?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r21147: committing changes for 3.0.24
[Samba.git] / source / smbd / nttrans.c
blob15f427553c8b67e5dde1143c224539f5eb2f4e3c
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int max_send;
25 extern enum protocol_types Protocol;
26 extern int smb_read_error;
27 extern struct current_user current_user;
28
29 static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\spoolss",
41 "\\netdfs",
42 "\\rpcecho",
43 "\\svcctl",
44 "\\eventlog",
45 "\\unixinfo",
46 NULL
47 };
48
49 static char *nttrans_realloc(char **ptr, size_t size)
50 {
51 if (ptr==NULL) {
52 smb_panic("nttrans_realloc() called with NULL ptr\n");
53 }
54
55 *ptr = SMB_REALLOC(*ptr, size);
56 if(*ptr == NULL) {
57 return NULL;
58 }
59 memset(*ptr,'\0',size);
60 return *ptr;
61 }
62
63 /****************************************************************************
64 Send the required number of replies back.
65 We assume all fields other than the data fields are
66 set correctly for the type of call.
67 HACK ! Always assumes smb_setup field is zero.
68 ****************************************************************************/
69
70 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
71 int paramsize, char *pdata, int datasize)
72 {
73 int data_to_send = datasize;
74 int params_to_send = paramsize;
75 int useable_space;
76 char *pp = params;
77 char *pd = pdata;
78 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
79 int alignment_offset = 3;
80 int data_alignment_offset = 0;
81
82 /*
83 * Initially set the wcnt area to be 18 - this is true for all
84 * transNT replies.
85 */
86
87 set_message(outbuf,18,0,True);
88
89 if (NT_STATUS_V(nt_error)) {
90 ERROR_NT(nt_error);
91 }
92
93 /*
94 * If there genuinely are no parameters or data to send just send
95 * the empty packet.
96 */
97
98 if(params_to_send == 0 && data_to_send == 0) {
99 show_msg(outbuf);
100 if (!send_smb(smbd_server_fd(),outbuf)) {
101 exit_server("send_nt_replies: send_smb failed.");
102 }
103 return 0;
104 }
105
106 /*
107 * When sending params and data ensure that both are nicely aligned.
108 * Only do this alignment when there is also data to send - else
109 * can cause NT redirector problems.
110 */
111
112 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
113 data_alignment_offset = 4 - (params_to_send % 4);
114 }
115
116 /*
117 * Space is bufsize minus Netbios over TCP header minus SMB header.
118 * The alignment_offset is to align the param bytes on a four byte
119 * boundary (2 bytes for data len, one byte pad).
120 * NT needs this to work correctly.
121 */
122
123 useable_space = bufsize - ((smb_buf(outbuf)+
124 alignment_offset+data_alignment_offset) -
125 outbuf);
126
127 /*
128 * useable_space can never be more than max_send minus the
129 * alignment offset.
130 */
131
132 useable_space = MIN(useable_space,
133 max_send - (alignment_offset+data_alignment_offset));
134
135
136 while (params_to_send || data_to_send) {
137
138 /*
139 * Calculate whether we will totally or partially fill this packet.
140 */
141
142 total_sent_thistime = params_to_send + data_to_send +
143 alignment_offset + data_alignment_offset;
144
145 /*
146 * We can never send more than useable_space.
147 */
148
149 total_sent_thistime = MIN(total_sent_thistime, useable_space);
150
151 set_message(outbuf, 18, total_sent_thistime, True);
152
153 /*
154 * Set total params and data to be sent.
155 */
156
157 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
158 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
159
160 /*
161 * Calculate how many parameters and data we can fit into
162 * this packet. Parameters get precedence.
163 */
164
165 params_sent_thistime = MIN(params_to_send,useable_space);
166 data_sent_thistime = useable_space - params_sent_thistime;
167 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
168
169 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
170
171 if(params_sent_thistime == 0) {
172 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
173 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
174 } else {
175 /*
176 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
177 * parameter bytes, however the first 4 bytes of outbuf are
178 * the Netbios over TCP header. Thus use smb_base() to subtract
179 * them from the calculation.
180 */
181
182 SIVAL(outbuf,smb_ntr_ParameterOffset,
183 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
184 /*
185 * Absolute displacement of param bytes sent in this packet.
186 */
187
188 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
189 }
190
191 /*
192 * Deal with the data portion.
193 */
194
195 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
196
197 if(data_sent_thistime == 0) {
198 SIVAL(outbuf,smb_ntr_DataOffset,0);
199 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
200 } else {
201 /*
202 * The offset of the data bytes is the offset of the
203 * parameter bytes plus the number of parameters being sent this time.
204 */
205
206 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
207 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
208 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
209 }
210
211 /*
212 * Copy the param bytes into the packet.
213 */
214
215 if(params_sent_thistime) {
216 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
217 }
218
219 /*
220 * Copy in the data bytes
221 */
222
223 if(data_sent_thistime) {
224 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
225 data_alignment_offset,pd,data_sent_thistime);
226 }
227
228 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
229 params_sent_thistime, data_sent_thistime, useable_space));
230 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
231 params_to_send, data_to_send, paramsize, datasize));
232
233 /* Send the packet */
234 show_msg(outbuf);
235 if (!send_smb(smbd_server_fd(),outbuf)) {
236 exit_server("send_nt_replies: send_smb failed.");
237 }
238
239 pp += params_sent_thistime;
240 pd += data_sent_thistime;
241
242 params_to_send -= params_sent_thistime;
243 data_to_send -= data_sent_thistime;
244
245 /*
246 * Sanity check
247 */
248
249 if(params_to_send < 0 || data_to_send < 0) {
250 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
251 params_to_send, data_to_send));
252 return -1;
253 }
254 }
255
256 return 0;
257 }
258
259 /****************************************************************************
260 Is it an NTFS stream name ?
261 ****************************************************************************/
262
263 BOOL is_ntfs_stream_name(const char *fname)
264 {
265 if (lp_posix_pathnames()) {
266 return False;
267 }
268 return (strchr_m(fname, ':') != NULL) ? True : False;
269 }
270
271 /****************************************************************************
272 Save case statics.
273 ****************************************************************************/
274
275 static BOOL saved_case_sensitive;
276 static BOOL saved_case_preserve;
277 static BOOL saved_short_case_preserve;
278
279 /****************************************************************************
280 Save case semantics.
281 ****************************************************************************/
282
283 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
284 {
285 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
286 return;
287 }
288
289 saved_case_sensitive = conn->case_sensitive;
290 saved_case_preserve = conn->case_preserve;
291 saved_short_case_preserve = conn->short_case_preserve;
292
293 /* Set to POSIX. */
294 conn->case_sensitive = True;
295 conn->case_preserve = True;
296 conn->short_case_preserve = True;
297 }
298
299 /****************************************************************************
300 Restore case semantics.
301 ****************************************************************************/
302
303 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
304 {
305 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
306 return;
307 }
308
309 conn->case_sensitive = saved_case_sensitive;
310 conn->case_preserve = saved_case_preserve;
311 conn->short_case_preserve = saved_short_case_preserve;
312 }
313
314 /****************************************************************************
315 Reply to an NT create and X call on a pipe.
316 ****************************************************************************/
317
318 static int nt_open_pipe(char *fname, connection_struct *conn,
319 char *inbuf, char *outbuf, int *ppnum)
320 {
321 smb_np_struct *p = NULL;
322 uint16 vuid = SVAL(inbuf, smb_uid);
323 int i;
324
325 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
326
327 /* See if it is one we want to handle. */
328
329 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
330 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
331 }
332
333 for( i = 0; known_nt_pipes[i]; i++ ) {
334 if( strequal(fname,known_nt_pipes[i])) {
335 break;
336 }
337 }
338
339 if ( known_nt_pipes[i] == NULL ) {
340 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
341 }
342
343 /* Strip \\ off the name. */
344 fname++;
345
346 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
347
348 p = open_rpc_pipe_p(fname, conn, vuid);
349 if (!p) {
350 return(ERROR_DOS(ERRSRV,ERRnofids));
351 }
352
353 *ppnum = p->pnum;
354 return 0;
355 }
356
357 /****************************************************************************
358 Reply to an NT create and X call for pipes.
359 ****************************************************************************/
360
361 static int do_ntcreate_pipe_open(connection_struct *conn,
362 char *inbuf,char *outbuf,int length,int bufsize)
363 {
364 pstring fname;
365 int ret;
366 int pnum = -1;
367 char *p = NULL;
368
369 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
370
371 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
372 return ret;
373 }
374
375 /*
376 * Deal with pipe return.
377 */
378
379 set_message(outbuf,34,0,True);
380
381 p = outbuf + smb_vwv2;
382 p++;
383 SSVAL(p,0,pnum);
384 p += 2;
385 SIVAL(p,0,FILE_WAS_OPENED);
386 p += 4;
387 p += 32;
388 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
389 p += 20;
390 /* File type. */
391 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
392 /* Device state. */
393 SSVAL(p,2, 0x5FF); /* ? */
394
395 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
396
397 return chain_reply(inbuf,outbuf,length,bufsize);
398 }
399
400 /****************************************************************************
401 Reply to an NT create and X call for a quota file.
402 ****************************************************************************/
403
404 int reply_ntcreate_and_X_quota(connection_struct *conn,
405 char *inbuf,
406 char *outbuf,
407 int length,
408 int bufsize,
409 enum FAKE_FILE_TYPE fake_file_type,
410 const char *fname)
411 {
412 int result;
413 char *p;
414 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
415 files_struct *fsp = open_fake_file(conn, fake_file_type, fname, desired_access);
416
417 if (!fsp) {
418 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
419 }
420
421 set_message(outbuf,34,0,True);
422
423 p = outbuf + smb_vwv2;
424
425 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
426 p++;
427 SSVAL(p,0,fsp->fnum);
428 #if 0
429 p += 2;
430 SIVAL(p,0,smb_action);
431 p += 4;
432
433 /* Create time. */
434 put_long_date(p,c_time);
435 p += 8;
436 put_long_date(p,sbuf.st_atime); /* access time */
437 p += 8;
438 put_long_date(p,sbuf.st_mtime); /* write time */
439 p += 8;
440 put_long_date(p,sbuf.st_mtime); /* change time */
441 p += 8;
442 SIVAL(p,0,fattr); /* File Attributes. */
443 p += 4;
444 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
445 p += 8;
446 SOFF_T(p,0,file_len);
447 p += 8;
448 if (flags & EXTENDED_RESPONSE_REQUIRED)
449 SSVAL(p,2,0x7);
450 p += 4;
451 SCVAL(p,0,fsp->is_directory ? 1 : 0);
452 #endif
453
454 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
455
456 result = chain_reply(inbuf,outbuf,length,bufsize);
457 return result;
458 }
459
460 /****************************************************************************
461 Reply to an NT create and X call.
462 ****************************************************************************/
463
464 int reply_ntcreate_and_X(connection_struct *conn,
465 char *inbuf,char *outbuf,int length,int bufsize)
466 {
467 int result;
468 pstring fname;
469 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
470 uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
471 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
472 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
473 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
474 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
475 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
476 /* Breakout the oplock request bits so we can set the
477 reply bits separately. */
478 int oplock_request = 0;
479 uint32 fattr=0;
480 SMB_OFF_T file_len = 0;
481 SMB_STRUCT_STAT sbuf;
482 int info = 0;
483 BOOL bad_path = False;
484 files_struct *fsp=NULL;
485 char *p = NULL;
486 time_t c_time;
487 BOOL extended_oplock_granted = False;
488 NTSTATUS status;
489
490 START_PROFILE(SMBntcreateX);
491
492 DEBUG(10,("reply_ntcreateX: flags = 0x%x, access_mask = 0x%x \
493 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
494 create_options = 0x%x root_dir_fid = 0x%x\n",
495 (unsigned int)flags,
496 (unsigned int)access_mask,
497 (unsigned int)file_attributes,
498 (unsigned int)share_access,
499 (unsigned int)create_disposition,
500 (unsigned int)create_options,
501 (unsigned int)root_dir_fid ));
502
503 /* If it's an IPC, use the pipe handler. */
504
505 if (IS_IPC(conn)) {
506 if (lp_nt_pipe_support()) {
507 END_PROFILE(SMBntcreateX);
508 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
509 } else {
510 END_PROFILE(SMBntcreateX);
511 return(ERROR_DOS(ERRDOS,ERRnoaccess));
512 }
513 }
514
515 if (create_options & FILE_OPEN_BY_FILE_ID) {
516 END_PROFILE(SMBntcreateX);
517 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
518 }
519
520 /*
521 * Get the file name.
522 */
523
524 if(root_dir_fid != 0) {
525 /*
526 * This filename is relative to a directory fid.
527 */
528 pstring rel_fname;
529 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
530 size_t dir_name_len;
531
532 if(!dir_fsp) {
533 END_PROFILE(SMBntcreateX);
534 return(ERROR_DOS(ERRDOS,ERRbadfid));
535 }
536
537 if(!dir_fsp->is_directory) {
538
539 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
540 if (!NT_STATUS_IS_OK(status)) {
541 END_PROFILE(SMBntcreateX);
542 return ERROR_NT(status);
543 }
544
545 /*
546 * Check to see if this is a mac fork of some kind.
547 */
548
549 if( is_ntfs_stream_name(fname)) {
550 END_PROFILE(SMBntcreateX);
551 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
552 }
553
554 /*
555 we need to handle the case when we get a
556 relative open relative to a file and the
557 pathname is blank - this is a reopen!
558 (hint from demyn plantenberg)
559 */
560
561 END_PROFILE(SMBntcreateX);
562 return(ERROR_DOS(ERRDOS,ERRbadfid));
563 }
564
565 /*
566 * Copy in the base directory name.
567 */
568
569 pstrcpy( fname, dir_fsp->fsp_name );
570 dir_name_len = strlen(fname);
571
572 /*
573 * Ensure it ends in a '\'.
574 */
575
576 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
577 pstrcat(fname, "/");
578 dir_name_len++;
579 }
580
581 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
582 if (!NT_STATUS_IS_OK(status)) {
583 END_PROFILE(SMBntcreateX);
584 return ERROR_NT(status);
585 }
586 pstrcat(fname, rel_fname);
587 } else {
588 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
589 if (!NT_STATUS_IS_OK(status)) {
590 END_PROFILE(SMBntcreateX);
591 return ERROR_NT(status);
592 }
593
594 /*
595 * Check to see if this is a mac fork of some kind.
596 */
597
598 if( is_ntfs_stream_name(fname)) {
599 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
600 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
601 /*
602 * Here we go! support for changing the disk quotas --metze
603 *
604 * We need to fake up to open this MAGIC QUOTA file
605 * and return a valid FID.
606 *
607 * w2k close this file directly after openening
608 * xp also tries a QUERY_FILE_INFO on the file and then close it
609 */
610 result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
611 fake_file_type, fname);
612 END_PROFILE(SMBntcreateX);
613 return result;
614 } else {
615 END_PROFILE(SMBntcreateX);
616 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
617 }
618 }
619 }
620
621 /*
622 * Now contruct the smb_open_mode value from the filename,
623 * desired access and the share access.
624 */
625 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
626
627 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
628 if (oplock_request) {
629 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
630 }
631
632 /*
633 * Ordinary file or directory.
634 */
635
636 /*
637 * Check if POSIX semantics are wanted.
638 */
639
640 set_posix_case_semantics(conn, file_attributes);
641
642 unix_convert(fname,conn,0,&bad_path,&sbuf);
643
644 if (bad_path) {
645 restore_case_semantics(conn, file_attributes);
646 END_PROFILE(SMBntcreateX);
647 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
648 }
649 /* All file access must go through check_name() */
650 if (!check_name(fname,conn)) {
651 restore_case_semantics(conn, file_attributes);
652 END_PROFILE(SMBntcreateX);
653 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
654 }
655
656 #if 0
657 /* This is the correct thing to do (check every time) but can_delete is
658 expensive (it may have to read the parent directory permissions). So
659 for now we're not doing it unless we have a strong hint the client
660 is really going to delete this file. */
661 if (desired_access & DELETE_ACCESS) {
662 #else
663 /* Setting FILE_SHARE_DELETE is the hint. */
664 if (lp_acl_check_permissions(SNUM(conn)) && (share_access & FILE_SHARE_DELETE)
665 && (access_mask & DELETE_ACCESS)) {
666 #endif
667 status = can_delete(conn, fname, file_attributes, bad_path, True, False);
668 /* We're only going to fail here if it's access denied, as that's the
669 only error we care about for "can we delete this ?" questions. */
670 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
671 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
672 restore_case_semantics(conn, file_attributes);
673 END_PROFILE(SMBntcreateX);
674 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
675 }
676 }
677
678 /*
679 * If it's a request for a directory open, deal with it separately.
680 */
681
682 if(create_options & FILE_DIRECTORY_FILE) {
683 oplock_request = 0;
684
685 /* Can't open a temp directory. IFS kit test. */
686 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
687 END_PROFILE(SMBntcreateX);
688 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
689 }
690
691 fsp = open_directory(conn, fname, &sbuf,
692 access_mask,
693 share_access,
694 create_disposition,
695 create_options,
696 &info);
697
698 restore_case_semantics(conn, file_attributes);
699
700 if(!fsp) {
701 END_PROFILE(SMBntcreateX);
702 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
703 }
704 } else {
705 /*
706 * Ordinary file case.
707 */
708
709 /* NB. We have a potential bug here. If we
710 * cause an oplock break to ourselves, then we
711 * could end up processing filename related
712 * SMB requests whilst we await the oplock
713 * break response. As we may have changed the
714 * filename case semantics to be POSIX-like,
715 * this could mean a filename request could
716 * fail when it should succeed. This is a rare
717 * condition, but eventually we must arrange
718 * to restore the correct case semantics
719 * before issuing an oplock break request to
720 * our client. JRA. */
721
722 fsp = open_file_ntcreate(conn,fname,&sbuf,
723 access_mask,
724 share_access,
725 create_disposition,
726 create_options,
727 file_attributes,
728 oplock_request,
729 &info);
730 if (!fsp) {
731 /* We cheat here. There are two cases we
732 * care about. One is a directory rename,
733 * where the NT client will attempt to
734 * open the source directory for
735 * DELETE access. Note that when the
736 * NT client does this it does *not*
737 * set the directory bit in the
738 * request packet. This is translated
739 * into a read/write open
740 * request. POSIX states that any open
741 * for write request on a directory
742 * will generate an EISDIR error, so
743 * we can catch this here and open a
744 * pseudo handle that is flagged as a
745 * directory. The second is an open
746 * for a permissions read only, which
747 * we handle in the open_file_stat case. JRA.
748 */
749
750 if(errno == EISDIR) {
751
752 /*
753 * Fail the open if it was explicitly a non-directory file.
754 */
755
756 if (create_options & FILE_NON_DIRECTORY_FILE) {
757 restore_case_semantics(conn, file_attributes);
758 END_PROFILE(SMBntcreateX);
759 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
760 }
761
762 oplock_request = 0;
763 fsp = open_directory(conn, fname, &sbuf,
764 access_mask,
765 share_access,
766 create_disposition,
767 create_options,
768 &info);
769
770 if(!fsp) {
771 restore_case_semantics(conn, file_attributes);
772 END_PROFILE(SMBntcreateX);
773 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
774 }
775 } else {
776
777 restore_case_semantics(conn, file_attributes);
778 END_PROFILE(SMBntcreateX);
779 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
780 /* We have re-scheduled this call. */
781 return -1;
782 }
783 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
784 }
785 }
786 }
787
788 restore_case_semantics(conn, file_attributes);
789
790 file_len = sbuf.st_size;
791 fattr = dos_mode(conn,fname,&sbuf);
792 if(fattr == 0) {
793 fattr = FILE_ATTRIBUTE_NORMAL;
794 }
795 if (!fsp->is_directory && (fattr & aDIR)) {
796 close_file(fsp,ERROR_CLOSE);
797 END_PROFILE(SMBntcreateX);
798 return ERROR_DOS(ERRDOS,ERRnoaccess);
799 }
800
801 /* Save the requested allocation size. */
802 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
803 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
804 #ifdef LARGE_SMB_OFF_T
805 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
806 #endif
807 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
808 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
809 if (fsp->is_directory) {
810 close_file(fsp,ERROR_CLOSE);
811 END_PROFILE(SMBntcreateX);
812 /* Can't set allocation size on a directory. */
813 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
814 }
815 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
816 close_file(fsp,ERROR_CLOSE);
817 END_PROFILE(SMBntcreateX);
818 return ERROR_NT(NT_STATUS_DISK_FULL);
819 }
820 } else {
821 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
822 }
823 }
824
825 /*
826 * If the caller set the extended oplock request bit
827 * and we granted one (by whatever means) - set the
828 * correct bit for extended oplock reply.
829 */
830
831 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
832 extended_oplock_granted = True;
833 }
834
835 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
836 extended_oplock_granted = True;
837 }
838
839 #if 0
840 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
841 set_message(outbuf,42,0,True);
842 #else
843 set_message(outbuf,34,0,True);
844 #endif
845
846 p = outbuf + smb_vwv2;
847
848 /*
849 * Currently as we don't support level II oplocks we just report
850 * exclusive & batch here.
851 */
852
853 if (extended_oplock_granted) {
854 if (flags & REQUEST_BATCH_OPLOCK) {
855 SCVAL(p,0, BATCH_OPLOCK_RETURN);
856 } else {
857 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
858 }
859 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
860 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
861 } else {
862 SCVAL(p,0,NO_OPLOCK_RETURN);
863 }
864
865 p++;
866 SSVAL(p,0,fsp->fnum);
867 p += 2;
868 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
869 SIVAL(p,0,FILE_WAS_SUPERSEDED);
870 } else {
871 SIVAL(p,0,info);
872 }
873 p += 4;
874
875 /* Create time. */
876 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
877
878 if (lp_dos_filetime_resolution(SNUM(conn))) {
879 c_time &= ~1;
880 sbuf.st_atime &= ~1;
881 sbuf.st_mtime &= ~1;
882 sbuf.st_mtime &= ~1;
883 }
884
885 put_long_date(p,c_time);
886 p += 8;
887 put_long_date(p,sbuf.st_atime); /* access time */
888 p += 8;
889 put_long_date(p,sbuf.st_mtime); /* write time */
890 p += 8;
891 put_long_date(p,sbuf.st_mtime); /* change time */
892 p += 8;
893 SIVAL(p,0,fattr); /* File Attributes. */
894 p += 4;
895 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
896 p += 8;
897 SOFF_T(p,0,file_len);
898 p += 8;
899 if (flags & EXTENDED_RESPONSE_REQUIRED) {
900 SSVAL(p,2,0x7);
901 }
902 p += 4;
903 SCVAL(p,0,fsp->is_directory ? 1 : 0);
904
905 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
906
907 result = chain_reply(inbuf,outbuf,length,bufsize);
908 END_PROFILE(SMBntcreateX);
909 return result;
910 }
911
912 /****************************************************************************
913 Reply to a NT_TRANSACT_CREATE call to open a pipe.
914 ****************************************************************************/
915
916 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
917 uint16 **ppsetup, uint32 setup_count,
918 char **ppparams, uint32 parameter_count,
919 char **ppdata, uint32 data_count)
920 {
921 pstring fname;
922 char *params = *ppparams;
923 int ret;
924 int pnum = -1;
925 char *p = NULL;
926 NTSTATUS status;
927
928 /*
929 * Ensure minimum number of parameters sent.
930 */
931
932 if(parameter_count < 54) {
933 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
934 return ERROR_DOS(ERRDOS,ERRnoaccess);
935 }
936
937 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
938 if (!NT_STATUS_IS_OK(status)) {
939 return ERROR_NT(status);
940 }
941
942 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
943 return ret;
944 }
945
946 /* Realloc the size of parameters and data we will return */
947 params = nttrans_realloc(ppparams, 69);
948 if(params == NULL) {
949 return ERROR_DOS(ERRDOS,ERRnomem);
950 }
951
952 p = params;
953 SCVAL(p,0,NO_OPLOCK_RETURN);
954
955 p += 2;
956 SSVAL(p,0,pnum);
957 p += 2;
958 SIVAL(p,0,FILE_WAS_OPENED);
959 p += 8;
960
961 p += 32;
962 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
963 p += 20;
964 /* File type. */
965 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
966 /* Device state. */
967 SSVAL(p,2, 0x5FF); /* ? */
968
969 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
970
971 /* Send the required number of replies */
972 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
973
974 return -1;
975 }
976
977 /****************************************************************************
978 Internal fn to set security descriptors.
979 ****************************************************************************/
980
981 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
982 {
983 prs_struct pd;
984 SEC_DESC *psd = NULL;
985 TALLOC_CTX *mem_ctx;
986 BOOL ret;
987
988 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
989 return NT_STATUS_OK;
990 }
991
992 /*
993 * Init the parse struct we will unmarshall from.
994 */
995
996 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
997 DEBUG(0,("set_sd: talloc_init failed.\n"));
998 return NT_STATUS_NO_MEMORY;
999 }
1000
1001 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1002
1003 /*
1004 * Setup the prs_struct to point at the memory we just
1005 * allocated.
1006 */
1007
1008 prs_give_memory( &pd, data, sd_len, False);
1009
1010 /*
1011 * Finally, unmarshall from the data buffer.
1012 */
1013
1014 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1015 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1016 /*
1017 * Return access denied for want of a better error message..
1018 */
1019 talloc_destroy(mem_ctx);
1020 return NT_STATUS_NO_MEMORY;
1021 }
1022
1023 if (psd->off_owner_sid==0) {
1024 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1025 }
1026 if (psd->off_grp_sid==0) {
1027 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1028 }
1029 if (psd->off_sacl==0) {
1030 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1031 }
1032 if (psd->off_dacl==0) {
1033 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1034 }
1035
1036 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1037
1038 if (!ret) {
1039 talloc_destroy(mem_ctx);
1040 return NT_STATUS_ACCESS_DENIED;
1041 }
1042
1043 talloc_destroy(mem_ctx);
1044
1045 return NT_STATUS_OK;
1046 }
1047
1048 /****************************************************************************
1049 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1050 ****************************************************************************/
1051
1052 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1053 {
1054 struct ea_list *ea_list_head = NULL;
1055 size_t offset = 0;
1056
1057 if (data_size < 4) {
1058 return NULL;
1059 }
1060
1061 while (offset + 4 <= data_size) {
1062 size_t next_offset = IVAL(pdata,offset);
1063 struct ea_list *tmp;
1064 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1065
1066 if (!eal) {
1067 return NULL;
1068 }
1069
1070 DLIST_ADD_END(ea_list_head, eal, tmp);
1071 if (next_offset == 0) {
1072 break;
1073 }
1074 offset += next_offset;
1075 }
1076
1077 return ea_list_head;
1078 }
1079
1080 /****************************************************************************
1081 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1082 ****************************************************************************/
1083
1084 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1085 uint16 **ppsetup, uint32 setup_count,
1086 char **ppparams, uint32 parameter_count,
1087 char **ppdata, uint32 data_count, uint32 max_data_count)
1088 {
1089 pstring fname;
1090 char *params = *ppparams;
1091 char *data = *ppdata;
1092 /* Breakout the oplock request bits so we can set the reply bits separately. */
1093 int oplock_request = 0;
1094 uint32 fattr=0;
1095 SMB_OFF_T file_len = 0;
1096 SMB_STRUCT_STAT sbuf;
1097 int info = 0;
1098 BOOL bad_path = False;
1099 files_struct *fsp = NULL;
1100 char *p = NULL;
1101 BOOL extended_oplock_granted = False;
1102 uint32 flags;
1103 uint32 access_mask;
1104 uint32 file_attributes;
1105 uint32 share_access;
1106 uint32 create_disposition;
1107 uint32 create_options;
1108 uint32 sd_len;
1109 uint32 ea_len;
1110 uint16 root_dir_fid;
1111 time_t c_time;
1112 struct ea_list *ea_list = NULL;
1113 TALLOC_CTX *ctx = NULL;
1114 char *pdata = NULL;
1115 NTSTATUS status;
1116
1117 DEBUG(5,("call_nt_transact_create\n"));
1118
1119 /*
1120 * If it's an IPC, use the pipe handler.
1121 */
1122
1123 if (IS_IPC(conn)) {
1124 if (lp_nt_pipe_support()) {
1125 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1126 bufsize,
1127 ppsetup, setup_count,
1128 ppparams, parameter_count,
1129 ppdata, data_count);
1130 } else {
1131 return ERROR_DOS(ERRDOS,ERRnoaccess);
1132 }
1133 }
1134
1135 /*
1136 * Ensure minimum number of parameters sent.
1137 */
1138
1139 if(parameter_count < 54) {
1140 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1141 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1142 }
1143
1144 flags = IVAL(params,0);
1145 access_mask = IVAL(params,8);
1146 file_attributes = IVAL(params,20);
1147 share_access = IVAL(params,24);
1148 create_disposition = IVAL(params,28);
1149 create_options = IVAL(params,32);
1150 sd_len = IVAL(params,36);
1151 ea_len = IVAL(params,40);
1152 root_dir_fid = (uint16)IVAL(params,4);
1153
1154 /* Ensure the data_len is correct for the sd and ea values given. */
1155 if ((ea_len + sd_len > data_count) ||
1156 (ea_len > data_count) || (sd_len > data_count) ||
1157 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1158 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1159 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1160 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1161 }
1162
1163 if (ea_len) {
1164 if (!lp_ea_support(SNUM(conn))) {
1165 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1166 (unsigned int)ea_len ));
1167 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1168 }
1169
1170 if (ea_len < 10) {
1171 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1172 (unsigned int)ea_len ));
1173 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1174 }
1175 }
1176
1177 if (create_options & FILE_OPEN_BY_FILE_ID) {
1178 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1179 }
1180
1181 /*
1182 * Get the file name.
1183 */
1184
1185 if(root_dir_fid != 0) {
1186 /*
1187 * This filename is relative to a directory fid.
1188 */
1189 files_struct *dir_fsp = file_fsp(params,4);
1190 size_t dir_name_len;
1191
1192 if(!dir_fsp) {
1193 return ERROR_DOS(ERRDOS,ERRbadfid);
1194 }
1195
1196 if(!dir_fsp->is_directory) {
1197 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1198 if (!NT_STATUS_IS_OK(status)) {
1199 return ERROR_NT(status);
1200 }
1201
1202 /*
1203 * Check to see if this is a mac fork of some kind.
1204 */
1205
1206 if( is_ntfs_stream_name(fname)) {
1207 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1208 }
1209
1210 return ERROR_DOS(ERRDOS,ERRbadfid);
1211 }
1212
1213 /*
1214 * Copy in the base directory name.
1215 */
1216
1217 pstrcpy( fname, dir_fsp->fsp_name );
1218 dir_name_len = strlen(fname);
1219
1220 /*
1221 * Ensure it ends in a '\'.
1222 */
1223
1224 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1225 pstrcat(fname, "/");
1226 dir_name_len++;
1227 }
1228
1229 {
1230 pstring tmpname;
1231 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1232 if (!NT_STATUS_IS_OK(status)) {
1233 return ERROR_NT(status);
1234 }
1235 pstrcat(fname, tmpname);
1236 }
1237 } else {
1238 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1239 if (!NT_STATUS_IS_OK(status)) {
1240 return ERROR_NT(status);
1241 }
1242
1243 /*
1244 * Check to see if this is a mac fork of some kind.
1245 */
1246
1247 if( is_ntfs_stream_name(fname)) {
1248 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1249 }
1250 }
1251
1252 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1253 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1254
1255 /*
1256 * Check if POSIX semantics are wanted.
1257 */
1258
1259 set_posix_case_semantics(conn, file_attributes);
1260
1261 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1262
1263 unix_convert(fname,conn,0,&bad_path,&sbuf);
1264 if (bad_path) {
1265 restore_case_semantics(conn, file_attributes);
1266 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1267 }
1268 /* All file access must go through check_name() */
1269 if (!check_name(fname,conn)) {
1270 restore_case_semantics(conn, file_attributes);
1271 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
1272 }
1273
1274 #if 0
1275 /* This is the correct thing to do (check every time) but can_delete is
1276 expensive (it may have to read the parent directory permissions). So
1277 for now we're not doing it unless we have a strong hint the client
1278 is really going to delete this file. */
1279 if (desired_access & DELETE_ACCESS) {
1280 #else
1281 /* Setting FILE_SHARE_DELETE is the hint. */
1282 if (lp_acl_check_permissions(SNUM(conn)) && (share_access & FILE_SHARE_DELETE) && (access_mask & DELETE_ACCESS)) {
1283 #endif
1284 status = can_delete(conn, fname, file_attributes, bad_path, True, False);
1285 /* We're only going to fail here if it's access denied, as that's the
1286 only error we care about for "can we delete this ?" questions. */
1287 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
1288 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
1289 restore_case_semantics(conn, file_attributes);
1290 return ERROR_NT(status);
1291 }
1292 }
1293
1294 if (ea_len) {
1295 ctx = talloc_init("NTTRANS_CREATE_EA");
1296 if (!ctx) {
1297 talloc_destroy(ctx);
1298 restore_case_semantics(conn, file_attributes);
1299 return ERROR_NT(NT_STATUS_NO_MEMORY);
1300 }
1301
1302 pdata = data + sd_len;
1303
1304 /* We have already checked that ea_len <= data_count here. */
1305 ea_list = read_nttrans_ea_list(ctx, pdata, ea_len);
1306 if (!ea_list ) {
1307 talloc_destroy(ctx);
1308 restore_case_semantics(conn, file_attributes);
1309 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1310 }
1311 }
1312
1313 /*
1314 * If it's a request for a directory open, deal with it separately.
1315 */
1316
1317 if(create_options & FILE_DIRECTORY_FILE) {
1318
1319 /* Can't open a temp directory. IFS kit test. */
1320 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1321 talloc_destroy(ctx);
1322 restore_case_semantics(conn, file_attributes);
1323 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1324 }
1325
1326 oplock_request = 0;
1327
1328 /*
1329 * We will get a create directory here if the Win32
1330 * app specified a security descriptor in the
1331 * CreateDirectory() call.
1332 */
1333
1334 fsp = open_directory(conn, fname, &sbuf,
1335 access_mask,
1336 share_access,
1337 create_disposition,
1338 create_options,
1339 &info);
1340 if(!fsp) {
1341 talloc_destroy(ctx);
1342 restore_case_semantics(conn, file_attributes);
1343 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1344 }
1345
1346 } else {
1347
1348 /*
1349 * Ordinary file case.
1350 */
1351
1352 fsp = open_file_ntcreate(conn,fname,&sbuf,
1353 access_mask,
1354 share_access,
1355 create_disposition,
1356 create_options,
1357 file_attributes,
1358 oplock_request,
1359 &info);
1360
1361 if (!fsp) {
1362 if(errno == EISDIR) {
1363
1364 /*
1365 * Fail the open if it was explicitly a non-directory file.
1366 */
1367
1368 if (create_options & FILE_NON_DIRECTORY_FILE) {
1369 restore_case_semantics(conn, file_attributes);
1370 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1371 }
1372
1373 oplock_request = 0;
1374 fsp = open_directory(conn, fname, &sbuf,
1375 access_mask,
1376 share_access,
1377 create_disposition,
1378 create_options,
1379 &info);
1380 if(!fsp) {
1381 talloc_destroy(ctx);
1382 restore_case_semantics(conn, file_attributes);
1383 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1384 }
1385 } else {
1386 talloc_destroy(ctx);
1387 restore_case_semantics(conn, file_attributes);
1388 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1389 /* We have re-scheduled this call. */
1390 return -1;
1391 }
1392 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1393 }
1394 }
1395 }
1396
1397 /*
1398 * According to the MS documentation, the only time the security
1399 * descriptor is applied to the opened file is iff we *created* the
1400 * file; an existing file stays the same.
1401 *
1402 * Also, it seems (from observation) that you can open the file with
1403 * any access mask but you can still write the sd. We need to override
1404 * the granted access before we call set_sd
1405 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1406 */
1407
1408 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1409 uint32 saved_access_mask = fsp->access_mask;
1410
1411 /* We have already checked that sd_len <= data_count here. */
1412
1413 fsp->access_mask = FILE_GENERIC_ALL;
1414
1415 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1416 if (!NT_STATUS_IS_OK(status)) {
1417 talloc_destroy(ctx);
1418 close_file(fsp,ERROR_CLOSE);
1419 restore_case_semantics(conn, file_attributes);
1420 return ERROR_NT(status);
1421 }
1422 fsp->access_mask = saved_access_mask;
1423 }
1424
1425 if (ea_len && (info == FILE_WAS_CREATED)) {
1426 status = set_ea(conn, fsp, fname, ea_list);
1427 talloc_destroy(ctx);
1428 if (!NT_STATUS_IS_OK(status)) {
1429 close_file(fsp,ERROR_CLOSE);
1430 restore_case_semantics(conn, file_attributes);
1431 return ERROR_NT(status);
1432 }
1433 }
1434
1435 restore_case_semantics(conn, file_attributes);
1436
1437 file_len = sbuf.st_size;
1438 fattr = dos_mode(conn,fname,&sbuf);
1439 if(fattr == 0) {
1440 fattr = FILE_ATTRIBUTE_NORMAL;
1441 }
1442 if (!fsp->is_directory && (fattr & aDIR)) {
1443 close_file(fsp,ERROR_CLOSE);
1444 return ERROR_DOS(ERRDOS,ERRnoaccess);
1445 }
1446
1447 /* Save the requested allocation size. */
1448 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1449 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1450 #ifdef LARGE_SMB_OFF_T
1451 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1452 #endif
1453 if (allocation_size && (allocation_size > file_len)) {
1454 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1455 if (fsp->is_directory) {
1456 close_file(fsp,ERROR_CLOSE);
1457 /* Can't set allocation size on a directory. */
1458 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1459 }
1460 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1461 close_file(fsp,ERROR_CLOSE);
1462 return ERROR_NT(NT_STATUS_DISK_FULL);
1463 }
1464 } else {
1465 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1466 }
1467 }
1468
1469 /*
1470 * If the caller set the extended oplock request bit
1471 * and we granted one (by whatever means) - set the
1472 * correct bit for extended oplock reply.
1473 */
1474
1475 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1476 extended_oplock_granted = True;
1477 }
1478
1479 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1480 extended_oplock_granted = True;
1481 }
1482
1483 /* Realloc the size of parameters and data we will return */
1484 params = nttrans_realloc(ppparams, 69);
1485 if(params == NULL) {
1486 return ERROR_DOS(ERRDOS,ERRnomem);
1487 }
1488
1489 p = params;
1490 if (extended_oplock_granted) {
1491 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1492 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
1493 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1494 } else {
1495 SCVAL(p,0,NO_OPLOCK_RETURN);
1496 }
1497
1498 p += 2;
1499 SSVAL(p,0,fsp->fnum);
1500 p += 2;
1501 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1502 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1503 } else {
1504 SIVAL(p,0,info);
1505 }
1506 p += 8;
1507
1508 /* Create time. */
1509 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1510
1511 if (lp_dos_filetime_resolution(SNUM(conn))) {
1512 c_time &= ~1;
1513 sbuf.st_atime &= ~1;
1514 sbuf.st_mtime &= ~1;
1515 sbuf.st_mtime &= ~1;
1516 }
1517
1518 put_long_date(p,c_time);
1519 p += 8;
1520 put_long_date(p,sbuf.st_atime); /* access time */
1521 p += 8;
1522 put_long_date(p,sbuf.st_mtime); /* write time */
1523 p += 8;
1524 put_long_date(p,sbuf.st_mtime); /* change time */
1525 p += 8;
1526 SIVAL(p,0,fattr); /* File Attributes. */
1527 p += 4;
1528 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1529 p += 8;
1530 SOFF_T(p,0,file_len);
1531 p += 8;
1532 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1533 SSVAL(p,2,0x7);
1534 }
1535 p += 4;
1536 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1537
1538 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1539
1540 /* Send the required number of replies */
1541 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1542
1543 return -1;
1544 }
1545
1546 /****************************************************************************
1547 Reply to a NT CANCEL request.
1548 conn POINTER CAN BE NULL HERE !
1549 ****************************************************************************/
1550
1551 int reply_ntcancel(connection_struct *conn,
1552 char *inbuf,char *outbuf,int length,int bufsize)
1553 {
1554 /*
1555 * Go through and cancel any pending change notifies.
1556 */
1557
1558 int mid = SVAL(inbuf,smb_mid);
1559 START_PROFILE(SMBntcancel);
1560 remove_pending_change_notify_requests_by_mid(mid);
1561 remove_pending_lock_requests_by_mid(mid);
1562 srv_cancel_sign_response(mid);
1563
1564 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1565
1566 END_PROFILE(SMBntcancel);
1567 return(-1);
1568 }
1569
1570 /****************************************************************************
1571 Copy a file.
1572 ****************************************************************************/
1573
1574 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint32 attrs)
1575 {
1576 BOOL bad_path_oldname = False;
1577 BOOL bad_path_newname = False;
1578 SMB_STRUCT_STAT sbuf1, sbuf2;
1579 pstring last_component_oldname;
1580 pstring last_component_newname;
1581 files_struct *fsp1,*fsp2;
1582 uint32 fattr;
1583 int info;
1584 SMB_OFF_T ret=-1;
1585 int close_ret;
1586 NTSTATUS status = NT_STATUS_OK;
1587
1588 ZERO_STRUCT(sbuf1);
1589 ZERO_STRUCT(sbuf2);
1590
1591 /* No wildcards. */
1592 if (ms_has_wild(newname) || ms_has_wild(oldname)) {
1593 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1594 }
1595
1596 if (!CAN_WRITE(conn))
1597 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1598
1599 unix_convert(oldname,conn,last_component_oldname,&bad_path_oldname,&sbuf1);
1600 if (bad_path_oldname) {
1601 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1602 }
1603
1604 /* Quick check for "." and ".." */
1605 if (last_component_oldname[0] == '.') {
1606 if (!last_component_oldname[1] || (last_component_oldname[1] == '.' && !last_component_oldname[2])) {
1607 return NT_STATUS_OBJECT_NAME_INVALID;
1608 }
1609 }
1610
1611 /* Source must already exist. */
1612 if (!VALID_STAT(sbuf1)) {
1613 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1614 }
1615 if (!check_name(oldname,conn)) {
1616 return NT_STATUS_ACCESS_DENIED;
1617 }
1618
1619 /* Ensure attributes match. */
1620 fattr = dos_mode(conn,oldname,&sbuf1);
1621 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1622 return NT_STATUS_NO_SUCH_FILE;
1623 }
1624
1625 unix_convert(newname,conn,last_component_newname,&bad_path_newname,&sbuf2);
1626 if (bad_path_newname) {
1627 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1628 }
1629
1630 /* Quick check for "." and ".." */
1631 if (last_component_newname[0] == '.') {
1632 if (!last_component_newname[1] || (last_component_newname[1] == '.' && !last_component_newname[2])) {
1633 return NT_STATUS_OBJECT_NAME_INVALID;
1634 }
1635 }
1636
1637 /* Disallow if newname already exists. */
1638 if (VALID_STAT(sbuf2)) {
1639 return NT_STATUS_OBJECT_NAME_COLLISION;
1640 }
1641
1642 if (!check_name(newname,conn)) {
1643 return NT_STATUS_ACCESS_DENIED;
1644 }
1645
1646 /* No links from a directory. */
1647 if (S_ISDIR(sbuf1.st_mode)) {
1648 return NT_STATUS_FILE_IS_A_DIRECTORY;
1649 }
1650
1651 /* Ensure this is within the share. */
1652 if (!reduce_name(conn, oldname) != 0) {
1653 return NT_STATUS_ACCESS_DENIED;
1654 }
1655
1656 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1657
1658 fsp1 = open_file_ntcreate(conn,oldname,&sbuf1,
1659 FILE_READ_DATA, /* Read-only. */
1660 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1661 FILE_OPEN,
1662 0, /* No create options. */
1663 FILE_ATTRIBUTE_NORMAL,
1664 NO_OPLOCK,
1665 &info);
1666
1667 if (!fsp1) {
1668 status = get_saved_ntstatus();
1669 if (NT_STATUS_IS_OK(status)) {
1670 status = NT_STATUS_ACCESS_DENIED;
1671 }
1672 set_saved_ntstatus(NT_STATUS_OK);
1673 return status;
1674 }
1675
1676 fsp2 = open_file_ntcreate(conn,newname,&sbuf2,
1677 FILE_WRITE_DATA, /* Write-only. */
1678 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1679 FILE_CREATE,
1680 0, /* No create options. */
1681 fattr,
1682 NO_OPLOCK,
1683 &info);
1684
1685 if (!fsp2) {
1686 status = get_saved_ntstatus();
1687 if (NT_STATUS_IS_OK(status)) {
1688 status = NT_STATUS_ACCESS_DENIED;
1689 }
1690 set_saved_ntstatus(NT_STATUS_OK);
1691 close_file(fsp1,ERROR_CLOSE);
1692 return status;
1693 }
1694
1695 if (sbuf1.st_size) {
1696 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1697 }
1698
1699 /*
1700 * As we are opening fsp1 read-only we only expect
1701 * an error on close on fsp2 if we are out of space.
1702 * Thus we don't look at the error return from the
1703 * close of fsp1.
1704 */
1705 close_file(fsp1,NORMAL_CLOSE);
1706
1707 /* Ensure the modtime is set correctly on the destination file. */
1708 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1709
1710 close_ret = close_file(fsp2,NORMAL_CLOSE);
1711
1712 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1713 creates the file. This isn't the correct thing to do in the copy
1714 case. JRA */
1715 file_set_dosmode(conn, newname, fattr, &sbuf2, True);
1716
1717 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1718 return NT_STATUS_DISK_FULL;
1719 }
1720
1721 if (close_ret != 0) {
1722 status = map_nt_error_from_unix(close_ret);
1723 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1724 nt_errstr(status), oldname, newname));
1725 }
1726 return status;
1727 }
1728
1729 /****************************************************************************
1730 Reply to a NT rename request.
1731 ****************************************************************************/
1732
1733 int reply_ntrename(connection_struct *conn,
1734 char *inbuf,char *outbuf,int length,int bufsize)
1735 {
1736 int outsize = 0;
1737 pstring oldname;
1738 pstring newname;
1739 char *p;
1740 NTSTATUS status;
1741 BOOL path_contains_wcard = False;
1742 uint32 attrs = SVAL(inbuf,smb_vwv0);
1743 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1744
1745 START_PROFILE(SMBntrename);
1746
1747 p = smb_buf(inbuf) + 1;
1748 p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &path_contains_wcard);
1749 if (!NT_STATUS_IS_OK(status)) {
1750 END_PROFILE(SMBntrename);
1751 return ERROR_NT(status);
1752 }
1753
1754 if( is_ntfs_stream_name(oldname)) {
1755 /* Can't rename a stream. */
1756 END_PROFILE(SMBntrename);
1757 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1758 }
1759
1760 if (ms_has_wild(oldname)) {
1761 END_PROFILE(SMBntrename);
1762 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1763 }
1764
1765 p++;
1766 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
1767 if (!NT_STATUS_IS_OK(status)) {
1768 END_PROFILE(SMBntrename);
1769 return ERROR_NT(status);
1770 }
1771
1772 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1773 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1774
1775 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1776
1777 switch(rename_type) {
1778 case RENAME_FLAG_RENAME:
1779 status = rename_internals(conn, oldname, newname, attrs, False, path_contains_wcard);
1780 break;
1781 case RENAME_FLAG_HARD_LINK:
1782 status = hardlink_internals(conn, oldname, newname);
1783 break;
1784 case RENAME_FLAG_COPY:
1785 if (path_contains_wcard) {
1786 /* No wildcards. */
1787 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1788 } else {
1789 status = copy_internals(conn, oldname, newname, attrs);
1790 }
1791 break;
1792 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1793 status = NT_STATUS_INVALID_PARAMETER;
1794 break;
1795 default:
1796 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1797 break;
1798 }
1799
1800 if (!NT_STATUS_IS_OK(status)) {
1801 END_PROFILE(SMBntrename);
1802 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1803 /* We have re-scheduled this call. */
1804 return -1;
1805 }
1806 return ERROR_NT(status);
1807 }
1808
1809 /*
1810 * Win2k needs a changenotify request response before it will
1811 * update after a rename..
1812 */
1813 process_pending_change_notify_queue((time_t)0);
1814 outsize = set_message(outbuf,0,0,False);
1815
1816 END_PROFILE(SMBntrename);
1817 return(outsize);
1818 }
1819
1820 /****************************************************************************
1821 Reply to a notify change - queue the request and
1822 don't allow a directory to be opened.
1823 ****************************************************************************/
1824
1825 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1826 uint16 **ppsetup, uint32 setup_count,
1827 char **ppparams, uint32 parameter_count,
1828 char **ppdata, uint32 data_count, uint32 max_data_count)
1829 {
1830 uint16 *setup = *ppsetup;
1831 files_struct *fsp;
1832 uint32 flags;
1833
1834 if(setup_count < 6) {
1835 return ERROR_DOS(ERRDOS,ERRbadfunc);
1836 }
1837
1838 fsp = file_fsp((char *)setup,4);
1839 flags = IVAL(setup, 0);
1840
1841 DEBUG(3,("call_nt_transact_notify_change\n"));
1842
1843 if(!fsp) {
1844 return ERROR_DOS(ERRDOS,ERRbadfid);
1845 }
1846
1847 if((!fsp->is_directory) || (conn != fsp->conn)) {
1848 return ERROR_DOS(ERRDOS,ERRbadfid);
1849 }
1850
1851 if (!change_notify_set(inbuf, fsp, conn, flags)) {
1852 return(UNIXERROR(ERRDOS,ERRbadfid));
1853 }
1854
1855 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1856 name = %s\n", fsp->fsp_name ));
1857
1858 return -1;
1859 }
1860
1861 /****************************************************************************
1862 Reply to an NT transact rename command.
1863 ****************************************************************************/
1864
1865 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1866 uint16 **ppsetup, uint32 setup_count,
1867 char **ppparams, uint32 parameter_count,
1868 char **ppdata, uint32 data_count, uint32 max_data_count)
1869 {
1870 char *params = *ppparams;
1871 pstring new_name;
1872 files_struct *fsp = NULL;
1873 BOOL replace_if_exists = False;
1874 BOOL path_contains_wcard = False;
1875 NTSTATUS status;
1876
1877 if(parameter_count < 4) {
1878 return ERROR_DOS(ERRDOS,ERRbadfunc);
1879 }
1880
1881 fsp = file_fsp(params, 0);
1882 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1883 CHECK_FSP(fsp, conn);
1884 srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status, &path_contains_wcard);
1885 if (!NT_STATUS_IS_OK(status)) {
1886 return ERROR_NT(status);
1887 }
1888
1889 status = rename_internals(conn, fsp->fsp_name,
1890 new_name, 0, replace_if_exists, path_contains_wcard);
1891
1892 if (!NT_STATUS_IS_OK(status)) {
1893 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1894 /* We have re-scheduled this call. */
1895 return -1;
1896 }
1897 return ERROR_NT(status);
1898 }
1899
1900 /*
1901 * Rename was successful.
1902 */
1903 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1904
1905 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1906 fsp->fsp_name, new_name));
1907
1908 /*
1909 * Win2k needs a changenotify request response before it will
1910 * update after a rename..
1911 */
1912
1913 process_pending_change_notify_queue((time_t)0);
1914
1915 return -1;
1916 }
1917
1918 /******************************************************************************
1919 Fake up a completely empty SD.
1920 *******************************************************************************/
1921
1922 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1923 {
1924 size_t sd_size;
1925
1926 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1927 if(!*ppsd) {
1928 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1929 sd_size = 0;
1930 }
1931
1932 return sd_size;
1933 }
1934
1935 /****************************************************************************
1936 Reply to query a security descriptor.
1937 ****************************************************************************/
1938
1939 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1940 uint16 **ppsetup, uint32 setup_count,
1941 char **ppparams, uint32 parameter_count,
1942 char **ppdata, uint32 data_count, uint32 max_data_count)
1943 {
1944 char *params = *ppparams;
1945 char *data = *ppdata;
1946 prs_struct pd;
1947 SEC_DESC *psd = NULL;
1948 size_t sd_size;
1949 uint32 security_info_wanted;
1950 TALLOC_CTX *mem_ctx;
1951 files_struct *fsp = NULL;
1952
1953 if(parameter_count < 8) {
1954 return ERROR_DOS(ERRDOS,ERRbadfunc);
1955 }
1956
1957 fsp = file_fsp(params,0);
1958 if(!fsp) {
1959 return ERROR_DOS(ERRDOS,ERRbadfid);
1960 }
1961
1962 security_info_wanted = IVAL(params,4);
1963
1964 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1965 (unsigned int)security_info_wanted ));
1966
1967 params = nttrans_realloc(ppparams, 4);
1968 if(params == NULL) {
1969 return ERROR_DOS(ERRDOS,ERRnomem);
1970 }
1971
1972 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1973 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1974 return ERROR_DOS(ERRDOS,ERRnomem);
1975 }
1976
1977 /*
1978 * Get the permissions to return.
1979 */
1980
1981 if (!lp_nt_acl_support(SNUM(conn))) {
1982 sd_size = get_null_nt_acl(mem_ctx, &psd);
1983 } else {
1984 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
1985 }
1986
1987 if (sd_size == 0) {
1988 talloc_destroy(mem_ctx);
1989 return(UNIXERROR(ERRDOS,ERRnoaccess));
1990 }
1991
1992 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1993
1994 SIVAL(params,0,(uint32)sd_size);
1995
1996 if(max_data_count < sd_size) {
1997
1998 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
1999 params, 4, *ppdata, 0);
2000 talloc_destroy(mem_ctx);
2001 return -1;
2002 }
2003
2004 /*
2005 * Allocate the data we will point this at.
2006 */
2007
2008 data = nttrans_realloc(ppdata, sd_size);
2009 if(data == NULL) {
2010 talloc_destroy(mem_ctx);
2011 return ERROR_DOS(ERRDOS,ERRnomem);
2012 }
2013
2014 /*
2015 * Init the parse struct we will marshall into.
2016 */
2017
2018 prs_init(&pd, 0, mem_ctx, MARSHALL);
2019
2020 /*
2021 * Setup the prs_struct to point at the memory we just
2022 * allocated.
2023 */
2024
2025 prs_give_memory( &pd, data, (uint32)sd_size, False);
2026
2027 /*
2028 * Finally, linearize into the outgoing buffer.
2029 */
2030
2031 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2032 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2033 security descriptor.\n"));
2034 /*
2035 * Return access denied for want of a better error message..
2036 */
2037 talloc_destroy(mem_ctx);
2038 return(UNIXERROR(ERRDOS,ERRnoaccess));
2039 }
2040
2041 /*
2042 * Now we can delete the security descriptor.
2043 */
2044
2045 talloc_destroy(mem_ctx);
2046
2047 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
2048 return -1;
2049 }
2050
2051 /****************************************************************************
2052 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2053 ****************************************************************************/
2054
2055 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2056 uint16 **ppsetup, uint32 setup_count,
2057 char **ppparams, uint32 parameter_count,
2058 char **ppdata, uint32 data_count, uint32 max_data_count)
2059 {
2060 char *params= *ppparams;
2061 char *data = *ppdata;
2062 files_struct *fsp = NULL;
2063 uint32 security_info_sent = 0;
2064 NTSTATUS nt_status;
2065
2066 if(parameter_count < 8) {
2067 return ERROR_DOS(ERRDOS,ERRbadfunc);
2068 }
2069
2070 if((fsp = file_fsp(params,0)) == NULL) {
2071 return ERROR_DOS(ERRDOS,ERRbadfid);
2072 }
2073
2074 if(!lp_nt_acl_support(SNUM(conn))) {
2075 goto done;
2076 }
2077
2078 security_info_sent = IVAL(params,4);
2079
2080 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2081 (unsigned int)security_info_sent ));
2082
2083 if (data_count == 0) {
2084 return ERROR_DOS(ERRDOS, ERRnoaccess);
2085 }
2086
2087 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2088 return ERROR_NT(nt_status);
2089 }
2090
2091 done:
2092
2093 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2094 return -1;
2095 }
2096
2097 /****************************************************************************
2098 Reply to NT IOCTL
2099 ****************************************************************************/
2100
2101 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2102 uint16 **ppsetup, uint32 setup_count,
2103 char **ppparams, uint32 parameter_count,
2104 char **ppdata, uint32 data_count, uint32 max_data_count)
2105 {
2106 uint32 function;
2107 uint16 fidnum;
2108 files_struct *fsp;
2109 uint8 isFSctl;
2110 uint8 compfilter;
2111 static BOOL logged_message;
2112 char *pdata = *ppdata;
2113
2114 if (setup_count != 8) {
2115 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2116 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2117 }
2118
2119 function = IVAL(*ppsetup, 0);
2120 fidnum = SVAL(*ppsetup, 4);
2121 isFSctl = CVAL(*ppsetup, 6);
2122 compfilter = CVAL(*ppsetup, 7);
2123
2124 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2125 function, fidnum, isFSctl, compfilter));
2126
2127 fsp=file_fsp((char *)*ppsetup, 4);
2128 /* this check is done in each implemented function case for now
2129 because I don't want to break anything... --metze
2130 FSP_BELONGS_CONN(fsp,conn);*/
2131
2132 switch (function) {
2133 case FSCTL_SET_SPARSE:
2134 /* pretend this succeeded - tho strictly we should
2135 mark the file sparse (if the local fs supports it)
2136 so we can know if we need to pre-allocate or not */
2137
2138 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2139 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2140 return -1;
2141
2142 case FSCTL_0x000900C0:
2143 /* pretend this succeeded - don't know what this really is
2144 but works ok like this --metze
2145 */
2146
2147 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2148 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2149 return -1;
2150
2151 case FSCTL_GET_REPARSE_POINT:
2152 /* pretend this fail - my winXP does it like this
2153 * --metze
2154 */
2155
2156 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2157 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2158 return -1;
2159
2160 case FSCTL_SET_REPARSE_POINT:
2161 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2162 * --metze
2163 */
2164
2165 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2166 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2167 return -1;
2168
2169 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2170 {
2171 /*
2172 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2173 * and return their volume names. If max_data_count is 16, then it is just
2174 * asking for the number of volumes and length of the combined names.
2175 *
2176 * pdata is the data allocated by our caller, but that uses
2177 * total_data_count (which is 0 in our case) rather than max_data_count.
2178 * Allocate the correct amount and return the pointer to let
2179 * it be deallocated when we return.
2180 */
2181 SHADOW_COPY_DATA *shadow_data = NULL;
2182 TALLOC_CTX *shadow_mem_ctx = NULL;
2183 BOOL labels = False;
2184 uint32 labels_data_count = 0;
2185 uint32 i;
2186 char *cur_pdata;
2187
2188 FSP_BELONGS_CONN(fsp,conn);
2189
2190 if (max_data_count < 16) {
2191 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2192 max_data_count));
2193 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2194 }
2195
2196 if (max_data_count > 16) {
2197 labels = True;
2198 }
2199
2200 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2201 if (shadow_mem_ctx == NULL) {
2202 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2203 return ERROR_NT(NT_STATUS_NO_MEMORY);
2204 }
2205
2206 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2207 if (shadow_data == NULL) {
2208 DEBUG(0,("talloc_zero() failed!\n"));
2209 talloc_destroy(shadow_mem_ctx);
2210 return ERROR_NT(NT_STATUS_NO_MEMORY);
2211 }
2212
2213 shadow_data->mem_ctx = shadow_mem_ctx;
2214
2215 /*
2216 * Call the VFS routine to actually do the work.
2217 */
2218 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2219 talloc_destroy(shadow_data->mem_ctx);
2220 if (errno == ENOSYS) {
2221 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2222 conn->connectpath));
2223 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2224 } else {
2225 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2226 conn->connectpath));
2227 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2228 }
2229 }
2230
2231 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2232
2233 if (!labels) {
2234 data_count = 16;
2235 } else {
2236 data_count = 12+labels_data_count+4;
2237 }
2238
2239 if (max_data_count<data_count) {
2240 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2241 max_data_count,data_count));
2242 talloc_destroy(shadow_data->mem_ctx);
2243 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2244 }
2245
2246 pdata = nttrans_realloc(ppdata, data_count);
2247 if (pdata == NULL) {
2248 talloc_destroy(shadow_data->mem_ctx);
2249 return ERROR_NT(NT_STATUS_NO_MEMORY);
2250 }
2251
2252 cur_pdata = pdata;
2253
2254 /* num_volumes 4 bytes */
2255 SIVAL(pdata,0,shadow_data->num_volumes);
2256
2257 if (labels) {
2258 /* num_labels 4 bytes */
2259 SIVAL(pdata,4,shadow_data->num_volumes);
2260 }
2261
2262 /* needed_data_count 4 bytes */
2263 SIVAL(pdata,8,labels_data_count);
2264
2265 cur_pdata+=12;
2266
2267 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2268 shadow_data->num_volumes,fsp->fsp_name));
2269 if (labels && shadow_data->labels) {
2270 for (i=0;i<shadow_data->num_volumes;i++) {
2271 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2272 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2273 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2274 }
2275 }
2276
2277 talloc_destroy(shadow_data->mem_ctx);
2278
2279 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2280
2281 return -1;
2282 }
2283
2284 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2285 {
2286 /* pretend this succeeded -
2287 *
2288 * we have to send back a list with all files owned by this SID
2289 *
2290 * but I have to check that --metze
2291 */
2292 DOM_SID sid;
2293 uid_t uid;
2294 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2295
2296 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2297
2298 FSP_BELONGS_CONN(fsp,conn);
2299
2300 /* unknown 4 bytes: this is not the length of the sid :-( */
2301 /*unknown = IVAL(pdata,0);*/
2302
2303 sid_parse(pdata+4,sid_len,&sid);
2304 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2305
2306 if (!sid_to_uid(&sid, &uid)) {
2307 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2308 sid_string_static(&sid),(unsigned long)sid_len));
2309 uid = (-1);
2310 }
2311
2312 /* we can take a look at the find source :-)
2313 *
2314 * find ./ -uid $uid -name '*' is what we need here
2315 *
2316 *
2317 * and send 4bytes len and then NULL terminated unicode strings
2318 * for each file
2319 *
2320 * but I don't know how to deal with the paged results
2321 * (maybe we can hang the result anywhere in the fsp struct)
2322 *
2323 * we don't send all files at once
2324 * and at the next we should *not* start from the beginning,
2325 * so we have to cache the result
2326 *
2327 * --metze
2328 */
2329
2330 /* this works for now... */
2331 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2332 return -1;
2333 }
2334 default:
2335 if (!logged_message) {
2336 logged_message = True; /* Only print this once... */
2337 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2338 function));
2339 }
2340 }
2341
2342 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2343 }
2344
2345
2346 #ifdef HAVE_SYS_QUOTAS
2347 /****************************************************************************
2348 Reply to get user quota
2349 ****************************************************************************/
2350
2351 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2352 uint16 **ppsetup, uint32 setup_count,
2353 char **ppparams, uint32 parameter_count,
2354 char **ppdata, uint32 data_count, uint32 max_data_count)
2355 {
2356 NTSTATUS nt_status = NT_STATUS_OK;
2357 char *params = *ppparams;
2358 char *pdata = *ppdata;
2359 char *entry;
2360 int data_len=0,param_len=0;
2361 int qt_len=0;
2362 int entry_len = 0;
2363 files_struct *fsp = NULL;
2364 uint16 level = 0;
2365 size_t sid_len;
2366 DOM_SID sid;
2367 BOOL start_enum = True;
2368 SMB_NTQUOTA_STRUCT qt;
2369 SMB_NTQUOTA_LIST *tmp_list;
2370 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2371 extern struct current_user current_user;
2372
2373 ZERO_STRUCT(qt);
2374
2375 /* access check */
2376 if (current_user.ut.uid != 0) {
2377 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2378 lp_servicename(SNUM(conn)),conn->user));
2379 return ERROR_DOS(ERRDOS,ERRnoaccess);
2380 }
2381
2382 /*
2383 * Ensure minimum number of parameters sent.
2384 */
2385
2386 if (parameter_count < 4) {
2387 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2388 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2389 }
2390
2391 /* maybe we can check the quota_fnum */
2392 fsp = file_fsp(params,0);
2393 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2394 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2395 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2396 }
2397
2398 /* the NULL pointer cheking for fsp->fake_file_handle->pd
2399 * is done by CHECK_NTQUOTA_HANDLE_OK()
2400 */
2401 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2402
2403 level = SVAL(params,2);
2404
2405 /* unknown 12 bytes leading in params */
2406
2407 switch (level) {
2408 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2409 /* seems that we should continue with the enum here --metze */
2410
2411 if (qt_handle->quota_list!=NULL &&
2412 qt_handle->tmp_list==NULL) {
2413
2414 /* free the list */
2415 free_ntquota_list(&(qt_handle->quota_list));
2416
2417 /* Realloc the size of parameters and data we will return */
2418 param_len = 4;
2419 params = nttrans_realloc(ppparams, param_len);
2420 if(params == NULL) {
2421 return ERROR_DOS(ERRDOS,ERRnomem);
2422 }
2423
2424 data_len = 0;
2425 SIVAL(params,0,data_len);
2426
2427 break;
2428 }
2429
2430 start_enum = False;
2431
2432 case TRANSACT_GET_USER_QUOTA_LIST_START:
2433
2434 if (qt_handle->quota_list==NULL &&
2435 qt_handle->tmp_list==NULL) {
2436 start_enum = True;
2437 }
2438
2439 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2440 return ERROR_DOS(ERRSRV,ERRerror);
2441
2442 /* Realloc the size of parameters and data we will return */
2443 param_len = 4;
2444 params = nttrans_realloc(ppparams, param_len);
2445 if(params == NULL) {
2446 return ERROR_DOS(ERRDOS,ERRnomem);
2447 }
2448
2449 /* we should not trust the value in max_data_count*/
2450 max_data_count = MIN(max_data_count,2048);
2451
2452 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2453 if(pdata == NULL) {
2454 return ERROR_DOS(ERRDOS,ERRnomem);
2455 }
2456
2457 entry = pdata;
2458
2459 /* set params Size of returned Quota Data 4 bytes*/
2460 /* but set it later when we know it */
2461
2462 /* for each entry push the data */
2463
2464 if (start_enum) {
2465 qt_handle->tmp_list = qt_handle->quota_list;
2466 }
2467
2468 tmp_list = qt_handle->tmp_list;
2469
2470 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2471 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2472
2473 sid_len = sid_size(&tmp_list->quotas->sid);
2474 entry_len = 40 + sid_len;
2475
2476 /* nextoffset entry 4 bytes */
2477 SIVAL(entry,0,entry_len);
2478
2479 /* then the len of the SID 4 bytes */
2480 SIVAL(entry,4,sid_len);
2481
2482 /* unknown data 8 bytes SMB_BIG_UINT */
2483 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2484
2485 /* the used disk space 8 bytes SMB_BIG_UINT */
2486 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2487
2488 /* the soft quotas 8 bytes SMB_BIG_UINT */
2489 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2490
2491 /* the hard quotas 8 bytes SMB_BIG_UINT */
2492 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2493
2494 /* and now the SID */
2495 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2496 }
2497
2498 qt_handle->tmp_list = tmp_list;
2499
2500 /* overwrite the offset of the last entry */
2501 SIVAL(entry-entry_len,0,0);
2502
2503 data_len = 4+qt_len;
2504 /* overwrite the params quota_data_len */
2505 SIVAL(params,0,data_len);
2506
2507 break;
2508
2509 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2510
2511 /* unknown 4 bytes IVAL(pdata,0) */
2512
2513 if (data_count < 8) {
2514 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2515 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2516 }
2517
2518 sid_len = IVAL(pdata,4);
2519 /* Ensure this is less than 1mb. */
2520 if (sid_len > (1024*1024)) {
2521 return ERROR_DOS(ERRDOS,ERRnomem);
2522 }
2523
2524 if (data_count < 8+sid_len) {
2525 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2526 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2527 }
2528
2529 data_len = 4+40+sid_len;
2530
2531 if (max_data_count < data_len) {
2532 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2533 max_data_count, data_len));
2534 param_len = 4;
2535 SIVAL(params,0,data_len);
2536 data_len = 0;
2537 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2538 break;
2539 }
2540
2541 sid_parse(pdata+8,sid_len,&sid);
2542
2543 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2544 ZERO_STRUCT(qt);
2545 /*
2546 * we have to return zero's in all fields
2547 * instead of returning an error here
2548 * --metze
2549 */
2550 }
2551
2552 /* Realloc the size of parameters and data we will return */
2553 param_len = 4;
2554 params = nttrans_realloc(ppparams, param_len);
2555 if(params == NULL) {
2556 return ERROR_DOS(ERRDOS,ERRnomem);
2557 }
2558
2559 pdata = nttrans_realloc(ppdata, data_len);
2560 if(pdata == NULL) {
2561 return ERROR_DOS(ERRDOS,ERRnomem);
2562 }
2563
2564 entry = pdata;
2565
2566 /* set params Size of returned Quota Data 4 bytes*/
2567 SIVAL(params,0,data_len);
2568
2569 /* nextoffset entry 4 bytes */
2570 SIVAL(entry,0,0);
2571
2572 /* then the len of the SID 4 bytes */
2573 SIVAL(entry,4,sid_len);
2574
2575 /* unknown data 8 bytes SMB_BIG_UINT */
2576 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2577
2578 /* the used disk space 8 bytes SMB_BIG_UINT */
2579 SBIG_UINT(entry,16,qt.usedspace);
2580
2581 /* the soft quotas 8 bytes SMB_BIG_UINT */
2582 SBIG_UINT(entry,24,qt.softlim);
2583
2584 /* the hard quotas 8 bytes SMB_BIG_UINT */
2585 SBIG_UINT(entry,32,qt.hardlim);
2586
2587 /* and now the SID */
2588 sid_linearize(entry+40, sid_len, &sid);
2589
2590 break;
2591
2592 default:
2593 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2594 return ERROR_DOS(ERRSRV,ERRerror);
2595 break;
2596 }
2597
2598 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2599
2600 return -1;
2601 }
2602
2603 /****************************************************************************
2604 Reply to set user quota
2605 ****************************************************************************/
2606
2607 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2608 uint16 **ppsetup, uint32 setup_count,
2609 char **ppparams, uint32 parameter_count,
2610 char **ppdata, uint32 data_count, uint32 max_data_count)
2611 {
2612 char *params = *ppparams;
2613 char *pdata = *ppdata;
2614 int data_len=0,param_len=0;
2615 SMB_NTQUOTA_STRUCT qt;
2616 size_t sid_len;
2617 DOM_SID sid;
2618 files_struct *fsp = NULL;
2619
2620 ZERO_STRUCT(qt);
2621
2622 /* access check */
2623 if (current_user.ut.uid != 0) {
2624 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2625 lp_servicename(SNUM(conn)),conn->user));
2626 return ERROR_DOS(ERRDOS,ERRnoaccess);
2627 }
2628
2629 /*
2630 * Ensure minimum number of parameters sent.
2631 */
2632
2633 if (parameter_count < 2) {
2634 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2635 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2636 }
2637
2638 /* maybe we can check the quota_fnum */
2639 fsp = file_fsp(params,0);
2640 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2641 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2642 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2643 }
2644
2645 if (data_count < 40) {
2646 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2647 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2648 }
2649
2650 /* offset to next quota record.
2651 * 4 bytes IVAL(pdata,0)
2652 * unused here...
2653 */
2654
2655 /* sid len */
2656 sid_len = IVAL(pdata,4);
2657
2658 if (data_count < 40+sid_len) {
2659 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2660 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2661 }
2662
2663 /* unknown 8 bytes in pdata
2664 * maybe its the change time in NTTIME
2665 */
2666
2667 /* the used space 8 bytes (SMB_BIG_UINT)*/
2668 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2669 #ifdef LARGE_SMB_OFF_T
2670 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2671 #else /* LARGE_SMB_OFF_T */
2672 if ((IVAL(pdata,20) != 0)&&
2673 ((qt.usedspace != 0xFFFFFFFF)||
2674 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2675 /* more than 32 bits? */
2676 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2677 }
2678 #endif /* LARGE_SMB_OFF_T */
2679
2680 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2681 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2682 #ifdef LARGE_SMB_OFF_T
2683 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2684 #else /* LARGE_SMB_OFF_T */
2685 if ((IVAL(pdata,28) != 0)&&
2686 ((qt.softlim != 0xFFFFFFFF)||
2687 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2688 /* more than 32 bits? */
2689 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2690 }
2691 #endif /* LARGE_SMB_OFF_T */
2692
2693 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2694 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2695 #ifdef LARGE_SMB_OFF_T
2696 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2697 #else /* LARGE_SMB_OFF_T */
2698 if ((IVAL(pdata,36) != 0)&&
2699 ((qt.hardlim != 0xFFFFFFFF)||
2700 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2701 /* more than 32 bits? */
2702 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2703 }
2704 #endif /* LARGE_SMB_OFF_T */
2705
2706 sid_parse(pdata+40,sid_len,&sid);
2707 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2708
2709 /* 44 unknown bytes left... */
2710
2711 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2712 return ERROR_DOS(ERRSRV,ERRerror);
2713 }
2714
2715 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2716
2717 return -1;
2718 }
2719 #endif /* HAVE_SYS_QUOTAS */
2720
2721 static int handle_nttrans(connection_struct *conn,
2722 struct trans_state *state,
2723 char *inbuf, char *outbuf, int size, int bufsize)
2724 {
2725 int outsize;
2726
2727 if (Protocol >= PROTOCOL_NT1) {
2728 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
2729 }
2730
2731 /* Now we must call the relevant NT_TRANS function */
2732 switch(state->call) {
2733 case NT_TRANSACT_CREATE:
2734 {
2735 START_PROFILE_NESTED(NT_transact_create);
2736 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2737 size, bufsize,
2738 &state->setup, state->setup_count,
2739 &state->param, state->total_param,
2740 &state->data, state->total_data,
2741 state->max_data_return);
2742 END_PROFILE_NESTED(NT_transact_create);
2743 break;
2744 }
2745
2746 case NT_TRANSACT_IOCTL:
2747 {
2748 START_PROFILE_NESTED(NT_transact_ioctl);
2749 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2750 size, bufsize,
2751 &state->setup, state->setup_count,
2752 &state->param, state->total_param,
2753 &state->data, state->total_data, state->max_data_return);
2754 END_PROFILE_NESTED(NT_transact_ioctl);
2755 break;
2756 }
2757
2758 case NT_TRANSACT_SET_SECURITY_DESC:
2759 {
2760 START_PROFILE_NESTED(NT_transact_set_security_desc);
2761 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2762 size, bufsize,
2763 &state->setup, state->setup_count,
2764 &state->param, state->total_param,
2765 &state->data, state->total_data, state->max_data_return);
2766 END_PROFILE_NESTED(NT_transact_set_security_desc);
2767 break;
2768 }
2769
2770 case NT_TRANSACT_NOTIFY_CHANGE:
2771 {
2772 START_PROFILE_NESTED(NT_transact_notify_change);
2773 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
2774 size, bufsize,
2775 &state->setup, state->setup_count,
2776 &state->param, state->total_param,
2777 &state->data, state->total_data, state->max_data_return);
2778 END_PROFILE_NESTED(NT_transact_notify_change);
2779 break;
2780 }
2781
2782 case NT_TRANSACT_RENAME:
2783 {
2784 START_PROFILE_NESTED(NT_transact_rename);
2785 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2786 size, bufsize,
2787 &state->setup, state->setup_count,
2788 &state->param, state->total_param,
2789 &state->data, state->total_data, state->max_data_return);
2790 END_PROFILE_NESTED(NT_transact_rename);
2791 break;
2792 }
2793
2794 case NT_TRANSACT_QUERY_SECURITY_DESC:
2795 {
2796 START_PROFILE_NESTED(NT_transact_query_security_desc);
2797 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2798 size, bufsize,
2799 &state->setup, state->setup_count,
2800 &state->param, state->total_param,
2801 &state->data, state->total_data, state->max_data_return);
2802 END_PROFILE_NESTED(NT_transact_query_security_desc);
2803 break;
2804 }
2805
2806 #ifdef HAVE_SYS_QUOTAS
2807 case NT_TRANSACT_GET_USER_QUOTA:
2808 {
2809 START_PROFILE_NESTED(NT_transact_get_user_quota);
2810 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2811 size, bufsize,
2812 &state->setup, state->setup_count,
2813 &state->param, state->total_param,
2814 &state->data, state->total_data, state->max_data_return);
2815 END_PROFILE_NESTED(NT_transact_get_user_quota);
2816 break;
2817 }
2818
2819 case NT_TRANSACT_SET_USER_QUOTA:
2820 {
2821 START_PROFILE_NESTED(NT_transact_set_user_quota);
2822 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2823 size, bufsize,
2824 &state->setup, state->setup_count,
2825 &state->param, state->total_param,
2826 &state->data, state->total_data, state->max_data_return);
2827 END_PROFILE_NESTED(NT_transact_set_user_quota);
2828 break;
2829 }
2830 #endif /* HAVE_SYS_QUOTAS */
2831
2832 default:
2833 /* Error in request */
2834 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2835 state->call));
2836 return ERROR_DOS(ERRSRV,ERRerror);
2837 }
2838 return outsize;
2839 }
2840
2841 /****************************************************************************
2842 Reply to a SMBNTtrans.
2843 ****************************************************************************/
2844
2845 int reply_nttrans(connection_struct *conn,
2846 char *inbuf,char *outbuf,int size,int bufsize)
2847 {
2848 int outsize = 0;
2849 uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2850 uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2851 uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2852 uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2853
2854 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2855 NTSTATUS result;
2856 struct trans_state *state;
2857
2858 START_PROFILE(SMBnttrans);
2859
2860 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2861 END_PROFILE(SMBnttrans);
2862 return ERROR_DOS(ERRSRV,ERRaccess);
2863 }
2864
2865 result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2866 if (!NT_STATUS_IS_OK(result)) {
2867 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2868 END_PROFILE(SMBnttrans);
2869 return ERROR_NT(result);
2870 }
2871
2872 if ((state = TALLOC_P(NULL, struct trans_state)) == NULL) {
2873 END_PROFILE(SMBnttrans);
2874 return ERROR_DOS(ERRSRV,ERRaccess);
2875 }
2876
2877 state->cmd = SMBnttrans;
2878
2879 state->mid = SVAL(inbuf,smb_mid);
2880 state->vuid = SVAL(inbuf,smb_uid);
2881 state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
2882 state->data = NULL;
2883 state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
2884 state->param = NULL;
2885 state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
2886
2887 /* setup count is in *words* */
2888 state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
2889 state->call = function_code;
2890
2891 /*
2892 * All nttrans messages we handle have smb_wct == 19 +
2893 * state->setup_count. Ensure this is so as a sanity check.
2894 */
2895
2896 if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
2897 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2898 CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
2899 goto bad_param;
2900 }
2901
2902 /* Don't allow more than 128mb for each value. */
2903 if ((state->total_data > (1024*1024*128)) ||
2904 (state->total_param > (1024*1024*128))) {
2905 END_PROFILE(SMBnttrans);
2906 return ERROR_DOS(ERRDOS,ERRnomem);
2907 }
2908
2909 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2910 goto bad_param;
2911
2912 if (state->total_data) {
2913 /* Can't use talloc here, the core routines do realloc on the
2914 * params and data. */
2915 if ((state->data = SMB_MALLOC(state->total_data)) == NULL) {
2916 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2917 "bytes !\n", (unsigned int)state->total_data));
2918 TALLOC_FREE(state);
2919 END_PROFILE(SMBnttrans);
2920 return(ERROR_DOS(ERRDOS,ERRnomem));
2921 }
2922 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
2923 goto bad_param;
2924 if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
2925 (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
2926 goto bad_param;
2927
2928 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
2929 }
2930
2931 if (state->total_param) {
2932 /* Can't use talloc here, the core routines do realloc on the
2933 * params and data. */
2934 if ((state->param = SMB_MALLOC(state->total_param)) == NULL) {
2935 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2936 "bytes !\n", (unsigned int)state->total_param));
2937 SAFE_FREE(state->data);
2938 TALLOC_FREE(state);
2939 END_PROFILE(SMBnttrans);
2940 return(ERROR_DOS(ERRDOS,ERRnomem));
2941 }
2942 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
2943 goto bad_param;
2944 if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
2945 (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
2946 goto bad_param;
2947
2948 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
2949 }
2950
2951 state->received_data = dscnt;
2952 state->received_param = pscnt;
2953
2954 if(state->setup_count > 0) {
2955 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2956 state->setup_count));
2957 state->setup = TALLOC(state, state->setup_count);
2958 if (state->setup == NULL) {
2959 DEBUG(0,("reply_nttrans : Out of memory\n"));
2960 SAFE_FREE(state->data);
2961 SAFE_FREE(state->param);
2962 TALLOC_FREE(state);
2963 END_PROFILE(SMBnttrans);
2964 return ERROR_DOS(ERRDOS,ERRnomem);
2965 }
2966
2967 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2968 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2969 goto bad_param;
2970 }
2971 if (smb_nt_SetupStart + state->setup_count > size) {
2972 goto bad_param;
2973 }
2974
2975 memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
2976 dump_data(10, (char *)state->setup, state->setup_count);
2977 }
2978
2979 if ((state->received_data == state->total_data) &&
2980 (state->received_param == state->total_param)) {
2981 outsize = handle_nttrans(conn, state, inbuf, outbuf,
2982 size, bufsize);
2983 SAFE_FREE(state->param);
2984 SAFE_FREE(state->data);
2985 TALLOC_FREE(state);
2986 END_PROFILE(SMBnttrans);
2987 return outsize;
2988 }
2989
2990 DLIST_ADD(conn->pending_trans, state);
2991
2992 /* We need to send an interim response then receive the rest
2993 of the parameter/data bytes */
2994 outsize = set_message(outbuf,0,0,False);
2995 show_msg(outbuf);
2996 END_PROFILE(SMBnttrans);
2997 return outsize;
2998
2999 bad_param:
3000
3001 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3002 SAFE_FREE(state->data);
3003 SAFE_FREE(state->param);
3004 TALLOC_FREE(state);
3005 END_PROFILE(SMBnttrans);
3006 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3007 }
3008
3009 /****************************************************************************
3010 Reply to a SMBnttranss
3011 ****************************************************************************/
3012
3013 int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf,
3014 int size,int bufsize)
3015 {
3016 int outsize = 0;
3017 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3018 struct trans_state *state;
3019
3020 START_PROFILE(SMBnttranss);
3021
3022 show_msg(inbuf);
3023
3024 for (state = conn->pending_trans; state != NULL;
3025 state = state->next) {
3026 if (state->mid == SVAL(inbuf,smb_mid)) {
3027 break;
3028 }
3029 }
3030
3031 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3032 END_PROFILE(SMBnttranss);
3033 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3034 }
3035
3036 /* Revise state->total_param and state->total_data in case they have
3037 changed downwards */
3038 if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3039 state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3040 }
3041 if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3042 state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3043 }
3044
3045 pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3046 poff = IVAL(inbuf, smb_nts_ParameterOffset);
3047 pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3048
3049 dcnt = IVAL(inbuf, smb_nts_DataCount);
3050 ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3051 doff = IVAL(inbuf, smb_nts_DataOffset);
3052
3053 state->received_param += pcnt;
3054 state->received_data += dcnt;
3055
3056 if ((state->received_data > state->total_data) ||
3057 (state->received_param > state->total_param))
3058 goto bad_param;
3059
3060 if (pcnt) {
3061 if (pdisp+pcnt > state->total_param)
3062 goto bad_param;
3063 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3064 goto bad_param;
3065 if (pdisp > state->total_param)
3066 goto bad_param;
3067 if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
3068 (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3069 goto bad_param;
3070 if (state->param + pdisp < state->param)
3071 goto bad_param;
3072
3073 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3074 pcnt);
3075 }
3076
3077 if (dcnt) {
3078 if (ddisp+dcnt > state->total_data)
3079 goto bad_param;
3080 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3081 goto bad_param;
3082 if (ddisp > state->total_data)
3083 goto bad_param;
3084 if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
3085 (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3086 goto bad_param;
3087 if (state->data + ddisp < state->data)
3088 goto bad_param;
3089
3090 memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3091 dcnt);
3092 }
3093
3094 if ((state->received_param < state->total_param) ||
3095 (state->received_data < state->total_data)) {
3096 END_PROFILE(SMBnttranss);
3097 return -1;
3098 }
3099
3100 /* construct_reply_common has done us the favor to pre-fill the
3101 * command field with SMBnttranss which is wrong :-)
3102 */
3103 SCVAL(outbuf,smb_com,SMBnttrans);
3104
3105 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3106 size, bufsize);
3107
3108 DLIST_REMOVE(conn->pending_trans, state);
3109 SAFE_FREE(state->data);
3110 SAFE_FREE(state->param);
3111 TALLOC_FREE(state);
3112
3113 if (outsize == 0) {
3114 END_PROFILE(SMBnttranss);
3115 return(ERROR_DOS(ERRSRV,ERRnosupport));
3116 }
3117
3118 END_PROFILE(SMBnttranss);
3119 return(outsize);
3120
3121 bad_param:
3122
3123 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3124 DLIST_REMOVE(conn->pending_trans, state);
3125 SAFE_FREE(state->data);
3126 SAFE_FREE(state->param);
3127 TALLOC_FREE(state);
3128 END_PROFILE(SMBnttranss);
3129 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3130 }
Samba GIT mirror