2 Unix SMB/Netbios implementation.
4 SMB NT transaction handling
5 Copyright (C) Jeremy Allison 1994-1998
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 extern int smb_read_error
;
26 extern int global_oplock_break
;
27 extern BOOL case_sensitive
;
28 extern BOOL case_preserve
;
29 extern BOOL short_case_preserve
;
31 static char *known_nt_pipes
[] = {
49 /* Map generic permissions to file object specific permissions */
51 struct generic_mapping file_generic_mapping
= {
58 /****************************************************************************
59 Send the required number of replies back.
60 We assume all fields other than the data fields are
61 set correctly for the type of call.
62 HACK ! Always assumes smb_setup field is zero.
63 ****************************************************************************/
65 static int send_nt_replies(char *inbuf
, char *outbuf
, int bufsize
, NTSTATUS nt_error
, char *params
,
66 int paramsize
, char *pdata
, int datasize
)
69 int data_to_send
= datasize
;
70 int params_to_send
= paramsize
;
74 int params_sent_thistime
, data_sent_thistime
, total_sent_thistime
;
75 int alignment_offset
= 3;
76 int data_alignment_offset
= 0;
79 * Initially set the wcnt area to be 18 - this is true for all
83 set_message(outbuf
,18,0,True
);
85 if(NT_STATUS_V(nt_error
)) {
90 * If there genuinely are no parameters or data to send just send
94 if(params_to_send
== 0 && data_to_send
== 0) {
95 if (!send_smb(smbd_server_fd(),outbuf
))
96 exit_server("send_nt_replies: send_smb failed.");
101 * When sending params and data ensure that both are nicely aligned.
102 * Only do this alignment when there is also data to send - else
103 * can cause NT redirector problems.
106 if (((params_to_send
% 4) != 0) && (data_to_send
!= 0))
107 data_alignment_offset
= 4 - (params_to_send
% 4);
110 * Space is bufsize minus Netbios over TCP header minus SMB header.
111 * The alignment_offset is to align the param bytes on a four byte
112 * boundary (2 bytes for data len, one byte pad).
113 * NT needs this to work correctly.
116 useable_space
= bufsize
- ((smb_buf(outbuf
)+
117 alignment_offset
+data_alignment_offset
) -
121 * useable_space can never be more than max_send minus the
125 useable_space
= MIN(useable_space
,
126 max_send
- (alignment_offset
+data_alignment_offset
));
129 while (params_to_send
|| data_to_send
) {
132 * Calculate whether we will totally or partially fill this packet.
135 total_sent_thistime
= params_to_send
+ data_to_send
+
136 alignment_offset
+ data_alignment_offset
;
139 * We can never send more than useable_space.
142 total_sent_thistime
= MIN(total_sent_thistime
, useable_space
);
144 set_message(outbuf
, 18, total_sent_thistime
, True
);
147 * Set total params and data to be sent.
150 SIVAL(outbuf
,smb_ntr_TotalParameterCount
,paramsize
);
151 SIVAL(outbuf
,smb_ntr_TotalDataCount
,datasize
);
154 * Calculate how many parameters and data we can fit into
155 * this packet. Parameters get precedence.
158 params_sent_thistime
= MIN(params_to_send
,useable_space
);
159 data_sent_thistime
= useable_space
- params_sent_thistime
;
160 data_sent_thistime
= MIN(data_sent_thistime
,data_to_send
);
162 SIVAL(outbuf
,smb_ntr_ParameterCount
,params_sent_thistime
);
164 if(params_sent_thistime
== 0) {
165 SIVAL(outbuf
,smb_ntr_ParameterOffset
,0);
166 SIVAL(outbuf
,smb_ntr_ParameterDisplacement
,0);
169 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
170 * parameter bytes, however the first 4 bytes of outbuf are
171 * the Netbios over TCP header. Thus use smb_base() to subtract
172 * them from the calculation.
175 SIVAL(outbuf
,smb_ntr_ParameterOffset
,
176 ((smb_buf(outbuf
)+alignment_offset
) - smb_base(outbuf
)));
178 * Absolute displacement of param bytes sent in this packet.
181 SIVAL(outbuf
,smb_ntr_ParameterDisplacement
,pp
- params
);
185 * Deal with the data portion.
188 SIVAL(outbuf
,smb_ntr_DataCount
, data_sent_thistime
);
190 if(data_sent_thistime
== 0) {
191 SIVAL(outbuf
,smb_ntr_DataOffset
,0);
192 SIVAL(outbuf
,smb_ntr_DataDisplacement
, 0);
195 * The offset of the data bytes is the offset of the
196 * parameter bytes plus the number of parameters being sent this time.
199 SIVAL(outbuf
,smb_ntr_DataOffset
,((smb_buf(outbuf
)+alignment_offset
) -
200 smb_base(outbuf
)) + params_sent_thistime
+ data_alignment_offset
);
201 SIVAL(outbuf
,smb_ntr_DataDisplacement
, pd
- pdata
);
205 * Copy the param bytes into the packet.
208 if(params_sent_thistime
)
209 memcpy((smb_buf(outbuf
)+alignment_offset
),pp
,params_sent_thistime
);
212 * Copy in the data bytes
215 if(data_sent_thistime
)
216 memcpy(smb_buf(outbuf
)+alignment_offset
+params_sent_thistime
+
217 data_alignment_offset
,pd
,data_sent_thistime
);
219 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
220 params_sent_thistime
, data_sent_thistime
, useable_space
));
221 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
222 params_to_send
, data_to_send
, paramsize
, datasize
));
224 /* Send the packet */
225 if (!send_smb(smbd_server_fd(),outbuf
))
226 exit_server("send_nt_replies: send_smb failed.");
228 pp
+= params_sent_thistime
;
229 pd
+= data_sent_thistime
;
231 params_to_send
-= params_sent_thistime
;
232 data_to_send
-= data_sent_thistime
;
238 if(params_to_send
< 0 || data_to_send
< 0) {
239 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
240 params_to_send
, data_to_send
));
248 /****************************************************************************
249 (Hopefully) temporary call to fix bugs in NT5.0beta2. This OS sends unicode
250 strings in NT calls AND DOESN'T SET THE UNICODE BIT !!!!!!!
251 ****************************************************************************/
253 static void get_filename( char *fname
, char *inbuf
, int data_offset
, int data_len
, int fname_len
)
256 * We need various heuristics here to detect a unicode string... JRA.
259 DEBUG(10,("get_filename: data_offset = %d, data_len = %d, fname_len = %d\n",
260 data_offset
, data_len
, fname_len
));
262 if(data_len
- fname_len
> 1) {
264 * NT 5.0 Beta 2 has kindly sent us a UNICODE string
265 * without bothering to set the unicode bit. How kind.
267 * Firstly - ensure that the data offset is aligned
268 * on a 2 byte boundary - add one if not.
270 fname_len
= fname_len
/2;
273 pstrcpy(fname
, dos_unistrn2((uint16
*)(inbuf
+data_offset
), fname_len
));
275 StrnCpy(fname
,inbuf
+data_offset
,fname_len
);
276 fname
[fname_len
] = '\0';
280 /****************************************************************************
281 Fix bugs in Win2000 final release. In trans calls this OS sends unicode
282 strings AND DOESN'T SET THE UNICODE BIT !!!!!!!
283 ****************************************************************************/
285 static void get_filename_transact( char *fname
, char *inbuf
, int data_offset
, int data_len
, int fname_len
)
287 DEBUG(10,("get_filename_transact: data_offset = %d, data_len = %d, fname_len = %d\n",
288 data_offset
, data_len
, fname_len
));
291 * Win2K sends a unicode filename plus one extra alingment byte.
292 * WinNT4.x send an ascii string with multiple garbage bytes on
297 * We need various heuristics here to detect a unicode string... JRA.
300 if( ((fname_len
% 2) == 0) &&
303 (inbuf
[data_offset
] == '\0') ||
304 ((fname_len
> 1) && (inbuf
[data_offset
+1] == '\\') && (inbuf
[data_offset
+2] == '\0'))
308 * Ensure that the data offset is aligned
309 * on a 2 byte boundary - add one if not.
311 fname_len
= fname_len
/2;
314 pstrcpy(fname
, dos_unistrn2((uint16
*)(inbuf
+data_offset
), fname_len
));
316 StrnCpy(fname
,inbuf
+data_offset
,fname_len
);
317 fname
[fname_len
] = '\0';
321 /****************************************************************************
323 ****************************************************************************/
325 static BOOL saved_case_sensitive
;
326 static BOOL saved_case_preserve
;
327 static BOOL saved_short_case_preserve
;
329 /****************************************************************************
331 ****************************************************************************/
333 static void set_posix_case_semantics(uint32 file_attributes
)
335 if(!(file_attributes
& FILE_FLAG_POSIX_SEMANTICS
))
338 saved_case_sensitive
= case_sensitive
;
339 saved_case_preserve
= case_preserve
;
340 saved_short_case_preserve
= short_case_preserve
;
343 case_sensitive
= True
;
344 case_preserve
= True
;
345 short_case_preserve
= True
;
348 /****************************************************************************
349 Restore case semantics.
350 ****************************************************************************/
352 static void restore_case_semantics(uint32 file_attributes
)
354 if(!(file_attributes
& FILE_FLAG_POSIX_SEMANTICS
))
357 case_sensitive
= saved_case_sensitive
;
358 case_preserve
= saved_case_preserve
;
359 short_case_preserve
= saved_short_case_preserve
;
362 /****************************************************************************
363 Utility function to map create disposition.
364 ****************************************************************************/
366 static int map_create_disposition( uint32 create_disposition
)
370 switch( create_disposition
) {
372 /* create if not exist, fail if exist */
373 ret
= (FILE_CREATE_IF_NOT_EXIST
|FILE_EXISTS_FAIL
);
376 case FILE_OVERWRITE_IF
:
377 /* create if not exist, trunc if exist */
378 ret
= (FILE_CREATE_IF_NOT_EXIST
|FILE_EXISTS_TRUNCATE
);
381 /* fail if not exist, open if exists */
382 ret
= (FILE_FAIL_IF_NOT_EXIST
|FILE_EXISTS_OPEN
);
385 /* create if not exist, open if exists */
386 ret
= (FILE_CREATE_IF_NOT_EXIST
|FILE_EXISTS_OPEN
);
389 /* fail if not exist, truncate if exists */
390 ret
= (FILE_FAIL_IF_NOT_EXIST
|FILE_EXISTS_TRUNCATE
);
393 DEBUG(0,("map_create_disposition: Incorrect value for create_disposition = %d\n",
394 create_disposition
));
398 DEBUG(10,("map_create_disposition: Mapped create_disposition 0x%lx to 0x%x\n",
399 (unsigned long)create_disposition
, ret
));
404 /****************************************************************************
405 Utility function to map share modes.
406 ****************************************************************************/
408 static int map_share_mode( char *fname
, uint32 create_options
,
409 uint32
*desired_access
, uint32 share_access
, uint32 file_attributes
)
411 int smb_open_mode
= -1;
414 * Convert GENERIC bits to specific bits.
417 se_map_generic(desired_access
, &file_generic_mapping
);
419 switch( *desired_access
& (FILE_READ_DATA
|FILE_WRITE_DATA
|FILE_APPEND_DATA
) ) {
421 smb_open_mode
= DOS_OPEN_RDONLY
;
423 case FILE_WRITE_DATA
:
424 case FILE_APPEND_DATA
:
425 case FILE_WRITE_DATA
|FILE_APPEND_DATA
:
426 smb_open_mode
= DOS_OPEN_WRONLY
;
428 case FILE_READ_DATA
|FILE_WRITE_DATA
:
429 case FILE_READ_DATA
|FILE_WRITE_DATA
|FILE_APPEND_DATA
:
430 case FILE_READ_DATA
|FILE_APPEND_DATA
:
431 smb_open_mode
= DOS_OPEN_RDWR
;
436 * NB. For DELETE_ACCESS we should really check the
437 * directory permissions, as that is what controls
438 * delete, and for WRITE_DAC_ACCESS we should really
439 * check the ownership, as that is what controls the
440 * chmod. Note that this is *NOT* a security hole (this
441 * note is for you, Andrew) as we are not *allowing*
442 * the access at this point, the actual unlink or
443 * chown or chmod call would do this. We are just helping
444 * clients out by telling them if they have a hope
445 * of any of this succeeding. POSIX acls may still
446 * deny the real call. JRA.
449 if (smb_open_mode
== -1) {
451 if(*desired_access
& (DELETE_ACCESS
|WRITE_DAC_ACCESS
|WRITE_OWNER_ACCESS
|SYNCHRONIZE_ACCESS
|
452 FILE_EXECUTE
|FILE_READ_ATTRIBUTES
|
453 FILE_READ_EA
|FILE_WRITE_EA
|SYSTEM_SECURITY_ACCESS
|
454 FILE_WRITE_ATTRIBUTES
|READ_CONTROL_ACCESS
)) {
455 smb_open_mode
= DOS_OPEN_RDONLY
;
456 } else if(*desired_access
== 0) {
459 * JRA - NT seems to sometimes send desired_access as zero. play it safe
460 * and map to a stat open.
463 smb_open_mode
= DOS_OPEN_RDONLY
;
466 DEBUG(0,("map_share_mode: Incorrect value 0x%lx for desired_access to file %s\n",
467 (unsigned long)*desired_access
, fname
));
473 * Set the special bit that means allow share delete.
474 * This is held outside the normal share mode bits at 1<<15.
478 if(share_access
& FILE_SHARE_DELETE
) {
479 smb_open_mode
|= ALLOW_SHARE_DELETE
;
480 DEBUG(10,("map_share_mode: FILE_SHARE_DELETE requested. open_mode = 0x%x\n", smb_open_mode
));
484 * We need to store the intent to open for Delete. This
485 * is what determines if a delete on close flag can be set.
486 * This is the wrong way (and place) to store this, but for 2.2 this
487 * is the only practical way. JRA.
490 if(*desired_access
& DELETE_ACCESS
) {
491 DEBUG(10,("map_share_mode: DELETE_ACCESS requested. open_mode = 0x%x\n", smb_open_mode
));
494 if (create_options
& FILE_DELETE_ON_CLOSE
) {
495 /* Implicit delete access is *NOT* requested... */
496 smb_open_mode
|= DELETE_ON_CLOSE_FLAG
;
497 DEBUG(10,("map_share_mode: FILE_DELETE_ON_CLOSE requested. open_mode = 0x%x\n", smb_open_mode
));
500 /* Add in the requested share mode. */
501 switch( share_access
& (FILE_SHARE_READ
|FILE_SHARE_WRITE
)) {
502 case FILE_SHARE_READ
:
503 smb_open_mode
|= SET_DENY_MODE(DENY_WRITE
);
505 case FILE_SHARE_WRITE
:
506 smb_open_mode
|= SET_DENY_MODE(DENY_READ
);
508 case (FILE_SHARE_READ
|FILE_SHARE_WRITE
):
509 smb_open_mode
|= SET_DENY_MODE(DENY_NONE
);
511 case FILE_SHARE_NONE
:
512 smb_open_mode
|= SET_DENY_MODE(DENY_ALL
);
517 * Handle an O_SYNC request.
520 if(file_attributes
& FILE_FLAG_WRITE_THROUGH
)
521 smb_open_mode
|= FILE_SYNC_OPENMODE
;
523 DEBUG(10,("map_share_mode: Mapped desired access 0x%lx, share access 0x%lx, file attributes 0x%lx \
524 to open_mode 0x%x\n", (unsigned long)*desired_access
, (unsigned long)share_access
,
525 (unsigned long)file_attributes
, smb_open_mode
));
527 return smb_open_mode
;
530 /****************************************************************************
531 Reply to an NT create and X call on a pipe.
532 ****************************************************************************/
534 static int nt_open_pipe(char *fname
, connection_struct
*conn
,
535 char *inbuf
, char *outbuf
, int *ppnum
)
537 pipes_struct
*p
= NULL
;
539 uint16 vuid
= SVAL(inbuf
, smb_uid
);
542 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname
));
544 /* See if it is one we want to handle. */
546 if (lp_disable_spoolss() && strequal(fname
, "\\spoolss"))
547 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND
,ERRDOS
,ERRbadpipe
));
549 for( i
= 0; known_nt_pipes
[i
]; i
++ )
550 if( strequal(fname
,known_nt_pipes
[i
]))
553 if ( known_nt_pipes
[i
] == NULL
)
554 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND
,ERRDOS
,ERRbadpipe
));
556 /* Strip \\ off the name. */
559 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname
));
561 p
= open_rpc_pipe_p(fname
, conn
, vuid
);
563 return(ERROR_DOS(ERRSRV
,ERRnofids
));
570 /****************************************************************************
571 Reply to an NT create and X call for pipes.
572 ****************************************************************************/
574 static int do_ntcreate_pipe_open(connection_struct
*conn
,
575 char *inbuf
,char *outbuf
,int length
,int bufsize
)
581 uint32 fname_len
= MIN(((uint32
)SVAL(inbuf
,smb_ntcreate_NameLength
)),
582 ((uint32
)sizeof(fname
)-1));
584 get_filename(fname
, inbuf
, smb_buf(inbuf
)-inbuf
,
585 smb_buflen(inbuf
),fname_len
);
586 if ((ret
= nt_open_pipe(fname
, conn
, inbuf
, outbuf
, &pnum
)) != 0)
590 * Deal with pipe return.
593 set_message(outbuf
,34,0,True
);
595 p
= outbuf
+ smb_vwv2
;
599 SIVAL(p
,0,FILE_WAS_OPENED
);
602 SIVAL(p
,0,FILE_ATTRIBUTE_NORMAL
); /* File Attributes. */
605 SSVAL(p
,0,FILE_TYPE_MESSAGE_MODE_PIPE
);
607 SSVAL(p
,2, 0x5FF); /* ? */
609 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname
));
611 return chain_reply(inbuf
,outbuf
,length
,bufsize
);
614 /****************************************************************************
615 Reply to an NT create and X call.
616 ****************************************************************************/
618 int reply_ntcreate_and_X(connection_struct
*conn
,
619 char *inbuf
,char *outbuf
,int length
,int bufsize
)
623 uint32 flags
= IVAL(inbuf
,smb_ntcreate_Flags
);
624 uint32 desired_access
= IVAL(inbuf
,smb_ntcreate_DesiredAccess
);
625 uint32 file_attributes
= IVAL(inbuf
,smb_ntcreate_FileAttributes
);
626 uint32 share_access
= IVAL(inbuf
,smb_ntcreate_ShareAccess
);
627 uint32 create_disposition
= IVAL(inbuf
,smb_ntcreate_CreateDisposition
);
628 uint32 create_options
= IVAL(inbuf
,smb_ntcreate_CreateOptions
);
629 uint32 fname_len
= MIN(((uint32
)SVAL(inbuf
,smb_ntcreate_NameLength
)),
630 ((uint32
)sizeof(fname
)-1));
631 uint16 root_dir_fid
= (uint16
)IVAL(inbuf
,smb_ntcreate_RootDirectoryFid
);
632 SMB_OFF_T allocation_size
= 0;
635 int smb_attr
= (file_attributes
& SAMBA_ATTRIBUTES_MASK
);
636 /* Breakout the oplock request bits so we can set the
637 reply bits separately. */
638 int oplock_request
= 0;
641 SMB_OFF_T file_len
= 0;
642 SMB_STRUCT_STAT sbuf
;
644 BOOL bad_path
= False
;
645 files_struct
*fsp
=NULL
;
648 BOOL extended_oplock_granted
= False
;
650 START_PROFILE(SMBntcreateX
);
652 DEBUG(10,("reply_ntcreateX: flags = 0x%x, desired_access = 0x%x \
653 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
654 create_options = 0x%x root_dir_fid = 0x%x\n", flags
, desired_access
, file_attributes
,
655 share_access
, create_disposition
,
656 root_dir_fid
, create_options
));
658 /* If it's an IPC, use the pipe handler. */
661 if (lp_nt_pipe_support()) {
662 END_PROFILE(SMBntcreateX
);
663 return do_ntcreate_pipe_open(conn
,inbuf
,outbuf
,length
,bufsize
);
665 END_PROFILE(SMBntcreateX
);
666 return(ERROR_DOS(ERRDOS
,ERRnoaccess
));
670 if (create_options
& FILE_OPEN_BY_FILE_ID
) {
671 END_PROFILE(SMBntcreateX
);
672 return ERROR_NT(NT_STATUS_NOT_SUPPORTED
);
676 * We need to construct the open_and_X ofun value from the
677 * NT values, as that's what our code is structured to accept.
680 if((smb_ofun
= map_create_disposition( create_disposition
)) == -1) {
681 END_PROFILE(SMBntcreateX
);
682 return(ERROR_DOS(ERRDOS
,ERRnoaccess
));
689 if(root_dir_fid
!= 0) {
691 * This filename is relative to a directory fid.
693 files_struct
*dir_fsp
= file_fsp(inbuf
,smb_ntcreate_RootDirectoryFid
);
697 END_PROFILE(SMBntcreateX
);
698 return(ERROR_DOS(ERRDOS
,ERRbadfid
));
701 if(!dir_fsp
->is_directory
) {
703 get_filename(&fname
[0], inbuf
, smb_buf(inbuf
)-inbuf
,
704 smb_buflen(inbuf
),fname_len
);
707 * Check to see if this is a mac fork of some kind.
710 if( strchr(fname
, ':')) {
711 END_PROFILE(SMBntcreateX
);
712 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND
);
714 END_PROFILE(SMBntcreateX
);
715 return(ERROR_DOS(ERRDOS
,ERRbadfid
));
719 * Copy in the base directory name.
722 pstrcpy( fname
, dir_fsp
->fsp_name
);
723 dir_name_len
= strlen(fname
);
726 * Ensure it ends in a '\'.
729 if(fname
[dir_name_len
-1] != '\\' && fname
[dir_name_len
-1] != '/') {
730 pstrcat(fname
, "\\");
735 * This next calculation can refuse a correct filename if we're dealing
736 * with the Win2k unicode bug, but that would be rare. JRA.
739 if(fname_len
+ dir_name_len
>= sizeof(pstring
)) {
740 END_PROFILE(SMBntcreateX
);
741 return(ERROR_DOS(ERRSRV
,ERRfilespecs
));
744 get_filename(&fname
[dir_name_len
], inbuf
, smb_buf(inbuf
)-inbuf
,
745 smb_buflen(inbuf
),fname_len
);
749 get_filename(fname
, inbuf
, smb_buf(inbuf
)-inbuf
,
750 smb_buflen(inbuf
),fname_len
);
753 * Check to see if this is a mac fork of some kind.
756 if( strchr(fname
, ':')) {
757 END_PROFILE(SMBntcreateX
);
758 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND
);
763 * Now contruct the smb_open_mode value from the filename,
764 * desired access and the share access.
766 RESOLVE_DFSPATH(fname
, conn
, inbuf
, outbuf
);
768 if((smb_open_mode
= map_share_mode(fname
, create_options
, &desired_access
,
770 file_attributes
)) == -1) {
771 END_PROFILE(SMBntcreateX
);
772 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
775 oplock_request
= (flags
& REQUEST_OPLOCK
) ? EXCLUSIVE_OPLOCK
: 0;
776 if (oplock_request
) {
777 oplock_request
|= (flags
& REQUEST_BATCH_OPLOCK
) ? BATCH_OPLOCK
: 0;
781 * Ordinary file or directory.
785 * Check if POSIX semantics are wanted.
788 set_posix_case_semantics(file_attributes
);
790 unix_convert(fname
,conn
,0,&bad_path
,&sbuf
);
792 unixmode
= unix_mode(conn
,smb_attr
| aARCH
, fname
);
795 * If it's a request for a directory open, deal with it separately.
798 if(create_options
& FILE_DIRECTORY_FILE
) {
801 /* Can't open a temp directory. IFS kit test. */
802 if (file_attributes
& FILE_ATTRIBUTE_TEMPORARY
) {
803 END_PROFILE(SMBntcreateX
);
804 return ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
807 fsp
= open_directory(conn
, fname
, &sbuf
, desired_access
, smb_open_mode
, smb_ofun
, unixmode
, &smb_action
);
809 restore_case_semantics(file_attributes
);
812 set_bad_path_error(errno
, bad_path
);
813 END_PROFILE(SMBntcreateX
);
814 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
818 * Ordinary file case.
821 /* NB. We have a potential bug here. If we
822 * cause an oplock break to ourselves, then we
823 * could end up processing filename related
824 * SMB requests whilst we await the oplock
825 * break response. As we may have changed the
826 * filename case semantics to be POSIX-like,
827 * this could mean a filename request could
828 * fail when it should succeed. This is a rare
829 * condition, but eventually we must arrange
830 * to restore the correct case semantics
831 * before issuing an oplock break request to
832 * our client. JRA. */
834 fsp
= open_file_shared1(conn
,fname
,&sbuf
,
837 smb_ofun
, unixmode
, oplock_request
,
841 /* We cheat here. There are two cases we
842 * care about. One is a directory rename,
843 * where the NT client will attempt to
844 * open the source directory for
845 * DELETE access. Note that when the
846 * NT client does this it does *not*
847 * set the directory bit in the
848 * request packet. This is translated
849 * into a read/write open
850 * request. POSIX states that any open
851 * for write request on a directory
852 * will generate an EISDIR error, so
853 * we can catch this here and open a
854 * pseudo handle that is flagged as a
855 * directory. The second is an open
856 * for a permissions read only, which
857 * we handle in the open_file_stat case. JRA.
860 if(errno
== EISDIR
) {
863 * Fail the open if it was explicitly a non-directory file.
866 if (create_options
& FILE_NON_DIRECTORY_FILE
) {
867 restore_case_semantics(file_attributes
);
868 SSVAL(outbuf
, smb_flg2
,
869 SVAL(outbuf
,smb_flg2
) | FLAGS2_32_BIT_ERROR_CODES
);
870 END_PROFILE(SMBntcreateX
);
871 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY
);
875 fsp
= open_directory(conn
, fname
, &sbuf
, desired_access
, smb_open_mode
, smb_ofun
, unixmode
, &smb_action
);
878 restore_case_semantics(file_attributes
);
879 set_bad_path_error(errno
, bad_path
);
880 END_PROFILE(SMBntcreateX
);
881 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
885 restore_case_semantics(file_attributes
);
886 set_bad_path_error(errno
, bad_path
);
888 END_PROFILE(SMBntcreateX
);
889 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
894 restore_case_semantics(file_attributes
);
896 file_len
= sbuf
.st_size
;
897 fmode
= dos_mode(conn
,fname
,&sbuf
);
899 fmode
= FILE_ATTRIBUTE_NORMAL
;
900 if (!fsp
->is_directory
&& (fmode
& aDIR
)) {
901 close_file(fsp
,False
);
902 END_PROFILE(SMBntcreateX
);
903 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
906 /* Save the requested allocation size. */
907 allocation_size
= IVAL(inbuf
,smb_ntcreate_AllocationSize
);
908 #ifdef LARGE_SMB_OFF_T
909 allocation_size
|= (((SMB_OFF_T
)IVAL(inbuf
,smb_ntcreate_AllocationSize
+ 4)) << 32);
911 if (allocation_size
&& (allocation_size
> file_len
)) {
912 fsp
->initial_allocation_size
= SMB_ROUNDUP(allocation_size
,SMB_ROUNDUP_ALLOCATION_SIZE
);
913 if (vfs_allocate_file_space(fsp
, fsp
->initial_allocation_size
) == -1) {
914 close_file(fsp
,False
);
915 END_PROFILE(SMBntcreateX
);
916 return ERROR_NT(NT_STATUS_DISK_FULL
);
919 fsp
->initial_allocation_size
= SMB_ROUNDUP(file_len
,SMB_ROUNDUP_ALLOCATION_SIZE
);
923 * If the caller set the extended oplock request bit
924 * and we granted one (by whatever means) - set the
925 * correct bit for extended oplock reply.
928 if (oplock_request
&& lp_fake_oplocks(SNUM(conn
)))
929 extended_oplock_granted
= True
;
931 if(oplock_request
&& EXCLUSIVE_OPLOCK_TYPE(fsp
->oplock_type
))
932 extended_oplock_granted
= True
;
935 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
936 set_message(outbuf
,42,0,True
);
938 set_message(outbuf
,34,0,True
);
941 p
= outbuf
+ smb_vwv2
;
944 * Currently as we don't support level II oplocks we just report
945 * exclusive & batch here.
948 if (extended_oplock_granted
) {
949 if (flags
& REQUEST_BATCH_OPLOCK
) {
950 SCVAL(p
,0, BATCH_OPLOCK_RETURN
);
952 SCVAL(p
,0, EXCLUSIVE_OPLOCK_RETURN
);
954 } else if (LEVEL_II_OPLOCK_TYPE(fsp
->oplock_type
)) {
955 SCVAL(p
,0, LEVEL_II_OPLOCK_RETURN
);
957 SCVAL(p
,0,NO_OPLOCK_RETURN
);
961 SSVAL(p
,0,fsp
->fnum
);
963 if ((create_disposition
== FILE_SUPERSEDE
) && (smb_action
== FILE_WAS_OVERWRITTEN
))
964 SIVAL(p
,0,FILE_WAS_SUPERSEDED
);
966 SIVAL(p
,0,smb_action
);
970 c_time
= get_create_time(&sbuf
,lp_fake_dir_create_times(SNUM(conn
)));
972 if (lp_dos_filetime_resolution(SNUM(conn
))) {
979 put_long_date(p
,c_time
);
981 put_long_date(p
,sbuf
.st_atime
); /* access time */
983 put_long_date(p
,sbuf
.st_mtime
); /* write time */
985 put_long_date(p
,sbuf
.st_mtime
); /* change time */
987 SIVAL(p
,0,fmode
); /* File Attributes. */
989 SOFF_T(p
, 0, get_allocation_size(fsp
, &sbuf
));
991 SOFF_T(p
,0,file_len
);
993 SCVAL(p
,0,fsp
->is_directory
? 1 : 0);
995 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp
->fnum
, fsp
->fsp_name
));
997 result
= chain_reply(inbuf
,outbuf
,length
,bufsize
);
998 END_PROFILE(SMBntcreateX
);
1002 /****************************************************************************
1003 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1004 ****************************************************************************/
1006 static int do_nt_transact_create_pipe( connection_struct
*conn
,
1007 char *inbuf
, char *outbuf
, int length
,
1008 int bufsize
, char **ppsetup
, char **ppparams
,
1013 int total_parameter_count
= (int)IVAL(inbuf
, smb_nt_TotalParameterCount
);
1014 char *params
= *ppparams
;
1020 * Ensure minimum number of parameters sent.
1023 if(total_parameter_count
< 54) {
1024 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)total_parameter_count
));
1025 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
1028 fname_len
= MIN(((uint32
)IVAL(params
,44)),((uint32
)sizeof(fname
)-1));
1030 get_filename_transact(&fname
[0], params
, 53,
1031 total_parameter_count
- 53 - fname_len
, fname_len
);
1033 if ((ret
= nt_open_pipe(fname
, conn
, inbuf
, outbuf
, &pnum
)) != 0)
1036 /* Realloc the size of parameters and data we will return */
1037 params
= Realloc(*ppparams
, 69);
1039 return ERROR_DOS(ERRDOS
,ERRnomem
);
1043 memset((char *)params
,'\0',69);
1046 SCVAL(p
,0,NO_OPLOCK_RETURN
);
1051 SIVAL(p
,0,FILE_WAS_OPENED
);
1055 SIVAL(p
,0,FILE_ATTRIBUTE_NORMAL
); /* File Attributes. */
1058 SSVAL(p
,0,FILE_TYPE_MESSAGE_MODE_PIPE
);
1060 SSVAL(p
,2, 0x5FF); /* ? */
1062 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname
));
1064 /* Send the required number of replies */
1065 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, params
, 69, *ppdata
, 0);
1070 /****************************************************************************
1071 Internal fn to set security descriptors.
1072 ****************************************************************************/
1074 static BOOL
set_sd(files_struct
*fsp
, char *data
, uint32 sd_len
, uint32 security_info_sent
, int *pdef_class
,uint32
*pdef_code
)
1077 SEC_DESC
*psd
= NULL
;
1078 TALLOC_CTX
*mem_ctx
;
1088 * Init the parse struct we will unmarshall from.
1091 if ((mem_ctx
= talloc_init()) == NULL
) {
1092 DEBUG(0,("set_sd: talloc_init failed.\n"));
1093 *pdef_class
= ERRDOS
;
1094 *pdef_code
= ERRnomem
;
1098 prs_init(&pd
, 0, mem_ctx
, UNMARSHALL
);
1101 * Setup the prs_struct to point at the memory we just
1105 prs_give_memory( &pd
, data
, sd_len
, False
);
1108 * Finally, unmarshall from the data buffer.
1111 if(!sec_io_desc( "sd data", &psd
, &pd
, 1)) {
1112 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1114 * Return access denied for want of a better error message..
1116 talloc_destroy(mem_ctx
);
1117 *pdef_class
= ERRDOS
;
1118 *pdef_code
= ERRnomem
;
1122 if (psd
->off_owner_sid
==0)
1123 security_info_sent
&= ~OWNER_SECURITY_INFORMATION
;
1124 if (psd
->off_grp_sid
==0)
1125 security_info_sent
&= ~GROUP_SECURITY_INFORMATION
;
1126 if (psd
->off_sacl
==0)
1127 security_info_sent
&= ~SACL_SECURITY_INFORMATION
;
1128 if (psd
->off_dacl
==0)
1129 security_info_sent
&= ~DACL_SECURITY_INFORMATION
;
1131 ret
= fsp
->conn
->vfs_ops
.fset_nt_acl( fsp
, fsp
->fd
, security_info_sent
, psd
);
1134 talloc_destroy(mem_ctx
);
1135 *pdef_class
= ERRDOS
;
1136 *pdef_code
= ERRnoaccess
;
1140 talloc_destroy(mem_ctx
);
1147 /****************************************************************************
1148 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1149 ****************************************************************************/
1151 static int call_nt_transact_create(connection_struct
*conn
,
1152 char *inbuf
, char *outbuf
, int length
,
1153 int bufsize
, char **ppsetup
, char **ppparams
,
1157 char *params
= *ppparams
;
1158 char *data
= *ppdata
;
1159 int total_parameter_count
= (int)IVAL(inbuf
, smb_nt_TotalParameterCount
);
1160 /* Breakout the oplock request bits so we can set the reply bits separately. */
1161 int oplock_request
= 0;
1163 int fmode
=0,rmode
=0;
1164 SMB_OFF_T file_len
= 0;
1165 SMB_STRUCT_STAT sbuf
;
1167 BOOL bad_path
= False
;
1168 files_struct
*fsp
= NULL
;
1170 BOOL extended_oplock_granted
= False
;
1172 uint32 desired_access
;
1173 uint32 file_attributes
;
1174 uint32 share_access
;
1175 uint32 create_disposition
;
1176 uint32 create_options
;
1179 uint16 root_dir_fid
;
1180 SMB_OFF_T allocation_size
;
1188 DEBUG(5,("call_nt_transact_create\n"));
1191 * If it's an IPC, use the pipe handler.
1195 if (lp_nt_pipe_support())
1196 return do_nt_transact_create_pipe(conn
, inbuf
, outbuf
, length
,
1197 bufsize
, ppsetup
, ppparams
, ppdata
);
1199 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
1203 * Ensure minimum number of parameters sent.
1206 if(total_parameter_count
< 54) {
1207 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)total_parameter_count
));
1208 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
1211 flags
= IVAL(params
,0);
1212 desired_access
= IVAL(params
,8);
1213 file_attributes
= IVAL(params
,20);
1214 share_access
= IVAL(params
,24);
1215 create_disposition
= IVAL(params
,28);
1216 create_options
= IVAL(params
,32);
1217 sd_len
= IVAL(params
,36);
1218 fname_len
= MIN(((uint32
)IVAL(params
,44)),((uint32
)sizeof(fname
)-1));
1219 root_dir_fid
= (uint16
)IVAL(params
,4);
1220 smb_attr
= (file_attributes
& SAMBA_ATTRIBUTES_MASK
);
1222 if (create_options
& FILE_OPEN_BY_FILE_ID
) {
1223 END_PROFILE(SMBntcreateX
);
1224 return ERROR_NT(NT_STATUS_NOT_SUPPORTED
);
1228 * We need to construct the open_and_X ofun value from the
1229 * NT values, as that's what our code is structured to accept.
1232 if((smb_ofun
= map_create_disposition( create_disposition
)) == -1)
1233 return ERROR_DOS(ERRDOS
,ERRbadmem
);
1236 * Get the file name.
1239 if(root_dir_fid
!= 0) {
1241 * This filename is relative to a directory fid.
1244 files_struct
*dir_fsp
= file_fsp(params
,4);
1245 size_t dir_name_len
;
1248 return ERROR_DOS(ERRDOS
,ERRbadfid
);
1250 if(!dir_fsp
->is_directory
) {
1251 get_filename_transact(&fname
[0], params
, 53,
1252 total_parameter_count
- 53 - fname_len
, fname_len
);
1255 * Check to see if this is a mac fork of some kind.
1258 if( strchr(fname
, ':'))
1259 return(ERROR_BOTH(NT_STATUS_OBJECT_PATH_NOT_FOUND
,ERRDOS
,ERRbadpath
));
1261 return(ERROR_DOS(ERRDOS
,ERRbadfid
));
1265 * Copy in the base directory name.
1268 pstrcpy( fname
, dir_fsp
->fsp_name
);
1269 dir_name_len
= strlen(fname
);
1272 * Ensure it ends in a '\'.
1275 if((fname
[dir_name_len
-1] != '\\') && (fname
[dir_name_len
-1] != '/')) {
1276 pstrcat(fname
, "\\");
1281 * This next calculation can refuse a correct filename if we're dealing
1282 * with the Win2k unicode bug, but that would be rare. JRA.
1285 if(fname_len
+ dir_name_len
>= sizeof(pstring
))
1286 return(ERROR_DOS(ERRSRV
,ERRfilespecs
));
1288 get_filename_transact(&fname
[dir_name_len
], params
, 53,
1289 total_parameter_count
- 53 - fname_len
, fname_len
);
1292 get_filename_transact(&fname
[0], params
, 53,
1293 total_parameter_count
- 53 - fname_len
, fname_len
);
1296 * Check to see if this is a mac fork of some kind.
1299 if( strchr(fname
, ':'))
1300 return(ERROR_BOTH(NT_STATUS_OBJECT_PATH_NOT_FOUND
,ERRDOS
,ERRbadpath
));
1304 * Now contruct the smb_open_mode value from the desired access
1305 * and the share access.
1308 if((smb_open_mode
= map_share_mode( fname
, create_options
, &desired_access
,
1309 share_access
, file_attributes
)) == -1)
1310 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
1312 oplock_request
= (flags
& REQUEST_OPLOCK
) ? EXCLUSIVE_OPLOCK
: 0;
1313 oplock_request
|= (flags
& REQUEST_BATCH_OPLOCK
) ? BATCH_OPLOCK
: 0;
1316 * Check if POSIX semantics are wanted.
1319 set_posix_case_semantics(file_attributes
);
1321 RESOLVE_DFSPATH(fname
, conn
, inbuf
, outbuf
);
1323 unix_convert(fname
,conn
,0,&bad_path
,&sbuf
);
1325 unixmode
= unix_mode(conn
,smb_attr
| aARCH
, fname
);
1328 * If it's a request for a directory open, deal with it separately.
1331 if(create_options
& FILE_DIRECTORY_FILE
) {
1333 /* Can't open a temp directory. IFS kit test. */
1334 if (file_attributes
& FILE_ATTRIBUTE_TEMPORARY
) {
1335 END_PROFILE(SMBntcreateX
);
1336 return ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
1342 * We will get a create directory here if the Win32
1343 * app specified a security descriptor in the
1344 * CreateDirectory() call.
1347 fsp
= open_directory(conn
, fname
, &sbuf
, desired_access
, smb_open_mode
, smb_ofun
, unixmode
, &smb_action
);
1350 restore_case_semantics(file_attributes
);
1351 set_bad_path_error(errno
, bad_path
);
1352 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
1358 * Ordinary file case.
1361 fsp
= open_file_shared1(conn
,fname
,&sbuf
,desired_access
,smb_open_mode
,smb_ofun
,unixmode
,
1362 oplock_request
,&rmode
,&smb_action
);
1366 if(errno
== EISDIR
) {
1369 * Fail the open if it was explicitly a non-directory file.
1372 if (create_options
& FILE_NON_DIRECTORY_FILE
) {
1373 restore_case_semantics(file_attributes
);
1374 SSVAL(outbuf
, smb_flg2
, SVAL(outbuf
,smb_flg2
) | FLAGS2_32_BIT_ERROR_CODES
);
1375 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY
);
1379 fsp
= open_directory(conn
, fname
, &sbuf
, desired_access
, smb_open_mode
, smb_ofun
, unixmode
, &smb_action
);
1382 restore_case_semantics(file_attributes
);
1383 set_bad_path_error(errno
, bad_path
);
1384 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
1388 restore_case_semantics(file_attributes
);
1389 set_bad_path_error(errno
, bad_path
);
1391 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
1395 file_len
= sbuf
.st_size
;
1396 fmode
= dos_mode(conn
,fname
,&sbuf
);
1398 fmode
= FILE_ATTRIBUTE_NORMAL
;
1401 close_file(fsp
,False
);
1402 restore_case_semantics(file_attributes
);
1403 return ERROR_DOS(ERRDOS
,ERRnoaccess
);
1407 * If the caller set the extended oplock request bit
1408 * and we granted one (by whatever means) - set the
1409 * correct bit for extended oplock reply.
1412 if (oplock_request
&& lp_fake_oplocks(SNUM(conn
)))
1413 extended_oplock_granted
= True
;
1415 if(oplock_request
&& EXCLUSIVE_OPLOCK_TYPE(fsp
->oplock_type
))
1416 extended_oplock_granted
= True
;
1420 * Now try and apply the desired SD.
1423 if (sd_len
&& !set_sd( fsp
, data
, sd_len
, ALL_SECURITY_INFORMATION
, &error_class
, &error_code
)) {
1424 close_file(fsp
,False
);
1425 restore_case_semantics(file_attributes
);
1426 return ERROR_DOS(error_class
, error_code
);
1429 restore_case_semantics(file_attributes
);
1431 /* Save the requested allocation size. */
1432 allocation_size
= IVAL(params
,12);
1433 #ifdef LARGE_SMB_OFF_T
1434 allocation_size
|= (((SMB_OFF_T
)IVAL(params
,16)) << 32);
1436 if (allocation_size
&& (allocation_size
> file_len
)) {
1437 fsp
->initial_allocation_size
= SMB_ROUNDUP(allocation_size
,SMB_ROUNDUP_ALLOCATION_SIZE
);
1438 if (vfs_allocate_file_space(fsp
, fsp
->initial_allocation_size
) == -1) {
1439 close_file(fsp
,False
);
1440 END_PROFILE(SMBntcreateX
);
1441 return ERROR_NT(NT_STATUS_DISK_FULL
);
1444 fsp
->initial_allocation_size
= SMB_ROUNDUP(file_len
,SMB_ROUNDUP_ALLOCATION_SIZE
);
1447 /* Realloc the size of parameters and data we will return */
1448 params
= Realloc(*ppparams
, 69);
1450 return ERROR_DOS(ERRDOS
,ERRnomem
);
1454 memset((char *)params
,'\0',69);
1457 if (extended_oplock_granted
)
1458 SCVAL(p
,0, BATCH_OPLOCK_RETURN
);
1459 else if (LEVEL_II_OPLOCK_TYPE(fsp
->oplock_type
))
1460 SCVAL(p
,0, LEVEL_II_OPLOCK_RETURN
);
1462 SCVAL(p
,0,NO_OPLOCK_RETURN
);
1465 SSVAL(p
,0,fsp
->fnum
);
1467 if ((create_disposition
== FILE_SUPERSEDE
) && (smb_action
== FILE_WAS_OVERWRITTEN
))
1468 SIVAL(p
,0,FILE_WAS_SUPERSEDED
);
1470 SIVAL(p
,0,smb_action
);
1474 c_time
= get_create_time(&sbuf
,lp_fake_dir_create_times(SNUM(conn
)));
1476 if (lp_dos_filetime_resolution(SNUM(conn
))) {
1478 sbuf
.st_atime
&= ~1;
1479 sbuf
.st_mtime
&= ~1;
1480 sbuf
.st_mtime
&= ~1;
1483 put_long_date(p
,c_time
);
1485 put_long_date(p
,sbuf
.st_atime
); /* access time */
1487 put_long_date(p
,sbuf
.st_mtime
); /* write time */
1489 put_long_date(p
,sbuf
.st_mtime
); /* change time */
1491 SIVAL(p
,0,fmode
); /* File Attributes. */
1493 SOFF_T(p
, 0, get_allocation_size(fsp
,&sbuf
));
1495 SOFF_T(p
,0,file_len
);
1497 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname
));
1499 /* Send the required number of replies */
1500 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, params
, 69, *ppdata
, 0);
1505 /****************************************************************************
1506 Reply to a NT CANCEL request.
1507 ****************************************************************************/
1509 int reply_ntcancel(connection_struct
*conn
,
1510 char *inbuf
,char *outbuf
,int length
,int bufsize
)
1513 * Go through and cancel any pending change notifies.
1516 int mid
= SVAL(inbuf
,smb_mid
);
1517 START_PROFILE(SMBntcancel
);
1518 remove_pending_change_notify_requests_by_mid(mid
);
1519 remove_pending_lock_requests_by_mid(mid
);
1521 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid
));
1523 END_PROFILE(SMBntcancel
);
1527 /****************************************************************************
1528 Reply to an unsolicited SMBNTtranss - just ignore it!
1529 ****************************************************************************/
1531 int reply_nttranss(connection_struct
*conn
,
1532 char *inbuf
,char *outbuf
,int length
,int bufsize
)
1534 START_PROFILE(SMBnttranss
);
1535 DEBUG(4,("Ignoring nttranss of length %d\n",length
));
1536 END_PROFILE(SMBnttranss
);
1540 /****************************************************************************
1541 Reply to a notify change - queue the request and
1542 don't allow a directory to be opened.
1543 ****************************************************************************/
1544 static int call_nt_transact_notify_change(connection_struct
*conn
,
1545 char *inbuf
, char *outbuf
, int length
,
1548 char **ppparams
, char **ppdata
)
1550 char *setup
= *ppsetup
;
1554 fsp
= file_fsp(setup
,4);
1555 flags
= IVAL(setup
, 0);
1557 DEBUG(3,("call_nt_transact_notify_change\n"));
1560 return ERROR_DOS(ERRDOS
,ERRbadfid
);
1562 if((!fsp
->is_directory
) || (conn
!= fsp
->conn
))
1563 return ERROR_DOS(ERRDOS
,ERRbadfid
);
1565 if (!change_notify_set(inbuf
, fsp
, conn
, flags
))
1566 return(UNIXERROR(ERRDOS
,ERRbadfid
));
1568 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1569 name = %s\n", fsp
->fsp_name
));
1574 /****************************************************************************
1575 Reply to an NT transact rename command.
1576 ****************************************************************************/
1578 static int call_nt_transact_rename(connection_struct
*conn
,
1579 char *inbuf
, char *outbuf
, int length
,
1581 char **ppsetup
, char **ppparams
, char **ppdata
)
1583 char *params
= *ppparams
;
1585 files_struct
*fsp
= file_fsp(params
, 0);
1586 BOOL replace_if_exists
= (SVAL(params
,2) & RENAME_REPLACE_IF_EXISTS
) ? True
: False
;
1588 uint32 fname_len
= MIN((((uint32
)IVAL(inbuf
,smb_nt_TotalParameterCount
)-4)),
1589 ((uint32
)sizeof(new_name
)-1));
1591 CHECK_FSP(fsp
, conn
);
1592 StrnCpy(new_name
,params
+4,fname_len
);
1593 new_name
[fname_len
] = '\0';
1595 status
= rename_internals(conn
, fsp
->fsp_name
,
1596 new_name
, replace_if_exists
);
1597 if (!NT_STATUS_IS_OK(status
))
1598 return ERROR_NT(status
);
1601 * Rename was successful.
1603 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1605 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1606 fsp
->fsp_name
, new_name
));
1609 * Win2k needs a changenotify request response before it will
1610 * update after a rename..
1613 process_pending_change_notify_queue((time_t)0);
1618 /******************************************************************************
1619 Fake up a completely empty SD.
1620 *******************************************************************************/
1622 static size_t get_null_nt_acl(TALLOC_CTX
*mem_ctx
, SEC_DESC
**ppsd
)
1624 extern DOM_SID global_sid_World
;
1627 *ppsd
= make_standard_sec_desc( mem_ctx
, &global_sid_World
, &global_sid_World
, NULL
, &sd_size
);
1629 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1636 /****************************************************************************
1637 Reply to query a security descriptor - currently this is not implemented (it
1638 is planned to be though). Right now it just returns the same thing NT would
1639 when queried on a FAT filesystem. JRA.
1640 ****************************************************************************/
1642 static int call_nt_transact_query_security_desc(connection_struct
*conn
,
1643 char *inbuf
, char *outbuf
,
1644 int length
, int bufsize
,
1645 char **ppsetup
, char **ppparams
, char **ppdata
)
1647 uint32 max_data_count
= IVAL(inbuf
,smb_nt_MaxDataCount
);
1648 char *params
= *ppparams
;
1649 char *data
= *ppdata
;
1651 SEC_DESC
*psd
= NULL
;
1653 TALLOC_CTX
*mem_ctx
;
1655 files_struct
*fsp
= file_fsp(params
,0);
1658 return ERROR_DOS(ERRDOS
,ERRbadfid
);
1660 DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp
->fsp_name
));
1662 params
= Realloc(*ppparams
, 4);
1664 return ERROR_DOS(ERRDOS
,ERRnomem
);
1668 if ((mem_ctx
= talloc_init()) == NULL
) {
1669 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1670 return ERROR_DOS(ERRDOS
,ERRnomem
);
1674 * Get the permissions to return.
1677 if (!lp_nt_acl_support(SNUM(conn
)))
1678 sd_size
= get_null_nt_acl(mem_ctx
, &psd
);
1680 sd_size
= conn
->vfs_ops
.fget_nt_acl(fsp
, fsp
->fd
, &psd
);
1683 talloc_destroy(mem_ctx
);
1684 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
1687 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %d.\n",(int)sd_size
));
1689 SIVAL(params
,0,(uint32
)sd_size
);
1691 if(max_data_count
< sd_size
) {
1693 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_BUFFER_TOO_SMALL
,
1694 params
, 4, *ppdata
, 0);
1695 talloc_destroy(mem_ctx
);
1700 * Allocate the data we will point this at.
1703 data
= Realloc(*ppdata
, sd_size
);
1705 talloc_destroy(mem_ctx
);
1706 return ERROR_DOS(ERRDOS
,ERRnomem
);
1711 memset(data
, '\0', sd_size
);
1714 * Init the parse struct we will marshall into.
1717 prs_init(&pd
, 0, mem_ctx
, MARSHALL
);
1720 * Setup the prs_struct to point at the memory we just
1724 prs_give_memory( &pd
, data
, (uint32
)sd_size
, False
);
1727 * Finally, linearize into the outgoing buffer.
1730 if(!sec_io_desc( "sd data", &psd
, &pd
, 1)) {
1731 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
1732 security descriptor.\n"));
1734 * Return access denied for want of a better error message..
1736 talloc_destroy(mem_ctx
);
1737 return(UNIXERROR(ERRDOS
,ERRnoaccess
));
1741 * Now we can delete the security descriptor.
1744 talloc_destroy(mem_ctx
);
1746 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, params
, 4, data
, (int)sd_size
);
1750 /****************************************************************************
1751 Reply to set a security descriptor. Map to UNIX perms.
1752 ****************************************************************************/
1754 static int call_nt_transact_set_security_desc(connection_struct
*conn
,
1755 char *inbuf
, char *outbuf
, int length
,
1756 int bufsize
, char **ppsetup
,
1757 char **ppparams
, char **ppdata
)
1759 uint32 total_parameter_count
= IVAL(inbuf
, smb_nts_TotalParameterCount
);
1760 char *params
= *ppparams
;
1761 char *data
= *ppdata
;
1762 uint32 total_data_count
= (uint32
)IVAL(inbuf
, smb_nts_TotalDataCount
);
1763 files_struct
*fsp
= NULL
;
1764 uint32 security_info_sent
= 0;
1768 if(total_parameter_count
< 8)
1769 return ERROR_DOS(ERRDOS
,ERRbadfunc
);
1771 if((fsp
= file_fsp(params
,0)) == NULL
)
1772 return ERROR_DOS(ERRDOS
,ERRbadfid
);
1774 if(!lp_nt_acl_support(SNUM(conn
)))
1777 security_info_sent
= IVAL(params
,4);
1779 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp
->fsp_name
,
1780 (unsigned int)security_info_sent
));
1782 if (total_data_count
== 0)
1783 return ERROR_DOS(ERRDOS
, ERRnoaccess
);
1785 if (!set_sd( fsp
, data
, total_data_count
, security_info_sent
, &error_class
, &error_code
))
1786 return ERROR_DOS(error_class
, error_code
);
1790 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1794 /****************************************************************************
1796 ****************************************************************************/
1798 static int call_nt_transact_ioctl(connection_struct
*conn
,
1799 char *inbuf
, char *outbuf
, int length
,
1801 char **ppsetup
, int setup_count
,
1802 char **ppparams
, int parameter_count
,
1803 char **ppdata
, int data_count
)
1805 unsigned fnum
, control
;
1806 static BOOL logged_message
;
1808 if (setup_count
!= 8) {
1809 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count
));
1810 return ERROR_NT(NT_STATUS_NOT_SUPPORTED
);
1813 fnum
= SVAL(*ppsetup
, 4);
1814 control
= IVAL(*ppsetup
, 0);
1816 DEBUG(6,("call_nt_transact_ioctl: fnum=%d control=0x%x\n",
1820 case NTIOCTL_SET_SPARSE
:
1821 /* pretend this succeeded - tho strictly we should
1822 mark the file sparse (if the local fs supports it)
1823 so we can know if we need to pre-allocate or not */
1824 send_nt_replies(inbuf
, outbuf
, bufsize
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1828 if (!logged_message
) {
1829 logged_message
= True
; /* Only print this once... */
1830 DEBUG(3,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1835 return ERROR_NT(NT_STATUS_NOT_SUPPORTED
);
1838 /****************************************************************************
1839 Reply to a SMBNTtrans.
1840 ****************************************************************************/
1841 int reply_nttrans(connection_struct
*conn
,
1842 char *inbuf
,char *outbuf
,int length
,int bufsize
)
1845 #if 0 /* Not used. */
1846 uint16 max_setup_count
= CVAL(inbuf
, smb_nt_MaxSetupCount
);
1847 uint32 max_parameter_count
= IVAL(inbuf
, smb_nt_MaxParameterCount
);
1848 uint32 max_data_count
= IVAL(inbuf
,smb_nt_MaxDataCount
);
1849 #endif /* Not used. */
1850 uint32 total_parameter_count
= IVAL(inbuf
, smb_nt_TotalParameterCount
);
1851 uint32 total_data_count
= IVAL(inbuf
, smb_nt_TotalDataCount
);
1852 uint32 parameter_count
= IVAL(inbuf
,smb_nt_ParameterCount
);
1853 uint32 parameter_offset
= IVAL(inbuf
,smb_nt_ParameterOffset
);
1854 uint32 data_count
= IVAL(inbuf
,smb_nt_DataCount
);
1855 uint32 data_offset
= IVAL(inbuf
,smb_nt_DataOffset
);
1856 uint16 setup_count
= 2*CVAL(inbuf
,smb_nt_SetupCount
); /* setup count is in *words* */
1857 uint16 function_code
= SVAL( inbuf
, smb_nt_Function
);
1858 char *params
= NULL
, *data
= NULL
, *setup
= NULL
;
1859 uint32 num_params_sofar
, num_data_sofar
;
1860 START_PROFILE(SMBnttrans
);
1862 if(global_oplock_break
&&
1863 ((function_code
== NT_TRANSACT_CREATE
) ||
1864 (function_code
== NT_TRANSACT_RENAME
))) {
1866 * Queue this open message as we are the process of an oplock break.
1869 DEBUG(2,("reply_nttrans: queueing message code 0x%x \
1870 due to being in oplock break state.\n", (unsigned int)function_code
));
1872 push_oplock_pending_smb_message( inbuf
, length
);
1873 END_PROFILE(SMBnttrans
);
1877 if (IS_IPC(conn
) && (function_code
!= NT_TRANSACT_CREATE
)) {
1878 END_PROFILE(SMBnttrans
);
1879 return ERROR_DOS(ERRSRV
,ERRaccess
);
1882 outsize
= set_message(outbuf
,0,0,True
);
1885 * All nttrans messages we handle have smb_wct == 19 + setup_count.
1886 * Ensure this is so as a sanity check.
1889 if(CVAL(inbuf
, smb_wct
) != 19 + (setup_count
/2)) {
1890 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
1891 CVAL(inbuf
, smb_wct
), 19 + (setup_count
/2)));
1892 END_PROFILE(SMBnttrans
);
1893 return ERROR_DOS(ERRSRV
,ERRerror
);
1896 /* Allocate the space for the setup, the maximum needed parameters and data */
1899 setup
= (char *)malloc(setup_count
);
1900 if (total_parameter_count
> 0)
1901 params
= (char *)malloc(total_parameter_count
);
1902 if (total_data_count
> 0)
1903 data
= (char *)malloc(total_data_count
);
1905 if ((total_parameter_count
&& !params
) || (total_data_count
&& !data
) ||
1906 (setup_count
&& !setup
)) {
1910 DEBUG(0,("reply_nttrans : Out of memory\n"));
1911 END_PROFILE(SMBnttrans
);
1912 return ERROR_DOS(ERRDOS
,ERRnomem
);
1915 /* Copy the param and data bytes sent with this request into
1916 the params buffer */
1917 num_params_sofar
= parameter_count
;
1918 num_data_sofar
= data_count
;
1920 if (parameter_count
> total_parameter_count
|| data_count
> total_data_count
)
1921 exit_server("reply_nttrans: invalid sizes in packet.");
1924 memcpy( setup
, &inbuf
[smb_nt_SetupStart
], setup_count
);
1925 DEBUG(10,("reply_nttrans: setup_count = %d\n", setup_count
));
1926 dump_data(10, setup
, setup_count
);
1929 memcpy( params
, smb_base(inbuf
) + parameter_offset
, parameter_count
);
1930 DEBUG(10,("reply_nttrans: parameter_count = %d\n", parameter_count
));
1931 dump_data(10, params
, parameter_count
);
1934 memcpy( data
, smb_base(inbuf
) + data_offset
, data_count
);
1935 DEBUG(10,("reply_nttrans: data_count = %d\n",data_count
));
1936 dump_data(10, data
, data_count
);
1939 if(num_data_sofar
< total_data_count
|| num_params_sofar
< total_parameter_count
) {
1940 /* We need to send an interim response then receive the rest
1941 of the parameter/data bytes */
1942 outsize
= set_message(outbuf
,0,0,True
);
1943 if (!send_smb(smbd_server_fd(),outbuf
))
1944 exit_server("reply_nttrans: send_smb failed.");
1946 while( num_data_sofar
< total_data_count
|| num_params_sofar
< total_parameter_count
) {
1949 ret
= receive_next_smb(inbuf
,bufsize
,SMB_SECONDARY_WAIT
);
1951 if((ret
&& (CVAL(inbuf
, smb_com
) != SMBnttranss
)) || !ret
) {
1952 outsize
= set_message(outbuf
,0,0,True
);
1954 DEBUG(0,("reply_nttrans: Invalid secondary nttrans packet\n"));
1956 DEBUG(0,("reply_nttrans: %s in getting secondary nttrans response.\n",
1957 (smb_read_error
== READ_ERROR
) ? "error" : "timeout" ));
1962 END_PROFILE(SMBnttrans
);
1963 return ERROR_DOS(ERRSRV
,ERRerror
);
1966 /* Revise total_params and total_data in case they have changed downwards */
1967 total_parameter_count
= IVAL(inbuf
, smb_nts_TotalParameterCount
);
1968 total_data_count
= IVAL(inbuf
, smb_nts_TotalDataCount
);
1969 num_params_sofar
+= (parameter_count
= IVAL(inbuf
,smb_nts_ParameterCount
));
1970 num_data_sofar
+= ( data_count
= IVAL(inbuf
, smb_nts_DataCount
));
1971 if (num_params_sofar
> total_parameter_count
|| num_data_sofar
> total_data_count
)
1972 exit_server("reply_nttrans2: data overflow in secondary nttrans packet");
1974 memcpy( ¶ms
[ IVAL(inbuf
, smb_nts_ParameterDisplacement
)],
1975 smb_base(inbuf
) + IVAL(inbuf
, smb_nts_ParameterOffset
), parameter_count
);
1976 memcpy( &data
[IVAL(inbuf
, smb_nts_DataDisplacement
)],
1977 smb_base(inbuf
)+ IVAL(inbuf
, smb_nts_DataOffset
), data_count
);
1981 if (Protocol
>= PROTOCOL_NT1
)
1982 SSVAL(outbuf
,smb_flg2
,SVAL(outbuf
,smb_flg2
) | FLAGS2_IS_LONG_NAME
);
1984 /* Now we must call the relevant NT_TRANS function */
1985 switch(function_code
) {
1986 case NT_TRANSACT_CREATE
:
1987 START_PROFILE_NESTED(NT_transact_create
);
1988 outsize
= call_nt_transact_create(conn
, inbuf
, outbuf
, length
, bufsize
,
1989 &setup
, ¶ms
, &data
);
1990 END_PROFILE_NESTED(NT_transact_create
);
1992 case NT_TRANSACT_IOCTL
:
1993 START_PROFILE_NESTED(NT_transact_ioctl
);
1994 outsize
= call_nt_transact_ioctl(conn
, inbuf
, outbuf
,
1996 &setup
, setup_count
,
1997 ¶ms
, parameter_count
,
1999 END_PROFILE_NESTED(NT_transact_ioctl
);
2001 case NT_TRANSACT_SET_SECURITY_DESC
:
2002 START_PROFILE_NESTED(NT_transact_set_security_desc
);
2003 outsize
= call_nt_transact_set_security_desc(conn
, inbuf
, outbuf
,
2005 &setup
, ¶ms
, &data
);
2006 END_PROFILE_NESTED(NT_transact_set_security_desc
);
2008 case NT_TRANSACT_NOTIFY_CHANGE
:
2009 START_PROFILE_NESTED(NT_transact_notify_change
);
2010 outsize
= call_nt_transact_notify_change(conn
, inbuf
, outbuf
,
2012 &setup
, ¶ms
, &data
);
2013 END_PROFILE_NESTED(NT_transact_notify_change
);
2015 case NT_TRANSACT_RENAME
:
2016 START_PROFILE_NESTED(NT_transact_rename
);
2017 outsize
= call_nt_transact_rename(conn
, inbuf
, outbuf
, length
,
2019 &setup
, ¶ms
, &data
);
2020 END_PROFILE_NESTED(NT_transact_rename
);
2023 case NT_TRANSACT_QUERY_SECURITY_DESC
:
2024 START_PROFILE_NESTED(NT_transact_query_security_desc
);
2025 outsize
= call_nt_transact_query_security_desc(conn
, inbuf
, outbuf
,
2027 &setup
, ¶ms
, &data
);
2028 END_PROFILE_NESTED(NT_transact_query_security_desc
);
2031 /* Error in request */
2032 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code
));
2036 END_PROFILE(SMBnttrans
);
2037 return ERROR_DOS(ERRSRV
,ERRerror
);
2040 /* As we do not know how many data packets will need to be
2041 returned here the various call_nt_transact_xxxx calls
2042 must send their own. Thus a call_nt_transact_xxxx routine only
2043 returns a value other than -1 when it wants to send
2050 END_PROFILE(SMBnttrans
);
2051 return outsize
; /* If a correct response was needed the call_nt_transact_xxxx
2052 calls have already sent it. If outsize != -1 then it is
2053 returning an error packet. */