD);
7231 END_PROFILE(SMBreadBs);
7232 return;
7233 }
7234
7235 /****************************************************************************
7236 Reply to a SMBsetattrE.
7237 ****************************************************************************/
7238
7239 void reply_setattrE(struct smb_request *req)
7240 {
7241 connection_struct *conn = req->conn;
7242 struct smb_file_time ft;
7243 files_struct *fsp;
7244 SMB_STRUCT_STAT sbuf;
7245 NTSTATUS status;
7246
7247 START_PROFILE(SMBsetattrE);
7248 ZERO_STRUCT(ft);
7249
7250 if (req->wct < 7) {
7251 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7252 END_PROFILE(SMBsetattrE);
7253 return;
7254 }
7255
7256 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7257
7258 if(!fsp || (fsp->conn != conn)) {
7259 reply_doserror(req, ERRDOS, ERRbadfid);
7260 END_PROFILE(SMBsetattrE);
7261 return;
7262 }
7263
7264
7265 /*
7266 * Convert the DOS times into unix times.
7267 */
7268
7269 ft.atime = convert_time_t_to_timespec(
7270 srv_make_unix_date2(req->vwv+3));
7271 ft.mtime = convert_time_t_to_timespec(
7272 srv_make_unix_date2(req->vwv+5));
7273 ft.create_time = convert_time_t_to_timespec(
7274 srv_make_unix_date2(req->vwv+1));
7275
7276 reply_outbuf(req, 0, 0);
7277
7278 /*
7279 * Patch from Ray Frush <frush@engr.colostate.edu>
7280 * Sometimes times are sent as zero - ignore them.
7281 */
7282
7283 /* Ensure we have a valid stat struct for the source. */
7284 if (fsp->fh->fd != -1) {
7285 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7286 status = map_nt_error_from_unix(errno);
7287 reply_nterror(req, status);
7288 END_PROFILE(SMBsetattrE);
7289 return;
7290 }
7291 } else {
7292 int ret = -1;
7293
7294 if (fsp->posix_open) {
7295 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7296 } else {
7297 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7298 }
7299 if (ret == -1) {
7300 status = map_nt_error_from_unix(errno);
7301 reply_nterror(req, status);
7302 END_PROFILE(SMBsetattrE);
7303 return;
7304 }
7305 }
7306
7307 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7308 &sbuf, &ft, true);
7309 if (!NT_STATUS_IS_OK(status)) {
7310 reply_doserror(req, ERRDOS, ERRnoaccess);
7311 END_PROFILE(SMBsetattrE);
7312 return;
7313 }
7314
7315 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7316 " createtime=%u\n",
7317 fsp->fnum,
7318 (unsigned int)ft.atime.tv_sec,
7319 (unsigned int)ft.mtime.tv_sec,
7320 (unsigned int)ft.create_time.tv_sec
7321 ));
7322
7323 END_PROFILE(SMBsetattrE);
7324 return;
7325 }
7326
7327
7328 /* Back from the dead for OS/2..... JRA. */
7329
7330 /****************************************************************************
7331 Reply to a SMBwritebmpx (write block multiplex primary) request.
7332 Always reply with an error, if someone has a platform really needs this,
7333 please contact vl@samba.org
7334 ****************************************************************************/
7335
7336 void reply_writebmpx(struct smb_request *req)
7337 {
7338 START_PROFILE(SMBwriteBmpx);
7339 reply_doserror(req, ERRSRV, ERRuseSTD);
7340 END_PROFILE(SMBwriteBmpx);
7341 return;
7342 }
7343
7344 /****************************************************************************
7345 Reply to a SMBwritebs (write block multiplex secondary) request.
7346 Always reply with an error, if someone has a platform really needs this,
7347 please contact vl@samba.org
7348 ****************************************************************************/
7349
7350 void reply_writebs(struct smb_request *req)
7351 {
7352 START_PROFILE(SMBwriteBs);
7353 reply_doserror(req, ERRSRV, ERRuseSTD);
7354 END_PROFILE(SMBwriteBs);
7355 return;
7356 }
7357
7358 /****************************************************************************
7359 Reply to a SMBgetattrE.
7360 ****************************************************************************/
7361
7362 void reply_getattrE(struct smb_request *req)
7363 {
7364 connection_struct *conn = req->conn;
7365 SMB_STRUCT_STAT sbuf;
7366 int mode;
7367 files_struct *fsp;
7368 struct timespec create_ts;
7369
7370 START_PROFILE(SMBgetattrE);
7371
7372 if (req->wct < 1) {
7373 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7374 END_PROFILE(SMBgetattrE);
7375 return;
7376 }
7377
7378 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7379
7380 if(!fsp || (fsp->conn != conn)) {
7381 reply_doserror(req, ERRDOS, ERRbadfid);
7382 END_PROFILE(SMBgetattrE);
7383 return;
7384 }
7385
7386 /* Do an fstat on this file */
7387 if(fsp_stat(fsp, &sbuf)) {
7388 reply_unixerror(req, ERRDOS, ERRnoaccess);
7389 END_PROFILE(SMBgetattrE);
7390 return;
7391 }
7392
7393 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7394
7395 /*
7396 * Convert the times into dos times. Set create
7397 * date to be last modify date as UNIX doesn't save
7398 * this.
7399 */
7400
7401 reply_outbuf(req, 11, 0);
7402
7403 create_ts = get_create_timespec(&sbuf,
7404 lp_fake_dir_create_times(SNUM(conn)));
7405 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7406 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7407 /* Should we check pending modtime here ? JRA */
7408 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7409
7410 if (mode & aDIR) {
7411 SIVAL(req->outbuf, smb_vwv6, 0);
7412 SIVAL(req->outbuf, smb_vwv8, 0);
7413 } else {
7414 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7415 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7416 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7417 }
7418 SSVAL(req->outbuf,smb_vwv10, mode);
7419
7420 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7421
7422 END_PROFILE(SMBgetattrE);
7423 return;
7424 }
Samba GIT mirror