?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r18745: Use the Samba4 data structures for security descriptors and security descriptor
[Samba.git] / source3 / smbd / nttrans.c
blob9cebd21d7d04a25cec8b378e0801c09f43c7904f
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int max_send;
25 extern enum protocol_types Protocol;
26 extern int smb_read_error;
27 extern struct current_user current_user;
28
29 static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\spoolss",
41 "\\netdfs",
42 "\\rpcecho",
43 "\\svcctl",
44 "\\eventlog",
45 "\\unixinfo",
46 NULL
47 };
48
49 static char *nttrans_realloc(char **ptr, size_t size)
50 {
51 if (ptr==NULL) {
52 smb_panic("nttrans_realloc() called with NULL ptr\n");
53 }
54
55 *ptr = (char *)SMB_REALLOC(*ptr, size);
56 if(*ptr == NULL) {
57 return NULL;
58 }
59 memset(*ptr,'\0',size);
60 return *ptr;
61 }
62
63 /****************************************************************************
64 Send the required number of replies back.
65 We assume all fields other than the data fields are
66 set correctly for the type of call.
67 HACK ! Always assumes smb_setup field is zero.
68 ****************************************************************************/
69
70 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
71 int paramsize, char *pdata, int datasize)
72 {
73 int data_to_send = datasize;
74 int params_to_send = paramsize;
75 int useable_space;
76 char *pp = params;
77 char *pd = pdata;
78 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
79 int alignment_offset = 3;
80 int data_alignment_offset = 0;
81
82 /*
83 * Initially set the wcnt area to be 18 - this is true for all
84 * transNT replies.
85 */
86
87 set_message(outbuf,18,0,True);
88
89 if (NT_STATUS_V(nt_error)) {
90 ERROR_NT(nt_error);
91 }
92
93 /*
94 * If there genuinely are no parameters or data to send just send
95 * the empty packet.
96 */
97
98 if(params_to_send == 0 && data_to_send == 0) {
99 show_msg(outbuf);
100 if (!send_smb(smbd_server_fd(),outbuf)) {
101 exit_server("send_nt_replies: send_smb failed.");
102 }
103 return 0;
104 }
105
106 /*
107 * When sending params and data ensure that both are nicely aligned.
108 * Only do this alignment when there is also data to send - else
109 * can cause NT redirector problems.
110 */
111
112 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
113 data_alignment_offset = 4 - (params_to_send % 4);
114 }
115
116 /*
117 * Space is bufsize minus Netbios over TCP header minus SMB header.
118 * The alignment_offset is to align the param bytes on a four byte
119 * boundary (2 bytes for data len, one byte pad).
120 * NT needs this to work correctly.
121 */
122
123 useable_space = bufsize - ((smb_buf(outbuf)+
124 alignment_offset+data_alignment_offset) -
125 outbuf);
126
127 /*
128 * useable_space can never be more than max_send minus the
129 * alignment offset.
130 */
131
132 useable_space = MIN(useable_space,
133 max_send - (alignment_offset+data_alignment_offset));
134
135
136 while (params_to_send || data_to_send) {
137
138 /*
139 * Calculate whether we will totally or partially fill this packet.
140 */
141
142 total_sent_thistime = params_to_send + data_to_send +
143 alignment_offset + data_alignment_offset;
144
145 /*
146 * We can never send more than useable_space.
147 */
148
149 total_sent_thistime = MIN(total_sent_thistime, useable_space);
150
151 set_message(outbuf, 18, total_sent_thistime, True);
152
153 /*
154 * Set total params and data to be sent.
155 */
156
157 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
158 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
159
160 /*
161 * Calculate how many parameters and data we can fit into
162 * this packet. Parameters get precedence.
163 */
164
165 params_sent_thistime = MIN(params_to_send,useable_space);
166 data_sent_thistime = useable_space - params_sent_thistime;
167 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
168
169 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
170
171 if(params_sent_thistime == 0) {
172 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
173 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
174 } else {
175 /*
176 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
177 * parameter bytes, however the first 4 bytes of outbuf are
178 * the Netbios over TCP header. Thus use smb_base() to subtract
179 * them from the calculation.
180 */
181
182 SIVAL(outbuf,smb_ntr_ParameterOffset,
183 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
184 /*
185 * Absolute displacement of param bytes sent in this packet.
186 */
187
188 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
189 }
190
191 /*
192 * Deal with the data portion.
193 */
194
195 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
196
197 if(data_sent_thistime == 0) {
198 SIVAL(outbuf,smb_ntr_DataOffset,0);
199 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
200 } else {
201 /*
202 * The offset of the data bytes is the offset of the
203 * parameter bytes plus the number of parameters being sent this time.
204 */
205
206 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
207 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
208 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
209 }
210
211 /*
212 * Copy the param bytes into the packet.
213 */
214
215 if(params_sent_thistime) {
216 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
217 }
218
219 /*
220 * Copy in the data bytes
221 */
222
223 if(data_sent_thistime) {
224 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
225 data_alignment_offset,pd,data_sent_thistime);
226 }
227
228 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
229 params_sent_thistime, data_sent_thistime, useable_space));
230 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
231 params_to_send, data_to_send, paramsize, datasize));
232
233 /* Send the packet */
234 show_msg(outbuf);
235 if (!send_smb(smbd_server_fd(),outbuf)) {
236 exit_server("send_nt_replies: send_smb failed.");
237 }
238
239 pp += params_sent_thistime;
240 pd += data_sent_thistime;
241
242 params_to_send -= params_sent_thistime;
243 data_to_send -= data_sent_thistime;
244
245 /*
246 * Sanity check
247 */
248
249 if(params_to_send < 0 || data_to_send < 0) {
250 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
251 params_to_send, data_to_send));
252 return -1;
253 }
254 }
255
256 return 0;
257 }
258
259 /****************************************************************************
260 Is it an NTFS stream name ?
261 ****************************************************************************/
262
263 BOOL is_ntfs_stream_name(const char *fname)
264 {
265 if (lp_posix_pathnames()) {
266 return False;
267 }
268 return (strchr_m(fname, ':') != NULL) ? True : False;
269 }
270
271 /****************************************************************************
272 Save case statics.
273 ****************************************************************************/
274
275 static BOOL saved_case_sensitive;
276 static BOOL saved_case_preserve;
277 static BOOL saved_short_case_preserve;
278
279 /****************************************************************************
280 Save case semantics.
281 ****************************************************************************/
282
283 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
284 {
285 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
286 return;
287 }
288
289 saved_case_sensitive = conn->case_sensitive;
290 saved_case_preserve = conn->case_preserve;
291 saved_short_case_preserve = conn->short_case_preserve;
292
293 /* Set to POSIX. */
294 conn->case_sensitive = True;
295 conn->case_preserve = True;
296 conn->short_case_preserve = True;
297 }
298
299 /****************************************************************************
300 Restore case semantics.
301 ****************************************************************************/
302
303 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
304 {
305 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
306 return;
307 }
308
309 conn->case_sensitive = saved_case_sensitive;
310 conn->case_preserve = saved_case_preserve;
311 conn->short_case_preserve = saved_short_case_preserve;
312 }
313
314 /****************************************************************************
315 Reply to an NT create and X call on a pipe.
316 ****************************************************************************/
317
318 static int nt_open_pipe(char *fname, connection_struct *conn,
319 char *inbuf, char *outbuf, int *ppnum)
320 {
321 smb_np_struct *p = NULL;
322 uint16 vuid = SVAL(inbuf, smb_uid);
323 int i;
324
325 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
326
327 /* See if it is one we want to handle. */
328
329 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
330 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
331 }
332
333 for( i = 0; known_nt_pipes[i]; i++ ) {
334 if( strequal(fname,known_nt_pipes[i])) {
335 break;
336 }
337 }
338
339 if ( known_nt_pipes[i] == NULL ) {
340 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
341 }
342
343 /* Strip \\ off the name. */
344 fname++;
345
346 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
347
348 p = open_rpc_pipe_p(fname, conn, vuid);
349 if (!p) {
350 return(ERROR_DOS(ERRSRV,ERRnofids));
351 }
352
353 /* TODO: Add pipe to db */
354
355 if ( !store_pipe_opendb( p ) ) {
356 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
357 }
358
359 *ppnum = p->pnum;
360 return 0;
361 }
362
363 /****************************************************************************
364 Reply to an NT create and X call for pipes.
365 ****************************************************************************/
366
367 static int do_ntcreate_pipe_open(connection_struct *conn,
368 char *inbuf,char *outbuf,int length,int bufsize)
369 {
370 pstring fname;
371 int ret;
372 int pnum = -1;
373 char *p = NULL;
374
375 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
376
377 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
378 return ret;
379 }
380
381 /*
382 * Deal with pipe return.
383 */
384
385 set_message(outbuf,34,0,True);
386
387 p = outbuf + smb_vwv2;
388 p++;
389 SSVAL(p,0,pnum);
390 p += 2;
391 SIVAL(p,0,FILE_WAS_OPENED);
392 p += 4;
393 p += 32;
394 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
395 p += 20;
396 /* File type. */
397 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
398 /* Device state. */
399 SSVAL(p,2, 0x5FF); /* ? */
400
401 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
402
403 return chain_reply(inbuf,outbuf,length,bufsize);
404 }
405
406 /****************************************************************************
407 Reply to an NT create and X call for a quota file.
408 ****************************************************************************/
409
410 int reply_ntcreate_and_X_quota(connection_struct *conn,
411 char *inbuf,
412 char *outbuf,
413 int length,
414 int bufsize,
415 enum FAKE_FILE_TYPE fake_file_type,
416 const char *fname)
417 {
418 int result;
419 char *p;
420 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
421 files_struct *fsp;
422 NTSTATUS status;
423
424 status = open_fake_file(conn, fake_file_type, fname, desired_access,
425 &fsp);
426
427 if (!NT_STATUS_IS_OK(status)) {
428 return ERROR_NT(status);
429 }
430
431 set_message(outbuf,34,0,True);
432
433 p = outbuf + smb_vwv2;
434
435 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
436 p++;
437 SSVAL(p,0,fsp->fnum);
438
439 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
440
441 result = chain_reply(inbuf,outbuf,length,bufsize);
442 return result;
443 }
444
445 /****************************************************************************
446 Reply to an NT create and X call.
447 ****************************************************************************/
448
449 int reply_ntcreate_and_X(connection_struct *conn,
450 char *inbuf,char *outbuf,int length,int bufsize)
451 {
452 int result;
453 pstring fname;
454 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
455 uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
456 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
457 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
458 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
459 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
460 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
461 /* Breakout the oplock request bits so we can set the
462 reply bits separately. */
463 int oplock_request = 0;
464 uint32 fattr=0;
465 SMB_OFF_T file_len = 0;
466 SMB_STRUCT_STAT sbuf;
467 int info = 0;
468 BOOL bad_path = False;
469 files_struct *fsp=NULL;
470 char *p = NULL;
471 struct timespec c_timespec;
472 struct timespec a_timespec;
473 struct timespec m_timespec;
474 BOOL extended_oplock_granted = False;
475 NTSTATUS status;
476
477 START_PROFILE(SMBntcreateX);
478
479 DEBUG(10,("reply_ntcreateX: flags = 0x%x, access_mask = 0x%x \
480 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
481 create_options = 0x%x root_dir_fid = 0x%x\n",
482 (unsigned int)flags,
483 (unsigned int)access_mask,
484 (unsigned int)file_attributes,
485 (unsigned int)share_access,
486 (unsigned int)create_disposition,
487 (unsigned int)create_options,
488 (unsigned int)root_dir_fid ));
489
490 /* If it's an IPC, use the pipe handler. */
491
492 if (IS_IPC(conn)) {
493 if (lp_nt_pipe_support()) {
494 END_PROFILE(SMBntcreateX);
495 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
496 } else {
497 END_PROFILE(SMBntcreateX);
498 return(ERROR_DOS(ERRDOS,ERRnoaccess));
499 }
500 }
501
502 if (create_options & FILE_OPEN_BY_FILE_ID) {
503 END_PROFILE(SMBntcreateX);
504 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
505 }
506
507 /*
508 * Get the file name.
509 */
510
511 if(root_dir_fid != 0) {
512 /*
513 * This filename is relative to a directory fid.
514 */
515 pstring rel_fname;
516 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
517 size_t dir_name_len;
518
519 if(!dir_fsp) {
520 END_PROFILE(SMBntcreateX);
521 return(ERROR_DOS(ERRDOS,ERRbadfid));
522 }
523
524 if(!dir_fsp->is_directory) {
525
526 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
527 if (!NT_STATUS_IS_OK(status)) {
528 END_PROFILE(SMBntcreateX);
529 return ERROR_NT(status);
530 }
531
532 /*
533 * Check to see if this is a mac fork of some kind.
534 */
535
536 if( is_ntfs_stream_name(fname)) {
537 END_PROFILE(SMBntcreateX);
538 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
539 }
540
541 /*
542 we need to handle the case when we get a
543 relative open relative to a file and the
544 pathname is blank - this is a reopen!
545 (hint from demyn plantenberg)
546 */
547
548 END_PROFILE(SMBntcreateX);
549 return(ERROR_DOS(ERRDOS,ERRbadfid));
550 }
551
552 /*
553 * Copy in the base directory name.
554 */
555
556 pstrcpy( fname, dir_fsp->fsp_name );
557 dir_name_len = strlen(fname);
558
559 /*
560 * Ensure it ends in a '\'.
561 */
562
563 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
564 pstrcat(fname, "/");
565 dir_name_len++;
566 }
567
568 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
569 if (!NT_STATUS_IS_OK(status)) {
570 END_PROFILE(SMBntcreateX);
571 return ERROR_NT(status);
572 }
573 pstrcat(fname, rel_fname);
574 } else {
575 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
576 if (!NT_STATUS_IS_OK(status)) {
577 END_PROFILE(SMBntcreateX);
578 return ERROR_NT(status);
579 }
580
581 /*
582 * Check to see if this is a mac fork of some kind.
583 */
584
585 if( is_ntfs_stream_name(fname)) {
586 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
587 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
588 /*
589 * Here we go! support for changing the disk quotas --metze
590 *
591 * We need to fake up to open this MAGIC QUOTA file
592 * and return a valid FID.
593 *
594 * w2k close this file directly after openening
595 * xp also tries a QUERY_FILE_INFO on the file and then close it
596 */
597 result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
598 fake_file_type, fname);
599 END_PROFILE(SMBntcreateX);
600 return result;
601 } else {
602 END_PROFILE(SMBntcreateX);
603 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
604 }
605 }
606 }
607
608 /*
609 * Now contruct the smb_open_mode value from the filename,
610 * desired access and the share access.
611 */
612 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
613
614 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
615 if (oplock_request) {
616 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
617 }
618
619 /*
620 * Ordinary file or directory.
621 */
622
623 /*
624 * Check if POSIX semantics are wanted.
625 */
626
627 set_posix_case_semantics(conn, file_attributes);
628
629 unix_convert(fname,conn,0,&bad_path,&sbuf);
630
631 if (bad_path) {
632 restore_case_semantics(conn, file_attributes);
633 END_PROFILE(SMBntcreateX);
634 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
635 }
636 /* All file access must go through check_name() */
637 if (!check_name(fname,conn)) {
638 restore_case_semantics(conn, file_attributes);
639 END_PROFILE(SMBntcreateX);
640 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
641 }
642
643 #if 0
644 /* This is the correct thing to do (check every time) but can_delete is
645 expensive (it may have to read the parent directory permissions). So
646 for now we're not doing it unless we have a strong hint the client
647 is really going to delete this file. */
648 if (desired_access & DELETE_ACCESS) {
649 #else
650 /* Setting FILE_SHARE_DELETE is the hint. */
651 if (lp_acl_check_permissions(SNUM(conn)) && (share_access & FILE_SHARE_DELETE)
652 && (access_mask & DELETE_ACCESS)) {
653 #endif
654 status = can_delete(conn, fname, file_attributes, bad_path, True);
655 /* We're only going to fail here if it's access denied, as that's the
656 only error we care about for "can we delete this ?" questions. */
657 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
658 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
659 restore_case_semantics(conn, file_attributes);
660 END_PROFILE(SMBntcreateX);
661 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
662 }
663 }
664
665 /*
666 * If it's a request for a directory open, deal with it separately.
667 */
668
669 if(create_options & FILE_DIRECTORY_FILE) {
670 oplock_request = 0;
671
672 /* Can't open a temp directory. IFS kit test. */
673 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
674 END_PROFILE(SMBntcreateX);
675 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
676 }
677
678 status = open_directory(conn, fname, &sbuf,
679 access_mask,
680 share_access,
681 create_disposition,
682 create_options,
683 &info, &fsp);
684
685 restore_case_semantics(conn, file_attributes);
686
687 if(!NT_STATUS_IS_OK(status)) {
688 END_PROFILE(SMBntcreateX);
689 return ERROR_NT(status);
690 }
691 } else {
692 /*
693 * Ordinary file case.
694 */
695
696 /* NB. We have a potential bug here. If we
697 * cause an oplock break to ourselves, then we
698 * could end up processing filename related
699 * SMB requests whilst we await the oplock
700 * break response. As we may have changed the
701 * filename case semantics to be POSIX-like,
702 * this could mean a filename request could
703 * fail when it should succeed. This is a rare
704 * condition, but eventually we must arrange
705 * to restore the correct case semantics
706 * before issuing an oplock break request to
707 * our client. JRA. */
708
709 status = open_file_ntcreate(conn,fname,&sbuf,
710 access_mask,
711 share_access,
712 create_disposition,
713 create_options,
714 file_attributes,
715 oplock_request,
716 &info, &fsp);
717 if (!NT_STATUS_IS_OK(status)) {
718 /* We cheat here. There are two cases we
719 * care about. One is a directory rename,
720 * where the NT client will attempt to
721 * open the source directory for
722 * DELETE access. Note that when the
723 * NT client does this it does *not*
724 * set the directory bit in the
725 * request packet. This is translated
726 * into a read/write open
727 * request. POSIX states that any open
728 * for write request on a directory
729 * will generate an EISDIR error, so
730 * we can catch this here and open a
731 * pseudo handle that is flagged as a
732 * directory. The second is an open
733 * for a permissions read only, which
734 * we handle in the open_file_stat case. JRA.
735 */
736
737 if (NT_STATUS_EQUAL(status,
738 NT_STATUS_FILE_IS_A_DIRECTORY)) {
739
740 /*
741 * Fail the open if it was explicitly a non-directory file.
742 */
743
744 if (create_options & FILE_NON_DIRECTORY_FILE) {
745 restore_case_semantics(conn, file_attributes);
746 END_PROFILE(SMBntcreateX);
747 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
748 }
749
750 oplock_request = 0;
751 status = open_directory(conn, fname, &sbuf,
752 access_mask,
753 share_access,
754 create_disposition,
755 create_options,
756 &info, &fsp);
757
758 if(!NT_STATUS_IS_OK(status)) {
759 restore_case_semantics(conn, file_attributes);
760 END_PROFILE(SMBntcreateX);
761 return ERROR_NT(status);
762 }
763 } else {
764
765 restore_case_semantics(conn, file_attributes);
766 END_PROFILE(SMBntcreateX);
767 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
768 /* We have re-scheduled this call. */
769 return -1;
770 }
771 return ERROR_NT(status);
772 }
773 }
774 }
775
776 restore_case_semantics(conn, file_attributes);
777
778 file_len = sbuf.st_size;
779 fattr = dos_mode(conn,fname,&sbuf);
780 if(fattr == 0) {
781 fattr = FILE_ATTRIBUTE_NORMAL;
782 }
783 if (!fsp->is_directory && (fattr & aDIR)) {
784 close_file(fsp,ERROR_CLOSE);
785 END_PROFILE(SMBntcreateX);
786 return ERROR_DOS(ERRDOS,ERRnoaccess);
787 }
788
789 /* Save the requested allocation size. */
790 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
791 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
792 #ifdef LARGE_SMB_OFF_T
793 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
794 #endif
795 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
796 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
797 if (fsp->is_directory) {
798 close_file(fsp,ERROR_CLOSE);
799 END_PROFILE(SMBntcreateX);
800 /* Can't set allocation size on a directory. */
801 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
802 }
803 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
804 close_file(fsp,ERROR_CLOSE);
805 END_PROFILE(SMBntcreateX);
806 return ERROR_NT(NT_STATUS_DISK_FULL);
807 }
808 } else {
809 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
810 }
811 }
812
813 /*
814 * If the caller set the extended oplock request bit
815 * and we granted one (by whatever means) - set the
816 * correct bit for extended oplock reply.
817 */
818
819 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
820 extended_oplock_granted = True;
821 }
822
823 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
824 extended_oplock_granted = True;
825 }
826
827 #if 0
828 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
829 set_message(outbuf,42,0,True);
830 #else
831 set_message(outbuf,34,0,True);
832 #endif
833
834 p = outbuf + smb_vwv2;
835
836 /*
837 * Currently as we don't support level II oplocks we just report
838 * exclusive & batch here.
839 */
840
841 if (extended_oplock_granted) {
842 if (flags & REQUEST_BATCH_OPLOCK) {
843 SCVAL(p,0, BATCH_OPLOCK_RETURN);
844 } else {
845 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
846 }
847 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
848 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
849 } else {
850 SCVAL(p,0,NO_OPLOCK_RETURN);
851 }
852
853 p++;
854 SSVAL(p,0,fsp->fnum);
855 p += 2;
856 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
857 SIVAL(p,0,FILE_WAS_SUPERSEDED);
858 } else {
859 SIVAL(p,0,info);
860 }
861 p += 4;
862
863 /* Create time. */
864 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
865 a_timespec = get_atimespec(&sbuf);
866 m_timespec = get_mtimespec(&sbuf);
867
868 if (lp_dos_filetime_resolution(SNUM(conn))) {
869 dos_filetime_timespec(&c_timespec);
870 dos_filetime_timespec(&a_timespec);
871 dos_filetime_timespec(&m_timespec);
872 }
873
874 put_long_date_timespec(p, c_timespec);
875 p += 8;
876 put_long_date_timespec(p, a_timespec); /* access time */
877 p += 8;
878 put_long_date_timespec(p, m_timespec); /* write time */
879 p += 8;
880 put_long_date_timespec(p, m_timespec); /* change time */
881 p += 8;
882 SIVAL(p,0,fattr); /* File Attributes. */
883 p += 4;
884 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
885 p += 8;
886 SOFF_T(p,0,file_len);
887 p += 8;
888 if (flags & EXTENDED_RESPONSE_REQUIRED) {
889 SSVAL(p,2,0x7);
890 }
891 p += 4;
892 SCVAL(p,0,fsp->is_directory ? 1 : 0);
893
894 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
895
896 result = chain_reply(inbuf,outbuf,length,bufsize);
897 END_PROFILE(SMBntcreateX);
898 return result;
899 }
900
901 /****************************************************************************
902 Reply to a NT_TRANSACT_CREATE call to open a pipe.
903 ****************************************************************************/
904
905 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
906 uint16 **ppsetup, uint32 setup_count,
907 char **ppparams, uint32 parameter_count,
908 char **ppdata, uint32 data_count)
909 {
910 pstring fname;
911 char *params = *ppparams;
912 int ret;
913 int pnum = -1;
914 char *p = NULL;
915 NTSTATUS status;
916
917 /*
918 * Ensure minimum number of parameters sent.
919 */
920
921 if(parameter_count < 54) {
922 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
923 return ERROR_DOS(ERRDOS,ERRnoaccess);
924 }
925
926 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
927 if (!NT_STATUS_IS_OK(status)) {
928 return ERROR_NT(status);
929 }
930
931 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
932 return ret;
933 }
934
935 /* Realloc the size of parameters and data we will return */
936 params = nttrans_realloc(ppparams, 69);
937 if(params == NULL) {
938 return ERROR_DOS(ERRDOS,ERRnomem);
939 }
940
941 p = params;
942 SCVAL(p,0,NO_OPLOCK_RETURN);
943
944 p += 2;
945 SSVAL(p,0,pnum);
946 p += 2;
947 SIVAL(p,0,FILE_WAS_OPENED);
948 p += 8;
949
950 p += 32;
951 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
952 p += 20;
953 /* File type. */
954 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
955 /* Device state. */
956 SSVAL(p,2, 0x5FF); /* ? */
957
958 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
959
960 /* Send the required number of replies */
961 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
962
963 return -1;
964 }
965
966 /****************************************************************************
967 Internal fn to set security descriptors.
968 ****************************************************************************/
969
970 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
971 {
972 prs_struct pd;
973 SEC_DESC *psd = NULL;
974 TALLOC_CTX *mem_ctx;
975 BOOL ret;
976
977 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
978 return NT_STATUS_OK;
979 }
980
981 /*
982 * Init the parse struct we will unmarshall from.
983 */
984
985 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
986 DEBUG(0,("set_sd: talloc_init failed.\n"));
987 return NT_STATUS_NO_MEMORY;
988 }
989
990 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
991
992 /*
993 * Setup the prs_struct to point at the memory we just
994 * allocated.
995 */
996
997 prs_give_memory( &pd, data, sd_len, False);
998
999 /*
1000 * Finally, unmarshall from the data buffer.
1001 */
1002
1003 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1004 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1005 /*
1006 * Return access denied for want of a better error message..
1007 */
1008 talloc_destroy(mem_ctx);
1009 return NT_STATUS_NO_MEMORY;
1010 }
1011
1012 if (psd->owner_sid==0) {
1013 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1014 }
1015 if (psd->group_sid==0) {
1016 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1017 }
1018 if (psd->sacl==0) {
1019 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1020 }
1021 if (psd->dacl==0) {
1022 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1023 }
1024
1025 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1026
1027 if (!ret) {
1028 talloc_destroy(mem_ctx);
1029 return NT_STATUS_ACCESS_DENIED;
1030 }
1031
1032 talloc_destroy(mem_ctx);
1033
1034 return NT_STATUS_OK;
1035 }
1036
1037 /****************************************************************************
1038 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1039 ****************************************************************************/
1040
1041 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1042 {
1043 struct ea_list *ea_list_head = NULL;
1044 size_t offset = 0;
1045
1046 if (data_size < 4) {
1047 return NULL;
1048 }
1049
1050 while (offset + 4 <= data_size) {
1051 size_t next_offset = IVAL(pdata,offset);
1052 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1053
1054 if (!eal) {
1055 return NULL;
1056 }
1057
1058 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1059 if (next_offset == 0) {
1060 break;
1061 }
1062 offset += next_offset;
1063 }
1064
1065 return ea_list_head;
1066 }
1067
1068 /****************************************************************************
1069 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1070 ****************************************************************************/
1071
1072 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1073 uint16 **ppsetup, uint32 setup_count,
1074 char **ppparams, uint32 parameter_count,
1075 char **ppdata, uint32 data_count, uint32 max_data_count)
1076 {
1077 pstring fname;
1078 char *params = *ppparams;
1079 char *data = *ppdata;
1080 /* Breakout the oplock request bits so we can set the reply bits separately. */
1081 int oplock_request = 0;
1082 uint32 fattr=0;
1083 SMB_OFF_T file_len = 0;
1084 SMB_STRUCT_STAT sbuf;
1085 int info = 0;
1086 BOOL bad_path = False;
1087 files_struct *fsp = NULL;
1088 char *p = NULL;
1089 BOOL extended_oplock_granted = False;
1090 uint32 flags;
1091 uint32 access_mask;
1092 uint32 file_attributes;
1093 uint32 share_access;
1094 uint32 create_disposition;
1095 uint32 create_options;
1096 uint32 sd_len;
1097 uint32 ea_len;
1098 uint16 root_dir_fid;
1099 struct timespec c_timespec;
1100 struct timespec a_timespec;
1101 struct timespec m_timespec;
1102 struct ea_list *ea_list = NULL;
1103 TALLOC_CTX *ctx = NULL;
1104 char *pdata = NULL;
1105 NTSTATUS status;
1106
1107 DEBUG(5,("call_nt_transact_create\n"));
1108
1109 /*
1110 * If it's an IPC, use the pipe handler.
1111 */
1112
1113 if (IS_IPC(conn)) {
1114 if (lp_nt_pipe_support()) {
1115 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1116 bufsize,
1117 ppsetup, setup_count,
1118 ppparams, parameter_count,
1119 ppdata, data_count);
1120 } else {
1121 return ERROR_DOS(ERRDOS,ERRnoaccess);
1122 }
1123 }
1124
1125 /*
1126 * Ensure minimum number of parameters sent.
1127 */
1128
1129 if(parameter_count < 54) {
1130 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1131 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1132 }
1133
1134 flags = IVAL(params,0);
1135 access_mask = IVAL(params,8);
1136 file_attributes = IVAL(params,20);
1137 share_access = IVAL(params,24);
1138 create_disposition = IVAL(params,28);
1139 create_options = IVAL(params,32);
1140 sd_len = IVAL(params,36);
1141 ea_len = IVAL(params,40);
1142 root_dir_fid = (uint16)IVAL(params,4);
1143
1144 /* Ensure the data_len is correct for the sd and ea values given. */
1145 if ((ea_len + sd_len > data_count) ||
1146 (ea_len > data_count) || (sd_len > data_count) ||
1147 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1148 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1149 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1150 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1151 }
1152
1153 if (ea_len) {
1154 if (!lp_ea_support(SNUM(conn))) {
1155 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1156 (unsigned int)ea_len ));
1157 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1158 }
1159
1160 if (ea_len < 10) {
1161 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1162 (unsigned int)ea_len ));
1163 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1164 }
1165 }
1166
1167 if (create_options & FILE_OPEN_BY_FILE_ID) {
1168 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1169 }
1170
1171 /*
1172 * Get the file name.
1173 */
1174
1175 if(root_dir_fid != 0) {
1176 /*
1177 * This filename is relative to a directory fid.
1178 */
1179 files_struct *dir_fsp = file_fsp(params,4);
1180 size_t dir_name_len;
1181
1182 if(!dir_fsp) {
1183 return ERROR_DOS(ERRDOS,ERRbadfid);
1184 }
1185
1186 if(!dir_fsp->is_directory) {
1187 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 return ERROR_NT(status);
1190 }
1191
1192 /*
1193 * Check to see if this is a mac fork of some kind.
1194 */
1195
1196 if( is_ntfs_stream_name(fname)) {
1197 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1198 }
1199
1200 return ERROR_DOS(ERRDOS,ERRbadfid);
1201 }
1202
1203 /*
1204 * Copy in the base directory name.
1205 */
1206
1207 pstrcpy( fname, dir_fsp->fsp_name );
1208 dir_name_len = strlen(fname);
1209
1210 /*
1211 * Ensure it ends in a '\'.
1212 */
1213
1214 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1215 pstrcat(fname, "/");
1216 dir_name_len++;
1217 }
1218
1219 {
1220 pstring tmpname;
1221 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1222 if (!NT_STATUS_IS_OK(status)) {
1223 return ERROR_NT(status);
1224 }
1225 pstrcat(fname, tmpname);
1226 }
1227 } else {
1228 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1229 if (!NT_STATUS_IS_OK(status)) {
1230 return ERROR_NT(status);
1231 }
1232
1233 /*
1234 * Check to see if this is a mac fork of some kind.
1235 */
1236
1237 if( is_ntfs_stream_name(fname)) {
1238 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1239 }
1240 }
1241
1242 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1243 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1244
1245 /*
1246 * Check if POSIX semantics are wanted.
1247 */
1248
1249 set_posix_case_semantics(conn, file_attributes);
1250
1251 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1252
1253 unix_convert(fname,conn,0,&bad_path,&sbuf);
1254 if (bad_path) {
1255 restore_case_semantics(conn, file_attributes);
1256 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1257 }
1258 /* All file access must go through check_name() */
1259 if (!check_name(fname,conn)) {
1260 restore_case_semantics(conn, file_attributes);
1261 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
1262 }
1263
1264 #if 0
1265 /* This is the correct thing to do (check every time) but can_delete is
1266 expensive (it may have to read the parent directory permissions). So
1267 for now we're not doing it unless we have a strong hint the client
1268 is really going to delete this file. */
1269 if (desired_access & DELETE_ACCESS) {
1270 #else
1271 /* Setting FILE_SHARE_DELETE is the hint. */
1272 if (lp_acl_check_permissions(SNUM(conn)) && (share_access & FILE_SHARE_DELETE) && (access_mask & DELETE_ACCESS)) {
1273 #endif
1274 status = can_delete(conn, fname, file_attributes, bad_path, True);
1275 /* We're only going to fail here if it's access denied, as that's the
1276 only error we care about for "can we delete this ?" questions. */
1277 if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
1278 NT_STATUS_EQUAL(status,NT_STATUS_CANNOT_DELETE))) {
1279 restore_case_semantics(conn, file_attributes);
1280 return ERROR_NT(status);
1281 }
1282 }
1283
1284 if (ea_len) {
1285 ctx = talloc_init("NTTRANS_CREATE_EA");
1286 if (!ctx) {
1287 talloc_destroy(ctx);
1288 restore_case_semantics(conn, file_attributes);
1289 return ERROR_NT(NT_STATUS_NO_MEMORY);
1290 }
1291
1292 pdata = data + sd_len;
1293
1294 /* We have already checked that ea_len <= data_count here. */
1295 ea_list = read_nttrans_ea_list(ctx, pdata, ea_len);
1296 if (!ea_list ) {
1297 talloc_destroy(ctx);
1298 restore_case_semantics(conn, file_attributes);
1299 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1300 }
1301 }
1302
1303 /*
1304 * If it's a request for a directory open, deal with it separately.
1305 */
1306
1307 if(create_options & FILE_DIRECTORY_FILE) {
1308
1309 /* Can't open a temp directory. IFS kit test. */
1310 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1311 talloc_destroy(ctx);
1312 restore_case_semantics(conn, file_attributes);
1313 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1314 }
1315
1316 oplock_request = 0;
1317
1318 /*
1319 * We will get a create directory here if the Win32
1320 * app specified a security descriptor in the
1321 * CreateDirectory() call.
1322 */
1323
1324 status = open_directory(conn, fname, &sbuf,
1325 access_mask,
1326 share_access,
1327 create_disposition,
1328 create_options,
1329 &info, &fsp);
1330 if(!NT_STATUS_IS_OK(status)) {
1331 talloc_destroy(ctx);
1332 restore_case_semantics(conn, file_attributes);
1333 return ERROR_NT(status);
1334 }
1335
1336 } else {
1337
1338 /*
1339 * Ordinary file case.
1340 */
1341
1342 status = open_file_ntcreate(conn,fname,&sbuf,
1343 access_mask,
1344 share_access,
1345 create_disposition,
1346 create_options,
1347 file_attributes,
1348 oplock_request,
1349 &info, &fsp);
1350
1351 if (!NT_STATUS_IS_OK(status)) {
1352 if (NT_STATUS_EQUAL(status,
1353 NT_STATUS_FILE_IS_A_DIRECTORY)) {
1354
1355 /*
1356 * Fail the open if it was explicitly a non-directory file.
1357 */
1358
1359 if (create_options & FILE_NON_DIRECTORY_FILE) {
1360 restore_case_semantics(conn, file_attributes);
1361 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1362 }
1363
1364 oplock_request = 0;
1365 status = open_directory(conn, fname, &sbuf,
1366 access_mask,
1367 share_access,
1368 create_disposition,
1369 create_options,
1370 &info, &fsp);
1371 if(!NT_STATUS_IS_OK(status)) {
1372 talloc_destroy(ctx);
1373 restore_case_semantics(conn, file_attributes);
1374 return ERROR_NT(status);
1375 }
1376 } else {
1377 talloc_destroy(ctx);
1378 restore_case_semantics(conn, file_attributes);
1379 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1380 /* We have re-scheduled this call. */
1381 return -1;
1382 }
1383 return ERROR_NT(status);
1384 }
1385 }
1386 }
1387
1388 /*
1389 * According to the MS documentation, the only time the security
1390 * descriptor is applied to the opened file is iff we *created* the
1391 * file; an existing file stays the same.
1392 *
1393 * Also, it seems (from observation) that you can open the file with
1394 * any access mask but you can still write the sd. We need to override
1395 * the granted access before we call set_sd
1396 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1397 */
1398
1399 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1400 uint32 saved_access_mask = fsp->access_mask;
1401
1402 /* We have already checked that sd_len <= data_count here. */
1403
1404 fsp->access_mask = FILE_GENERIC_ALL;
1405
1406 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1407 if (!NT_STATUS_IS_OK(status)) {
1408 talloc_destroy(ctx);
1409 close_file(fsp,ERROR_CLOSE);
1410 restore_case_semantics(conn, file_attributes);
1411 return ERROR_NT(status);
1412 }
1413 fsp->access_mask = saved_access_mask;
1414 }
1415
1416 if (ea_len && (info == FILE_WAS_CREATED)) {
1417 status = set_ea(conn, fsp, fname, ea_list);
1418 talloc_destroy(ctx);
1419 if (!NT_STATUS_IS_OK(status)) {
1420 close_file(fsp,ERROR_CLOSE);
1421 restore_case_semantics(conn, file_attributes);
1422 return ERROR_NT(status);
1423 }
1424 }
1425
1426 restore_case_semantics(conn, file_attributes);
1427
1428 file_len = sbuf.st_size;
1429 fattr = dos_mode(conn,fname,&sbuf);
1430 if(fattr == 0) {
1431 fattr = FILE_ATTRIBUTE_NORMAL;
1432 }
1433 if (!fsp->is_directory && (fattr & aDIR)) {
1434 close_file(fsp,ERROR_CLOSE);
1435 return ERROR_DOS(ERRDOS,ERRnoaccess);
1436 }
1437
1438 /* Save the requested allocation size. */
1439 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1440 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1441 #ifdef LARGE_SMB_OFF_T
1442 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1443 #endif
1444 if (allocation_size && (allocation_size > file_len)) {
1445 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1446 if (fsp->is_directory) {
1447 close_file(fsp,ERROR_CLOSE);
1448 /* Can't set allocation size on a directory. */
1449 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1450 }
1451 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1452 close_file(fsp,ERROR_CLOSE);
1453 return ERROR_NT(NT_STATUS_DISK_FULL);
1454 }
1455 } else {
1456 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1457 }
1458 }
1459
1460 /*
1461 * If the caller set the extended oplock request bit
1462 * and we granted one (by whatever means) - set the
1463 * correct bit for extended oplock reply.
1464 */
1465
1466 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1467 extended_oplock_granted = True;
1468 }
1469
1470 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1471 extended_oplock_granted = True;
1472 }
1473
1474 /* Realloc the size of parameters and data we will return */
1475 params = nttrans_realloc(ppparams, 69);
1476 if(params == NULL) {
1477 return ERROR_DOS(ERRDOS,ERRnomem);
1478 }
1479
1480 p = params;
1481 if (extended_oplock_granted) {
1482 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1483 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
1484 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1485 } else {
1486 SCVAL(p,0,NO_OPLOCK_RETURN);
1487 }
1488
1489 p += 2;
1490 SSVAL(p,0,fsp->fnum);
1491 p += 2;
1492 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1493 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1494 } else {
1495 SIVAL(p,0,info);
1496 }
1497 p += 8;
1498
1499 /* Create time. */
1500 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1501 a_timespec = get_atimespec(&sbuf);
1502 m_timespec = get_mtimespec(&sbuf);
1503
1504 if (lp_dos_filetime_resolution(SNUM(conn))) {
1505 dos_filetime_timespec(&c_timespec);
1506 dos_filetime_timespec(&a_timespec);
1507 dos_filetime_timespec(&m_timespec);
1508 }
1509
1510 put_long_date_timespec(p, c_timespec); /* create time. */
1511 p += 8;
1512 put_long_date_timespec(p, a_timespec); /* access time */
1513 p += 8;
1514 put_long_date_timespec(p, m_timespec); /* write time */
1515 p += 8;
1516 put_long_date_timespec(p, m_timespec); /* change time */
1517 p += 8;
1518 SIVAL(p,0,fattr); /* File Attributes. */
1519 p += 4;
1520 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1521 p += 8;
1522 SOFF_T(p,0,file_len);
1523 p += 8;
1524 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1525 SSVAL(p,2,0x7);
1526 }
1527 p += 4;
1528 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1529
1530 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1531
1532 /* Send the required number of replies */
1533 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1534
1535 return -1;
1536 }
1537
1538 /****************************************************************************
1539 Reply to a NT CANCEL request.
1540 conn POINTER CAN BE NULL HERE !
1541 ****************************************************************************/
1542
1543 int reply_ntcancel(connection_struct *conn,
1544 char *inbuf,char *outbuf,int length,int bufsize)
1545 {
1546 /*
1547 * Go through and cancel any pending change notifies.
1548 */
1549
1550 int mid = SVAL(inbuf,smb_mid);
1551 START_PROFILE(SMBntcancel);
1552 remove_pending_change_notify_requests_by_mid(mid);
1553 remove_pending_lock_requests_by_mid(mid);
1554 srv_cancel_sign_response(mid);
1555
1556 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1557
1558 END_PROFILE(SMBntcancel);
1559 return(-1);
1560 }
1561
1562 /****************************************************************************
1563 Copy a file.
1564 ****************************************************************************/
1565
1566 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint32 attrs)
1567 {
1568 BOOL bad_path_oldname = False;
1569 BOOL bad_path_newname = False;
1570 SMB_STRUCT_STAT sbuf1, sbuf2;
1571 pstring last_component_oldname;
1572 pstring last_component_newname;
1573 files_struct *fsp1,*fsp2;
1574 uint32 fattr;
1575 int info;
1576 SMB_OFF_T ret=-1;
1577 int close_ret;
1578 NTSTATUS status = NT_STATUS_OK;
1579
1580 ZERO_STRUCT(sbuf1);
1581 ZERO_STRUCT(sbuf2);
1582
1583 /* No wildcards. */
1584 if (ms_has_wild(newname) || ms_has_wild(oldname)) {
1585 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1586 }
1587
1588 if (!CAN_WRITE(conn))
1589 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1590
1591 unix_convert(oldname,conn,last_component_oldname,&bad_path_oldname,&sbuf1);
1592 if (bad_path_oldname) {
1593 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1594 }
1595
1596 /* Quick check for "." and ".." */
1597 if (last_component_oldname[0] == '.') {
1598 if (!last_component_oldname[1] || (last_component_oldname[1] == '.' && !last_component_oldname[2])) {
1599 return NT_STATUS_OBJECT_NAME_INVALID;
1600 }
1601 }
1602
1603 /* Source must already exist. */
1604 if (!VALID_STAT(sbuf1)) {
1605 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1606 }
1607 if (!check_name(oldname,conn)) {
1608 return NT_STATUS_ACCESS_DENIED;
1609 }
1610
1611 /* Ensure attributes match. */
1612 fattr = dos_mode(conn,oldname,&sbuf1);
1613 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1614 return NT_STATUS_NO_SUCH_FILE;
1615 }
1616
1617 unix_convert(newname,conn,last_component_newname,&bad_path_newname,&sbuf2);
1618 if (bad_path_newname) {
1619 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1620 }
1621
1622 /* Quick check for "." and ".." */
1623 if (last_component_newname[0] == '.') {
1624 if (!last_component_newname[1] || (last_component_newname[1] == '.' && !last_component_newname[2])) {
1625 return NT_STATUS_OBJECT_NAME_INVALID;
1626 }
1627 }
1628
1629 /* Disallow if newname already exists. */
1630 if (VALID_STAT(sbuf2)) {
1631 return NT_STATUS_OBJECT_NAME_COLLISION;
1632 }
1633
1634 if (!check_name(newname,conn)) {
1635 return NT_STATUS_ACCESS_DENIED;
1636 }
1637
1638 /* No links from a directory. */
1639 if (S_ISDIR(sbuf1.st_mode)) {
1640 return NT_STATUS_FILE_IS_A_DIRECTORY;
1641 }
1642
1643 /* Ensure this is within the share. */
1644 if (!reduce_name(conn, oldname) != 0) {
1645 return NT_STATUS_ACCESS_DENIED;
1646 }
1647
1648 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1649
1650 status = open_file_ntcreate(conn,oldname,&sbuf1,
1651 FILE_READ_DATA, /* Read-only. */
1652 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1653 FILE_OPEN,
1654 0, /* No create options. */
1655 FILE_ATTRIBUTE_NORMAL,
1656 NO_OPLOCK,
1657 &info, &fsp1);
1658
1659 if (!NT_STATUS_IS_OK(status)) {
1660 return status;
1661 }
1662
1663 status = open_file_ntcreate(conn,newname,&sbuf2,
1664 FILE_WRITE_DATA, /* Read-only. */
1665 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1666 FILE_CREATE,
1667 0, /* No create options. */
1668 fattr,
1669 NO_OPLOCK,
1670 &info, &fsp2);
1671
1672 if (!NT_STATUS_IS_OK(status)) {
1673 close_file(fsp1,ERROR_CLOSE);
1674 return status;
1675 }
1676
1677 if (sbuf1.st_size) {
1678 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1679 }
1680
1681 /*
1682 * As we are opening fsp1 read-only we only expect
1683 * an error on close on fsp2 if we are out of space.
1684 * Thus we don't look at the error return from the
1685 * close of fsp1.
1686 */
1687 close_file(fsp1,NORMAL_CLOSE);
1688
1689 /* Ensure the modtime is set correctly on the destination file. */
1690 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1691
1692 close_ret = close_file(fsp2,NORMAL_CLOSE);
1693
1694 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1695 creates the file. This isn't the correct thing to do in the copy
1696 case. JRA */
1697 file_set_dosmode(conn, newname, fattr, &sbuf2, True);
1698
1699 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1700 return NT_STATUS_DISK_FULL;
1701 }
1702
1703 if (close_ret != 0) {
1704 status = map_nt_error_from_unix(close_ret);
1705 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1706 nt_errstr(status), oldname, newname));
1707 }
1708 return status;
1709 }
1710
1711 /****************************************************************************
1712 Reply to a NT rename request.
1713 ****************************************************************************/
1714
1715 int reply_ntrename(connection_struct *conn,
1716 char *inbuf,char *outbuf,int length,int bufsize)
1717 {
1718 int outsize = 0;
1719 pstring oldname;
1720 pstring newname;
1721 char *p;
1722 NTSTATUS status;
1723 BOOL path_contains_wcard = False;
1724 uint32 attrs = SVAL(inbuf,smb_vwv0);
1725 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1726
1727 START_PROFILE(SMBntrename);
1728
1729 p = smb_buf(inbuf) + 1;
1730 p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &path_contains_wcard);
1731 if (!NT_STATUS_IS_OK(status)) {
1732 END_PROFILE(SMBntrename);
1733 return ERROR_NT(status);
1734 }
1735
1736 if( is_ntfs_stream_name(oldname)) {
1737 /* Can't rename a stream. */
1738 END_PROFILE(SMBntrename);
1739 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1740 }
1741
1742 if (ms_has_wild(oldname)) {
1743 END_PROFILE(SMBntrename);
1744 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1745 }
1746
1747 p++;
1748 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
1749 if (!NT_STATUS_IS_OK(status)) {
1750 END_PROFILE(SMBntrename);
1751 return ERROR_NT(status);
1752 }
1753
1754 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1755 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1756
1757 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1758
1759 switch(rename_type) {
1760 case RENAME_FLAG_RENAME:
1761 status = rename_internals(conn, oldname, newname, attrs, False, path_contains_wcard);
1762 break;
1763 case RENAME_FLAG_HARD_LINK:
1764 status = hardlink_internals(conn, oldname, newname);
1765 break;
1766 case RENAME_FLAG_COPY:
1767 if (path_contains_wcard) {
1768 /* No wildcards. */
1769 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1770 } else {
1771 status = copy_internals(conn, oldname, newname, attrs);
1772 }
1773 break;
1774 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1775 status = NT_STATUS_INVALID_PARAMETER;
1776 break;
1777 default:
1778 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1779 break;
1780 }
1781
1782 if (!NT_STATUS_IS_OK(status)) {
1783 END_PROFILE(SMBntrename);
1784 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1785 /* We have re-scheduled this call. */
1786 return -1;
1787 }
1788 return ERROR_NT(status);
1789 }
1790
1791 /*
1792 * Win2k needs a changenotify request response before it will
1793 * update after a rename..
1794 */
1795 process_pending_change_notify_queue((time_t)0);
1796 outsize = set_message(outbuf,0,0,False);
1797
1798 END_PROFILE(SMBntrename);
1799 return(outsize);
1800 }
1801
1802 /****************************************************************************
1803 Reply to a notify change - queue the request and
1804 don't allow a directory to be opened.
1805 ****************************************************************************/
1806
1807 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1808 uint16 **ppsetup, uint32 setup_count,
1809 char **ppparams, uint32 parameter_count,
1810 char **ppdata, uint32 data_count, uint32 max_data_count)
1811 {
1812 uint16 *setup = *ppsetup;
1813 files_struct *fsp;
1814 uint32 flags;
1815
1816 if(setup_count < 6) {
1817 return ERROR_DOS(ERRDOS,ERRbadfunc);
1818 }
1819
1820 fsp = file_fsp((char *)setup,4);
1821 flags = IVAL(setup, 0);
1822
1823 DEBUG(3,("call_nt_transact_notify_change\n"));
1824
1825 if(!fsp) {
1826 return ERROR_DOS(ERRDOS,ERRbadfid);
1827 }
1828
1829 if((!fsp->is_directory) || (conn != fsp->conn)) {
1830 return ERROR_DOS(ERRDOS,ERRbadfid);
1831 }
1832
1833 if (!change_notify_set(inbuf, fsp, conn, flags)) {
1834 return(UNIXERROR(ERRDOS,ERRbadfid));
1835 }
1836
1837 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1838 name = %s\n", fsp->fsp_name ));
1839
1840 return -1;
1841 }
1842
1843 /****************************************************************************
1844 Reply to an NT transact rename command.
1845 ****************************************************************************/
1846
1847 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1848 uint16 **ppsetup, uint32 setup_count,
1849 char **ppparams, uint32 parameter_count,
1850 char **ppdata, uint32 data_count, uint32 max_data_count)
1851 {
1852 char *params = *ppparams;
1853 pstring new_name;
1854 files_struct *fsp = NULL;
1855 BOOL replace_if_exists = False;
1856 BOOL path_contains_wcard = False;
1857 NTSTATUS status;
1858
1859 if(parameter_count < 4) {
1860 return ERROR_DOS(ERRDOS,ERRbadfunc);
1861 }
1862
1863 fsp = file_fsp(params, 0);
1864 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1865 CHECK_FSP(fsp, conn);
1866 srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status, &path_contains_wcard);
1867 if (!NT_STATUS_IS_OK(status)) {
1868 return ERROR_NT(status);
1869 }
1870
1871 status = rename_internals(conn, fsp->fsp_name,
1872 new_name, 0, replace_if_exists, path_contains_wcard);
1873 if (!NT_STATUS_IS_OK(status))
1874 return ERROR_NT(status);
1875
1876 /*
1877 * Rename was successful.
1878 */
1879 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1880
1881 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1882 fsp->fsp_name, new_name));
1883
1884 /*
1885 * Win2k needs a changenotify request response before it will
1886 * update after a rename..
1887 */
1888
1889 process_pending_change_notify_queue((time_t)0);
1890
1891 return -1;
1892 }
1893
1894 /******************************************************************************
1895 Fake up a completely empty SD.
1896 *******************************************************************************/
1897
1898 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1899 {
1900 size_t sd_size;
1901
1902 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1903 if(!*ppsd) {
1904 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1905 sd_size = 0;
1906 }
1907
1908 return sd_size;
1909 }
1910
1911 /****************************************************************************
1912 Reply to query a security descriptor.
1913 ****************************************************************************/
1914
1915 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1916 uint16 **ppsetup, uint32 setup_count,
1917 char **ppparams, uint32 parameter_count,
1918 char **ppdata, uint32 data_count, uint32 max_data_count)
1919 {
1920 char *params = *ppparams;
1921 char *data = *ppdata;
1922 prs_struct pd;
1923 SEC_DESC *psd = NULL;
1924 size_t sd_size;
1925 uint32 security_info_wanted;
1926 TALLOC_CTX *mem_ctx;
1927 files_struct *fsp = NULL;
1928
1929 if(parameter_count < 8) {
1930 return ERROR_DOS(ERRDOS,ERRbadfunc);
1931 }
1932
1933 fsp = file_fsp(params,0);
1934 if(!fsp) {
1935 return ERROR_DOS(ERRDOS,ERRbadfid);
1936 }
1937
1938 security_info_wanted = IVAL(params,4);
1939
1940 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1941 (unsigned int)security_info_wanted ));
1942
1943 params = nttrans_realloc(ppparams, 4);
1944 if(params == NULL) {
1945 return ERROR_DOS(ERRDOS,ERRnomem);
1946 }
1947
1948 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1949 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1950 return ERROR_DOS(ERRDOS,ERRnomem);
1951 }
1952
1953 /*
1954 * Get the permissions to return.
1955 */
1956
1957 if (!lp_nt_acl_support(SNUM(conn))) {
1958 sd_size = get_null_nt_acl(mem_ctx, &psd);
1959 } else {
1960 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
1961 }
1962
1963 if (sd_size == 0) {
1964 talloc_destroy(mem_ctx);
1965 return(UNIXERROR(ERRDOS,ERRnoaccess));
1966 }
1967
1968 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1969
1970 SIVAL(params,0,(uint32)sd_size);
1971
1972 if(max_data_count < sd_size) {
1973
1974 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
1975 params, 4, *ppdata, 0);
1976 talloc_destroy(mem_ctx);
1977 return -1;
1978 }
1979
1980 /*
1981 * Allocate the data we will point this at.
1982 */
1983
1984 data = nttrans_realloc(ppdata, sd_size);
1985 if(data == NULL) {
1986 talloc_destroy(mem_ctx);
1987 return ERROR_DOS(ERRDOS,ERRnomem);
1988 }
1989
1990 /*
1991 * Init the parse struct we will marshall into.
1992 */
1993
1994 prs_init(&pd, 0, mem_ctx, MARSHALL);
1995
1996 /*
1997 * Setup the prs_struct to point at the memory we just
1998 * allocated.
1999 */
2000
2001 prs_give_memory( &pd, data, (uint32)sd_size, False);
2002
2003 /*
2004 * Finally, linearize into the outgoing buffer.
2005 */
2006
2007 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2008 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2009 security descriptor.\n"));
2010 /*
2011 * Return access denied for want of a better error message..
2012 */
2013 talloc_destroy(mem_ctx);
2014 return(UNIXERROR(ERRDOS,ERRnoaccess));
2015 }
2016
2017 /*
2018 * Now we can delete the security descriptor.
2019 */
2020
2021 talloc_destroy(mem_ctx);
2022
2023 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
2024 return -1;
2025 }
2026
2027 /****************************************************************************
2028 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2029 ****************************************************************************/
2030
2031 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2032 uint16 **ppsetup, uint32 setup_count,
2033 char **ppparams, uint32 parameter_count,
2034 char **ppdata, uint32 data_count, uint32 max_data_count)
2035 {
2036 char *params= *ppparams;
2037 char *data = *ppdata;
2038 files_struct *fsp = NULL;
2039 uint32 security_info_sent = 0;
2040 NTSTATUS nt_status;
2041
2042 if(parameter_count < 8) {
2043 return ERROR_DOS(ERRDOS,ERRbadfunc);
2044 }
2045
2046 if((fsp = file_fsp(params,0)) == NULL) {
2047 return ERROR_DOS(ERRDOS,ERRbadfid);
2048 }
2049
2050 if(!lp_nt_acl_support(SNUM(conn))) {
2051 goto done;
2052 }
2053
2054 security_info_sent = IVAL(params,4);
2055
2056 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2057 (unsigned int)security_info_sent ));
2058
2059 if (data_count == 0) {
2060 return ERROR_DOS(ERRDOS, ERRnoaccess);
2061 }
2062
2063 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2064 return ERROR_NT(nt_status);
2065 }
2066
2067 done:
2068
2069 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2070 return -1;
2071 }
2072
2073 /****************************************************************************
2074 Reply to NT IOCTL
2075 ****************************************************************************/
2076
2077 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2078 uint16 **ppsetup, uint32 setup_count,
2079 char **ppparams, uint32 parameter_count,
2080 char **ppdata, uint32 data_count, uint32 max_data_count)
2081 {
2082 uint32 function;
2083 uint16 fidnum;
2084 files_struct *fsp;
2085 uint8 isFSctl;
2086 uint8 compfilter;
2087 static BOOL logged_message;
2088 char *pdata = *ppdata;
2089
2090 if (setup_count != 8) {
2091 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2092 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2093 }
2094
2095 function = IVAL(*ppsetup, 0);
2096 fidnum = SVAL(*ppsetup, 4);
2097 isFSctl = CVAL(*ppsetup, 6);
2098 compfilter = CVAL(*ppsetup, 7);
2099
2100 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2101 function, fidnum, isFSctl, compfilter));
2102
2103 fsp=file_fsp((char *)*ppsetup, 4);
2104 /* this check is done in each implemented function case for now
2105 because I don't want to break anything... --metze
2106 FSP_BELONGS_CONN(fsp,conn);*/
2107
2108 switch (function) {
2109 case FSCTL_SET_SPARSE:
2110 /* pretend this succeeded - tho strictly we should
2111 mark the file sparse (if the local fs supports it)
2112 so we can know if we need to pre-allocate or not */
2113
2114 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2115 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2116 return -1;
2117
2118 case FSCTL_0x000900C0:
2119 /* pretend this succeeded - don't know what this really is
2120 but works ok like this --metze
2121 */
2122
2123 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2124 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2125 return -1;
2126
2127 case FSCTL_GET_REPARSE_POINT:
2128 /* pretend this fail - my winXP does it like this
2129 * --metze
2130 */
2131
2132 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2133 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2134 return -1;
2135
2136 case FSCTL_SET_REPARSE_POINT:
2137 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2138 * --metze
2139 */
2140
2141 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2142 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2143 return -1;
2144
2145 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2146 {
2147 /*
2148 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2149 * and return their volume names. If max_data_count is 16, then it is just
2150 * asking for the number of volumes and length of the combined names.
2151 *
2152 * pdata is the data allocated by our caller, but that uses
2153 * total_data_count (which is 0 in our case) rather than max_data_count.
2154 * Allocate the correct amount and return the pointer to let
2155 * it be deallocated when we return.
2156 */
2157 SHADOW_COPY_DATA *shadow_data = NULL;
2158 TALLOC_CTX *shadow_mem_ctx = NULL;
2159 BOOL labels = False;
2160 uint32 labels_data_count = 0;
2161 uint32 i;
2162 char *cur_pdata;
2163
2164 FSP_BELONGS_CONN(fsp,conn);
2165
2166 if (max_data_count < 16) {
2167 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2168 max_data_count));
2169 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2170 }
2171
2172 if (max_data_count > 16) {
2173 labels = True;
2174 }
2175
2176 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2177 if (shadow_mem_ctx == NULL) {
2178 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2179 return ERROR_NT(NT_STATUS_NO_MEMORY);
2180 }
2181
2182 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2183 if (shadow_data == NULL) {
2184 DEBUG(0,("talloc_zero() failed!\n"));
2185 talloc_destroy(shadow_mem_ctx);
2186 return ERROR_NT(NT_STATUS_NO_MEMORY);
2187 }
2188
2189 shadow_data->mem_ctx = shadow_mem_ctx;
2190
2191 /*
2192 * Call the VFS routine to actually do the work.
2193 */
2194 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2195 talloc_destroy(shadow_data->mem_ctx);
2196 if (errno == ENOSYS) {
2197 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2198 conn->connectpath));
2199 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2200 } else {
2201 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2202 conn->connectpath));
2203 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2204 }
2205 }
2206
2207 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2208
2209 if (!labels) {
2210 data_count = 16;
2211 } else {
2212 data_count = 12+labels_data_count+4;
2213 }
2214
2215 if (max_data_count<data_count) {
2216 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2217 max_data_count,data_count));
2218 talloc_destroy(shadow_data->mem_ctx);
2219 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2220 }
2221
2222 pdata = nttrans_realloc(ppdata, data_count);
2223 if (pdata == NULL) {
2224 talloc_destroy(shadow_data->mem_ctx);
2225 return ERROR_NT(NT_STATUS_NO_MEMORY);
2226 }
2227
2228 cur_pdata = pdata;
2229
2230 /* num_volumes 4 bytes */
2231 SIVAL(pdata,0,shadow_data->num_volumes);
2232
2233 if (labels) {
2234 /* num_labels 4 bytes */
2235 SIVAL(pdata,4,shadow_data->num_volumes);
2236 }
2237
2238 /* needed_data_count 4 bytes */
2239 SIVAL(pdata,8,labels_data_count);
2240
2241 cur_pdata+=12;
2242
2243 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2244 shadow_data->num_volumes,fsp->fsp_name));
2245 if (labels && shadow_data->labels) {
2246 for (i=0;i<shadow_data->num_volumes;i++) {
2247 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2248 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2249 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2250 }
2251 }
2252
2253 talloc_destroy(shadow_data->mem_ctx);
2254
2255 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2256
2257 return -1;
2258 }
2259
2260 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2261 {
2262 /* pretend this succeeded -
2263 *
2264 * we have to send back a list with all files owned by this SID
2265 *
2266 * but I have to check that --metze
2267 */
2268 DOM_SID sid;
2269 uid_t uid;
2270 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2271
2272 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2273
2274 FSP_BELONGS_CONN(fsp,conn);
2275
2276 /* unknown 4 bytes: this is not the length of the sid :-( */
2277 /*unknown = IVAL(pdata,0);*/
2278
2279 sid_parse(pdata+4,sid_len,&sid);
2280 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2281
2282 if (!sid_to_uid(&sid, &uid)) {
2283 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2284 sid_string_static(&sid),(unsigned long)sid_len));
2285 uid = (-1);
2286 }
2287
2288 /* we can take a look at the find source :-)
2289 *
2290 * find ./ -uid $uid -name '*' is what we need here
2291 *
2292 *
2293 * and send 4bytes len and then NULL terminated unicode strings
2294 * for each file
2295 *
2296 * but I don't know how to deal with the paged results
2297 * (maybe we can hang the result anywhere in the fsp struct)
2298 *
2299 * we don't send all files at once
2300 * and at the next we should *not* start from the beginning,
2301 * so we have to cache the result
2302 *
2303 * --metze
2304 */
2305
2306 /* this works for now... */
2307 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2308 return -1;
2309 }
2310 default:
2311 if (!logged_message) {
2312 logged_message = True; /* Only print this once... */
2313 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2314 function));
2315 }
2316 }
2317
2318 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2319 }
2320
2321
2322 #ifdef HAVE_SYS_QUOTAS
2323 /****************************************************************************
2324 Reply to get user quota
2325 ****************************************************************************/
2326
2327 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2328 uint16 **ppsetup, uint32 setup_count,
2329 char **ppparams, uint32 parameter_count,
2330 char **ppdata, uint32 data_count, uint32 max_data_count)
2331 {
2332 NTSTATUS nt_status = NT_STATUS_OK;
2333 char *params = *ppparams;
2334 char *pdata = *ppdata;
2335 char *entry;
2336 int data_len=0,param_len=0;
2337 int qt_len=0;
2338 int entry_len = 0;
2339 files_struct *fsp = NULL;
2340 uint16 level = 0;
2341 size_t sid_len;
2342 DOM_SID sid;
2343 BOOL start_enum = True;
2344 SMB_NTQUOTA_STRUCT qt;
2345 SMB_NTQUOTA_LIST *tmp_list;
2346 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2347 extern struct current_user current_user;
2348
2349 ZERO_STRUCT(qt);
2350
2351 /* access check */
2352 if (current_user.ut.uid != 0) {
2353 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2354 lp_servicename(SNUM(conn)),conn->user));
2355 return ERROR_DOS(ERRDOS,ERRnoaccess);
2356 }
2357
2358 /*
2359 * Ensure minimum number of parameters sent.
2360 */
2361
2362 if (parameter_count < 4) {
2363 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2364 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2365 }
2366
2367 /* maybe we can check the quota_fnum */
2368 fsp = file_fsp(params,0);
2369 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2370 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2371 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2372 }
2373
2374 /* the NULL pointer checking for fsp->fake_file_handle->pd
2375 * is done by CHECK_NTQUOTA_HANDLE_OK()
2376 */
2377 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2378
2379 level = SVAL(params,2);
2380
2381 /* unknown 12 bytes leading in params */
2382
2383 switch (level) {
2384 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2385 /* seems that we should continue with the enum here --metze */
2386
2387 if (qt_handle->quota_list!=NULL &&
2388 qt_handle->tmp_list==NULL) {
2389
2390 /* free the list */
2391 free_ntquota_list(&(qt_handle->quota_list));
2392
2393 /* Realloc the size of parameters and data we will return */
2394 param_len = 4;
2395 params = nttrans_realloc(ppparams, param_len);
2396 if(params == NULL) {
2397 return ERROR_DOS(ERRDOS,ERRnomem);
2398 }
2399
2400 data_len = 0;
2401 SIVAL(params,0,data_len);
2402
2403 break;
2404 }
2405
2406 start_enum = False;
2407
2408 case TRANSACT_GET_USER_QUOTA_LIST_START:
2409
2410 if (qt_handle->quota_list==NULL &&
2411 qt_handle->tmp_list==NULL) {
2412 start_enum = True;
2413 }
2414
2415 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2416 return ERROR_DOS(ERRSRV,ERRerror);
2417
2418 /* Realloc the size of parameters and data we will return */
2419 param_len = 4;
2420 params = nttrans_realloc(ppparams, param_len);
2421 if(params == NULL) {
2422 return ERROR_DOS(ERRDOS,ERRnomem);
2423 }
2424
2425 /* we should not trust the value in max_data_count*/
2426 max_data_count = MIN(max_data_count,2048);
2427
2428 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2429 if(pdata == NULL) {
2430 return ERROR_DOS(ERRDOS,ERRnomem);
2431 }
2432
2433 entry = pdata;
2434
2435 /* set params Size of returned Quota Data 4 bytes*/
2436 /* but set it later when we know it */
2437
2438 /* for each entry push the data */
2439
2440 if (start_enum) {
2441 qt_handle->tmp_list = qt_handle->quota_list;
2442 }
2443
2444 tmp_list = qt_handle->tmp_list;
2445
2446 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2447 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2448
2449 sid_len = sid_size(&tmp_list->quotas->sid);
2450 entry_len = 40 + sid_len;
2451
2452 /* nextoffset entry 4 bytes */
2453 SIVAL(entry,0,entry_len);
2454
2455 /* then the len of the SID 4 bytes */
2456 SIVAL(entry,4,sid_len);
2457
2458 /* unknown data 8 bytes SMB_BIG_UINT */
2459 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2460
2461 /* the used disk space 8 bytes SMB_BIG_UINT */
2462 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2463
2464 /* the soft quotas 8 bytes SMB_BIG_UINT */
2465 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2466
2467 /* the hard quotas 8 bytes SMB_BIG_UINT */
2468 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2469
2470 /* and now the SID */
2471 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2472 }
2473
2474 qt_handle->tmp_list = tmp_list;
2475
2476 /* overwrite the offset of the last entry */
2477 SIVAL(entry-entry_len,0,0);
2478
2479 data_len = 4+qt_len;
2480 /* overwrite the params quota_data_len */
2481 SIVAL(params,0,data_len);
2482
2483 break;
2484
2485 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2486
2487 /* unknown 4 bytes IVAL(pdata,0) */
2488
2489 if (data_count < 8) {
2490 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2491 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2492 }
2493
2494 sid_len = IVAL(pdata,4);
2495 /* Ensure this is less than 1mb. */
2496 if (sid_len > (1024*1024)) {
2497 return ERROR_DOS(ERRDOS,ERRnomem);
2498 }
2499
2500 if (data_count < 8+sid_len) {
2501 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2502 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2503 }
2504
2505 data_len = 4+40+sid_len;
2506
2507 if (max_data_count < data_len) {
2508 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2509 max_data_count, data_len));
2510 param_len = 4;
2511 SIVAL(params,0,data_len);
2512 data_len = 0;
2513 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2514 break;
2515 }
2516
2517 sid_parse(pdata+8,sid_len,&sid);
2518
2519 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2520 ZERO_STRUCT(qt);
2521 /*
2522 * we have to return zero's in all fields
2523 * instead of returning an error here
2524 * --metze
2525 */
2526 }
2527
2528 /* Realloc the size of parameters and data we will return */
2529 param_len = 4;
2530 params = nttrans_realloc(ppparams, param_len);
2531 if(params == NULL) {
2532 return ERROR_DOS(ERRDOS,ERRnomem);
2533 }
2534
2535 pdata = nttrans_realloc(ppdata, data_len);
2536 if(pdata == NULL) {
2537 return ERROR_DOS(ERRDOS,ERRnomem);
2538 }
2539
2540 entry = pdata;
2541
2542 /* set params Size of returned Quota Data 4 bytes*/
2543 SIVAL(params,0,data_len);
2544
2545 /* nextoffset entry 4 bytes */
2546 SIVAL(entry,0,0);
2547
2548 /* then the len of the SID 4 bytes */
2549 SIVAL(entry,4,sid_len);
2550
2551 /* unknown data 8 bytes SMB_BIG_UINT */
2552 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2553
2554 /* the used disk space 8 bytes SMB_BIG_UINT */
2555 SBIG_UINT(entry,16,qt.usedspace);
2556
2557 /* the soft quotas 8 bytes SMB_BIG_UINT */
2558 SBIG_UINT(entry,24,qt.softlim);
2559
2560 /* the hard quotas 8 bytes SMB_BIG_UINT */
2561 SBIG_UINT(entry,32,qt.hardlim);
2562
2563 /* and now the SID */
2564 sid_linearize(entry+40, sid_len, &sid);
2565
2566 break;
2567
2568 default:
2569 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2570 return ERROR_DOS(ERRSRV,ERRerror);
2571 break;
2572 }
2573
2574 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2575
2576 return -1;
2577 }
2578
2579 /****************************************************************************
2580 Reply to set user quota
2581 ****************************************************************************/
2582
2583 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2584 uint16 **ppsetup, uint32 setup_count,
2585 char **ppparams, uint32 parameter_count,
2586 char **ppdata, uint32 data_count, uint32 max_data_count)
2587 {
2588 char *params = *ppparams;
2589 char *pdata = *ppdata;
2590 int data_len=0,param_len=0;
2591 SMB_NTQUOTA_STRUCT qt;
2592 size_t sid_len;
2593 DOM_SID sid;
2594 files_struct *fsp = NULL;
2595
2596 ZERO_STRUCT(qt);
2597
2598 /* access check */
2599 if (current_user.ut.uid != 0) {
2600 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2601 lp_servicename(SNUM(conn)),conn->user));
2602 return ERROR_DOS(ERRDOS,ERRnoaccess);
2603 }
2604
2605 /*
2606 * Ensure minimum number of parameters sent.
2607 */
2608
2609 if (parameter_count < 2) {
2610 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2611 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2612 }
2613
2614 /* maybe we can check the quota_fnum */
2615 fsp = file_fsp(params,0);
2616 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2617 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2618 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2619 }
2620
2621 if (data_count < 40) {
2622 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2623 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2624 }
2625
2626 /* offset to next quota record.
2627 * 4 bytes IVAL(pdata,0)
2628 * unused here...
2629 */
2630
2631 /* sid len */
2632 sid_len = IVAL(pdata,4);
2633
2634 if (data_count < 40+sid_len) {
2635 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2636 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2637 }
2638
2639 /* unknown 8 bytes in pdata
2640 * maybe its the change time in NTTIME
2641 */
2642
2643 /* the used space 8 bytes (SMB_BIG_UINT)*/
2644 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2645 #ifdef LARGE_SMB_OFF_T
2646 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2647 #else /* LARGE_SMB_OFF_T */
2648 if ((IVAL(pdata,20) != 0)&&
2649 ((qt.usedspace != 0xFFFFFFFF)||
2650 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2651 /* more than 32 bits? */
2652 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2653 }
2654 #endif /* LARGE_SMB_OFF_T */
2655
2656 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2657 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2658 #ifdef LARGE_SMB_OFF_T
2659 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2660 #else /* LARGE_SMB_OFF_T */
2661 if ((IVAL(pdata,28) != 0)&&
2662 ((qt.softlim != 0xFFFFFFFF)||
2663 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2664 /* more than 32 bits? */
2665 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2666 }
2667 #endif /* LARGE_SMB_OFF_T */
2668
2669 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2670 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2671 #ifdef LARGE_SMB_OFF_T
2672 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2673 #else /* LARGE_SMB_OFF_T */
2674 if ((IVAL(pdata,36) != 0)&&
2675 ((qt.hardlim != 0xFFFFFFFF)||
2676 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2677 /* more than 32 bits? */
2678 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2679 }
2680 #endif /* LARGE_SMB_OFF_T */
2681
2682 sid_parse(pdata+40,sid_len,&sid);
2683 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2684
2685 /* 44 unknown bytes left... */
2686
2687 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2688 return ERROR_DOS(ERRSRV,ERRerror);
2689 }
2690
2691 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2692
2693 return -1;
2694 }
2695 #endif /* HAVE_SYS_QUOTAS */
2696
2697 static int handle_nttrans(connection_struct *conn,
2698 struct trans_state *state,
2699 char *inbuf, char *outbuf, int size, int bufsize)
2700 {
2701 int outsize;
2702
2703 if (Protocol >= PROTOCOL_NT1) {
2704 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
2705 }
2706
2707 /* Now we must call the relevant NT_TRANS function */
2708 switch(state->call) {
2709 case NT_TRANSACT_CREATE:
2710 {
2711 START_PROFILE_NESTED(NT_transact_create);
2712 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2713 size, bufsize,
2714 &state->setup, state->setup_count,
2715 &state->param, state->total_param,
2716 &state->data, state->total_data,
2717 state->max_data_return);
2718 END_PROFILE_NESTED(NT_transact_create);
2719 break;
2720 }
2721
2722 case NT_TRANSACT_IOCTL:
2723 {
2724 START_PROFILE_NESTED(NT_transact_ioctl);
2725 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2726 size, bufsize,
2727 &state->setup, state->setup_count,
2728 &state->param, state->total_param,
2729 &state->data, state->total_data, state->max_data_return);
2730 END_PROFILE_NESTED(NT_transact_ioctl);
2731 break;
2732 }
2733
2734 case NT_TRANSACT_SET_SECURITY_DESC:
2735 {
2736 START_PROFILE_NESTED(NT_transact_set_security_desc);
2737 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2738 size, bufsize,
2739 &state->setup, state->setup_count,
2740 &state->param, state->total_param,
2741 &state->data, state->total_data, state->max_data_return);
2742 END_PROFILE_NESTED(NT_transact_set_security_desc);
2743 break;
2744 }
2745
2746 case NT_TRANSACT_NOTIFY_CHANGE:
2747 {
2748 START_PROFILE_NESTED(NT_transact_notify_change);
2749 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
2750 size, bufsize,
2751 &state->setup, state->setup_count,
2752 &state->param, state->total_param,
2753 &state->data, state->total_data, state->max_data_return);
2754 END_PROFILE_NESTED(NT_transact_notify_change);
2755 break;
2756 }
2757
2758 case NT_TRANSACT_RENAME:
2759 {
2760 START_PROFILE_NESTED(NT_transact_rename);
2761 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2762 size, bufsize,
2763 &state->setup, state->setup_count,
2764 &state->param, state->total_param,
2765 &state->data, state->total_data, state->max_data_return);
2766 END_PROFILE_NESTED(NT_transact_rename);
2767 break;
2768 }
2769
2770 case NT_TRANSACT_QUERY_SECURITY_DESC:
2771 {
2772 START_PROFILE_NESTED(NT_transact_query_security_desc);
2773 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2774 size, bufsize,
2775 &state->setup, state->setup_count,
2776 &state->param, state->total_param,
2777 &state->data, state->total_data, state->max_data_return);
2778 END_PROFILE_NESTED(NT_transact_query_security_desc);
2779 break;
2780 }
2781
2782 #ifdef HAVE_SYS_QUOTAS
2783 case NT_TRANSACT_GET_USER_QUOTA:
2784 {
2785 START_PROFILE_NESTED(NT_transact_get_user_quota);
2786 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2787 size, bufsize,
2788 &state->setup, state->setup_count,
2789 &state->param, state->total_param,
2790 &state->data, state->total_data, state->max_data_return);
2791 END_PROFILE_NESTED(NT_transact_get_user_quota);
2792 break;
2793 }
2794
2795 case NT_TRANSACT_SET_USER_QUOTA:
2796 {
2797 START_PROFILE_NESTED(NT_transact_set_user_quota);
2798 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2799 size, bufsize,
2800 &state->setup, state->setup_count,
2801 &state->param, state->total_param,
2802 &state->data, state->total_data, state->max_data_return);
2803 END_PROFILE_NESTED(NT_transact_set_user_quota);
2804 break;
2805 }
2806 #endif /* HAVE_SYS_QUOTAS */
2807
2808 default:
2809 /* Error in request */
2810 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2811 state->call));
2812 return ERROR_DOS(ERRSRV,ERRerror);
2813 }
2814 return outsize;
2815 }
2816
2817 /****************************************************************************
2818 Reply to a SMBNTtrans.
2819 ****************************************************************************/
2820
2821 int reply_nttrans(connection_struct *conn,
2822 char *inbuf,char *outbuf,int size,int bufsize)
2823 {
2824 int outsize = 0;
2825 uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2826 uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2827 uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2828 uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2829
2830 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2831 NTSTATUS result;
2832 struct trans_state *state;
2833
2834 START_PROFILE(SMBnttrans);
2835
2836 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2837 END_PROFILE(SMBnttrans);
2838 return ERROR_DOS(ERRSRV,ERRaccess);
2839 }
2840
2841 result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2842 if (!NT_STATUS_IS_OK(result)) {
2843 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2844 END_PROFILE(SMBnttrans);
2845 return ERROR_NT(result);
2846 }
2847
2848 if ((state = TALLOC_P(NULL, struct trans_state)) == NULL) {
2849 END_PROFILE(SMBnttrans);
2850 return ERROR_DOS(ERRSRV,ERRaccess);
2851 }
2852
2853 state->cmd = SMBnttrans;
2854
2855 state->mid = SVAL(inbuf,smb_mid);
2856 state->vuid = SVAL(inbuf,smb_uid);
2857 state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
2858 state->data = NULL;
2859 state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
2860 state->param = NULL;
2861 state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
2862
2863 /* setup count is in *words* */
2864 state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
2865 state->call = function_code;
2866
2867 /*
2868 * All nttrans messages we handle have smb_wct == 19 +
2869 * state->setup_count. Ensure this is so as a sanity check.
2870 */
2871
2872 if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
2873 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2874 CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
2875 goto bad_param;
2876 }
2877
2878 /* Don't allow more than 128mb for each value. */
2879 if ((state->total_data > (1024*1024*128)) ||
2880 (state->total_param > (1024*1024*128))) {
2881 END_PROFILE(SMBnttrans);
2882 return ERROR_DOS(ERRDOS,ERRnomem);
2883 }
2884
2885 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2886 goto bad_param;
2887
2888 if (state->total_data) {
2889 /* Can't use talloc here, the core routines do realloc on the
2890 * params and data. */
2891 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2892 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2893 "bytes !\n", (unsigned int)state->total_data));
2894 TALLOC_FREE(state);
2895 END_PROFILE(SMBnttrans);
2896 return(ERROR_DOS(ERRDOS,ERRnomem));
2897 }
2898 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
2899 goto bad_param;
2900 if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
2901 (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
2902 goto bad_param;
2903
2904 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
2905 }
2906
2907 if (state->total_param) {
2908 /* Can't use talloc here, the core routines do realloc on the
2909 * params and data. */
2910 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2911 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2912 "bytes !\n", (unsigned int)state->total_param));
2913 SAFE_FREE(state->data);
2914 TALLOC_FREE(state);
2915 END_PROFILE(SMBnttrans);
2916 return(ERROR_DOS(ERRDOS,ERRnomem));
2917 }
2918 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
2919 goto bad_param;
2920 if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
2921 (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
2922 goto bad_param;
2923
2924 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
2925 }
2926
2927 state->received_data = dscnt;
2928 state->received_param = pscnt;
2929
2930 if(state->setup_count > 0) {
2931 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2932 state->setup_count));
2933 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2934 if (state->setup == NULL) {
2935 DEBUG(0,("reply_nttrans : Out of memory\n"));
2936 SAFE_FREE(state->data);
2937 SAFE_FREE(state->param);
2938 TALLOC_FREE(state);
2939 END_PROFILE(SMBnttrans);
2940 return ERROR_DOS(ERRDOS,ERRnomem);
2941 }
2942
2943 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2944 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2945 goto bad_param;
2946 }
2947 if (smb_nt_SetupStart + state->setup_count > size) {
2948 goto bad_param;
2949 }
2950
2951 memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
2952 dump_data(10, (char *)state->setup, state->setup_count);
2953 }
2954
2955 if ((state->received_data == state->total_data) &&
2956 (state->received_param == state->total_param)) {
2957 outsize = handle_nttrans(conn, state, inbuf, outbuf,
2958 size, bufsize);
2959 SAFE_FREE(state->param);
2960 SAFE_FREE(state->data);
2961 TALLOC_FREE(state);
2962 END_PROFILE(SMBnttrans);
2963 return outsize;
2964 }
2965
2966 DLIST_ADD(conn->pending_trans, state);
2967
2968 /* We need to send an interim response then receive the rest
2969 of the parameter/data bytes */
2970 outsize = set_message(outbuf,0,0,False);
2971 show_msg(outbuf);
2972 END_PROFILE(SMBnttrans);
2973 return outsize;
2974
2975 bad_param:
2976
2977 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2978 SAFE_FREE(state->data);
2979 SAFE_FREE(state->param);
2980 TALLOC_FREE(state);
2981 END_PROFILE(SMBnttrans);
2982 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2983 }
2984
2985 /****************************************************************************
2986 Reply to a SMBnttranss
2987 ****************************************************************************/
2988
2989 int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf,
2990 int size,int bufsize)
2991 {
2992 int outsize = 0;
2993 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
2994 struct trans_state *state;
2995
2996 START_PROFILE(SMBnttranss);
2997
2998 show_msg(inbuf);
2999
3000 for (state = conn->pending_trans; state != NULL;
3001 state = state->next) {
3002 if (state->mid == SVAL(inbuf,smb_mid)) {
3003 break;
3004 }
3005 }
3006
3007 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3008 END_PROFILE(SMBnttranss);
3009 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3010 }
3011
3012 /* Revise state->total_param and state->total_data in case they have
3013 changed downwards */
3014 if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3015 state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3016 }
3017 if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3018 state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3019 }
3020
3021 pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3022 poff = IVAL(inbuf, smb_nts_ParameterOffset);
3023 pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3024
3025 dcnt = IVAL(inbuf, smb_nts_DataCount);
3026 ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3027 doff = IVAL(inbuf, smb_nts_DataOffset);
3028
3029 state->received_param += pcnt;
3030 state->received_data += dcnt;
3031
3032 if ((state->received_data > state->total_data) ||
3033 (state->received_param > state->total_param))
3034 goto bad_param;
3035
3036 if (pcnt) {
3037 if (pdisp+pcnt > state->total_param)
3038 goto bad_param;
3039 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3040 goto bad_param;
3041 if (pdisp > state->total_param)
3042 goto bad_param;
3043 if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
3044 (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3045 goto bad_param;
3046 if (state->param + pdisp < state->param)
3047 goto bad_param;
3048
3049 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3050 pcnt);
3051 }
3052
3053 if (dcnt) {
3054 if (ddisp+dcnt > state->total_data)
3055 goto bad_param;
3056 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3057 goto bad_param;
3058 if (ddisp > state->total_data)
3059 goto bad_param;
3060 if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
3061 (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3062 goto bad_param;
3063 if (state->data + ddisp < state->data)
3064 goto bad_param;
3065
3066 memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3067 dcnt);
3068 }
3069
3070 if ((state->received_param < state->total_param) ||
3071 (state->received_data < state->total_data)) {
3072 END_PROFILE(SMBnttranss);
3073 return -1;
3074 }
3075
3076 /* construct_reply_common has done us the favor to pre-fill the
3077 * command field with SMBnttranss which is wrong :-)
3078 */
3079 SCVAL(outbuf,smb_com,SMBnttrans);
3080
3081 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3082 size, bufsize);
3083
3084 DLIST_REMOVE(conn->pending_trans, state);
3085 SAFE_FREE(state->data);
3086 SAFE_FREE(state->param);
3087 TALLOC_FREE(state);
3088
3089 if (outsize == 0) {
3090 END_PROFILE(SMBnttranss);
3091 return(ERROR_DOS(ERRSRV,ERRnosupport));
3092 }
3093
3094 END_PROFILE(SMBnttranss);
3095 return(outsize);
3096
3097 bad_param:
3098
3099 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3100 DLIST_REMOVE(conn->pending_trans, state);
3101 SAFE_FREE(state->data);
3102 SAFE_FREE(state->param);
3103 TALLOC_FREE(state);
3104 END_PROFILE(SMBnttranss);
3105 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3106 }
Samba GIT mirror