?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix the build of nfs4_acls.c
[Samba.git] / source3 / smbd / reply.c
blob8657bd6e1807b9103b6c8ba34a97954c15c78f2b
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!posix_path && !stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* Stream names allow more characters than file names.
80 We're overloading posix_path here to allow a wider
81 range of characters. If stream_started is true this
82 is still a Windows path even if posix_path is true.
83 JRA.
84 */
85 stream_started = true;
86 start_of_name_component = false;
87 posix_path = true;
88
89 if (s[1] == '\0') {
90 return NT_STATUS_OBJECT_NAME_INVALID;
91 }
92 }
93
94 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
95 /*
96 * Safe to assume is not the second part of a mb char
97 * as this is handled below.
98 */
99 /* Eat multiple '/' or '\\' */
100 while (IS_PATH_SEP(*s,posix_path)) {
101 s++;
102 }
103 if ((d != path) && (*s != '\0')) {
104 /* We only care about non-leading or trailing '/' or '\\' */
105 *d++ = '/';
106 }
107
108 start_of_name_component = True;
109 /* New component. */
110 *p_last_component_contains_wcard = False;
111 continue;
112 }
113
114 if (start_of_name_component) {
115 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
116 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
117
118 /*
119 * No mb char starts with '.' so we're safe checking the directory separator here.
120 */
121
122 /* If we just added a '/' - delete it */
123 if ((d > path) && (*(d-1) == '/')) {
124 *(d-1) = '\0';
125 d--;
126 }
127
128 /* Are we at the start ? Can't go back further if so. */
129 if (d <= path) {
130 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
131 break;
132 }
133 /* Go back one level... */
134 /* We know this is safe as '/' cannot be part of a mb sequence. */
135 /* NOTE - if this assumption is invalid we are not in good shape... */
136 /* Decrement d first as d points to the *next* char to write into. */
137 for (d--; d > path; d--) {
138 if (*d == '/')
139 break;
140 }
141 s += 2; /* Else go past the .. */
142 /* We're still at the start of a name component, just the previous one. */
143 continue;
144
145 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
146 if (posix_path) {
147 /* Eat the '.' */
148 s++;
149 continue;
150 }
151 }
152
153 }
154
155 if (!(*s & 0x80)) {
156 if (!posix_path) {
157 if (*s <= 0x1f || *s == '|') {
158 return NT_STATUS_OBJECT_NAME_INVALID;
159 }
160 switch (*s) {
161 case '*':
162 case '?':
163 case '<':
164 case '>':
165 case '"':
166 *p_last_component_contains_wcard = True;
167 break;
168 default:
169 break;
170 }
171 }
172 *d++ = *s++;
173 } else {
174 size_t siz;
175 /* Get the size of the next MB character. */
176 next_codepoint(s,&siz);
177 switch(siz) {
178 case 5:
179 *d++ = *s++;
180 /*fall through*/
181 case 4:
182 *d++ = *s++;
183 /*fall through*/
184 case 3:
185 *d++ = *s++;
186 /*fall through*/
187 case 2:
188 *d++ = *s++;
189 /*fall through*/
190 case 1:
191 *d++ = *s++;
192 break;
193 default:
194 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
195 *d = '\0';
196 return NT_STATUS_INVALID_PARAMETER;
197 }
198 }
199 start_of_name_component = False;
200 }
201
202 *d = '\0';
203
204 return ret;
205 }
206
207 /****************************************************************************
208 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
209 No wildcards allowed.
210 ****************************************************************************/
211
212 NTSTATUS check_path_syntax(char *path)
213 {
214 bool ignore;
215 return check_path_syntax_internal(path, False, &ignore);
216 }
217
218 /****************************************************************************
219 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
220 Wildcards allowed - p_contains_wcard returns true if the last component contained
221 a wildcard.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
225 {
226 return check_path_syntax_internal(path, False, p_contains_wcard);
227 }
228
229 /****************************************************************************
230 Check the path for a POSIX client.
231 We're assuming here that '/' is not the second byte in any multibyte char
232 set (a safe assumption).
233 ****************************************************************************/
234
235 NTSTATUS check_path_syntax_posix(char *path)
236 {
237 bool ignore;
238 return check_path_syntax_internal(path, True, &ignore);
239 }
240
241 /****************************************************************************
242 Pull a string and check the path allowing a wilcard - provide for error return.
243 ****************************************************************************/
244
245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
246 const char *base_ptr,
247 uint16 smb_flags2,
248 char **pp_dest,
249 const char *src,
250 size_t src_len,
251 int flags,
252 NTSTATUS *err,
253 bool *contains_wcard)
254 {
255 size_t ret;
256
257 *pp_dest = NULL;
258
259 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
260 src_len, flags);
261
262 if (!*pp_dest) {
263 *err = NT_STATUS_INVALID_PARAMETER;
264 return ret;
265 }
266
267 *contains_wcard = False;
268
269 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
270 /*
271 * For a DFS path the function parse_dfs_path()
272 * will do the path processing, just make a copy.
273 */
274 *err = NT_STATUS_OK;
275 return ret;
276 }
277
278 if (lp_posix_pathnames()) {
279 *err = check_path_syntax_posix(*pp_dest);
280 } else {
281 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
282 }
283
284 return ret;
285 }
286
287 /****************************************************************************
288 Pull a string and check the path - provide for error return.
289 ****************************************************************************/
290
291 size_t srvstr_get_path(TALLOC_CTX *ctx,
292 const char *base_ptr,
293 uint16 smb_flags2,
294 char **pp_dest,
295 const char *src,
296 size_t src_len,
297 int flags,
298 NTSTATUS *err)
299 {
300 bool ignore;
301 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
302 src_len, flags, err, &ignore);
303 }
304
305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
306 char **pp_dest, const char *src, int flags,
307 NTSTATUS *err, bool *contains_wcard)
308 {
309 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
310 pp_dest, src, smbreq_bufrem(req, src),
311 flags, err, contains_wcard);
312 }
313
314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
315 char **pp_dest, const char *src, int flags,
316 NTSTATUS *err)
317 {
318 bool ignore;
319 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
320 flags, err, &ignore);
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 static bool netbios_session_retarget(const char *name, int name_type)
411 {
412 char *trim_name;
413 char *trim_name_type;
414 const char *retarget_parm;
415 char *retarget;
416 char *p;
417 int retarget_type = 0x20;
418 int retarget_port = 139;
419 struct sockaddr_storage retarget_addr;
420 struct sockaddr_in *in_addr;
421 bool ret = false;
422 uint8_t outbuf[10];
423
424 if (get_socket_port(smbd_server_fd()) != 139) {
425 return false;
426 }
427
428 trim_name = talloc_strdup(talloc_tos(), name);
429 if (trim_name == NULL) {
430 goto fail;
431 }
432 trim_char(trim_name, ' ', ' ');
433
434 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
435 name_type);
436 if (trim_name_type == NULL) {
437 goto fail;
438 }
439
440 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
441 trim_name_type, NULL);
442 if (retarget_parm == NULL) {
443 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
444 trim_name, NULL);
445 }
446 if (retarget_parm == NULL) {
447 goto fail;
448 }
449
450 retarget = talloc_strdup(trim_name, retarget_parm);
451 if (retarget == NULL) {
452 goto fail;
453 }
454
455 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
456
457 p = strchr(retarget, ':');
458 if (p != NULL) {
459 *p++ = '\0';
460 retarget_port = atoi(p);
461 }
462
463 p = strchr_m(retarget, '#');
464 if (p != NULL) {
465 *p++ = '\0';
466 sscanf(p, "%x", &retarget_type);
467 }
468
469 ret = resolve_name(retarget, &retarget_addr, retarget_type);
470 if (!ret) {
471 DEBUG(10, ("could not resolve %s\n", retarget));
472 goto fail;
473 }
474
475 if (retarget_addr.ss_family != AF_INET) {
476 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
477 goto fail;
478 }
479
480 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
481
482 _smb_setlen(outbuf, 6);
483 SCVAL(outbuf, 0, 0x84);
484 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
485 *(uint16_t *)(outbuf+8) = htons(retarget_port);
486
487 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
488 NULL)) {
489 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
490 "failed.");
491 }
492
493 ret = true;
494 fail:
495 TALLOC_FREE(trim_name);
496 return ret;
497 }
498
499 /****************************************************************************
500 Reply to a (netbios-level) special message.
501 ****************************************************************************/
502
503 void reply_special(char *inbuf)
504 {
505 int msg_type = CVAL(inbuf,0);
506 int msg_flags = CVAL(inbuf,1);
507 fstring name1,name2;
508 char name_type1, name_type2;
509
510 /*
511 * We only really use 4 bytes of the outbuf, but for the smb_setlen
512 * calculation & friends (srv_send_smb uses that) we need the full smb
513 * header.
514 */
515 char outbuf[smb_size];
516
517 *name1 = *name2 = 0;
518
519 memset(outbuf, '\0', sizeof(outbuf));
520
521 smb_setlen(outbuf,0);
522
523 switch (msg_type) {
524 case 0x81: /* session request */
525
526 if (already_got_session) {
527 exit_server_cleanly("multiple session request not permitted");
528 }
529
530 SCVAL(outbuf,0,0x82);
531 SCVAL(outbuf,3,0);
532 if (name_len(inbuf+4) > 50 ||
533 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
534 DEBUG(0,("Invalid name length in session request\n"));
535 return;
536 }
537 name_type1 = name_extract(inbuf,4,name1);
538 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
539 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
540 name1, name_type1, name2, name_type2));
541
542 if (netbios_session_retarget(name1, name_type1)) {
543 exit_server_cleanly("retargeted client");
544 }
545
546 set_local_machine_name(name1, True);
547 set_remote_machine_name(name2, True);
548
549 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
550 get_local_machine_name(), get_remote_machine_name(),
551 name_type2));
552
553 if (name_type2 == 'R') {
554 /* We are being asked for a pathworks session ---
555 no thanks! */
556 SCVAL(outbuf, 0,0x83);
557 break;
558 }
559
560 /* only add the client's machine name to the list
561 of possibly valid usernames if we are operating
562 in share mode security */
563 if (lp_security() == SEC_SHARE) {
564 add_session_user(get_remote_machine_name());
565 }
566
567 reload_services(True);
568 reopen_logs();
569
570 already_got_session = True;
571 break;
572
573 case 0x89: /* session keepalive request
574 (some old clients produce this?) */
575 SCVAL(outbuf,0,SMBkeepalive);
576 SCVAL(outbuf,3,0);
577 break;
578
579 case 0x82: /* positive session response */
580 case 0x83: /* negative session response */
581 case 0x84: /* retarget session response */
582 DEBUG(0,("Unexpected session response\n"));
583 break;
584
585 case SMBkeepalive: /* session keepalive */
586 default:
587 return;
588 }
589
590 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
591 msg_type, msg_flags));
592
593 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
594 return;
595 }
596
597 /****************************************************************************
598 Reply to a tcon.
599 conn POINTER CAN BE NULL HERE !
600 ****************************************************************************/
601
602 void reply_tcon(struct smb_request *req)
603 {
604 connection_struct *conn = req->conn;
605 const char *service;
606 char *service_buf = NULL;
607 char *password = NULL;
608 char *dev = NULL;
609 int pwlen=0;
610 NTSTATUS nt_status;
611 const char *p;
612 DATA_BLOB password_blob;
613 TALLOC_CTX *ctx = talloc_tos();
614
615 START_PROFILE(SMBtcon);
616
617 if (req->buflen < 4) {
618 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
619 END_PROFILE(SMBtcon);
620 return;
621 }
622
623 p = (const char *)req->buf + 1;
624 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
625 p += 1;
626 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
627 p += pwlen+1;
628 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
629 p += 1;
630
631 if (service_buf == NULL || password == NULL || dev == NULL) {
632 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
633 END_PROFILE(SMBtcon);
634 return;
635 }
636 p = strrchr_m(service_buf,'\\');
637 if (p) {
638 service = p+1;
639 } else {
640 service = service_buf;
641 }
642
643 password_blob = data_blob(password, pwlen+1);
644
645 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
646 req->conn = conn;
647
648 data_blob_clear_free(&password_blob);
649
650 if (!conn) {
651 reply_nterror(req, nt_status);
652 END_PROFILE(SMBtcon);
653 return;
654 }
655
656 reply_outbuf(req, 2, 0);
657 SSVAL(req->outbuf,smb_vwv0,max_recv);
658 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
659 SSVAL(req->outbuf,smb_tid,conn->cnum);
660
661 DEBUG(3,("tcon service=%s cnum=%d\n",
662 service, conn->cnum));
663
664 END_PROFILE(SMBtcon);
665 return;
666 }
667
668 /****************************************************************************
669 Reply to a tcon and X.
670 conn POINTER CAN BE NULL HERE !
671 ****************************************************************************/
672
673 void reply_tcon_and_X(struct smb_request *req)
674 {
675 connection_struct *conn = req->conn;
676 const char *service = NULL;
677 DATA_BLOB password;
678 TALLOC_CTX *ctx = talloc_tos();
679 /* what the cleint thinks the device is */
680 char *client_devicetype = NULL;
681 /* what the server tells the client the share represents */
682 const char *server_devicetype;
683 NTSTATUS nt_status;
684 int passlen;
685 char *path = NULL;
686 const char *p, *q;
687 uint16 tcon_flags;
688
689 START_PROFILE(SMBtconX);
690
691 if (req->wct < 4) {
692 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
693 END_PROFILE(SMBtconX);
694 return;
695 }
696
697 passlen = SVAL(req->vwv+3, 0);
698 tcon_flags = SVAL(req->vwv+2, 0);
699
700 /* we might have to close an old one */
701 if ((tcon_flags & 0x1) && conn) {
702 close_cnum(conn,req->vuid);
703 req->conn = NULL;
704 conn = NULL;
705 }
706
707 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
708 reply_doserror(req, ERRDOS, ERRbuftoosmall);
709 END_PROFILE(SMBtconX);
710 return;
711 }
712
713 if (global_encrypted_passwords_negotiated) {
714 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
715 if (lp_security() == SEC_SHARE) {
716 /*
717 * Security = share always has a pad byte
718 * after the password.
719 */
720 p = (const char *)req->buf + passlen + 1;
721 } else {
722 p = (const char *)req->buf + passlen;
723 }
724 } else {
725 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
726 /* Ensure correct termination */
727 password.data[passlen]=0;
728 p = (const char *)req->buf + passlen + 1;
729 }
730
731 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
732
733 if (path == NULL) {
734 data_blob_clear_free(&password);
735 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
736 END_PROFILE(SMBtconX);
737 return;
738 }
739
740 /*
741 * the service name can be either: \\server\share
742 * or share directly like on the DELL PowerVault 705
743 */
744 if (*path=='\\') {
745 q = strchr_m(path+2,'\\');
746 if (!q) {
747 data_blob_clear_free(&password);
748 reply_doserror(req, ERRDOS, ERRnosuchshare);
749 END_PROFILE(SMBtconX);
750 return;
751 }
752 service = q+1;
753 } else {
754 service = path;
755 }
756
757 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
758 &client_devicetype, p,
759 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
760
761 if (client_devicetype == NULL) {
762 data_blob_clear_free(&password);
763 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
764 END_PROFILE(SMBtconX);
765 return;
766 }
767
768 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
769
770 conn = make_connection(service, password, client_devicetype,
771 req->vuid, &nt_status);
772 req->conn =conn;
773
774 data_blob_clear_free(&password);
775
776 if (!conn) {
777 reply_nterror(req, nt_status);
778 END_PROFILE(SMBtconX);
779 return;
780 }
781
782 if ( IS_IPC(conn) )
783 server_devicetype = "IPC";
784 else if ( IS_PRINT(conn) )
785 server_devicetype = "LPT1:";
786 else
787 server_devicetype = "A:";
788
789 if (Protocol < PROTOCOL_NT1) {
790 reply_outbuf(req, 2, 0);
791 if (message_push_string(&req->outbuf, server_devicetype,
792 STR_TERMINATE|STR_ASCII) == -1) {
793 reply_nterror(req, NT_STATUS_NO_MEMORY);
794 END_PROFILE(SMBtconX);
795 return;
796 }
797 } else {
798 /* NT sets the fstype of IPC$ to the null string */
799 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
800
801 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
802 /* Return permissions. */
803 uint32 perm1 = 0;
804 uint32 perm2 = 0;
805
806 reply_outbuf(req, 7, 0);
807
808 if (IS_IPC(conn)) {
809 perm1 = FILE_ALL_ACCESS;
810 perm2 = FILE_ALL_ACCESS;
811 } else {
812 perm1 = CAN_WRITE(conn) ?
813 SHARE_ALL_ACCESS :
814 SHARE_READ_ONLY;
815 }
816
817 SIVAL(req->outbuf, smb_vwv3, perm1);
818 SIVAL(req->outbuf, smb_vwv5, perm2);
819 } else {
820 reply_outbuf(req, 3, 0);
821 }
822
823 if ((message_push_string(&req->outbuf, server_devicetype,
824 STR_TERMINATE|STR_ASCII) == -1)
825 || (message_push_string(&req->outbuf, fstype,
826 STR_TERMINATE) == -1)) {
827 reply_nterror(req, NT_STATUS_NO_MEMORY);
828 END_PROFILE(SMBtconX);
829 return;
830 }
831
832 /* what does setting this bit do? It is set by NT4 and
833 may affect the ability to autorun mounted cdroms */
834 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
835 (lp_csc_policy(SNUM(conn)) << 2));
836
837 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
838 DEBUG(2,("Serving %s as a Dfs root\n",
839 lp_servicename(SNUM(conn)) ));
840 SSVAL(req->outbuf, smb_vwv2,
841 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
842 }
843 }
844
845
846 DEBUG(3,("tconX service=%s \n",
847 service));
848
849 /* set the incoming and outgoing tid to the just created one */
850 SSVAL(req->inbuf,smb_tid,conn->cnum);
851 SSVAL(req->outbuf,smb_tid,conn->cnum);
852
853 END_PROFILE(SMBtconX);
854
855 chain_reply(req);
856 return;
857 }
858
859 /****************************************************************************
860 Reply to an unknown type.
861 ****************************************************************************/
862
863 void reply_unknown_new(struct smb_request *req, uint8 type)
864 {
865 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
866 smb_fn_name(type), type, type));
867 reply_doserror(req, ERRSRV, ERRunknownsmb);
868 return;
869 }
870
871 /****************************************************************************
872 Reply to an ioctl.
873 conn POINTER CAN BE NULL HERE !
874 ****************************************************************************/
875
876 void reply_ioctl(struct smb_request *req)
877 {
878 connection_struct *conn = req->conn;
879 uint16 device;
880 uint16 function;
881 uint32 ioctl_code;
882 int replysize;
883 char *p;
884
885 START_PROFILE(SMBioctl);
886
887 if (req->wct < 3) {
888 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
889 END_PROFILE(SMBioctl);
890 return;
891 }
892
893 device = SVAL(req->vwv+1, 0);
894 function = SVAL(req->vwv+2, 0);
895 ioctl_code = (device << 16) + function;
896
897 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
898
899 switch (ioctl_code) {
900 case IOCTL_QUERY_JOB_INFO:
901 replysize = 32;
902 break;
903 default:
904 reply_doserror(req, ERRSRV, ERRnosupport);
905 END_PROFILE(SMBioctl);
906 return;
907 }
908
909 reply_outbuf(req, 8, replysize+1);
910 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
911 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
912 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
913 p = smb_buf(req->outbuf);
914 memset(p, '\0', replysize+1); /* valgrind-safe. */
915 p += 1; /* Allow for alignment */
916
917 switch (ioctl_code) {
918 case IOCTL_QUERY_JOB_INFO:
919 {
920 files_struct *fsp = file_fsp(
921 req, SVAL(req->vwv+0, 0));
922 if (!fsp) {
923 reply_doserror(req, ERRDOS, ERRbadfid);
924 END_PROFILE(SMBioctl);
925 return;
926 }
927 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
928 srvstr_push((char *)req->outbuf, req->flags2, p+2,
929 global_myname(), 15,
930 STR_TERMINATE|STR_ASCII);
931 if (conn) {
932 srvstr_push((char *)req->outbuf, req->flags2,
933 p+18, lp_servicename(SNUM(conn)),
934 13, STR_TERMINATE|STR_ASCII);
935 } else {
936 memset(p+18, 0, 13);
937 }
938 break;
939 }
940 }
941
942 END_PROFILE(SMBioctl);
943 return;
944 }
945
946 /****************************************************************************
947 Strange checkpath NTSTATUS mapping.
948 ****************************************************************************/
949
950 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
951 {
952 /* Strange DOS error code semantics only for checkpath... */
953 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
954 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
955 /* We need to map to ERRbadpath */
956 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
957 }
958 }
959 return status;
960 }
961
962 /****************************************************************************
963 Reply to a checkpath.
964 ****************************************************************************/
965
966 void reply_checkpath(struct smb_request *req)
967 {
968 connection_struct *conn = req->conn;
969 struct smb_filename *smb_fname = NULL;
970 char *name = NULL;
971 NTSTATUS status;
972 TALLOC_CTX *ctx = talloc_tos();
973
974 START_PROFILE(SMBcheckpath);
975
976 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
977 STR_TERMINATE, &status);
978
979 if (!NT_STATUS_IS_OK(status)) {
980 status = map_checkpath_error(req->flags2, status);
981 reply_nterror(req, status);
982 END_PROFILE(SMBcheckpath);
983 return;
984 }
985
986 status = resolve_dfspath(ctx, conn,
987 req->flags2 & FLAGS2_DFS_PATHNAMES,
988 name,
989 &name);
990 if (!NT_STATUS_IS_OK(status)) {
991 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
992 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
993 ERRSRV, ERRbadpath);
994 END_PROFILE(SMBcheckpath);
995 return;
996 }
997 goto path_err;
998 }
999
1000 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1001
1002 status = unix_convert(ctx, conn, name, &smb_fname, 0);
1003 if (!NT_STATUS_IS_OK(status)) {
1004 goto path_err;
1005 }
1006
1007 status = get_full_smb_filename(ctx, smb_fname, &name);
1008 if (!NT_STATUS_IS_OK(status)) {
1009 goto path_err;
1010 }
1011
1012 status = check_name(conn, name);
1013 if (!NT_STATUS_IS_OK(status)) {
1014 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
1015 goto path_err;
1016 }
1017
1018 if (!VALID_STAT(smb_fname->st) &&
1019 (SMB_VFS_STAT(conn, name, &smb_fname->st) != 0)) {
1020 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
1021 status = map_nt_error_from_unix(errno);
1022 goto path_err;
1023 }
1024
1025 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1026 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1027 ERRDOS, ERRbadpath);
1028 goto out;
1029 }
1030
1031 reply_outbuf(req, 0, 0);
1032 out:
1033 TALLOC_FREE(smb_fname);
1034 END_PROFILE(SMBcheckpath);
1035 return;
1036
1037 path_err:
1038
1039 TALLOC_FREE(smb_fname);
1040
1041 END_PROFILE(SMBcheckpath);
1042
1043 /* We special case this - as when a Windows machine
1044 is parsing a path is steps through the components
1045 one at a time - if a component fails it expects
1046 ERRbadpath, not ERRbadfile.
1047 */
1048 status = map_checkpath_error(req->flags2, status);
1049 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1050 /*
1051 * Windows returns different error codes if
1052 * the parent directory is valid but not the
1053 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1054 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1055 * if the path is invalid.
1056 */
1057 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1058 ERRDOS, ERRbadpath);
1059 return;
1060 }
1061
1062 reply_nterror(req, status);
1063 }
1064
1065 /****************************************************************************
1066 Reply to a getatr.
1067 ****************************************************************************/
1068
1069 void reply_getatr(struct smb_request *req)
1070 {
1071 connection_struct *conn = req->conn;
1072 struct smb_filename *smb_fname = NULL;
1073 char *fname = NULL;
1074 int mode=0;
1075 SMB_OFF_T size=0;
1076 time_t mtime=0;
1077 const char *p;
1078 NTSTATUS status;
1079 TALLOC_CTX *ctx = talloc_tos();
1080
1081 START_PROFILE(SMBgetatr);
1082
1083 p = (const char *)req->buf + 1;
1084 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1085 if (!NT_STATUS_IS_OK(status)) {
1086 reply_nterror(req, status);
1087 goto out;
1088 }
1089
1090 status = resolve_dfspath(ctx, conn,
1091 req->flags2 & FLAGS2_DFS_PATHNAMES,
1092 fname,
1093 &fname);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1096 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1097 ERRSRV, ERRbadpath);
1098 goto out;
1099 }
1100 reply_nterror(req, status);
1101 goto out;
1102 }
1103
1104 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1105 under WfWg - weird! */
1106 if (*fname == '\0') {
1107 mode = aHIDDEN | aDIR;
1108 if (!CAN_WRITE(conn)) {
1109 mode |= aRONLY;
1110 }
1111 size = 0;
1112 mtime = 0;
1113 } else {
1114 status = unix_convert(ctx, conn, fname, &smb_fname, 0);
1115 if (!NT_STATUS_IS_OK(status)) {
1116 reply_nterror(req, status);
1117 goto out;
1118 }
1119 status = get_full_smb_filename(ctx, smb_fname, &fname);
1120 if (!NT_STATUS_IS_OK(status)) {
1121 reply_nterror(req, status);
1122 goto out;
1123 }
1124 status = check_name(conn, fname);
1125 if (!NT_STATUS_IS_OK(status)) {
1126 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1127 reply_nterror(req, status);
1128 goto out;
1129 }
1130 if (!VALID_STAT(smb_fname->st) &&
1131 (SMB_VFS_STAT(conn, fname, &smb_fname->st) != 0)) {
1132 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1133 reply_unixerror(req, ERRDOS,ERRbadfile);
1134 goto out;
1135 }
1136
1137 mode = dos_mode(conn, fname, &smb_fname->st);
1138 size = smb_fname->st.st_ex_size;
1139 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1140 if (mode & aDIR) {
1141 size = 0;
1142 }
1143 }
1144
1145 reply_outbuf(req, 10, 0);
1146
1147 SSVAL(req->outbuf,smb_vwv0,mode);
1148 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1149 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1150 } else {
1151 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1152 }
1153 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1154
1155 if (Protocol >= PROTOCOL_NT1) {
1156 SSVAL(req->outbuf, smb_flg2,
1157 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1158 }
1159
1160 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1161
1162 out:
1163 TALLOC_FREE(smb_fname);
1164 END_PROFILE(SMBgetatr);
1165 return;
1166 }
1167
1168 /****************************************************************************
1169 Reply to a setatr.
1170 ****************************************************************************/
1171
1172 void reply_setatr(struct smb_request *req)
1173 {
1174 struct smb_file_time ft;
1175 connection_struct *conn = req->conn;
1176 struct smb_filename *smb_fname = NULL;
1177 char *fname = NULL;
1178 int mode;
1179 time_t mtime;
1180 const char *p;
1181 NTSTATUS status;
1182 TALLOC_CTX *ctx = talloc_tos();
1183
1184 START_PROFILE(SMBsetatr);
1185
1186 ZERO_STRUCT(ft);
1187
1188 if (req->wct < 2) {
1189 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1190 goto out;
1191 }
1192
1193 p = (const char *)req->buf + 1;
1194 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1195 if (!NT_STATUS_IS_OK(status)) {
1196 reply_nterror(req, status);
1197 goto out;
1198 }
1199
1200 status = resolve_dfspath(ctx, conn,
1201 req->flags2 & FLAGS2_DFS_PATHNAMES,
1202 fname,
1203 &fname);
1204 if (!NT_STATUS_IS_OK(status)) {
1205 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1206 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1207 ERRSRV, ERRbadpath);
1208 goto out;
1209 }
1210 reply_nterror(req, status);
1211 goto out;
1212 }
1213
1214 status = unix_convert(ctx, conn, fname, &smb_fname, 0);
1215 if (!NT_STATUS_IS_OK(status)) {
1216 reply_nterror(req, status);
1217 goto out;
1218 }
1219
1220 status = get_full_smb_filename(ctx, smb_fname, &fname);
1221 if (!NT_STATUS_IS_OK(status)) {
1222 reply_nterror(req, status);
1223 goto out;
1224 }
1225
1226 status = check_name(conn, fname);
1227 if (!NT_STATUS_IS_OK(status)) {
1228 reply_nterror(req, status);
1229 goto out;
1230 }
1231
1232 if (fname[0] == '.' && fname[1] == '\0') {
1233 /*
1234 * Not sure here is the right place to catch this
1235 * condition. Might be moved to somewhere else later -- vl
1236 */
1237 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1238 goto out;
1239 }
1240
1241 mode = SVAL(req->vwv+0, 0);
1242 mtime = srv_make_unix_date3(req->vwv+1);
1243
1244 ft.mtime = convert_time_t_to_timespec(mtime);
1245 status = smb_set_file_time(conn, NULL, fname,
1246 &smb_fname->st, &ft, true);
1247 if (!NT_STATUS_IS_OK(status)) {
1248 reply_unixerror(req, ERRDOS, ERRnoaccess);
1249 goto out;
1250 }
1251
1252 if (mode != FILE_ATTRIBUTE_NORMAL) {
1253 if (VALID_STAT_OF_DIR(smb_fname->st))
1254 mode |= aDIR;
1255 else
1256 mode &= ~aDIR;
1257
1258 if (file_set_dosmode(conn, fname, mode, &smb_fname->st, NULL,
1259 false) != 0) {
1260 reply_unixerror(req, ERRDOS, ERRnoaccess);
1261 goto out;
1262 }
1263 }
1264
1265 reply_outbuf(req, 0, 0);
1266
1267 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1268 out:
1269 TALLOC_FREE(smb_fname);
1270 END_PROFILE(SMBsetatr);
1271 return;
1272 }
1273
1274 /****************************************************************************
1275 Reply to a dskattr.
1276 ****************************************************************************/
1277
1278 void reply_dskattr(struct smb_request *req)
1279 {
1280 connection_struct *conn = req->conn;
1281 uint64_t dfree,dsize,bsize;
1282 START_PROFILE(SMBdskattr);
1283
1284 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1285 reply_unixerror(req, ERRHRD, ERRgeneral);
1286 END_PROFILE(SMBdskattr);
1287 return;
1288 }
1289
1290 reply_outbuf(req, 5, 0);
1291
1292 if (Protocol <= PROTOCOL_LANMAN2) {
1293 double total_space, free_space;
1294 /* we need to scale this to a number that DOS6 can handle. We
1295 use floating point so we can handle large drives on systems
1296 that don't have 64 bit integers
1297
1298 we end up displaying a maximum of 2G to DOS systems
1299 */
1300 total_space = dsize * (double)bsize;
1301 free_space = dfree * (double)bsize;
1302
1303 dsize = (uint64_t)((total_space+63*512) / (64*512));
1304 dfree = (uint64_t)((free_space+63*512) / (64*512));
1305
1306 if (dsize > 0xFFFF) dsize = 0xFFFF;
1307 if (dfree > 0xFFFF) dfree = 0xFFFF;
1308
1309 SSVAL(req->outbuf,smb_vwv0,dsize);
1310 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1311 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1312 SSVAL(req->outbuf,smb_vwv3,dfree);
1313 } else {
1314 SSVAL(req->outbuf,smb_vwv0,dsize);
1315 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1316 SSVAL(req->outbuf,smb_vwv2,512);
1317 SSVAL(req->outbuf,smb_vwv3,dfree);
1318 }
1319
1320 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1321
1322 END_PROFILE(SMBdskattr);
1323 return;
1324 }
1325
1326 /****************************************************************************
1327 Reply to a search.
1328 Can be called from SMBsearch, SMBffirst or SMBfunique.
1329 ****************************************************************************/
1330
1331 void reply_search(struct smb_request *req)
1332 {
1333 connection_struct *conn = req->conn;
1334 const char *mask = NULL;
1335 char *directory = NULL;
1336 char *fname = NULL;
1337 SMB_OFF_T size;
1338 uint32 mode;
1339 struct timespec date;
1340 uint32 dirtype;
1341 unsigned int numentries = 0;
1342 unsigned int maxentries = 0;
1343 bool finished = False;
1344 const char *p;
1345 int status_len;
1346 char *path = NULL;
1347 char status[21];
1348 int dptr_num= -1;
1349 bool check_descend = False;
1350 bool expect_close = False;
1351 NTSTATUS nt_status;
1352 bool mask_contains_wcard = False;
1353 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1354 TALLOC_CTX *ctx = talloc_tos();
1355 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1356
1357 START_PROFILE(SMBsearch);
1358
1359 if (req->wct < 2) {
1360 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1361 END_PROFILE(SMBsearch);
1362 return;
1363 }
1364
1365 if (lp_posix_pathnames()) {
1366 reply_unknown_new(req, req->cmd);
1367 END_PROFILE(SMBsearch);
1368 return;
1369 }
1370
1371 /* If we were called as SMBffirst then we must expect close. */
1372 if(req->cmd == SMBffirst) {
1373 expect_close = True;
1374 }
1375
1376 reply_outbuf(req, 1, 3);
1377 maxentries = SVAL(req->vwv+0, 0);
1378 dirtype = SVAL(req->vwv+1, 0);
1379 p = (const char *)req->buf + 1;
1380 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1381 &nt_status, &mask_contains_wcard);
1382 if (!NT_STATUS_IS_OK(nt_status)) {
1383 reply_nterror(req, nt_status);
1384 END_PROFILE(SMBsearch);
1385 return;
1386 }
1387
1388 nt_status = resolve_dfspath_wcard(ctx, conn,
1389 req->flags2 & FLAGS2_DFS_PATHNAMES,
1390 path,
1391 &path,
1392 &mask_contains_wcard);
1393 if (!NT_STATUS_IS_OK(nt_status)) {
1394 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1395 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1396 ERRSRV, ERRbadpath);
1397 END_PROFILE(SMBsearch);
1398 return;
1399 }
1400 reply_nterror(req, nt_status);
1401 END_PROFILE(SMBsearch);
1402 return;
1403 }
1404
1405 p++;
1406 status_len = SVAL(p, 0);
1407 p += 2;
1408
1409 /* dirtype &= ~aDIR; */
1410
1411 if (status_len == 0) {
1412 struct smb_filename *smb_fname = NULL;
1413
1414 nt_status = unix_convert(ctx, conn, path, &smb_fname,
1415 UCF_ALLOW_WCARD_LCOMP);
1416 if (!NT_STATUS_IS_OK(nt_status)) {
1417 reply_nterror(req, nt_status);
1418 END_PROFILE(SMBsearch);
1419 return;
1420 }
1421
1422 nt_status = get_full_smb_filename(ctx, smb_fname, &directory);
1423 TALLOC_FREE(smb_fname);
1424 if (!NT_STATUS_IS_OK(nt_status)) {
1425 reply_nterror(req, nt_status);
1426 END_PROFILE(SMBsearch);
1427 return;
1428 }
1429
1430 nt_status = check_name(conn, directory);
1431 if (!NT_STATUS_IS_OK(nt_status)) {
1432 reply_nterror(req, nt_status);
1433 END_PROFILE(SMBsearch);
1434 return;
1435 }
1436
1437 p = strrchr_m(directory,'/');
1438 if ((p != NULL) && (*directory != '/')) {
1439 mask = p + 1;
1440 directory = talloc_strndup(ctx, directory,
1441 PTR_DIFF(p, directory));
1442 } else {
1443 mask = directory;
1444 directory = talloc_strdup(ctx,".");
1445 }
1446
1447 if (!directory) {
1448 reply_nterror(req, NT_STATUS_NO_MEMORY);
1449 END_PROFILE(SMBsearch);
1450 return;
1451 }
1452
1453 memset((char *)status,'\0',21);
1454 SCVAL(status,0,(dirtype & 0x1F));
1455
1456 nt_status = dptr_create(conn,
1457 directory,
1458 True,
1459 expect_close,
1460 req->smbpid,
1461 mask,
1462 mask_contains_wcard,
1463 dirtype,
1464 &conn->dirptr);
1465 if (!NT_STATUS_IS_OK(nt_status)) {
1466 reply_nterror(req, nt_status);
1467 END_PROFILE(SMBsearch);
1468 return;
1469 }
1470 dptr_num = dptr_dnum(conn->dirptr);
1471 } else {
1472 int status_dirtype;
1473
1474 memcpy(status,p,21);
1475 status_dirtype = CVAL(status,0) & 0x1F;
1476 if (status_dirtype != (dirtype & 0x1F)) {
1477 dirtype = status_dirtype;
1478 }
1479
1480 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1481 if (!conn->dirptr) {
1482 goto SearchEmpty;
1483 }
1484 string_set(&conn->dirpath,dptr_path(dptr_num));
1485 mask = dptr_wcard(dptr_num);
1486 if (!mask) {
1487 goto SearchEmpty;
1488 }
1489 /*
1490 * For a 'continue' search we have no string. So
1491 * check from the initial saved string.
1492 */
1493 mask_contains_wcard = ms_has_wild(mask);
1494 dirtype = dptr_attr(dptr_num);
1495 }
1496
1497 DEBUG(4,("dptr_num is %d\n",dptr_num));
1498
1499 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1500 dptr_init_search_op(conn->dirptr);
1501
1502 if ((dirtype&0x1F) == aVOLID) {
1503 char buf[DIR_STRUCT_SIZE];
1504 memcpy(buf,status,21);
1505 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1506 0,aVOLID,0,!allow_long_path_components)) {
1507 reply_nterror(req, NT_STATUS_NO_MEMORY);
1508 END_PROFILE(SMBsearch);
1509 return;
1510 }
1511 dptr_fill(buf+12,dptr_num);
1512 if (dptr_zero(buf+12) && (status_len==0)) {
1513 numentries = 1;
1514 } else {
1515 numentries = 0;
1516 }
1517 if (message_push_blob(&req->outbuf,
1518 data_blob_const(buf, sizeof(buf)))
1519 == -1) {
1520 reply_nterror(req, NT_STATUS_NO_MEMORY);
1521 END_PROFILE(SMBsearch);
1522 return;
1523 }
1524 } else {
1525 unsigned int i;
1526 maxentries = MIN(
1527 maxentries,
1528 ((BUFFER_SIZE -
1529 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1530 /DIR_STRUCT_SIZE));
1531
1532 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1533 conn->dirpath,lp_dontdescend(SNUM(conn))));
1534 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1535 check_descend = True;
1536 }
1537
1538 for (i=numentries;(i<maxentries) && !finished;i++) {
1539 finished = !get_dir_entry(ctx,
1540 conn,
1541 mask,
1542 dirtype,
1543 &fname,
1544 &size,
1545 &mode,
1546 &date,
1547 check_descend,
1548 ask_sharemode);
1549 if (!finished) {
1550 char buf[DIR_STRUCT_SIZE];
1551 memcpy(buf,status,21);
1552 if (!make_dir_struct(ctx,
1553 buf,
1554 mask,
1555 fname,
1556 size,
1557 mode,
1558 convert_timespec_to_time_t(date),
1559 !allow_long_path_components)) {
1560 reply_nterror(req, NT_STATUS_NO_MEMORY);
1561 END_PROFILE(SMBsearch);
1562 return;
1563 }
1564 if (!dptr_fill(buf+12,dptr_num)) {
1565 break;
1566 }
1567 if (message_push_blob(&req->outbuf,
1568 data_blob_const(buf, sizeof(buf)))
1569 == -1) {
1570 reply_nterror(req, NT_STATUS_NO_MEMORY);
1571 END_PROFILE(SMBsearch);
1572 return;
1573 }
1574 numentries++;
1575 }
1576 }
1577 }
1578
1579 SearchEmpty:
1580
1581 /* If we were called as SMBffirst with smb_search_id == NULL
1582 and no entries were found then return error and close dirptr
1583 (X/Open spec) */
1584
1585 if (numentries == 0) {
1586 dptr_close(&dptr_num);
1587 } else if(expect_close && status_len == 0) {
1588 /* Close the dptr - we know it's gone */
1589 dptr_close(&dptr_num);
1590 }
1591
1592 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1593 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1594 dptr_close(&dptr_num);
1595 }
1596
1597 if ((numentries == 0) && !mask_contains_wcard) {
1598 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1599 END_PROFILE(SMBsearch);
1600 return;
1601 }
1602
1603 SSVAL(req->outbuf,smb_vwv0,numentries);
1604 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1605 SCVAL(smb_buf(req->outbuf),0,5);
1606 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1607
1608 /* The replies here are never long name. */
1609 SSVAL(req->outbuf, smb_flg2,
1610 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1611 if (!allow_long_path_components) {
1612 SSVAL(req->outbuf, smb_flg2,
1613 SVAL(req->outbuf, smb_flg2)
1614 & (~FLAGS2_LONG_PATH_COMPONENTS));
1615 }
1616
1617 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1618 SSVAL(req->outbuf, smb_flg2,
1619 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1620
1621 if (!directory) {
1622 directory = dptr_path(dptr_num);
1623 }
1624
1625 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1626 smb_fn_name(req->cmd),
1627 mask,
1628 directory ? directory : "./",
1629 dirtype,
1630 numentries,
1631 maxentries ));
1632
1633 END_PROFILE(SMBsearch);
1634 return;
1635 }
1636
1637 /****************************************************************************
1638 Reply to a fclose (stop directory search).
1639 ****************************************************************************/
1640
1641 void reply_fclose(struct smb_request *req)
1642 {
1643 int status_len;
1644 char status[21];
1645 int dptr_num= -2;
1646 const char *p;
1647 char *path = NULL;
1648 NTSTATUS err;
1649 bool path_contains_wcard = False;
1650 TALLOC_CTX *ctx = talloc_tos();
1651
1652 START_PROFILE(SMBfclose);
1653
1654 if (lp_posix_pathnames()) {
1655 reply_unknown_new(req, req->cmd);
1656 END_PROFILE(SMBfclose);
1657 return;
1658 }
1659
1660 p = (const char *)req->buf + 1;
1661 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1662 &err, &path_contains_wcard);
1663 if (!NT_STATUS_IS_OK(err)) {
1664 reply_nterror(req, err);
1665 END_PROFILE(SMBfclose);
1666 return;
1667 }
1668 p++;
1669 status_len = SVAL(p,0);
1670 p += 2;
1671
1672 if (status_len == 0) {
1673 reply_doserror(req, ERRSRV, ERRsrverror);
1674 END_PROFILE(SMBfclose);
1675 return;
1676 }
1677
1678 memcpy(status,p,21);
1679
1680 if(dptr_fetch(status+12,&dptr_num)) {
1681 /* Close the dptr - we know it's gone */
1682 dptr_close(&dptr_num);
1683 }
1684
1685 reply_outbuf(req, 1, 0);
1686 SSVAL(req->outbuf,smb_vwv0,0);
1687
1688 DEBUG(3,("search close\n"));
1689
1690 END_PROFILE(SMBfclose);
1691 return;
1692 }
1693
1694 /****************************************************************************
1695 Reply to an open.
1696 ****************************************************************************/
1697
1698 void reply_open(struct smb_request *req)
1699 {
1700 connection_struct *conn = req->conn;
1701 char *fname = NULL;
1702 uint32 fattr=0;
1703 SMB_OFF_T size = 0;
1704 time_t mtime=0;
1705 int info;
1706 SMB_STRUCT_STAT sbuf;
1707 files_struct *fsp;
1708 int oplock_request;
1709 int deny_mode;
1710 uint32 dos_attr;
1711 uint32 access_mask;
1712 uint32 share_mode;
1713 uint32 create_disposition;
1714 uint32 create_options = 0;
1715 NTSTATUS status;
1716 TALLOC_CTX *ctx = talloc_tos();
1717
1718 START_PROFILE(SMBopen);
1719
1720 SET_STAT_INVALID(sbuf);
1721
1722 if (req->wct < 2) {
1723 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1724 END_PROFILE(SMBopen);
1725 return;
1726 }
1727
1728 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1729 deny_mode = SVAL(req->vwv+0, 0);
1730 dos_attr = SVAL(req->vwv+1, 0);
1731
1732 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1733 STR_TERMINATE, &status);
1734 if (!NT_STATUS_IS_OK(status)) {
1735 reply_nterror(req, status);
1736 END_PROFILE(SMBopen);
1737 return;
1738 }
1739
1740 if (!map_open_params_to_ntcreate(
1741 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1742 &share_mode, &create_disposition, &create_options)) {
1743 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1744 END_PROFILE(SMBopen);
1745 return;
1746 }
1747
1748 status = SMB_VFS_CREATE_FILE(
1749 conn, /* conn */
1750 req, /* req */
1751 0, /* root_dir_fid */
1752 fname, /* fname */
1753 CFF_DOS_PATH, /* create_file_flags */
1754 access_mask, /* access_mask */
1755 share_mode, /* share_access */
1756 create_disposition, /* create_disposition*/
1757 create_options, /* create_options */
1758 dos_attr, /* file_attributes */
1759 oplock_request, /* oplock_request */
1760 0, /* allocation_size */
1761 NULL, /* sd */
1762 NULL, /* ea_list */
1763 &fsp, /* result */
1764 &info, /* pinfo */
1765 &sbuf); /* psbuf */
1766
1767 if (!NT_STATUS_IS_OK(status)) {
1768 if (open_was_deferred(req->mid)) {
1769 /* We have re-scheduled this call. */
1770 END_PROFILE(SMBopen);
1771 return;
1772 }
1773 reply_openerror(req, status);
1774 END_PROFILE(SMBopen);
1775 return;
1776 }
1777
1778 size = sbuf.st_ex_size;
1779 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1780 mtime = convert_timespec_to_time_t(sbuf.st_ex_mtime);
1781
1782 if (fattr & aDIR) {
1783 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1784 close_file(req, fsp, ERROR_CLOSE);
1785 reply_doserror(req, ERRDOS,ERRnoaccess);
1786 END_PROFILE(SMBopen);
1787 return;
1788 }
1789
1790 reply_outbuf(req, 7, 0);
1791 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1792 SSVAL(req->outbuf,smb_vwv1,fattr);
1793 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1794 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1795 } else {
1796 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1797 }
1798 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1799 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1800
1801 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1802 SCVAL(req->outbuf,smb_flg,
1803 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1804 }
1805
1806 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1807 SCVAL(req->outbuf,smb_flg,
1808 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1809 }
1810 END_PROFILE(SMBopen);
1811 return;
1812 }
1813
1814 /****************************************************************************
1815 Reply to an open and X.
1816 ****************************************************************************/
1817
1818 void reply_open_and_X(struct smb_request *req)
1819 {
1820 connection_struct *conn = req->conn;
1821 char *fname = NULL;
1822 uint16 open_flags;
1823 int deny_mode;
1824 uint32 smb_attr;
1825 /* Breakout the oplock request bits so we can set the
1826 reply bits separately. */
1827 int ex_oplock_request;
1828 int core_oplock_request;
1829 int oplock_request;
1830 #if 0
1831 int smb_sattr = SVAL(req->vwv+4, 0);
1832 uint32 smb_time = make_unix_date3(req->vwv+6);
1833 #endif
1834 int smb_ofun;
1835 uint32 fattr=0;
1836 int mtime=0;
1837 SMB_STRUCT_STAT sbuf;
1838 int smb_action = 0;
1839 files_struct *fsp;
1840 NTSTATUS status;
1841 uint64_t allocation_size;
1842 ssize_t retval = -1;
1843 uint32 access_mask;
1844 uint32 share_mode;
1845 uint32 create_disposition;
1846 uint32 create_options = 0;
1847 TALLOC_CTX *ctx = talloc_tos();
1848
1849 START_PROFILE(SMBopenX);
1850
1851 if (req->wct < 15) {
1852 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1853 END_PROFILE(SMBopenX);
1854 return;
1855 }
1856
1857 SET_STAT_INVALID(sbuf);
1858
1859 open_flags = SVAL(req->vwv+2, 0);
1860 deny_mode = SVAL(req->vwv+3, 0);
1861 smb_attr = SVAL(req->vwv+5, 0);
1862 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1863 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1864 oplock_request = ex_oplock_request | core_oplock_request;
1865 smb_ofun = SVAL(req->vwv+8, 0);
1866 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1867
1868 /* If it's an IPC, pass off the pipe handler. */
1869 if (IS_IPC(conn)) {
1870 if (lp_nt_pipe_support()) {
1871 reply_open_pipe_and_X(conn, req);
1872 } else {
1873 reply_doserror(req, ERRSRV, ERRaccess);
1874 }
1875 END_PROFILE(SMBopenX);
1876 return;
1877 }
1878
1879 /* XXXX we need to handle passed times, sattr and flags */
1880 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1881 STR_TERMINATE, &status);
1882 if (!NT_STATUS_IS_OK(status)) {
1883 reply_nterror(req, status);
1884 END_PROFILE(SMBopenX);
1885 return;
1886 }
1887
1888 if (!map_open_params_to_ntcreate(
1889 fname, deny_mode, smb_ofun, &access_mask,
1890 &share_mode, &create_disposition, &create_options)) {
1891 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1892 END_PROFILE(SMBopenX);
1893 return;
1894 }
1895
1896 status = SMB_VFS_CREATE_FILE(
1897 conn, /* conn */
1898 req, /* req */
1899 0, /* root_dir_fid */
1900 fname, /* fname */
1901 CFF_DOS_PATH, /* create_file_flags */
1902 access_mask, /* access_mask */
1903 share_mode, /* share_access */
1904 create_disposition, /* create_disposition*/
1905 create_options, /* create_options */
1906 smb_attr, /* file_attributes */
1907 oplock_request, /* oplock_request */
1908 0, /* allocation_size */
1909 NULL, /* sd */
1910 NULL, /* ea_list */
1911 &fsp, /* result */
1912 &smb_action, /* pinfo */
1913 &sbuf); /* psbuf */
1914
1915 if (!NT_STATUS_IS_OK(status)) {
1916 END_PROFILE(SMBopenX);
1917 if (open_was_deferred(req->mid)) {
1918 /* We have re-scheduled this call. */
1919 return;
1920 }
1921 reply_openerror(req, status);
1922 return;
1923 }
1924
1925 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1926 if the file is truncated or created. */
1927 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1928 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1929 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1930 close_file(req, fsp, ERROR_CLOSE);
1931 reply_nterror(req, NT_STATUS_DISK_FULL);
1932 END_PROFILE(SMBopenX);
1933 return;
1934 }
1935 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1936 if (retval < 0) {
1937 close_file(req, fsp, ERROR_CLOSE);
1938 reply_nterror(req, NT_STATUS_DISK_FULL);
1939 END_PROFILE(SMBopenX);
1940 return;
1941 }
1942 sbuf.st_ex_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1943 }
1944
1945 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1946 mtime = convert_timespec_to_time_t(sbuf.st_ex_mtime);
1947 if (fattr & aDIR) {
1948 close_file(req, fsp, ERROR_CLOSE);
1949 reply_doserror(req, ERRDOS, ERRnoaccess);
1950 END_PROFILE(SMBopenX);
1951 return;
1952 }
1953
1954 /* If the caller set the extended oplock request bit
1955 and we granted one (by whatever means) - set the
1956 correct bit for extended oplock reply.
1957 */
1958
1959 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1960 smb_action |= EXTENDED_OPLOCK_GRANTED;
1961 }
1962
1963 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1964 smb_action |= EXTENDED_OPLOCK_GRANTED;
1965 }
1966
1967 /* If the caller set the core oplock request bit
1968 and we granted one (by whatever means) - set the
1969 correct bit for core oplock reply.
1970 */
1971
1972 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1973 reply_outbuf(req, 19, 0);
1974 } else {
1975 reply_outbuf(req, 15, 0);
1976 }
1977
1978 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1979 SCVAL(req->outbuf, smb_flg,
1980 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1981 }
1982
1983 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1984 SCVAL(req->outbuf, smb_flg,
1985 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1986 }
1987
1988 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1989 SSVAL(req->outbuf,smb_vwv3,fattr);
1990 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1991 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1992 } else {
1993 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1994 }
1995 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_ex_size);
1996 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1997 SSVAL(req->outbuf,smb_vwv11,smb_action);
1998
1999 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2000 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2001 }
2002
2003 END_PROFILE(SMBopenX);
2004 chain_reply(req);
2005 return;
2006 }
2007
2008 /****************************************************************************
2009 Reply to a SMBulogoffX.
2010 ****************************************************************************/
2011
2012 void reply_ulogoffX(struct smb_request *req)
2013 {
2014 user_struct *vuser;
2015
2016 START_PROFILE(SMBulogoffX);
2017
2018 vuser = get_valid_user_struct(req->vuid);
2019
2020 if(vuser == NULL) {
2021 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2022 req->vuid));
2023 }
2024
2025 /* in user level security we are supposed to close any files
2026 open by this user */
2027 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2028 file_close_user(req->vuid);
2029 }
2030
2031 invalidate_vuid(req->vuid);
2032
2033 reply_outbuf(req, 2, 0);
2034
2035 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2036
2037 END_PROFILE(SMBulogoffX);
2038 chain_reply(req);
2039 }
2040
2041 /****************************************************************************
2042 Reply to a mknew or a create.
2043 ****************************************************************************/
2044
2045 void reply_mknew(struct smb_request *req)
2046 {
2047 connection_struct *conn = req->conn;
2048 char *fname = NULL;
2049 uint32 fattr = 0;
2050 struct smb_file_time ft;
2051 files_struct *fsp;
2052 int oplock_request = 0;
2053 SMB_STRUCT_STAT sbuf;
2054 NTSTATUS status;
2055 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2056 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2057 uint32 create_disposition;
2058 uint32 create_options = 0;
2059 TALLOC_CTX *ctx = talloc_tos();
2060
2061 START_PROFILE(SMBcreate);
2062 ZERO_STRUCT(ft);
2063 SET_STAT_INVALID(sbuf);
2064
2065 if (req->wct < 3) {
2066 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2067 END_PROFILE(SMBcreate);
2068 return;
2069 }
2070
2071 fattr = SVAL(req->vwv+0, 0);
2072 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2073
2074 /* mtime. */
2075 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2076
2077 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2078 STR_TERMINATE, &status);
2079 if (!NT_STATUS_IS_OK(status)) {
2080 reply_nterror(req, status);
2081 END_PROFILE(SMBcreate);
2082 return;
2083 }
2084
2085 if (fattr & aVOLID) {
2086 DEBUG(0,("Attempt to create file (%s) with volid set - "
2087 "please report this\n", fname));
2088 }
2089
2090 if(req->cmd == SMBmknew) {
2091 /* We should fail if file exists. */
2092 create_disposition = FILE_CREATE;
2093 } else {
2094 /* Create if file doesn't exist, truncate if it does. */
2095 create_disposition = FILE_OVERWRITE_IF;
2096 }
2097
2098 status = SMB_VFS_CREATE_FILE(
2099 conn, /* conn */
2100 req, /* req */
2101 0, /* root_dir_fid */
2102 fname, /* fname */
2103 CFF_DOS_PATH, /* create_file_flags */
2104 access_mask, /* access_mask */
2105 share_mode, /* share_access */
2106 create_disposition, /* create_disposition*/
2107 create_options, /* create_options */
2108 fattr, /* file_attributes */
2109 oplock_request, /* oplock_request */
2110 0, /* allocation_size */
2111 NULL, /* sd */
2112 NULL, /* ea_list */
2113 &fsp, /* result */
2114 NULL, /* pinfo */
2115 &sbuf); /* psbuf */
2116
2117 if (!NT_STATUS_IS_OK(status)) {
2118 END_PROFILE(SMBcreate);
2119 if (open_was_deferred(req->mid)) {
2120 /* We have re-scheduled this call. */
2121 return;
2122 }
2123 reply_openerror(req, status);
2124 return;
2125 }
2126
2127 ft.atime = sbuf.st_ex_atime; /* atime. */
2128 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2129 if (!NT_STATUS_IS_OK(status)) {
2130 END_PROFILE(SMBcreate);
2131 reply_openerror(req, status);
2132 return;
2133 }
2134
2135 reply_outbuf(req, 1, 0);
2136 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2137
2138 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2139 SCVAL(req->outbuf,smb_flg,
2140 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2141 }
2142
2143 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2144 SCVAL(req->outbuf,smb_flg,
2145 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2146 }
2147
2148 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2149 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2150 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2151
2152 END_PROFILE(SMBcreate);
2153 return;
2154 }
2155
2156 /****************************************************************************
2157 Reply to a create temporary file.
2158 ****************************************************************************/
2159
2160 void reply_ctemp(struct smb_request *req)
2161 {
2162 connection_struct *conn = req->conn;
2163 struct smb_filename *smb_fname = NULL;
2164 char *fname = NULL;
2165 uint32 fattr;
2166 files_struct *fsp;
2167 int oplock_request;
2168 int tmpfd;
2169 char *s;
2170 NTSTATUS status;
2171 TALLOC_CTX *ctx = talloc_tos();
2172
2173 START_PROFILE(SMBctemp);
2174
2175 if (req->wct < 3) {
2176 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2177 goto out;
2178 }
2179
2180 fattr = SVAL(req->vwv+0, 0);
2181 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2182
2183 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2184 STR_TERMINATE, &status);
2185 if (!NT_STATUS_IS_OK(status)) {
2186 reply_nterror(req, status);
2187 goto out;
2188 }
2189 if (*fname) {
2190 fname = talloc_asprintf(ctx,
2191 "%s/TMXXXXXX",
2192 fname);
2193 } else {
2194 fname = talloc_strdup(ctx, "TMXXXXXX");
2195 }
2196
2197 if (!fname) {
2198 reply_nterror(req, NT_STATUS_NO_MEMORY);
2199 goto out;
2200 }
2201
2202 status = resolve_dfspath(ctx, conn,
2203 req->flags2 & FLAGS2_DFS_PATHNAMES,
2204 fname,
2205 &fname);
2206 if (!NT_STATUS_IS_OK(status)) {
2207 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2208 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2209 ERRSRV, ERRbadpath);
2210 goto out;
2211 }
2212 reply_nterror(req, status);
2213 goto out;
2214 }
2215
2216 status = unix_convert(ctx, conn, fname, &smb_fname, 0);
2217 if (!NT_STATUS_IS_OK(status)) {
2218 reply_nterror(req, status);
2219 goto out;
2220 }
2221
2222 status = get_full_smb_filename(ctx, smb_fname, &fname);
2223 if (!NT_STATUS_IS_OK(status)) {
2224 reply_nterror(req, status);
2225 goto out;
2226 }
2227
2228 status = check_name(conn, fname);
2229 if (!NT_STATUS_IS_OK(status)) {
2230 reply_nterror(req, status);
2231 goto out;
2232 }
2233
2234 tmpfd = mkstemp(fname);
2235 if (tmpfd == -1) {
2236 reply_unixerror(req, ERRDOS, ERRnoaccess);
2237 goto out;
2238 }
2239
2240 SET_STAT_INVALID(smb_fname->st);
2241 SMB_VFS_STAT(conn, fname, &smb_fname->st);
2242
2243 /* We should fail if file does not exist. */
2244 status = SMB_VFS_CREATE_FILE(
2245 conn, /* conn */
2246 req, /* req */
2247 0, /* root_dir_fid */
2248 fname, /* fname */
2249 0, /* create_file_flags */
2250 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2251 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2252 FILE_OPEN, /* create_disposition*/
2253 0, /* create_options */
2254 fattr, /* file_attributes */
2255 oplock_request, /* oplock_request */
2256 0, /* allocation_size */
2257 NULL, /* sd */
2258 NULL, /* ea_list */
2259 &fsp, /* result */
2260 NULL, /* pinfo */
2261 &smb_fname->st); /* psbuf */
2262
2263 /* close fd from mkstemp() */
2264 close(tmpfd);
2265
2266 if (!NT_STATUS_IS_OK(status)) {
2267 if (open_was_deferred(req->mid)) {
2268 /* We have re-scheduled this call. */
2269 goto out;
2270 }
2271 reply_openerror(req, status);
2272 goto out;
2273 }
2274
2275 reply_outbuf(req, 1, 0);
2276 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2277
2278 /* the returned filename is relative to the directory */
2279 s = strrchr_m(fsp->fsp_name, '/');
2280 if (!s) {
2281 s = fsp->fsp_name;
2282 } else {
2283 s++;
2284 }
2285
2286 #if 0
2287 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2288 thing in the byte section. JRA */
2289 SSVALS(p, 0, -1); /* what is this? not in spec */
2290 #endif
2291 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2292 == -1) {
2293 reply_nterror(req, NT_STATUS_NO_MEMORY);
2294 goto out;
2295 }
2296
2297 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2298 SCVAL(req->outbuf, smb_flg,
2299 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2300 }
2301
2302 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2303 SCVAL(req->outbuf, smb_flg,
2304 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2305 }
2306
2307 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2308 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2309 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2310 out:
2311 TALLOC_FREE(smb_fname);
2312 END_PROFILE(SMBctemp);
2313 return;
2314 }
2315
2316 /*******************************************************************
2317 Check if a user is allowed to rename a file.
2318 ********************************************************************/
2319
2320 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2321 uint16 dirtype, SMB_STRUCT_STAT *pst)
2322 {
2323 uint32 fmode;
2324
2325 if (!CAN_WRITE(conn)) {
2326 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2327 }
2328
2329 fmode = dos_mode(conn, fsp->fsp_name, pst);
2330 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2331 return NT_STATUS_NO_SUCH_FILE;
2332 }
2333
2334 if (S_ISDIR(pst->st_ex_mode)) {
2335 if (fsp->posix_open) {
2336 return NT_STATUS_OK;
2337 }
2338
2339 /* If no pathnames are open below this
2340 directory, allow the rename. */
2341
2342 if (file_find_subpath(fsp)) {
2343 return NT_STATUS_ACCESS_DENIED;
2344 }
2345 return NT_STATUS_OK;
2346 }
2347
2348 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2349 return NT_STATUS_OK;
2350 }
2351
2352 return NT_STATUS_ACCESS_DENIED;
2353 }
2354
2355 /*******************************************************************
2356 * unlink a file with all relevant access checks
2357 *******************************************************************/
2358
2359 static NTSTATUS do_unlink(connection_struct *conn,
2360 struct smb_request *req,
2361 const char *fname,
2362 uint32 dirtype)
2363 {
2364 SMB_STRUCT_STAT sbuf;
2365 uint32 fattr;
2366 files_struct *fsp;
2367 uint32 dirtype_orig = dirtype;
2368 NTSTATUS status;
2369
2370 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2371
2372 if (!CAN_WRITE(conn)) {
2373 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2374 }
2375
2376 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2377 return map_nt_error_from_unix(errno);
2378 }
2379
2380 fattr = dos_mode(conn,fname,&sbuf);
2381
2382 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2383 dirtype = aDIR|aARCH|aRONLY;
2384 }
2385
2386 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2387 if (!dirtype) {
2388 return NT_STATUS_NO_SUCH_FILE;
2389 }
2390
2391 if (!dir_check_ftype(conn, fattr, dirtype)) {
2392 if (fattr & aDIR) {
2393 return NT_STATUS_FILE_IS_A_DIRECTORY;
2394 }
2395 return NT_STATUS_NO_SUCH_FILE;
2396 }
2397
2398 if (dirtype_orig & 0x8000) {
2399 /* These will never be set for POSIX. */
2400 return NT_STATUS_NO_SUCH_FILE;
2401 }
2402
2403 #if 0
2404 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2405 return NT_STATUS_FILE_IS_A_DIRECTORY;
2406 }
2407
2408 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2409 return NT_STATUS_NO_SUCH_FILE;
2410 }
2411
2412 if (dirtype & 0xFF00) {
2413 /* These will never be set for POSIX. */
2414 return NT_STATUS_NO_SUCH_FILE;
2415 }
2416
2417 dirtype &= 0xFF;
2418 if (!dirtype) {
2419 return NT_STATUS_NO_SUCH_FILE;
2420 }
2421
2422 /* Can't delete a directory. */
2423 if (fattr & aDIR) {
2424 return NT_STATUS_FILE_IS_A_DIRECTORY;
2425 }
2426 #endif
2427
2428 #if 0 /* JRATEST */
2429 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2430 return NT_STATUS_OBJECT_NAME_INVALID;
2431 #endif /* JRATEST */
2432
2433 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2434
2435 On a Windows share, a file with read-only dosmode can be opened with
2436 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2437 fails with NT_STATUS_CANNOT_DELETE error.
2438
2439 This semantic causes a problem that a user can not
2440 rename a file with read-only dosmode on a Samba share
2441 from a Windows command prompt (i.e. cmd.exe, but can rename
2442 from Windows Explorer).
2443 */
2444
2445 if (!lp_delete_readonly(SNUM(conn))) {
2446 if (fattr & aRONLY) {
2447 return NT_STATUS_CANNOT_DELETE;
2448 }
2449 }
2450
2451 /* On open checks the open itself will check the share mode, so
2452 don't do it here as we'll get it wrong. */
2453
2454 status = SMB_VFS_CREATE_FILE
2455 (conn, /* conn */
2456 req, /* req */
2457 0, /* root_dir_fid */
2458 fname, /* fname */
2459 0, /* create_file_flags */
2460 DELETE_ACCESS, /* access_mask */
2461 FILE_SHARE_NONE, /* share_access */
2462 FILE_OPEN, /* create_disposition*/
2463 FILE_NON_DIRECTORY_FILE, /* create_options */
2464 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2465 0, /* oplock_request */
2466 0, /* allocation_size */
2467 NULL, /* sd */
2468 NULL, /* ea_list */
2469 &fsp, /* result */
2470 NULL, /* pinfo */
2471 &sbuf); /* psbuf */
2472
2473 if (!NT_STATUS_IS_OK(status)) {
2474 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2475 nt_errstr(status)));
2476 return status;
2477 }
2478
2479 /* The set is across all open files on this dev/inode pair. */
2480 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2481 close_file(req, fsp, NORMAL_CLOSE);
2482 return NT_STATUS_ACCESS_DENIED;
2483 }
2484
2485 return close_file(req, fsp, NORMAL_CLOSE);
2486 }
2487
2488 /****************************************************************************
2489 The guts of the unlink command, split out so it may be called by the NT SMB
2490 code.
2491 ****************************************************************************/
2492
2493 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2494 uint32 dirtype, const char *name_in, bool has_wild)
2495 {
2496 struct smb_filename *smb_fname = NULL;
2497 const char *directory = NULL;
2498 char *mask = NULL;
2499 char *name = NULL;
2500 char *p = NULL;
2501 int count=0;
2502 NTSTATUS status = NT_STATUS_OK;
2503 SMB_STRUCT_STAT st;
2504 TALLOC_CTX *ctx = talloc_tos();
2505
2506 status = unix_convert(ctx, conn, name_in, &smb_fname,
2507 has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
2508 if (!NT_STATUS_IS_OK(status)) {
2509 return status;
2510 }
2511
2512 status = get_full_smb_filename(ctx, smb_fname, &name);
2513 if (!NT_STATUS_IS_OK(status)) {
2514 TALLOC_FREE(smb_fname);
2515 return status;
2516 }
2517
2518 p = strrchr_m(name,'/');
2519 if (!p) {
2520 directory = talloc_strdup(ctx, ".");
2521 if (!directory) {
2522 TALLOC_FREE(smb_fname);
2523 return NT_STATUS_NO_MEMORY;
2524 }
2525 mask = name;
2526 } else {
2527 *p = 0;
2528 directory = name;
2529 mask = p+1;
2530 }
2531
2532 /*
2533 * We should only check the mangled cache
2534 * here if unix_convert failed. This means
2535 * that the path in 'mask' doesn't exist
2536 * on the file system and so we need to look
2537 * for a possible mangle. This patch from
2538 * Tine Smukavec <valentin.smukavec@hermes.si>.
2539 */
2540
2541 if (!VALID_STAT(smb_fname->st) && mangle_is_mangled(mask,conn->params)) {
2542 char *new_mask = NULL;
2543 mangle_lookup_name_from_8_3(ctx,
2544 mask,
2545 &new_mask,
2546 conn->params );
2547 if (new_mask) {
2548 mask = new_mask;
2549 }
2550 }
2551 TALLOC_FREE(smb_fname);
2552
2553 if (!has_wild) {
2554 directory = talloc_asprintf(ctx,
2555 "%s/%s",
2556 directory,
2557 mask);
2558 if (!directory) {
2559 return NT_STATUS_NO_MEMORY;
2560 }
2561 if (dirtype == 0) {
2562 dirtype = FILE_ATTRIBUTE_NORMAL;
2563 }
2564
2565 status = check_name(conn, directory);
2566 if (!NT_STATUS_IS_OK(status)) {
2567 return status;
2568 }
2569
2570 status = do_unlink(conn, req, directory, dirtype);
2571 if (!NT_STATUS_IS_OK(status)) {
2572 return status;
2573 }
2574
2575 count++;
2576 } else {
2577 struct smb_Dir *dir_hnd = NULL;
2578 long offset = 0;
2579 const char *dname;
2580
2581 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2582 return NT_STATUS_OBJECT_NAME_INVALID;
2583 }
2584
2585 if (strequal(mask,"????????.???")) {
2586 mask[0] = '*';
2587 mask[1] = '\0';
2588 }
2589
2590 status = check_name(conn, directory);
2591 if (!NT_STATUS_IS_OK(status)) {
2592 return status;
2593 }
2594
2595 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2596 dirtype);
2597 if (dir_hnd == NULL) {
2598 return map_nt_error_from_unix(errno);
2599 }
2600
2601 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2602 the pattern matches against the long name, otherwise the short name
2603 We don't implement this yet XXXX
2604 */
2605
2606 status = NT_STATUS_NO_SUCH_FILE;
2607
2608 while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
2609 char *fname = NULL;
2610
2611 if (!is_visible_file(conn, directory, dname, &st,
2612 true))
2613 {
2614 continue;
2615 }
2616
2617 /* Quick check for "." and ".." */
2618 if (ISDOT(dname) || ISDOTDOT(dname)) {
2619 continue;
2620 }
2621
2622 if(!mask_match(dname, mask, conn->case_sensitive)) {
2623 continue;
2624 }
2625
2626 fname = talloc_asprintf(ctx, "%s/%s",
2627 directory,
2628 dname);
2629 if (!fname) {
2630 return NT_STATUS_NO_MEMORY;
2631 }
2632
2633 status = check_name(conn, fname);
2634 if (!NT_STATUS_IS_OK(status)) {
2635 TALLOC_FREE(dir_hnd);
2636 return status;
2637 }
2638
2639 status = do_unlink(conn, req, fname, dirtype);
2640 if (!NT_STATUS_IS_OK(status)) {
2641 TALLOC_FREE(fname);
2642 continue;
2643 }
2644
2645 count++;
2646 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2647 fname));
2648
2649 TALLOC_FREE(fname);
2650 }
2651 TALLOC_FREE(dir_hnd);
2652 }
2653
2654 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2655 status = map_nt_error_from_unix(errno);
2656 }
2657
2658 return status;
2659 }
2660
2661 /****************************************************************************
2662 Reply to a unlink
2663 ****************************************************************************/
2664
2665 void reply_unlink(struct smb_request *req)
2666 {
2667 connection_struct *conn = req->conn;
2668 char *name = NULL;
2669 uint32 dirtype;
2670 NTSTATUS status;
2671 bool path_contains_wcard = False;
2672 TALLOC_CTX *ctx = talloc_tos();
2673
2674 START_PROFILE(SMBunlink);
2675
2676 if (req->wct < 1) {
2677 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2678 END_PROFILE(SMBunlink);
2679 return;
2680 }
2681
2682 dirtype = SVAL(req->vwv+0, 0);
2683
2684 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2685 STR_TERMINATE, &status,
2686 &path_contains_wcard);
2687 if (!NT_STATUS_IS_OK(status)) {
2688 reply_nterror(req, status);
2689 END_PROFILE(SMBunlink);
2690 return;
2691 }
2692
2693 status = resolve_dfspath_wcard(ctx, conn,
2694 req->flags2 & FLAGS2_DFS_PATHNAMES,
2695 name,
2696 &name,
2697 &path_contains_wcard);
2698 if (!NT_STATUS_IS_OK(status)) {
2699 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2700 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2701 ERRSRV, ERRbadpath);
2702 END_PROFILE(SMBunlink);
2703 return;
2704 }
2705 reply_nterror(req, status);
2706 END_PROFILE(SMBunlink);
2707 return;
2708 }
2709
2710 DEBUG(3,("reply_unlink : %s\n",name));
2711
2712 status = unlink_internals(conn, req, dirtype, name,
2713 path_contains_wcard);
2714 if (!NT_STATUS_IS_OK(status)) {
2715 if (open_was_deferred(req->mid)) {
2716 /* We have re-scheduled this call. */
2717 END_PROFILE(SMBunlink);
2718 return;
2719 }
2720 reply_nterror(req, status);
2721 END_PROFILE(SMBunlink);
2722 return;
2723 }
2724
2725 reply_outbuf(req, 0, 0);
2726 END_PROFILE(SMBunlink);
2727
2728 return;
2729 }
2730
2731 /****************************************************************************
2732 Fail for readbraw.
2733 ****************************************************************************/
2734
2735 static void fail_readraw(void)
2736 {
2737 const char *errstr = talloc_asprintf(talloc_tos(),
2738 "FAIL ! reply_readbraw: socket write fail (%s)",
2739 strerror(errno));
2740 if (!errstr) {
2741 errstr = "";
2742 }
2743 exit_server_cleanly(errstr);
2744 }
2745
2746 /****************************************************************************
2747 Fake (read/write) sendfile. Returns -1 on read or write fail.
2748 ****************************************************************************/
2749
2750 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2751 size_t nread)
2752 {
2753 size_t bufsize;
2754 size_t tosend = nread;
2755 char *buf;
2756
2757 if (nread == 0) {
2758 return 0;
2759 }
2760
2761 bufsize = MIN(nread, 65536);
2762
2763 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2764 return -1;
2765 }
2766
2767 while (tosend > 0) {
2768 ssize_t ret;
2769 size_t cur_read;
2770
2771 if (tosend > bufsize) {
2772 cur_read = bufsize;
2773 } else {
2774 cur_read = tosend;
2775 }
2776 ret = read_file(fsp,buf,startpos,cur_read);
2777 if (ret == -1) {
2778 SAFE_FREE(buf);
2779 return -1;
2780 }
2781
2782 /* If we had a short read, fill with zeros. */
2783 if (ret < cur_read) {
2784 memset(buf + ret, '\0', cur_read - ret);
2785 }
2786
2787 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2788 SAFE_FREE(buf);
2789 return -1;
2790 }
2791 tosend -= cur_read;
2792 startpos += cur_read;
2793 }
2794
2795 SAFE_FREE(buf);
2796 return (ssize_t)nread;
2797 }
2798
2799 #if defined(WITH_SENDFILE)
2800 /****************************************************************************
2801 Deal with the case of sendfile reading less bytes from the file than
2802 requested. Fill with zeros (all we can do).
2803 ****************************************************************************/
2804
2805 static void sendfile_short_send(files_struct *fsp,
2806 ssize_t nread,
2807 size_t headersize,
2808 size_t smb_maxcnt)
2809 {
2810 #define SHORT_SEND_BUFSIZE 1024
2811 if (nread < headersize) {
2812 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2813 "header for file %s (%s). Terminating\n",
2814 fsp->fsp_name, strerror(errno) ));
2815 exit_server_cleanly("sendfile_short_send failed");
2816 }
2817
2818 nread -= headersize;
2819
2820 if (nread < smb_maxcnt) {
2821 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2822 if (!buf) {
2823 exit_server_cleanly("sendfile_short_send: "
2824 "malloc failed");
2825 }
2826
2827 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2828 "with zeros !\n", fsp->fsp_name));
2829
2830 while (nread < smb_maxcnt) {
2831 /*
2832 * We asked for the real file size and told sendfile
2833 * to not go beyond the end of the file. But it can
2834 * happen that in between our fstat call and the
2835 * sendfile call the file was truncated. This is very
2836 * bad because we have already announced the larger
2837 * number of bytes to the client.
2838 *
2839 * The best we can do now is to send 0-bytes, just as
2840 * a read from a hole in a sparse file would do.
2841 *
2842 * This should happen rarely enough that I don't care
2843 * about efficiency here :-)
2844 */
2845 size_t to_write;
2846
2847 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2848 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2849 exit_server_cleanly("sendfile_short_send: "
2850 "write_data failed");
2851 }
2852 nread += to_write;
2853 }
2854 SAFE_FREE(buf);
2855 }
2856 }
2857 #endif /* defined WITH_SENDFILE */
2858
2859 /****************************************************************************
2860 Return a readbraw error (4 bytes of zero).
2861 ****************************************************************************/
2862
2863 static void reply_readbraw_error(void)
2864 {
2865 char header[4];
2866 SIVAL(header,0,0);
2867 if (write_data(smbd_server_fd(),header,4) != 4) {
2868 fail_readraw();
2869 }
2870 }
2871
2872 /****************************************************************************
2873 Use sendfile in readbraw.
2874 ****************************************************************************/
2875
2876 static void send_file_readbraw(connection_struct *conn,
2877 struct smb_request *req,
2878 files_struct *fsp,
2879 SMB_OFF_T startpos,
2880 size_t nread,
2881 ssize_t mincount)
2882 {
2883 char *outbuf = NULL;
2884 ssize_t ret=0;
2885
2886 #if defined(WITH_SENDFILE)
2887 /*
2888 * We can only use sendfile on a non-chained packet
2889 * but we can use on a non-oplocked file. tridge proved this
2890 * on a train in Germany :-). JRA.
2891 * reply_readbraw has already checked the length.
2892 */
2893
2894 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2895 (fsp->wcp == NULL) &&
2896 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2897 ssize_t sendfile_read = -1;
2898 char header[4];
2899 DATA_BLOB header_blob;
2900
2901 _smb_setlen(header,nread);
2902 header_blob = data_blob_const(header, 4);
2903
2904 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2905 &header_blob, startpos, nread)) == -1) {
2906 /* Returning ENOSYS means no data at all was sent.
2907 * Do this as a normal read. */
2908 if (errno == ENOSYS) {
2909 goto normal_readbraw;
2910 }
2911
2912 /*
2913 * Special hack for broken Linux with no working sendfile. If we
2914 * return EINTR we sent the header but not the rest of the data.
2915 * Fake this up by doing read/write calls.
2916 */
2917 if (errno == EINTR) {
2918 /* Ensure we don't do this again. */
2919 set_use_sendfile(SNUM(conn), False);
2920 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2921
2922 if (fake_sendfile(fsp, startpos, nread) == -1) {
2923 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2924 fsp->fsp_name, strerror(errno) ));
2925 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2926 }
2927 return;
2928 }
2929
2930 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2931 fsp->fsp_name, strerror(errno) ));
2932 exit_server_cleanly("send_file_readbraw sendfile failed");
2933 } else if (sendfile_read == 0) {
2934 /*
2935 * Some sendfile implementations return 0 to indicate
2936 * that there was a short read, but nothing was
2937 * actually written to the socket. In this case,
2938 * fallback to the normal read path so the header gets
2939 * the correct byte count.
2940 */
2941 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2942 "bytes falling back to the normal read: "
2943 "%s\n", fsp->fsp_name));
2944 goto normal_readbraw;
2945 }
2946
2947 /* Deal with possible short send. */
2948 if (sendfile_read != 4+nread) {
2949 sendfile_short_send(fsp, sendfile_read, 4, nread);
2950 }
2951 return;
2952 }
2953
2954 normal_readbraw:
2955 #endif
2956
2957 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2958 if (!outbuf) {
2959 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2960 (unsigned)(nread+4)));
2961 reply_readbraw_error();
2962 return;
2963 }
2964
2965 if (nread > 0) {
2966 ret = read_file(fsp,outbuf+4,startpos,nread);
2967 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2968 if (ret < mincount)
2969 ret = 0;
2970 #else
2971 if (ret < nread)
2972 ret = 0;
2973 #endif
2974 }
2975
2976 _smb_setlen(outbuf,ret);
2977 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2978 fail_readraw();
2979
2980 TALLOC_FREE(outbuf);
2981 }
2982
2983 /****************************************************************************
2984 Reply to a readbraw (core+ protocol).
2985 ****************************************************************************/
2986
2987 void reply_readbraw(struct smb_request *req)
2988 {
2989 connection_struct *conn = req->conn;
2990 ssize_t maxcount,mincount;
2991 size_t nread = 0;
2992 SMB_OFF_T startpos;
2993 files_struct *fsp;
2994 struct lock_struct lock;
2995 SMB_STRUCT_STAT st;
2996 SMB_OFF_T size = 0;
2997
2998 START_PROFILE(SMBreadbraw);
2999
3000 if (srv_is_signing_active(smbd_server_conn) ||
3001 is_encrypted_packet(req->inbuf)) {
3002 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3003 "raw reads/writes are disallowed.");
3004 }
3005
3006 if (req->wct < 8) {
3007 reply_readbraw_error();
3008 END_PROFILE(SMBreadbraw);
3009 return;
3010 }
3011
3012 /*
3013 * Special check if an oplock break has been issued
3014 * and the readraw request croses on the wire, we must
3015 * return a zero length response here.
3016 */
3017
3018 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3019
3020 /*
3021 * We have to do a check_fsp by hand here, as
3022 * we must always return 4 zero bytes on error,
3023 * not a NTSTATUS.
3024 */
3025
3026 if (!fsp || !conn || conn != fsp->conn ||
3027 req->vuid != fsp->vuid ||
3028 fsp->is_directory || fsp->fh->fd == -1) {
3029 /*
3030 * fsp could be NULL here so use the value from the packet. JRA.
3031 */
3032 DEBUG(3,("reply_readbraw: fnum %d not valid "
3033 "- cache prime?\n",
3034 (int)SVAL(req->vwv+0, 0)));
3035 reply_readbraw_error();
3036 END_PROFILE(SMBreadbraw);
3037 return;
3038 }
3039
3040 /* Do a "by hand" version of CHECK_READ. */
3041 if (!(fsp->can_read ||
3042 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3043 (fsp->access_mask & FILE_EXECUTE)))) {
3044 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3045 (int)SVAL(req->vwv+0, 0)));
3046 reply_readbraw_error();
3047 END_PROFILE(SMBreadbraw);
3048 return;
3049 }
3050
3051 flush_write_cache(fsp, READRAW_FLUSH);
3052
3053 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3054 if(req->wct == 10) {
3055 /*
3056 * This is a large offset (64 bit) read.
3057 */
3058 #ifdef LARGE_SMB_OFF_T
3059
3060 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3061
3062 #else /* !LARGE_SMB_OFF_T */
3063
3064 /*
3065 * Ensure we haven't been sent a >32 bit offset.
3066 */
3067
3068 if(IVAL(req->vwv+8, 0) != 0) {
3069 DEBUG(0,("reply_readbraw: large offset "
3070 "(%x << 32) used and we don't support "
3071 "64 bit offsets.\n",
3072 (unsigned int)IVAL(req->vwv+8, 0) ));
3073 reply_readbraw_error();
3074 END_PROFILE(SMBreadbraw);
3075 return;
3076 }
3077
3078 #endif /* LARGE_SMB_OFF_T */
3079
3080 if(startpos < 0) {
3081 DEBUG(0,("reply_readbraw: negative 64 bit "
3082 "readraw offset (%.0f) !\n",
3083 (double)startpos ));
3084 reply_readbraw_error();
3085 END_PROFILE(SMBreadbraw);
3086 return;
3087 }
3088 }
3089
3090 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3091 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3092
3093 /* ensure we don't overrun the packet size */
3094 maxcount = MIN(65535,maxcount);
3095
3096 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3097 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3098 &lock);
3099
3100 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3101 reply_readbraw_error();
3102 END_PROFILE(SMBreadbraw);
3103 return;
3104 }
3105
3106 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3107 size = st.st_ex_size;
3108 }
3109
3110 if (startpos >= size) {
3111 nread = 0;
3112 } else {
3113 nread = MIN(maxcount,(size - startpos));
3114 }
3115
3116 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3117 if (nread < mincount)
3118 nread = 0;
3119 #endif
3120
3121 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3122 "min=%lu nread=%lu\n",
3123 fsp->fnum, (double)startpos,
3124 (unsigned long)maxcount,
3125 (unsigned long)mincount,
3126 (unsigned long)nread ) );
3127
3128 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3129
3130 DEBUG(5,("reply_readbraw finished\n"));
3131
3132 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3133
3134 END_PROFILE(SMBreadbraw);
3135 return;
3136 }
3137
3138 #undef DBGC_CLASS
3139 #define DBGC_CLASS DBGC_LOCKING
3140
3141 /****************************************************************************
3142 Reply to a lockread (core+ protocol).
3143 ****************************************************************************/
3144
3145 void reply_lockread(struct smb_request *req)
3146 {
3147 connection_struct *conn = req->conn;
3148 ssize_t nread = -1;
3149 char *data;
3150 SMB_OFF_T startpos;
3151 size_t numtoread;
3152 NTSTATUS status;
3153 files_struct *fsp;
3154 struct byte_range_lock *br_lck = NULL;
3155 char *p = NULL;
3156
3157 START_PROFILE(SMBlockread);
3158
3159 if (req->wct < 5) {
3160 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3161 END_PROFILE(SMBlockread);
3162 return;
3163 }
3164
3165 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3166
3167 if (!check_fsp(conn, req, fsp)) {
3168 END_PROFILE(SMBlockread);
3169 return;
3170 }
3171
3172 if (!CHECK_READ(fsp,req)) {
3173 reply_doserror(req, ERRDOS, ERRbadaccess);
3174 END_PROFILE(SMBlockread);
3175 return;
3176 }
3177
3178 numtoread = SVAL(req->vwv+1, 0);
3179 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3180
3181 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3182
3183 reply_outbuf(req, 5, numtoread + 3);
3184
3185 data = smb_buf(req->outbuf) + 3;
3186
3187 /*
3188 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3189 * protocol request that predates the read/write lock concept.
3190 * Thus instead of asking for a read lock here we need to ask
3191 * for a write lock. JRA.
3192 * Note that the requested lock size is unaffected by max_recv.
3193 */
3194
3195 br_lck = do_lock(smbd_messaging_context(),
3196 fsp,
3197 req->smbpid,
3198 (uint64_t)numtoread,
3199 (uint64_t)startpos,
3200 WRITE_LOCK,
3201 WINDOWS_LOCK,
3202 False, /* Non-blocking lock. */
3203 &status,
3204 NULL,
3205 NULL);
3206 TALLOC_FREE(br_lck);
3207
3208 if (NT_STATUS_V(status)) {
3209 reply_nterror(req, status);
3210 END_PROFILE(SMBlockread);
3211 return;
3212 }
3213
3214 /*
3215 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3216 */
3217
3218 if (numtoread > max_recv) {
3219 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3220 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3221 (unsigned int)numtoread, (unsigned int)max_recv ));
3222 numtoread = MIN(numtoread,max_recv);
3223 }
3224 nread = read_file(fsp,data,startpos,numtoread);
3225
3226 if (nread < 0) {
3227 reply_unixerror(req, ERRDOS, ERRnoaccess);
3228 END_PROFILE(SMBlockread);
3229 return;
3230 }
3231
3232 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3233
3234 SSVAL(req->outbuf,smb_vwv0,nread);
3235 SSVAL(req->outbuf,smb_vwv5,nread+3);
3236 p = smb_buf(req->outbuf);
3237 SCVAL(p,0,0); /* pad byte. */
3238 SSVAL(p,1,nread);
3239
3240 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3241 fsp->fnum, (int)numtoread, (int)nread));
3242
3243 END_PROFILE(SMBlockread);
3244 return;
3245 }
3246
3247 #undef DBGC_CLASS
3248 #define DBGC_CLASS DBGC_ALL
3249
3250 /****************************************************************************
3251 Reply to a read.
3252 ****************************************************************************/
3253
3254 void reply_read(struct smb_request *req)
3255 {
3256 connection_struct *conn = req->conn;
3257 size_t numtoread;
3258 ssize_t nread = 0;
3259 char *data;
3260 SMB_OFF_T startpos;
3261 int outsize = 0;
3262 files_struct *fsp;
3263 struct lock_struct lock;
3264
3265 START_PROFILE(SMBread);
3266
3267 if (req->wct < 3) {
3268 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3269 END_PROFILE(SMBread);
3270 return;
3271 }
3272
3273 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3274
3275 if (!check_fsp(conn, req, fsp)) {
3276 END_PROFILE(SMBread);
3277 return;
3278 }
3279
3280 if (!CHECK_READ(fsp,req)) {
3281 reply_doserror(req, ERRDOS, ERRbadaccess);
3282 END_PROFILE(SMBread);
3283 return;
3284 }
3285
3286 numtoread = SVAL(req->vwv+1, 0);
3287 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3288
3289 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3290
3291 /*
3292 * The requested read size cannot be greater than max_recv. JRA.
3293 */
3294 if (numtoread > max_recv) {
3295 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3296 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3297 (unsigned int)numtoread, (unsigned int)max_recv ));
3298 numtoread = MIN(numtoread,max_recv);
3299 }
3300
3301 reply_outbuf(req, 5, numtoread+3);
3302
3303 data = smb_buf(req->outbuf) + 3;
3304
3305 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3306 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3307 &lock);
3308
3309 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3310 reply_doserror(req, ERRDOS,ERRlock);
3311 END_PROFILE(SMBread);
3312 return;
3313 }
3314
3315 if (numtoread > 0)
3316 nread = read_file(fsp,data,startpos,numtoread);
3317
3318 if (nread < 0) {
3319 reply_unixerror(req, ERRDOS,ERRnoaccess);
3320 goto strict_unlock;
3321 }
3322
3323 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3324
3325 SSVAL(req->outbuf,smb_vwv0,nread);
3326 SSVAL(req->outbuf,smb_vwv5,nread+3);
3327 SCVAL(smb_buf(req->outbuf),0,1);
3328 SSVAL(smb_buf(req->outbuf),1,nread);
3329
3330 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3331 fsp->fnum, (int)numtoread, (int)nread ) );
3332
3333 strict_unlock:
3334 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3335
3336 END_PROFILE(SMBread);
3337 return;
3338 }
3339
3340 /****************************************************************************
3341 Setup readX header.
3342 ****************************************************************************/
3343
3344 static int setup_readX_header(struct smb_request *req, char *outbuf,
3345 size_t smb_maxcnt)
3346 {
3347 int outsize;
3348 char *data;
3349
3350 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3351 data = smb_buf(outbuf);
3352
3353 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3354
3355 SCVAL(outbuf,smb_vwv0,0xFF);
3356 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3357 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3358 SSVAL(outbuf,smb_vwv6,
3359 req_wct_ofs(req)
3360 + 1 /* the wct field */
3361 + 12 * sizeof(uint16_t) /* vwv */
3362 + 2); /* the buflen field */
3363 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3364 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3365 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3366 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3367 return outsize;
3368 }
3369
3370 /****************************************************************************
3371 Reply to a read and X - possibly using sendfile.
3372 ****************************************************************************/
3373
3374 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3375 files_struct *fsp, SMB_OFF_T startpos,
3376 size_t smb_maxcnt)
3377 {
3378 SMB_STRUCT_STAT sbuf;
3379 ssize_t nread = -1;
3380 struct lock_struct lock;
3381
3382 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3383 reply_unixerror(req, ERRDOS, ERRnoaccess);
3384 return;
3385 }
3386
3387 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3388 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3389 &lock);
3390
3391 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3392 reply_doserror(req, ERRDOS, ERRlock);
3393 return;
3394 }
3395
3396 if (!S_ISREG(sbuf.st_ex_mode) || (startpos > sbuf.st_ex_size)
3397 || (smb_maxcnt > (sbuf.st_ex_size - startpos))) {
3398 /*
3399 * We already know that we would do a short read, so don't
3400 * try the sendfile() path.
3401 */
3402 goto nosendfile_read;
3403 }
3404
3405 #if defined(WITH_SENDFILE)
3406 /*
3407 * We can only use sendfile on a non-chained packet
3408 * but we can use on a non-oplocked file. tridge proved this
3409 * on a train in Germany :-). JRA.
3410 */
3411
3412 if (!req_is_in_chain(req) &&
3413 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3414 (fsp->wcp == NULL) &&
3415 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3416 uint8 headerbuf[smb_size + 12 * 2];
3417 DATA_BLOB header;
3418
3419 /*
3420 * Set up the packet header before send. We
3421 * assume here the sendfile will work (get the
3422 * correct amount of data).
3423 */
3424
3425 header = data_blob_const(headerbuf, sizeof(headerbuf));
3426
3427 construct_reply_common_req(req, (char *)headerbuf);
3428 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3429
3430 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3431 /* Returning ENOSYS means no data at all was sent.
3432 Do this as a normal read. */
3433 if (errno == ENOSYS) {
3434 goto normal_read;
3435 }
3436
3437 /*
3438 * Special hack for broken Linux with no working sendfile. If we
3439 * return EINTR we sent the header but not the rest of the data.
3440 * Fake this up by doing read/write calls.
3441 */
3442
3443 if (errno == EINTR) {
3444 /* Ensure we don't do this again. */
3445 set_use_sendfile(SNUM(conn), False);
3446 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3447 nread = fake_sendfile(fsp, startpos,
3448 smb_maxcnt);
3449 if (nread == -1) {
3450 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3451 fsp->fsp_name, strerror(errno) ));
3452 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3453 }
3454 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3455 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3456 /* No outbuf here means successful sendfile. */
3457 goto strict_unlock;
3458 }
3459
3460 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3461 fsp->fsp_name, strerror(errno) ));
3462 exit_server_cleanly("send_file_readX sendfile failed");
3463 } else if (nread == 0) {
3464 /*
3465 * Some sendfile implementations return 0 to indicate
3466 * that there was a short read, but nothing was
3467 * actually written to the socket. In this case,
3468 * fallback to the normal read path so the header gets
3469 * the correct byte count.
3470 */
3471 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3472 "falling back to the normal read: %s\n",
3473 fsp->fsp_name));
3474 goto normal_read;
3475 }
3476
3477 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3478 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3479
3480 /* Deal with possible short send. */
3481 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3482 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3483 }
3484 /* No outbuf here means successful sendfile. */
3485 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3486 SMB_PERFCOUNT_END(&req->pcd);
3487 goto strict_unlock;
3488 }
3489
3490 normal_read:
3491
3492 #endif
3493
3494 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3495 uint8 headerbuf[smb_size + 2*12];
3496
3497 construct_reply_common_req(req, (char *)headerbuf);
3498 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3499
3500 /* Send out the header. */
3501 if (write_data(smbd_server_fd(), (char *)headerbuf,
3502 sizeof(headerbuf)) != sizeof(headerbuf)) {
3503 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3504 fsp->fsp_name, strerror(errno) ));
3505 exit_server_cleanly("send_file_readX sendfile failed");
3506 }
3507 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3508 if (nread == -1) {
3509 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3510 fsp->fsp_name, strerror(errno) ));
3511 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3512 }
3513 goto strict_unlock;
3514 }
3515
3516 nosendfile_read:
3517
3518 reply_outbuf(req, 12, smb_maxcnt);
3519
3520 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3521
3522 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3523
3524 if (nread < 0) {
3525 reply_unixerror(req, ERRDOS, ERRnoaccess);
3526 return;
3527 }
3528
3529 setup_readX_header(req, (char *)req->outbuf, nread);
3530
3531 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3532 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3533
3534 chain_reply(req);
3535 return;
3536
3537 strict_unlock:
3538 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3539 TALLOC_FREE(req->outbuf);
3540 return;
3541 }
3542
3543 /****************************************************************************
3544 Reply to a read and X.
3545 ****************************************************************************/
3546
3547 void reply_read_and_X(struct smb_request *req)
3548 {
3549 connection_struct *conn = req->conn;
3550 files_struct *fsp;
3551 SMB_OFF_T startpos;
3552 size_t smb_maxcnt;
3553 bool big_readX = False;
3554 #if 0
3555 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3556 #endif
3557
3558 START_PROFILE(SMBreadX);
3559
3560 if ((req->wct != 10) && (req->wct != 12)) {
3561 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3562 return;
3563 }
3564
3565 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3566 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3567 smb_maxcnt = SVAL(req->vwv+5, 0);
3568
3569 /* If it's an IPC, pass off the pipe handler. */
3570 if (IS_IPC(conn)) {
3571 reply_pipe_read_and_X(req);
3572 END_PROFILE(SMBreadX);
3573 return;
3574 }
3575
3576 if (!check_fsp(conn, req, fsp)) {
3577 END_PROFILE(SMBreadX);
3578 return;
3579 }
3580
3581 if (!CHECK_READ(fsp,req)) {
3582 reply_doserror(req, ERRDOS,ERRbadaccess);
3583 END_PROFILE(SMBreadX);
3584 return;
3585 }
3586
3587 if (global_client_caps & CAP_LARGE_READX) {
3588 size_t upper_size = SVAL(req->vwv+7, 0);
3589 smb_maxcnt |= (upper_size<<16);
3590 if (upper_size > 1) {
3591 /* Can't do this on a chained packet. */
3592 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3593 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3594 END_PROFILE(SMBreadX);
3595 return;
3596 }
3597 /* We currently don't do this on signed or sealed data. */
3598 if (srv_is_signing_active(smbd_server_conn) ||
3599 is_encrypted_packet(req->inbuf)) {
3600 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3601 END_PROFILE(SMBreadX);
3602 return;
3603 }
3604 /* Is there room in the reply for this data ? */
3605 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3606 reply_nterror(req,
3607 NT_STATUS_INVALID_PARAMETER);
3608 END_PROFILE(SMBreadX);
3609 return;
3610 }
3611 big_readX = True;
3612 }
3613 }
3614
3615 if (req->wct == 12) {
3616 #ifdef LARGE_SMB_OFF_T
3617 /*
3618 * This is a large offset (64 bit) read.
3619 */
3620 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3621
3622 #else /* !LARGE_SMB_OFF_T */
3623
3624 /*
3625 * Ensure we haven't been sent a >32 bit offset.
3626 */
3627
3628 if(IVAL(req->vwv+10, 0) != 0) {
3629 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3630 "used and we don't support 64 bit offsets.\n",
3631 (unsigned int)IVAL(req->vwv+10, 0) ));
3632 END_PROFILE(SMBreadX);
3633 reply_doserror(req, ERRDOS, ERRbadaccess);
3634 return;
3635 }
3636
3637 #endif /* LARGE_SMB_OFF_T */
3638
3639 }
3640
3641 if (!big_readX &&
3642 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3643 goto out;
3644 }
3645
3646 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3647
3648 out:
3649 END_PROFILE(SMBreadX);
3650 return;
3651 }
3652
3653 /****************************************************************************
3654 Error replies to writebraw must have smb_wct == 1. Fix this up.
3655 ****************************************************************************/
3656
3657 void error_to_writebrawerr(struct smb_request *req)
3658 {
3659 uint8 *old_outbuf = req->outbuf;
3660
3661 reply_outbuf(req, 1, 0);
3662
3663 memcpy(req->outbuf, old_outbuf, smb_size);
3664 TALLOC_FREE(old_outbuf);
3665 }
3666
3667 /****************************************************************************
3668 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3669 ****************************************************************************/
3670
3671 void reply_writebraw(struct smb_request *req)
3672 {
3673 connection_struct *conn = req->conn;
3674 char *buf = NULL;
3675 ssize_t nwritten=0;
3676 ssize_t total_written=0;
3677 size_t numtowrite=0;
3678 size_t tcount;
3679 SMB_OFF_T startpos;
3680 char *data=NULL;
3681 bool write_through;
3682 files_struct *fsp;
3683 struct lock_struct lock;
3684 NTSTATUS status;
3685
3686 START_PROFILE(SMBwritebraw);
3687
3688 /*
3689 * If we ever reply with an error, it must have the SMB command
3690 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3691 * we're finished.
3692 */
3693 SCVAL(req->inbuf,smb_com,SMBwritec);
3694
3695 if (srv_is_signing_active(smbd_server_conn)) {
3696 END_PROFILE(SMBwritebraw);
3697 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3698 "raw reads/writes are disallowed.");
3699 }
3700
3701 if (req->wct < 12) {
3702 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3703 error_to_writebrawerr(req);
3704 END_PROFILE(SMBwritebraw);
3705 return;
3706 }
3707
3708 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3709 if (!check_fsp(conn, req, fsp)) {
3710 error_to_writebrawerr(req);
3711 END_PROFILE(SMBwritebraw);
3712 return;
3713 }
3714
3715 if (!CHECK_WRITE(fsp)) {
3716 reply_doserror(req, ERRDOS, ERRbadaccess);
3717 error_to_writebrawerr(req);
3718 END_PROFILE(SMBwritebraw);
3719 return;
3720 }
3721
3722 tcount = IVAL(req->vwv+1, 0);
3723 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3724 write_through = BITSETW(req->vwv+7,0);
3725
3726 /* We have to deal with slightly different formats depending
3727 on whether we are using the core+ or lanman1.0 protocol */
3728
3729 if(Protocol <= PROTOCOL_COREPLUS) {
3730 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3731 data = smb_buf(req->inbuf);
3732 } else {
3733 numtowrite = SVAL(req->vwv+10, 0);
3734 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3735 }
3736
3737 /* Ensure we don't write bytes past the end of this packet. */
3738 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3740 error_to_writebrawerr(req);
3741 END_PROFILE(SMBwritebraw);
3742 return;
3743 }
3744
3745 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3746 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3747 &lock);
3748
3749 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3750 reply_doserror(req, ERRDOS, ERRlock);
3751 error_to_writebrawerr(req);
3752 END_PROFILE(SMBwritebraw);
3753 return;
3754 }
3755
3756 if (numtowrite>0) {
3757 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3758 }
3759
3760 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3761 "wrote=%d sync=%d\n",
3762 fsp->fnum, (double)startpos, (int)numtowrite,
3763 (int)nwritten, (int)write_through));
3764
3765 if (nwritten < (ssize_t)numtowrite) {
3766 reply_unixerror(req, ERRHRD, ERRdiskfull);
3767 error_to_writebrawerr(req);
3768 goto strict_unlock;
3769 }
3770
3771 total_written = nwritten;
3772
3773 /* Allocate a buffer of 64k + length. */
3774 buf = TALLOC_ARRAY(NULL, char, 65540);
3775 if (!buf) {
3776 reply_doserror(req, ERRDOS, ERRnomem);
3777 error_to_writebrawerr(req);
3778 goto strict_unlock;
3779 }
3780
3781 /* Return a SMBwritebraw message to the redirector to tell
3782 * it to send more bytes */
3783
3784 memcpy(buf, req->inbuf, smb_size);
3785 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3786 SCVAL(buf,smb_com,SMBwritebraw);
3787 SSVALS(buf,smb_vwv0,0xFFFF);
3788 show_msg(buf);
3789 if (!srv_send_smb(smbd_server_fd(),
3790 buf,
3791 false, 0, /* no signing */
3792 IS_CONN_ENCRYPTED(conn),
3793 &req->pcd)) {
3794 exit_server_cleanly("reply_writebraw: srv_send_smb "
3795 "failed.");
3796 }
3797
3798 /* Now read the raw data into the buffer and write it */
3799 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3800 &numtowrite);
3801 if (!NT_STATUS_IS_OK(status)) {
3802 exit_server_cleanly("secondary writebraw failed");
3803 }
3804
3805 /* Set up outbuf to return the correct size */
3806 reply_outbuf(req, 1, 0);
3807
3808 if (numtowrite != 0) {
3809
3810 if (numtowrite > 0xFFFF) {
3811 DEBUG(0,("reply_writebraw: Oversize secondary write "
3812 "raw requested (%u). Terminating\n",
3813 (unsigned int)numtowrite ));
3814 exit_server_cleanly("secondary writebraw failed");
3815 }
3816
3817 if (tcount > nwritten+numtowrite) {
3818 DEBUG(3,("reply_writebraw: Client overestimated the "
3819 "write %d %d %d\n",
3820 (int)tcount,(int)nwritten,(int)numtowrite));
3821 }
3822
3823 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3824
3825 if (!NT_STATUS_IS_OK(status)) {
3826 DEBUG(0,("reply_writebraw: Oversize secondary write "
3827 "raw read failed (%s). Terminating\n",
3828 nt_errstr(status)));
3829 exit_server_cleanly("secondary writebraw failed");
3830 }
3831
3832 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3833 if (nwritten == -1) {
3834 TALLOC_FREE(buf);
3835 reply_unixerror(req, ERRHRD, ERRdiskfull);
3836 error_to_writebrawerr(req);
3837 goto strict_unlock;
3838 }
3839
3840 if (nwritten < (ssize_t)numtowrite) {
3841 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3842 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3843 }
3844
3845 if (nwritten > 0) {
3846 total_written += nwritten;
3847 }
3848 }
3849
3850 TALLOC_FREE(buf);
3851 SSVAL(req->outbuf,smb_vwv0,total_written);
3852
3853 status = sync_file(conn, fsp, write_through);
3854 if (!NT_STATUS_IS_OK(status)) {
3855 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3856 fsp->fsp_name, nt_errstr(status) ));
3857 reply_nterror(req, status);
3858 error_to_writebrawerr(req);
3859 goto strict_unlock;
3860 }
3861
3862 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3863 "wrote=%d\n",
3864 fsp->fnum, (double)startpos, (int)numtowrite,
3865 (int)total_written));
3866
3867 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3868
3869 /* We won't return a status if write through is not selected - this
3870 * follows what WfWg does */
3871 END_PROFILE(SMBwritebraw);
3872
3873 if (!write_through && total_written==tcount) {
3874
3875 #if RABBIT_PELLET_FIX
3876 /*
3877 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3878 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3879 * JRA.
3880 */
3881 if (!send_keepalive(smbd_server_fd())) {
3882 exit_server_cleanly("reply_writebraw: send of "
3883 "keepalive failed");
3884 }
3885 #endif
3886 TALLOC_FREE(req->outbuf);
3887 }
3888 return;
3889
3890 strict_unlock:
3891 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3892
3893 END_PROFILE(SMBwritebraw);
3894 return;
3895 }
3896
3897 #undef DBGC_CLASS
3898 #define DBGC_CLASS DBGC_LOCKING
3899
3900 /****************************************************************************
3901 Reply to a writeunlock (core+).
3902 ****************************************************************************/
3903
3904 void reply_writeunlock(struct smb_request *req)
3905 {
3906 connection_struct *conn = req->conn;
3907 ssize_t nwritten = -1;
3908 size_t numtowrite;
3909 SMB_OFF_T startpos;
3910 const char *data;
3911 NTSTATUS status = NT_STATUS_OK;
3912 files_struct *fsp;
3913 struct lock_struct lock;
3914
3915 START_PROFILE(SMBwriteunlock);
3916
3917 if (req->wct < 5) {
3918 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3919 END_PROFILE(SMBwriteunlock);
3920 return;
3921 }
3922
3923 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3924
3925 if (!check_fsp(conn, req, fsp)) {
3926 END_PROFILE(SMBwriteunlock);
3927 return;
3928 }
3929
3930 if (!CHECK_WRITE(fsp)) {
3931 reply_doserror(req, ERRDOS,ERRbadaccess);
3932 END_PROFILE(SMBwriteunlock);
3933 return;
3934 }
3935
3936 numtowrite = SVAL(req->vwv+1, 0);
3937 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3938 data = (const char *)req->buf + 3;
3939
3940 if (numtowrite) {
3941 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3942 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3943 &lock);
3944
3945 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3946 reply_doserror(req, ERRDOS, ERRlock);
3947 END_PROFILE(SMBwriteunlock);
3948 return;
3949 }
3950 }
3951
3952 /* The special X/Open SMB protocol handling of
3953 zero length writes is *NOT* done for
3954 this call */
3955 if(numtowrite == 0) {
3956 nwritten = 0;
3957 } else {
3958 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3959 }
3960
3961 status = sync_file(conn, fsp, False /* write through */);
3962 if (!NT_STATUS_IS_OK(status)) {
3963 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3964 fsp->fsp_name, nt_errstr(status) ));
3965 reply_nterror(req, status);
3966 goto strict_unlock;
3967 }
3968
3969 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3970 reply_unixerror(req, ERRHRD, ERRdiskfull);
3971 goto strict_unlock;
3972 }
3973
3974 if (numtowrite) {
3975 status = do_unlock(smbd_messaging_context(),
3976 fsp,
3977 req->smbpid,
3978 (uint64_t)numtowrite,
3979 (uint64_t)startpos,
3980 WINDOWS_LOCK);
3981
3982 if (NT_STATUS_V(status)) {
3983 reply_nterror(req, status);
3984 goto strict_unlock;
3985 }
3986 }
3987
3988 reply_outbuf(req, 1, 0);
3989
3990 SSVAL(req->outbuf,smb_vwv0,nwritten);
3991
3992 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3993 fsp->fnum, (int)numtowrite, (int)nwritten));
3994
3995 strict_unlock:
3996 if (numtowrite) {
3997 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3998 }
3999
4000 END_PROFILE(SMBwriteunlock);
4001 return;
4002 }
4003
4004 #undef DBGC_CLASS
4005 #define DBGC_CLASS DBGC_ALL
4006
4007 /****************************************************************************
4008 Reply to a write.
4009 ****************************************************************************/
4010
4011 void reply_write(struct smb_request *req)
4012 {
4013 connection_struct *conn = req->conn;
4014 size_t numtowrite;
4015 ssize_t nwritten = -1;
4016 SMB_OFF_T startpos;
4017 const char *data;
4018 files_struct *fsp;
4019 struct lock_struct lock;
4020 NTSTATUS status;
4021
4022 START_PROFILE(SMBwrite);
4023
4024 if (req->wct < 5) {
4025 END_PROFILE(SMBwrite);
4026 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4027 return;
4028 }
4029
4030 /* If it's an IPC, pass off the pipe handler. */
4031 if (IS_IPC(conn)) {
4032 reply_pipe_write(req);
4033 END_PROFILE(SMBwrite);
4034 return;
4035 }
4036
4037 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4038
4039 if (!check_fsp(conn, req, fsp)) {
4040 END_PROFILE(SMBwrite);
4041 return;
4042 }
4043
4044 if (!CHECK_WRITE(fsp)) {
4045 reply_doserror(req, ERRDOS, ERRbadaccess);
4046 END_PROFILE(SMBwrite);
4047 return;
4048 }
4049
4050 numtowrite = SVAL(req->vwv+1, 0);
4051 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4052 data = (const char *)req->buf + 3;
4053
4054 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4055 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4056 &lock);
4057
4058 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4059 reply_doserror(req, ERRDOS, ERRlock);
4060 END_PROFILE(SMBwrite);
4061 return;
4062 }
4063
4064 /*
4065 * X/Open SMB protocol says that if smb_vwv1 is
4066 * zero then the file size should be extended or
4067 * truncated to the size given in smb_vwv[2-3].
4068 */
4069
4070 if(numtowrite == 0) {
4071 /*
4072 * This is actually an allocate call, and set EOF. JRA.
4073 */
4074 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4075 if (nwritten < 0) {
4076 reply_nterror(req, NT_STATUS_DISK_FULL);
4077 goto strict_unlock;
4078 }
4079 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4080 if (nwritten < 0) {
4081 reply_nterror(req, NT_STATUS_DISK_FULL);
4082 goto strict_unlock;
4083 }
4084 trigger_write_time_update_immediate(fsp);
4085 } else {
4086 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4087 }
4088
4089 status = sync_file(conn, fsp, False);
4090 if (!NT_STATUS_IS_OK(status)) {
4091 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4092 fsp->fsp_name, nt_errstr(status) ));
4093 reply_nterror(req, status);
4094 goto strict_unlock;
4095 }
4096
4097 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4098 reply_unixerror(req, ERRHRD, ERRdiskfull);
4099 goto strict_unlock;
4100 }
4101
4102 reply_outbuf(req, 1, 0);
4103
4104 SSVAL(req->outbuf,smb_vwv0,nwritten);
4105
4106 if (nwritten < (ssize_t)numtowrite) {
4107 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4108 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4109 }
4110
4111 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4112
4113 strict_unlock:
4114 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4115
4116 END_PROFILE(SMBwrite);
4117 return;
4118 }
4119
4120 /****************************************************************************
4121 Ensure a buffer is a valid writeX for recvfile purposes.
4122 ****************************************************************************/
4123
4124 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4125 (2*14) + /* word count (including bcc) */ \
4126 1 /* pad byte */)
4127
4128 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4129 {
4130 size_t numtowrite;
4131 connection_struct *conn = NULL;
4132 unsigned int doff = 0;
4133 size_t len = smb_len_large(inbuf);
4134
4135 if (is_encrypted_packet(inbuf)) {
4136 /* Can't do this on encrypted
4137 * connections. */
4138 return false;
4139 }
4140
4141 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4142 return false;
4143 }
4144
4145 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4146 CVAL(inbuf,smb_wct) != 14) {
4147 DEBUG(10,("is_valid_writeX_buffer: chained or "
4148 "invalid word length.\n"));
4149 return false;
4150 }
4151
4152 conn = conn_find(SVAL(inbuf, smb_tid));
4153 if (conn == NULL) {
4154 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4155 return false;
4156 }
4157 if (IS_IPC(conn)) {
4158 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4159 return false;
4160 }
4161 if (IS_PRINT(conn)) {
4162 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4163 return false;
4164 }
4165 doff = SVAL(inbuf,smb_vwv11);
4166
4167 numtowrite = SVAL(inbuf,smb_vwv10);
4168
4169 if (len > doff && len - doff > 0xFFFF) {
4170 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4171 }
4172
4173 if (numtowrite == 0) {
4174 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4175 return false;
4176 }
4177
4178 /* Ensure the sizes match up. */
4179 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4180 /* no pad byte...old smbclient :-( */
4181 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4182 (unsigned int)doff,
4183 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4184 return false;
4185 }
4186
4187 if (len - doff != numtowrite) {
4188 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4189 "len = %u, doff = %u, numtowrite = %u\n",
4190 (unsigned int)len,
4191 (unsigned int)doff,
4192 (unsigned int)numtowrite ));
4193 return false;
4194 }
4195
4196 DEBUG(10,("is_valid_writeX_buffer: true "
4197 "len = %u, doff = %u, numtowrite = %u\n",
4198 (unsigned int)len,
4199 (unsigned int)doff,
4200 (unsigned int)numtowrite ));
4201
4202 return true;
4203 }
4204
4205 /****************************************************************************
4206 Reply to a write and X.
4207 ****************************************************************************/
4208
4209 void reply_write_and_X(struct smb_request *req)
4210 {
4211 connection_struct *conn = req->conn;
4212 files_struct *fsp;
4213 struct lock_struct lock;
4214 SMB_OFF_T startpos;
4215 size_t numtowrite;
4216 bool write_through;
4217 ssize_t nwritten;
4218 unsigned int smb_doff;
4219 unsigned int smblen;
4220 char *data;
4221 NTSTATUS status;
4222
4223 START_PROFILE(SMBwriteX);
4224
4225 if ((req->wct != 12) && (req->wct != 14)) {
4226 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4227 END_PROFILE(SMBwriteX);
4228 return;
4229 }
4230
4231 numtowrite = SVAL(req->vwv+10, 0);
4232 smb_doff = SVAL(req->vwv+11, 0);
4233 smblen = smb_len(req->inbuf);
4234
4235 if (req->unread_bytes > 0xFFFF ||
4236 (smblen > smb_doff &&
4237 smblen - smb_doff > 0xFFFF)) {
4238 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4239 }
4240
4241 if (req->unread_bytes) {
4242 /* Can't do a recvfile write on IPC$ */
4243 if (IS_IPC(conn)) {
4244 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4245 END_PROFILE(SMBwriteX);
4246 return;
4247 }
4248 if (numtowrite != req->unread_bytes) {
4249 reply_doserror(req, ERRDOS, ERRbadmem);
4250 END_PROFILE(SMBwriteX);
4251 return;
4252 }
4253 } else {
4254 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4255 smb_doff + numtowrite > smblen) {
4256 reply_doserror(req, ERRDOS, ERRbadmem);
4257 END_PROFILE(SMBwriteX);
4258 return;
4259 }
4260 }
4261
4262 /* If it's an IPC, pass off the pipe handler. */
4263 if (IS_IPC(conn)) {
4264 if (req->unread_bytes) {
4265 reply_doserror(req, ERRDOS, ERRbadmem);
4266 END_PROFILE(SMBwriteX);
4267 return;
4268 }
4269 reply_pipe_write_and_X(req);
4270 END_PROFILE(SMBwriteX);
4271 return;
4272 }
4273
4274 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4275 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4276 write_through = BITSETW(req->vwv+7,0);
4277
4278 if (!check_fsp(conn, req, fsp)) {
4279 END_PROFILE(SMBwriteX);
4280 return;
4281 }
4282
4283 if (!CHECK_WRITE(fsp)) {
4284 reply_doserror(req, ERRDOS, ERRbadaccess);
4285 END_PROFILE(SMBwriteX);
4286 return;
4287 }
4288
4289 data = smb_base(req->inbuf) + smb_doff;
4290
4291 if(req->wct == 14) {
4292 #ifdef LARGE_SMB_OFF_T
4293 /*
4294 * This is a large offset (64 bit) write.
4295 */
4296 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4297
4298 #else /* !LARGE_SMB_OFF_T */
4299
4300 /*
4301 * Ensure we haven't been sent a >32 bit offset.
4302 */
4303
4304 if(IVAL(req->vwv+12, 0) != 0) {
4305 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4306 "used and we don't support 64 bit offsets.\n",
4307 (unsigned int)IVAL(req->vwv+12, 0) ));
4308 reply_doserror(req, ERRDOS, ERRbadaccess);
4309 END_PROFILE(SMBwriteX);
4310 return;
4311 }
4312
4313 #endif /* LARGE_SMB_OFF_T */
4314 }
4315
4316 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4317 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4318 &lock);
4319
4320 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4321 reply_doserror(req, ERRDOS, ERRlock);
4322 END_PROFILE(SMBwriteX);
4323 return;
4324 }
4325
4326 /* X/Open SMB protocol says that, unlike SMBwrite
4327 if the length is zero then NO truncation is
4328 done, just a write of zero. To truncate a file,
4329 use SMBwrite. */
4330
4331 if(numtowrite == 0) {
4332 nwritten = 0;
4333 } else {
4334
4335 if ((req->unread_bytes == 0) &&
4336 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4337 numtowrite)) {
4338 goto strict_unlock;
4339 }
4340
4341 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4342 }
4343
4344 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4345 reply_unixerror(req, ERRHRD, ERRdiskfull);
4346 goto strict_unlock;
4347 }
4348
4349 reply_outbuf(req, 6, 0);
4350 SSVAL(req->outbuf,smb_vwv2,nwritten);
4351 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4352
4353 if (nwritten < (ssize_t)numtowrite) {
4354 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4355 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4356 }
4357
4358 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4359 fsp->fnum, (int)numtowrite, (int)nwritten));
4360
4361 status = sync_file(conn, fsp, write_through);
4362 if (!NT_STATUS_IS_OK(status)) {
4363 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4364 fsp->fsp_name, nt_errstr(status) ));
4365 reply_nterror(req, status);
4366 goto strict_unlock;
4367 }
4368
4369 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4370
4371 END_PROFILE(SMBwriteX);
4372 chain_reply(req);
4373 return;
4374
4375 strict_unlock:
4376 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4377
4378 END_PROFILE(SMBwriteX);
4379 return;
4380 }
4381
4382 /****************************************************************************
4383 Reply to a lseek.
4384 ****************************************************************************/
4385
4386 void reply_lseek(struct smb_request *req)
4387 {
4388 connection_struct *conn = req->conn;
4389 SMB_OFF_T startpos;
4390 SMB_OFF_T res= -1;
4391 int mode,umode;
4392 files_struct *fsp;
4393
4394 START_PROFILE(SMBlseek);
4395
4396 if (req->wct < 4) {
4397 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4398 END_PROFILE(SMBlseek);
4399 return;
4400 }
4401
4402 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4403
4404 if (!check_fsp(conn, req, fsp)) {
4405 return;
4406 }
4407
4408 flush_write_cache(fsp, SEEK_FLUSH);
4409
4410 mode = SVAL(req->vwv+1, 0) & 3;
4411 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4412 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4413
4414 switch (mode) {
4415 case 0:
4416 umode = SEEK_SET;
4417 res = startpos;
4418 break;
4419 case 1:
4420 umode = SEEK_CUR;
4421 res = fsp->fh->pos + startpos;
4422 break;
4423 case 2:
4424 umode = SEEK_END;
4425 break;
4426 default:
4427 umode = SEEK_SET;
4428 res = startpos;
4429 break;
4430 }
4431
4432 if (umode == SEEK_END) {
4433 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4434 if(errno == EINVAL) {
4435 SMB_OFF_T current_pos = startpos;
4436 SMB_STRUCT_STAT sbuf;
4437
4438 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4439 reply_unixerror(req, ERRDOS,
4440 ERRnoaccess);
4441 END_PROFILE(SMBlseek);
4442 return;
4443 }
4444
4445 current_pos += sbuf.st_ex_size;
4446 if(current_pos < 0)
4447 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4448 }
4449 }
4450
4451 if(res == -1) {
4452 reply_unixerror(req, ERRDOS, ERRnoaccess);
4453 END_PROFILE(SMBlseek);
4454 return;
4455 }
4456 }
4457
4458 fsp->fh->pos = res;
4459
4460 reply_outbuf(req, 2, 0);
4461 SIVAL(req->outbuf,smb_vwv0,res);
4462
4463 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4464 fsp->fnum, (double)startpos, (double)res, mode));
4465
4466 END_PROFILE(SMBlseek);
4467 return;
4468 }
4469
4470 /****************************************************************************
4471 Reply to a flush.
4472 ****************************************************************************/
4473
4474 void reply_flush(struct smb_request *req)
4475 {
4476 connection_struct *conn = req->conn;
4477 uint16 fnum;
4478 files_struct *fsp;
4479
4480 START_PROFILE(SMBflush);
4481
4482 if (req->wct < 1) {
4483 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4484 return;
4485 }
4486
4487 fnum = SVAL(req->vwv+0, 0);
4488 fsp = file_fsp(req, fnum);
4489
4490 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4491 return;
4492 }
4493
4494 if (!fsp) {
4495 file_sync_all(conn);
4496 } else {
4497 NTSTATUS status = sync_file(conn, fsp, True);
4498 if (!NT_STATUS_IS_OK(status)) {
4499 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4500 fsp->fsp_name, nt_errstr(status) ));
4501 reply_nterror(req, status);
4502 END_PROFILE(SMBflush);
4503 return;
4504 }
4505 }
4506
4507 reply_outbuf(req, 0, 0);
4508
4509 DEBUG(3,("flush\n"));
4510 END_PROFILE(SMBflush);
4511 return;
4512 }
4513
4514 /****************************************************************************
4515 Reply to a exit.
4516 conn POINTER CAN BE NULL HERE !
4517 ****************************************************************************/
4518
4519 void reply_exit(struct smb_request *req)
4520 {
4521 START_PROFILE(SMBexit);
4522
4523 file_close_pid(req->smbpid, req->vuid);
4524
4525 reply_outbuf(req, 0, 0);
4526
4527 DEBUG(3,("exit\n"));
4528
4529 END_PROFILE(SMBexit);
4530 return;
4531 }
4532
4533 /****************************************************************************
4534 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4535 ****************************************************************************/
4536
4537 void reply_close(struct smb_request *req)
4538 {
4539 connection_struct *conn = req->conn;
4540 NTSTATUS status = NT_STATUS_OK;
4541 files_struct *fsp = NULL;
4542 START_PROFILE(SMBclose);
4543
4544 if (req->wct < 3) {
4545 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4546 END_PROFILE(SMBclose);
4547 return;
4548 }
4549
4550 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4551
4552 /*
4553 * We can only use check_fsp if we know it's not a directory.
4554 */
4555
4556 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4557 reply_doserror(req, ERRDOS, ERRbadfid);
4558 END_PROFILE(SMBclose);
4559 return;
4560 }
4561
4562 if(fsp->is_directory) {
4563 /*
4564 * Special case - close NT SMB directory handle.
4565 */
4566 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4567 status = close_file(req, fsp, NORMAL_CLOSE);
4568 } else {
4569 time_t t;
4570 /*
4571 * Close ordinary file.
4572 */
4573
4574 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4575 fsp->fh->fd, fsp->fnum,
4576 conn->num_files_open));
4577
4578 /*
4579 * Take care of any time sent in the close.
4580 */
4581
4582 t = srv_make_unix_date3(req->vwv+1);
4583 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4584
4585 /*
4586 * close_file() returns the unix errno if an error
4587 * was detected on close - normally this is due to
4588 * a disk full error. If not then it was probably an I/O error.
4589 */
4590
4591 status = close_file(req, fsp, NORMAL_CLOSE);
4592 }
4593
4594 if (!NT_STATUS_IS_OK(status)) {
4595 reply_nterror(req, status);
4596 END_PROFILE(SMBclose);
4597 return;
4598 }
4599
4600 reply_outbuf(req, 0, 0);
4601 END_PROFILE(SMBclose);
4602 return;
4603 }
4604
4605 /****************************************************************************
4606 Reply to a writeclose (Core+ protocol).
4607 ****************************************************************************/
4608
4609 void reply_writeclose(struct smb_request *req)
4610 {
4611 connection_struct *conn = req->conn;
4612 size_t numtowrite;
4613 ssize_t nwritten = -1;
4614 NTSTATUS close_status = NT_STATUS_OK;
4615 SMB_OFF_T startpos;
4616 const char *data;
4617 struct timespec mtime;
4618 files_struct *fsp;
4619 struct lock_struct lock;
4620
4621 START_PROFILE(SMBwriteclose);
4622
4623 if (req->wct < 6) {
4624 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4625 END_PROFILE(SMBwriteclose);
4626 return;
4627 }
4628
4629 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4630
4631 if (!check_fsp(conn, req, fsp)) {
4632 END_PROFILE(SMBwriteclose);
4633 return;
4634 }
4635 if (!CHECK_WRITE(fsp)) {
4636 reply_doserror(req, ERRDOS,ERRbadaccess);
4637 END_PROFILE(SMBwriteclose);
4638 return;
4639 }
4640
4641 numtowrite = SVAL(req->vwv+1, 0);
4642 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4643 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4644 data = (const char *)req->buf + 1;
4645
4646 if (numtowrite) {
4647 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4648 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4649 &lock);
4650
4651 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4652 reply_doserror(req, ERRDOS,ERRlock);
4653 END_PROFILE(SMBwriteclose);
4654 return;
4655 }
4656 }
4657
4658 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4659
4660 set_close_write_time(fsp, mtime);
4661
4662 /*
4663 * More insanity. W2K only closes the file if writelen > 0.
4664 * JRA.
4665 */
4666
4667 if (numtowrite) {
4668 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4669 fsp->fsp_name ));
4670 close_status = close_file(req, fsp, NORMAL_CLOSE);
4671 }
4672
4673 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4674 fsp->fnum, (int)numtowrite, (int)nwritten,
4675 conn->num_files_open));
4676
4677 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4678 reply_doserror(req, ERRHRD, ERRdiskfull);
4679 goto strict_unlock;
4680 }
4681
4682 if(!NT_STATUS_IS_OK(close_status)) {
4683 reply_nterror(req, close_status);
4684 goto strict_unlock;
4685 }
4686
4687 reply_outbuf(req, 1, 0);
4688
4689 SSVAL(req->outbuf,smb_vwv0,nwritten);
4690
4691 strict_unlock:
4692 if (numtowrite) {
4693 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4694 }
4695
4696 END_PROFILE(SMBwriteclose);
4697 return;
4698 }
4699
4700 #undef DBGC_CLASS
4701 #define DBGC_CLASS DBGC_LOCKING
4702
4703 /****************************************************************************
4704 Reply to a lock.
4705 ****************************************************************************/
4706
4707 void reply_lock(struct smb_request *req)
4708 {
4709 connection_struct *conn = req->conn;
4710 uint64_t count,offset;
4711 NTSTATUS status;
4712 files_struct *fsp;
4713 struct byte_range_lock *br_lck = NULL;
4714
4715 START_PROFILE(SMBlock);
4716
4717 if (req->wct < 5) {
4718 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4719 END_PROFILE(SMBlock);
4720 return;
4721 }
4722
4723 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4724
4725 if (!check_fsp(conn, req, fsp)) {
4726 END_PROFILE(SMBlock);
4727 return;
4728 }
4729
4730 count = (uint64_t)IVAL(req->vwv+1, 0);
4731 offset = (uint64_t)IVAL(req->vwv+3, 0);
4732
4733 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4734 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4735
4736 br_lck = do_lock(smbd_messaging_context(),
4737 fsp,
4738 req->smbpid,
4739 count,
4740 offset,
4741 WRITE_LOCK,
4742 WINDOWS_LOCK,
4743 False, /* Non-blocking lock. */
4744 &status,
4745 NULL,
4746 NULL);
4747
4748 TALLOC_FREE(br_lck);
4749
4750 if (NT_STATUS_V(status)) {
4751 reply_nterror(req, status);
4752 END_PROFILE(SMBlock);
4753 return;
4754 }
4755
4756 reply_outbuf(req, 0, 0);
4757
4758 END_PROFILE(SMBlock);
4759 return;
4760 }
4761
4762 /****************************************************************************
4763 Reply to a unlock.
4764 ****************************************************************************/
4765
4766 void reply_unlock(struct smb_request *req)
4767 {
4768 connection_struct *conn = req->conn;
4769 uint64_t count,offset;
4770 NTSTATUS status;
4771 files_struct *fsp;
4772
4773 START_PROFILE(SMBunlock);
4774
4775 if (req->wct < 5) {
4776 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4777 END_PROFILE(SMBunlock);
4778 return;
4779 }
4780
4781 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4782
4783 if (!check_fsp(conn, req, fsp)) {
4784 END_PROFILE(SMBunlock);
4785 return;
4786 }
4787
4788 count = (uint64_t)IVAL(req->vwv+1, 0);
4789 offset = (uint64_t)IVAL(req->vwv+3, 0);
4790
4791 status = do_unlock(smbd_messaging_context(),
4792 fsp,
4793 req->smbpid,
4794 count,
4795 offset,
4796 WINDOWS_LOCK);
4797
4798 if (NT_STATUS_V(status)) {
4799 reply_nterror(req, status);
4800 END_PROFILE(SMBunlock);
4801 return;
4802 }
4803
4804 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4805 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4806
4807 reply_outbuf(req, 0, 0);
4808
4809 END_PROFILE(SMBunlock);
4810 return;
4811 }
4812
4813 #undef DBGC_CLASS
4814 #define DBGC_CLASS DBGC_ALL
4815
4816 /****************************************************************************
4817 Reply to a tdis.
4818 conn POINTER CAN BE NULL HERE !
4819 ****************************************************************************/
4820
4821 void reply_tdis(struct smb_request *req)
4822 {
4823 connection_struct *conn = req->conn;
4824 START_PROFILE(SMBtdis);
4825
4826 if (!conn) {
4827 DEBUG(4,("Invalid connection in tdis\n"));
4828 reply_doserror(req, ERRSRV, ERRinvnid);
4829 END_PROFILE(SMBtdis);
4830 return;
4831 }
4832
4833 conn->used = False;
4834
4835 close_cnum(conn,req->vuid);
4836 req->conn = NULL;
4837
4838 reply_outbuf(req, 0, 0);
4839 END_PROFILE(SMBtdis);
4840 return;
4841 }
4842
4843 /****************************************************************************
4844 Reply to a echo.
4845 conn POINTER CAN BE NULL HERE !
4846 ****************************************************************************/
4847
4848 void reply_echo(struct smb_request *req)
4849 {
4850 connection_struct *conn = req->conn;
4851 struct smb_perfcount_data local_pcd;
4852 struct smb_perfcount_data *cur_pcd;
4853 int smb_reverb;
4854 int seq_num;
4855
4856 START_PROFILE(SMBecho);
4857
4858 smb_init_perfcount_data(&local_pcd);
4859
4860 if (req->wct < 1) {
4861 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4862 END_PROFILE(SMBecho);
4863 return;
4864 }
4865
4866 smb_reverb = SVAL(req->vwv+0, 0);
4867
4868 reply_outbuf(req, 1, req->buflen);
4869
4870 /* copy any incoming data back out */
4871 if (req->buflen > 0) {
4872 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4873 }
4874
4875 if (smb_reverb > 100) {
4876 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4877 smb_reverb = 100;
4878 }
4879
4880 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4881
4882 /* this makes sure we catch the request pcd */
4883 if (seq_num == smb_reverb) {
4884 cur_pcd = &req->pcd;
4885 } else {
4886 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4887 cur_pcd = &local_pcd;
4888 }
4889
4890 SSVAL(req->outbuf,smb_vwv0,seq_num);
4891
4892 show_msg((char *)req->outbuf);
4893 if (!srv_send_smb(smbd_server_fd(),
4894 (char *)req->outbuf,
4895 true, req->seqnum+1,
4896 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4897 cur_pcd))
4898 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4899 }
4900
4901 DEBUG(3,("echo %d times\n", smb_reverb));
4902
4903 TALLOC_FREE(req->outbuf);
4904
4905 END_PROFILE(SMBecho);
4906 return;
4907 }
4908
4909 /****************************************************************************
4910 Reply to a printopen.
4911 ****************************************************************************/
4912
4913 void reply_printopen(struct smb_request *req)
4914 {
4915 connection_struct *conn = req->conn;
4916 files_struct *fsp;
4917 SMB_STRUCT_STAT sbuf;
4918 NTSTATUS status;
4919
4920 START_PROFILE(SMBsplopen);
4921
4922 if (req->wct < 2) {
4923 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4924 END_PROFILE(SMBsplopen);
4925 return;
4926 }
4927
4928 if (!CAN_PRINT(conn)) {
4929 reply_doserror(req, ERRDOS, ERRnoaccess);
4930 END_PROFILE(SMBsplopen);
4931 return;
4932 }
4933
4934 status = file_new(req, conn, &fsp);
4935 if(!NT_STATUS_IS_OK(status)) {
4936 reply_nterror(req, status);
4937 END_PROFILE(SMBsplopen);
4938 return;
4939 }
4940
4941 /* Open for exclusive use, write only. */
4942 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4943
4944 if (!NT_STATUS_IS_OK(status)) {
4945 reply_nterror(req, status);
4946 END_PROFILE(SMBsplopen);
4947 return;
4948 }
4949
4950 reply_outbuf(req, 1, 0);
4951 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4952
4953 DEBUG(3,("openprint fd=%d fnum=%d\n",
4954 fsp->fh->fd, fsp->fnum));
4955
4956 END_PROFILE(SMBsplopen);
4957 return;
4958 }
4959
4960 /****************************************************************************
4961 Reply to a printclose.
4962 ****************************************************************************/
4963
4964 void reply_printclose(struct smb_request *req)
4965 {
4966 connection_struct *conn = req->conn;
4967 files_struct *fsp;
4968 NTSTATUS status;
4969
4970 START_PROFILE(SMBsplclose);
4971
4972 if (req->wct < 1) {
4973 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4974 END_PROFILE(SMBsplclose);
4975 return;
4976 }
4977
4978 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4979
4980 if (!check_fsp(conn, req, fsp)) {
4981 END_PROFILE(SMBsplclose);
4982 return;
4983 }
4984
4985 if (!CAN_PRINT(conn)) {
4986 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4987 END_PROFILE(SMBsplclose);
4988 return;
4989 }
4990
4991 DEBUG(3,("printclose fd=%d fnum=%d\n",
4992 fsp->fh->fd,fsp->fnum));
4993
4994 status = close_file(req, fsp, NORMAL_CLOSE);
4995
4996 if(!NT_STATUS_IS_OK(status)) {
4997 reply_nterror(req, status);
4998 END_PROFILE(SMBsplclose);
4999 return;
5000 }
5001
5002 reply_outbuf(req, 0, 0);
5003
5004 END_PROFILE(SMBsplclose);
5005 return;
5006 }
5007
5008 /****************************************************************************
5009 Reply to a printqueue.
5010 ****************************************************************************/
5011
5012 void reply_printqueue(struct smb_request *req)
5013 {
5014 connection_struct *conn = req->conn;
5015 int max_count;
5016 int start_index;
5017
5018 START_PROFILE(SMBsplretq);
5019
5020 if (req->wct < 2) {
5021 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5022 END_PROFILE(SMBsplretq);
5023 return;
5024 }
5025
5026 max_count = SVAL(req->vwv+0, 0);
5027 start_index = SVAL(req->vwv+1, 0);
5028
5029 /* we used to allow the client to get the cnum wrong, but that
5030 is really quite gross and only worked when there was only
5031 one printer - I think we should now only accept it if they
5032 get it right (tridge) */
5033 if (!CAN_PRINT(conn)) {
5034 reply_doserror(req, ERRDOS, ERRnoaccess);
5035 END_PROFILE(SMBsplretq);
5036 return;
5037 }
5038
5039 reply_outbuf(req, 2, 3);
5040 SSVAL(req->outbuf,smb_vwv0,0);
5041 SSVAL(req->outbuf,smb_vwv1,0);
5042 SCVAL(smb_buf(req->outbuf),0,1);
5043 SSVAL(smb_buf(req->outbuf),1,0);
5044
5045 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5046 start_index, max_count));
5047
5048 {
5049 print_queue_struct *queue = NULL;
5050 print_status_struct status;
5051 int count = print_queue_status(SNUM(conn), &queue, &status);
5052 int num_to_get = ABS(max_count);
5053 int first = (max_count>0?start_index:start_index+max_count+1);
5054 int i;
5055
5056 if (first >= count)
5057 num_to_get = 0;
5058 else
5059 num_to_get = MIN(num_to_get,count-first);
5060
5061
5062 for (i=first;i<first+num_to_get;i++) {
5063 char blob[28];
5064 char *p = blob;
5065
5066 srv_put_dos_date2(p,0,queue[i].time);
5067 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5068 SSVAL(p,5, queue[i].job);
5069 SIVAL(p,7,queue[i].size);
5070 SCVAL(p,11,0);
5071 srvstr_push(blob, req->flags2, p+12,
5072 queue[i].fs_user, 16, STR_ASCII);
5073
5074 if (message_push_blob(
5075 &req->outbuf,
5076 data_blob_const(
5077 blob, sizeof(blob))) == -1) {
5078 reply_nterror(req, NT_STATUS_NO_MEMORY);
5079 END_PROFILE(SMBsplretq);
5080 return;
5081 }
5082 }
5083
5084 if (count > 0) {
5085 SSVAL(req->outbuf,smb_vwv0,count);
5086 SSVAL(req->outbuf,smb_vwv1,
5087 (max_count>0?first+count:first-1));
5088 SCVAL(smb_buf(req->outbuf),0,1);
5089 SSVAL(smb_buf(req->outbuf),1,28*count);
5090 }
5091
5092 SAFE_FREE(queue);
5093
5094 DEBUG(3,("%d entries returned in queue\n",count));
5095 }
5096
5097 END_PROFILE(SMBsplretq);
5098 return;
5099 }
5100
5101 /****************************************************************************
5102 Reply to a printwrite.
5103 ****************************************************************************/
5104
5105 void reply_printwrite(struct smb_request *req)
5106 {
5107 connection_struct *conn = req->conn;
5108 int numtowrite;
5109 const char *data;
5110 files_struct *fsp;
5111
5112 START_PROFILE(SMBsplwr);
5113
5114 if (req->wct < 1) {
5115 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5116 END_PROFILE(SMBsplwr);
5117 return;
5118 }
5119
5120 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5121
5122 if (!check_fsp(conn, req, fsp)) {
5123 END_PROFILE(SMBsplwr);
5124 return;
5125 }
5126
5127 if (!CAN_PRINT(conn)) {
5128 reply_doserror(req, ERRDOS, ERRnoaccess);
5129 END_PROFILE(SMBsplwr);
5130 return;
5131 }
5132
5133 if (!CHECK_WRITE(fsp)) {
5134 reply_doserror(req, ERRDOS, ERRbadaccess);
5135 END_PROFILE(SMBsplwr);
5136 return;
5137 }
5138
5139 numtowrite = SVAL(req->buf, 1);
5140
5141 if (req->buflen < numtowrite + 3) {
5142 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5143 END_PROFILE(SMBsplwr);
5144 return;
5145 }
5146
5147 data = (const char *)req->buf + 3;
5148
5149 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5150 reply_unixerror(req, ERRHRD, ERRdiskfull);
5151 END_PROFILE(SMBsplwr);
5152 return;
5153 }
5154
5155 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5156
5157 END_PROFILE(SMBsplwr);
5158 return;
5159 }
5160
5161 /****************************************************************************
5162 Reply to a mkdir.
5163 ****************************************************************************/
5164
5165 void reply_mkdir(struct smb_request *req)
5166 {
5167 connection_struct *conn = req->conn;
5168 struct smb_filename *smb_dname = NULL;
5169 char *directory = NULL;
5170 NTSTATUS status;
5171 TALLOC_CTX *ctx = talloc_tos();
5172
5173 START_PROFILE(SMBmkdir);
5174
5175 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5176 STR_TERMINATE, &status);
5177 if (!NT_STATUS_IS_OK(status)) {
5178 reply_nterror(req, status);
5179 goto out;
5180 }
5181
5182 status = resolve_dfspath(ctx, conn,
5183 req->flags2 & FLAGS2_DFS_PATHNAMES,
5184 directory,
5185 &directory);
5186 if (!NT_STATUS_IS_OK(status)) {
5187 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5188 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5189 ERRSRV, ERRbadpath);
5190 goto out;
5191 }
5192 reply_nterror(req, status);
5193 goto out;
5194 }
5195
5196 status = unix_convert(ctx, conn, directory, &smb_dname, 0);
5197 if (!NT_STATUS_IS_OK(status)) {
5198 reply_nterror(req, status);
5199 goto out;
5200 }
5201
5202 status = get_full_smb_filename(ctx, smb_dname, &directory);
5203 if (!NT_STATUS_IS_OK(status)) {
5204 reply_nterror(req, status);
5205 goto out;
5206 }
5207
5208 status = check_name(conn, directory);
5209 if (!NT_STATUS_IS_OK(status)) {
5210 reply_nterror(req, status);
5211 goto out;
5212 }
5213
5214 status = create_directory(conn, req, directory);
5215
5216 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5217
5218 if (!NT_STATUS_IS_OK(status)) {
5219
5220 if (!use_nt_status()
5221 && NT_STATUS_EQUAL(status,
5222 NT_STATUS_OBJECT_NAME_COLLISION)) {
5223 /*
5224 * Yes, in the DOS error code case we get a
5225 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5226 * samba4 torture test.
5227 */
5228 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5229 }
5230
5231 reply_nterror(req, status);
5232 goto out;
5233 }
5234
5235 reply_outbuf(req, 0, 0);
5236
5237 DEBUG( 3, ( "mkdir %s\n", directory ) );
5238 out:
5239 TALLOC_FREE(smb_dname);
5240 END_PROFILE(SMBmkdir);
5241 return;
5242 }
5243
5244 /****************************************************************************
5245 Static function used by reply_rmdir to delete an entire directory
5246 tree recursively. Return True on ok, False on fail.
5247 ****************************************************************************/
5248
5249 static bool recursive_rmdir(TALLOC_CTX *ctx,
5250 connection_struct *conn,
5251 char *directory)
5252 {
5253 const char *dname = NULL;
5254 bool ret = True;
5255 long offset = 0;
5256 SMB_STRUCT_STAT st;
5257 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5258 NULL, 0);
5259
5260 if(dir_hnd == NULL)
5261 return False;
5262
5263 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5264 char *fullname = NULL;
5265
5266 if (ISDOT(dname) || ISDOTDOT(dname)) {
5267 continue;
5268 }
5269
5270 if (!is_visible_file(conn, directory, dname, &st, False)) {
5271 continue;
5272 }
5273
5274 /* Construct the full name. */
5275 fullname = talloc_asprintf(ctx,
5276 "%s/%s",
5277 directory,
5278 dname);
5279 if (!fullname) {
5280 errno = ENOMEM;
5281 ret = False;
5282 break;
5283 }
5284
5285 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5286 ret = False;
5287 break;
5288 }
5289
5290 if(st.st_ex_mode & S_IFDIR) {
5291 if(!recursive_rmdir(ctx, conn, fullname)) {
5292 ret = False;
5293 break;
5294 }
5295 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5296 ret = False;
5297 break;
5298 }
5299 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5300 ret = False;
5301 break;
5302 }
5303 TALLOC_FREE(fullname);
5304 }
5305 TALLOC_FREE(dir_hnd);
5306 return ret;
5307 }
5308
5309 /****************************************************************************
5310 The internals of the rmdir code - called elsewhere.
5311 ****************************************************************************/
5312
5313 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5314 connection_struct *conn,
5315 const char *directory)
5316 {
5317 int ret;
5318 SMB_STRUCT_STAT st;
5319
5320 /* Might be a symlink. */
5321 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5322 return map_nt_error_from_unix(errno);
5323 }
5324
5325 if (S_ISLNK(st.st_ex_mode)) {
5326 /* Is what it points to a directory ? */
5327 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5328 return map_nt_error_from_unix(errno);
5329 }
5330 if (!(S_ISDIR(st.st_ex_mode))) {
5331 return NT_STATUS_NOT_A_DIRECTORY;
5332 }
5333 ret = SMB_VFS_UNLINK(conn,directory);
5334 } else {
5335 ret = SMB_VFS_RMDIR(conn,directory);
5336 }
5337 if (ret == 0) {
5338 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5339 FILE_NOTIFY_CHANGE_DIR_NAME,
5340 directory);
5341 return NT_STATUS_OK;
5342 }
5343
5344 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5345 /*
5346 * Check to see if the only thing in this directory are
5347 * vetoed files/directories. If so then delete them and
5348 * retry. If we fail to delete any of them (and we *don't*
5349 * do a recursive delete) then fail the rmdir.
5350 */
5351 const char *dname;
5352 long dirpos = 0;
5353 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5354 directory, NULL, 0);
5355
5356 if(dir_hnd == NULL) {
5357 errno = ENOTEMPTY;
5358 goto err;
5359 }
5360
5361 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5362 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5363 continue;
5364 if (!is_visible_file(conn, directory, dname, &st, False))
5365 continue;
5366 if(!IS_VETO_PATH(conn, dname)) {
5367 TALLOC_FREE(dir_hnd);
5368 errno = ENOTEMPTY;
5369 goto err;
5370 }
5371 }
5372
5373 /* We only have veto files/directories.
5374 * Are we allowed to delete them ? */
5375
5376 if(!lp_recursive_veto_delete(SNUM(conn))) {
5377 TALLOC_FREE(dir_hnd);
5378 errno = ENOTEMPTY;
5379 goto err;
5380 }
5381
5382 /* Do a recursive delete. */
5383 RewindDir(dir_hnd,&dirpos);
5384 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5385 char *fullname = NULL;
5386
5387 if (ISDOT(dname) || ISDOTDOT(dname)) {
5388 continue;
5389 }
5390 if (!is_visible_file(conn, directory, dname, &st, False)) {
5391 continue;
5392 }
5393
5394 fullname = talloc_asprintf(ctx,
5395 "%s/%s",
5396 directory,
5397 dname);
5398
5399 if(!fullname) {
5400 errno = ENOMEM;
5401 break;
5402 }
5403
5404 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5405 break;
5406 }
5407 if(st.st_ex_mode & S_IFDIR) {
5408 if(!recursive_rmdir(ctx, conn, fullname)) {
5409 break;
5410 }
5411 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5412 break;
5413 }
5414 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5415 break;
5416 }
5417 TALLOC_FREE(fullname);
5418 }
5419 TALLOC_FREE(dir_hnd);
5420 /* Retry the rmdir */
5421 ret = SMB_VFS_RMDIR(conn,directory);
5422 }
5423
5424 err:
5425
5426 if (ret != 0) {
5427 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5428 "%s\n", directory,strerror(errno)));
5429 return map_nt_error_from_unix(errno);
5430 }
5431
5432 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5433 FILE_NOTIFY_CHANGE_DIR_NAME,
5434 directory);
5435
5436 return NT_STATUS_OK;
5437 }
5438
5439 /****************************************************************************
5440 Reply to a rmdir.
5441 ****************************************************************************/
5442
5443 void reply_rmdir(struct smb_request *req)
5444 {
5445 connection_struct *conn = req->conn;
5446 struct smb_filename *smb_dname = NULL;
5447 char *directory = NULL;
5448 NTSTATUS status;
5449 TALLOC_CTX *ctx = talloc_tos();
5450
5451 START_PROFILE(SMBrmdir);
5452
5453 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5454 STR_TERMINATE, &status);
5455 if (!NT_STATUS_IS_OK(status)) {
5456 reply_nterror(req, status);
5457 goto out;
5458 }
5459
5460 status = resolve_dfspath(ctx, conn,
5461 req->flags2 & FLAGS2_DFS_PATHNAMES,
5462 directory,
5463 &directory);
5464 if (!NT_STATUS_IS_OK(status)) {
5465 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5466 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5467 ERRSRV, ERRbadpath);
5468 goto out;
5469 }
5470 reply_nterror(req, status);
5471 goto out;
5472 }
5473
5474 status = unix_convert(ctx, conn, directory, &smb_dname, 0);
5475 if (!NT_STATUS_IS_OK(status)) {
5476 reply_nterror(req, status);
5477 goto out;
5478 }
5479
5480 status = get_full_smb_filename(ctx, smb_dname, &directory);
5481 if (!NT_STATUS_IS_OK(status)) {
5482 reply_nterror(req, status);
5483 goto out;
5484 }
5485
5486 status = check_name(conn, directory);
5487 if (!NT_STATUS_IS_OK(status)) {
5488 reply_nterror(req, status);
5489 goto out;
5490 }
5491
5492 dptr_closepath(directory, req->smbpid);
5493 status = rmdir_internals(ctx, conn, directory);
5494 if (!NT_STATUS_IS_OK(status)) {
5495 reply_nterror(req, status);
5496 goto out;
5497 }
5498
5499 reply_outbuf(req, 0, 0);
5500
5501 DEBUG( 3, ( "rmdir %s\n", directory ) );
5502 out:
5503 TALLOC_FREE(smb_dname);
5504 END_PROFILE(SMBrmdir);
5505 return;
5506 }
5507
5508 /*******************************************************************
5509 Resolve wildcards in a filename rename.
5510 ********************************************************************/
5511
5512 static bool resolve_wildcards(TALLOC_CTX *ctx,
5513 const char *name1,
5514 const char *name2,
5515 char **pp_newname)
5516 {
5517 char *name2_copy = NULL;
5518 char *root1 = NULL;
5519 char *root2 = NULL;
5520 char *ext1 = NULL;
5521 char *ext2 = NULL;
5522 char *p,*p2, *pname1, *pname2;
5523
5524 name2_copy = talloc_strdup(ctx, name2);
5525 if (!name2_copy) {
5526 return False;
5527 }
5528
5529 pname1 = strrchr_m(name1,'/');
5530 pname2 = strrchr_m(name2_copy,'/');
5531
5532 if (!pname1 || !pname2) {
5533 return False;
5534 }
5535
5536 /* Truncate the copy of name2 at the last '/' */
5537 *pname2 = '\0';
5538
5539 /* Now go past the '/' */
5540 pname1++;
5541 pname2++;
5542
5543 root1 = talloc_strdup(ctx, pname1);
5544 root2 = talloc_strdup(ctx, pname2);
5545
5546 if (!root1 || !root2) {
5547 return False;
5548 }
5549
5550 p = strrchr_m(root1,'.');
5551 if (p) {
5552 *p = 0;
5553 ext1 = talloc_strdup(ctx, p+1);
5554 } else {
5555 ext1 = talloc_strdup(ctx, "");
5556 }
5557 p = strrchr_m(root2,'.');
5558 if (p) {
5559 *p = 0;
5560 ext2 = talloc_strdup(ctx, p+1);
5561 } else {
5562 ext2 = talloc_strdup(ctx, "");
5563 }
5564
5565 if (!ext1 || !ext2) {
5566 return False;
5567 }
5568
5569 p = root1;
5570 p2 = root2;
5571 while (*p2) {
5572 if (*p2 == '?') {
5573 /* Hmmm. Should this be mb-aware ? */
5574 *p2 = *p;
5575 p2++;
5576 } else if (*p2 == '*') {
5577 *p2 = '\0';
5578 root2 = talloc_asprintf(ctx, "%s%s",
5579 root2,
5580 p);
5581 if (!root2) {
5582 return False;
5583 }
5584 break;
5585 } else {
5586 p2++;
5587 }
5588 if (*p) {
5589 p++;
5590 }
5591 }
5592
5593 p = ext1;
5594 p2 = ext2;
5595 while (*p2) {
5596 if (*p2 == '?') {
5597 /* Hmmm. Should this be mb-aware ? */
5598 *p2 = *p;
5599 p2++;
5600 } else if (*p2 == '*') {
5601 *p2 = '\0';
5602 ext2 = talloc_asprintf(ctx, "%s%s",
5603 ext2,
5604 p);
5605 if (!ext2) {
5606 return False;
5607 }
5608 break;
5609 } else {
5610 p2++;
5611 }
5612 if (*p) {
5613 p++;
5614 }
5615 }
5616
5617 if (*ext2) {
5618 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5619 name2_copy,
5620 root2,
5621 ext2);
5622 } else {
5623 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5624 name2_copy,
5625 root2);
5626 }
5627
5628 if (!*pp_newname) {
5629 return False;
5630 }
5631
5632 return True;
5633 }
5634
5635 /****************************************************************************
5636 Ensure open files have their names updated. Updated to notify other smbd's
5637 asynchronously.
5638 ****************************************************************************/
5639
5640 static void rename_open_files(connection_struct *conn,
5641 struct share_mode_lock *lck,
5642 const char *newname)
5643 {
5644 files_struct *fsp;
5645 bool did_rename = False;
5646
5647 for(fsp = file_find_di_first(lck->id); fsp;
5648 fsp = file_find_di_next(fsp)) {
5649 /* fsp_name is a relative path under the fsp. To change this for other
5650 sharepaths we need to manipulate relative paths. */
5651 /* TODO - create the absolute path and manipulate the newname
5652 relative to the sharepath. */
5653 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5654 continue;
5655 }
5656 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5657 fsp->fnum, file_id_string_tos(&fsp->file_id),
5658 fsp->fsp_name, newname ));
5659 string_set(&fsp->fsp_name, newname);
5660 did_rename = True;
5661 }
5662
5663 if (!did_rename) {
5664 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5665 file_id_string_tos(&lck->id), newname ));
5666 }
5667
5668 /* Send messages to all smbd's (not ourself) that the name has changed. */
5669 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5670 newname);
5671 }
5672
5673 /****************************************************************************
5674 We need to check if the source path is a parent directory of the destination
5675 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5676 refuse the rename with a sharing violation. Under UNIX the above call can
5677 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5678 probably need to check that the client is a Windows one before disallowing
5679 this as a UNIX client (one with UNIX extensions) can know the source is a
5680 symlink and make this decision intelligently. Found by an excellent bug
5681 report from <AndyLiebman@aol.com>.
5682 ****************************************************************************/
5683
5684 static bool rename_path_prefix_equal(const char *src, const char *dest)
5685 {
5686 const char *psrc = src;
5687 const char *pdst = dest;
5688 size_t slen;
5689
5690 if (psrc[0] == '.' && psrc[1] == '/') {
5691 psrc += 2;
5692 }
5693 if (pdst[0] == '.' && pdst[1] == '/') {
5694 pdst += 2;
5695 }
5696 if ((slen = strlen(psrc)) > strlen(pdst)) {
5697 return False;
5698 }
5699 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5700 }
5701
5702 /*
5703 * Do the notify calls from a rename
5704 */
5705
5706 static void notify_rename(connection_struct *conn, bool is_dir,
5707 const char *oldpath, const char *newpath)
5708 {
5709 char *olddir, *newdir;
5710 const char *oldname, *newname;
5711 uint32 mask;
5712
5713 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5714 : FILE_NOTIFY_CHANGE_FILE_NAME;
5715
5716 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5717 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5718 TALLOC_FREE(olddir);
5719 return;
5720 }
5721
5722 if (strcmp(olddir, newdir) == 0) {
5723 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5724 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5725 }
5726 else {
5727 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5728 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5729 }
5730 TALLOC_FREE(olddir);
5731 TALLOC_FREE(newdir);
5732
5733 /* this is a strange one. w2k3 gives an additional event for
5734 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5735 files, but not directories */
5736 if (!is_dir) {
5737 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5738 FILE_NOTIFY_CHANGE_ATTRIBUTES
5739 |FILE_NOTIFY_CHANGE_CREATION,
5740 newpath);
5741 }
5742 }
5743
5744 /****************************************************************************
5745 Rename an open file - given an fsp.
5746 ****************************************************************************/
5747
5748 NTSTATUS rename_internals_fsp(connection_struct *conn,
5749 files_struct *fsp,
5750 char *newname,
5751 const char *newname_last_component,
5752 uint32 attrs,
5753 bool replace_if_exists)
5754 {
5755 TALLOC_CTX *ctx = talloc_tos();
5756 SMB_STRUCT_STAT sbuf, sbuf1;
5757 NTSTATUS status = NT_STATUS_OK;
5758 struct share_mode_lock *lck = NULL;
5759 bool dst_exists, old_is_stream, new_is_stream;
5760
5761 ZERO_STRUCT(sbuf);
5762
5763 status = check_name(conn, newname);
5764 if (!NT_STATUS_IS_OK(status)) {
5765 return status;
5766 }
5767
5768 /* Ensure newname contains a '/' */
5769 if(strrchr_m(newname,'/') == 0) {
5770 newname = talloc_asprintf(ctx,
5771 "./%s",
5772 newname);
5773 if (!newname) {
5774 return NT_STATUS_NO_MEMORY;
5775 }
5776 }
5777
5778 /*
5779 * Check for special case with case preserving and not
5780 * case sensitive. If the old last component differs from the original
5781 * last component only by case, then we should allow
5782 * the rename (user is trying to change the case of the
5783 * filename).
5784 */
5785
5786 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5787 strequal(newname, fsp->fsp_name)) {
5788 char *p;
5789 char *newname_modified_last_component = NULL;
5790
5791 /*
5792 * Get the last component of the modified name.
5793 * Note that we guarantee that newname contains a '/'
5794 * character above.
5795 */
5796 p = strrchr_m(newname,'/');
5797 newname_modified_last_component = talloc_strdup(ctx,
5798 p+1);
5799 if (!newname_modified_last_component) {
5800 return NT_STATUS_NO_MEMORY;
5801 }
5802
5803 if(strcsequal(newname_modified_last_component,
5804 newname_last_component) == False) {
5805 /*
5806 * Replace the modified last component with
5807 * the original.
5808 */
5809 *p = '\0'; /* Truncate at the '/' */
5810 newname = talloc_asprintf(ctx,
5811 "%s/%s",
5812 newname,
5813 newname_last_component);
5814 }
5815 }
5816
5817 /*
5818 * If the src and dest names are identical - including case,
5819 * don't do the rename, just return success.
5820 */
5821
5822 if (strcsequal(fsp->fsp_name, newname)) {
5823 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5824 newname));
5825 return NT_STATUS_OK;
5826 }
5827
5828 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5829 new_is_stream = is_ntfs_stream_name(newname);
5830
5831 /* Return the correct error code if both names aren't streams. */
5832 if (!old_is_stream && new_is_stream) {
5833 return NT_STATUS_OBJECT_NAME_INVALID;
5834 }
5835
5836 if (old_is_stream && !new_is_stream) {
5837 return NT_STATUS_INVALID_PARAMETER;
5838 }
5839
5840 /*
5841 * Have vfs_object_exist also fill sbuf1
5842 */
5843 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5844
5845 if(!replace_if_exists && dst_exists) {
5846 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5847 fsp->fsp_name,newname));
5848 return NT_STATUS_OBJECT_NAME_COLLISION;
5849 }
5850
5851 if (dst_exists) {
5852 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5853 files_struct *dst_fsp = file_find_di_first(fileid);
5854 /* The file can be open when renaming a stream */
5855 if (dst_fsp && !new_is_stream) {
5856 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5857 return NT_STATUS_ACCESS_DENIED;
5858 }
5859 }
5860
5861 /* Ensure we have a valid stat struct for the source. */
5862 if (fsp->fh->fd != -1) {
5863 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5864 return map_nt_error_from_unix(errno);
5865 }
5866 } else {
5867 int ret = -1;
5868 if (fsp->posix_open) {
5869 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5870 } else {
5871 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5872 }
5873 if (ret == -1) {
5874 return map_nt_error_from_unix(errno);
5875 }
5876 }
5877
5878 status = can_rename(conn, fsp, attrs, &sbuf);
5879
5880 if (!NT_STATUS_IS_OK(status)) {
5881 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5882 nt_errstr(status), fsp->fsp_name,newname));
5883 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5884 status = NT_STATUS_ACCESS_DENIED;
5885 return status;
5886 }
5887
5888 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5889 return NT_STATUS_ACCESS_DENIED;
5890 }
5891
5892 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5893 NULL);
5894
5895 /*
5896 * We have the file open ourselves, so not being able to get the
5897 * corresponding share mode lock is a fatal error.
5898 */
5899
5900 SMB_ASSERT(lck != NULL);
5901
5902 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5903 uint32 create_options = fsp->fh->private_options;
5904
5905 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5906 fsp->fsp_name,newname));
5907
5908 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5909
5910 rename_open_files(conn, lck, newname);
5911
5912 /*
5913 * A rename acts as a new file create w.r.t. allowing an initial delete
5914 * on close, probably because in Windows there is a new handle to the
5915 * new file. If initial delete on close was requested but not
5916 * originally set, we need to set it here. This is probably not 100% correct,
5917 * but will work for the CIFSFS client which in non-posix mode
5918 * depends on these semantics. JRA.
5919 */
5920
5921 if (create_options & FILE_DELETE_ON_CLOSE) {
5922 status = can_set_delete_on_close(fsp, True, 0);
5923
5924 if (NT_STATUS_IS_OK(status)) {
5925 /* Note that here we set the *inital* delete on close flag,
5926 * not the regular one. The magic gets handled in close. */
5927 fsp->initial_delete_on_close = True;
5928 }
5929 }
5930 TALLOC_FREE(lck);
5931 return NT_STATUS_OK;
5932 }
5933
5934 TALLOC_FREE(lck);
5935
5936 if (errno == ENOTDIR || errno == EISDIR) {
5937 status = NT_STATUS_OBJECT_NAME_COLLISION;
5938 } else {
5939 status = map_nt_error_from_unix(errno);
5940 }
5941
5942 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5943 nt_errstr(status), fsp->fsp_name,newname));
5944
5945 return status;
5946 }
5947
5948 /****************************************************************************
5949 The guts of the rename command, split out so it may be called by the NT SMB
5950 code.
5951 ****************************************************************************/
5952
5953 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5954 connection_struct *conn,
5955 struct smb_request *req,
5956 const char *name_in,
5957 const char *newname_in,
5958 uint32 attrs,
5959 bool replace_if_exists,
5960 bool src_has_wild,
5961 bool dest_has_wild,
5962 uint32_t access_mask)
5963 {
5964 struct smb_filename *smb_fname = NULL;
5965 struct smb_filename *smb_fname_new = NULL;
5966 char *directory = NULL;
5967 char *mask = NULL;
5968 char *name = NULL;
5969 char *newname = NULL;
5970 char *p;
5971 int count=0;
5972 NTSTATUS status = NT_STATUS_OK;
5973 struct smb_Dir *dir_hnd = NULL;
5974 const char *dname;
5975 long offset = 0;
5976 int create_options = 0;
5977 bool posix_pathnames = lp_posix_pathnames();
5978
5979 status = unix_convert(ctx, conn, name_in, &smb_fname,
5980 src_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
5981 if (!NT_STATUS_IS_OK(status)) {
5982 goto out;
5983 }
5984
5985 status = get_full_smb_filename(ctx, smb_fname, &name);
5986 if (!NT_STATUS_IS_OK(status)) {
5987 goto out;
5988 }
5989
5990 status = unix_convert(ctx, conn, newname_in, &smb_fname_new,
5991 (UCF_SAVE_LCOMP |
5992 (dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0)));
5993 if (!NT_STATUS_IS_OK(status)) {
5994 goto out;
5995 }
5996
5997 status = get_full_smb_filename(ctx, smb_fname_new, &newname);
5998 if (!NT_STATUS_IS_OK(status)) {
5999 goto out;
6000 }
6001
6002 /*
6003 * Split the old name into directory and last component
6004 * strings. Note that unix_convert may have stripped off a
6005 * leading ./ from both name and newname if the rename is
6006 * at the root of the share. We need to make sure either both
6007 * name and newname contain a / character or neither of them do
6008 * as this is checked in resolve_wildcards().
6009 */
6010
6011 p = strrchr_m(name,'/');
6012 if (!p) {
6013 directory = talloc_strdup(ctx, ".");
6014 if (!directory) {
6015 status = NT_STATUS_NO_MEMORY;
6016 goto out;
6017 }
6018 mask = name;
6019 } else {
6020 *p = 0;
6021 directory = talloc_strdup(ctx, name);
6022 if (!directory) {
6023 status = NT_STATUS_NO_MEMORY;
6024 goto out;
6025 }
6026 mask = p+1;
6027 *p = '/'; /* Replace needed for exceptional test below. */
6028 }
6029
6030 /*
6031 * We should only check the mangled cache
6032 * here if unix_convert failed. This means
6033 * that the path in 'mask' doesn't exist
6034 * on the file system and so we need to look
6035 * for a possible mangle. This patch from
6036 * Tine Smukavec <valentin.smukavec@hermes.si>.
6037 */
6038
6039 if (!VALID_STAT(smb_fname->st) && mangle_is_mangled(mask, conn->params)) {
6040 char *new_mask = NULL;
6041 mangle_lookup_name_from_8_3(ctx,
6042 mask,
6043 &new_mask,
6044 conn->params );
6045 if (new_mask) {
6046 mask = new_mask;
6047 }
6048 }
6049
6050 if (!src_has_wild) {
6051 files_struct *fsp;
6052
6053 /*
6054 * No wildcards - just process the one file.
6055 */
6056 /* Add a terminating '/' to the directory name. */
6057 directory = talloc_asprintf_append(directory,
6058 "/%s",
6059 mask);
6060 if (!directory) {
6061 status = NT_STATUS_NO_MEMORY;
6062 goto out;
6063 }
6064
6065 /* Ensure newname contains a '/' also */
6066 if(strrchr_m(newname,'/') == 0) {
6067 newname = talloc_asprintf(ctx,
6068 "./%s",
6069 newname);
6070 if (!newname) {
6071 status = NT_STATUS_NO_MEMORY;
6072 goto out;
6073 }
6074 }
6075
6076 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6077 "case_preserve = %d, short case preserve = %d, "
6078 "directory = %s, newname = %s, "
6079 "last_component_dest = %s\n",
6080 conn->case_sensitive, conn->case_preserve,
6081 conn->short_case_preserve, directory,
6082 newname, smb_fname_new->original_lcomp));
6083
6084 /* The dest name still may have wildcards. */
6085 if (dest_has_wild) {
6086 char *mod_newname = NULL;
6087 if (!resolve_wildcards(ctx,
6088 directory,newname,&mod_newname)) {
6089 DEBUG(6, ("rename_internals: resolve_wildcards "
6090 "%s %s failed\n",
6091 directory,
6092 newname));
6093 status = NT_STATUS_NO_MEMORY;
6094 goto out;
6095 }
6096 newname = mod_newname;
6097 }
6098
6099 ZERO_STRUCT(smb_fname->st);
6100 if (posix_pathnames) {
6101 SMB_VFS_LSTAT(conn, directory, &smb_fname->st);
6102 } else {
6103 SMB_VFS_STAT(conn, directory, &smb_fname->st);
6104 }
6105
6106 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
6107 create_options |= FILE_DIRECTORY_FILE;
6108 }
6109
6110 status = SMB_VFS_CREATE_FILE(
6111 conn, /* conn */
6112 req, /* req */
6113 0, /* root_dir_fid */
6114 directory, /* fname */
6115 0, /* create_file_flags */
6116 access_mask, /* access_mask */
6117 (FILE_SHARE_READ | /* share_access */
6118 FILE_SHARE_WRITE),
6119 FILE_OPEN, /* create_disposition*/
6120 create_options, /* create_options */
6121 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6122 0, /* oplock_request */
6123 0, /* allocation_size */
6124 NULL, /* sd */
6125 NULL, /* ea_list */
6126 &fsp, /* result */
6127 NULL, /* pinfo */
6128 &smb_fname->st); /* psbuf */
6129
6130 if (!NT_STATUS_IS_OK(status)) {
6131 DEBUG(3, ("Could not open rename source %s: %s\n",
6132 directory, nt_errstr(status)));
6133 goto out;
6134 }
6135
6136 status = rename_internals_fsp(conn, fsp, newname,
6137 smb_fname_new->original_lcomp,
6138 attrs, replace_if_exists);
6139
6140 close_file(req, fsp, NORMAL_CLOSE);
6141
6142 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6143 nt_errstr(status), directory,newname));
6144
6145 goto out;
6146 }
6147
6148 /*
6149 * Wildcards - process each file that matches.
6150 */
6151 if (strequal(mask,"????????.???")) {
6152 mask[0] = '*';
6153 mask[1] = '\0';
6154 }
6155
6156 status = check_name(conn, directory);
6157 if (!NT_STATUS_IS_OK(status)) {
6158 goto out;
6159 }
6160
6161 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
6162 if (dir_hnd == NULL) {
6163 status = map_nt_error_from_unix(errno);
6164 goto out;
6165 }
6166
6167 status = NT_STATUS_NO_SUCH_FILE;
6168 /*
6169 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6170 * - gentest fix. JRA
6171 */
6172
6173 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname->st))) {
6174 files_struct *fsp = NULL;
6175 char *fname = NULL;
6176 char *destname = NULL;
6177 bool sysdir_entry = False;
6178
6179 /* Quick check for "." and ".." */
6180 if (ISDOT(dname) || ISDOTDOT(dname)) {
6181 if (attrs & aDIR) {
6182 sysdir_entry = True;
6183 } else {
6184 continue;
6185 }
6186 }
6187
6188 if (!is_visible_file(conn, directory, dname, &smb_fname->st,
6189 False)) {
6190 continue;
6191 }
6192
6193 if(!mask_match(dname, mask, conn->case_sensitive)) {
6194 continue;
6195 }
6196
6197 if (sysdir_entry) {
6198 status = NT_STATUS_OBJECT_NAME_INVALID;
6199 break;
6200 }
6201
6202 fname = talloc_asprintf(ctx,
6203 "%s/%s",
6204 directory,
6205 dname);
6206 if (!fname) {
6207 status = NT_STATUS_NO_MEMORY;
6208 goto out;
6209 }
6210
6211 if (!resolve_wildcards(ctx,
6212 fname,newname,&destname)) {
6213 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6214 fname, destname));
6215 TALLOC_FREE(fname);
6216 continue;
6217 }
6218 if (!destname) {
6219 status = NT_STATUS_NO_MEMORY;
6220 goto out;
6221 }
6222
6223 ZERO_STRUCT(smb_fname->st);
6224 if (posix_pathnames) {
6225 SMB_VFS_LSTAT(conn, fname, &smb_fname->st);
6226 } else {
6227 SMB_VFS_STAT(conn, fname, &smb_fname->st);
6228 }
6229
6230 create_options = 0;
6231
6232 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
6233 create_options |= FILE_DIRECTORY_FILE;
6234 }
6235
6236 status = SMB_VFS_CREATE_FILE(
6237 conn, /* conn */
6238 req, /* req */
6239 0, /* root_dir_fid */
6240 fname, /* fname */
6241 0, /* create_file_flags */
6242 access_mask, /* access_mask */
6243 (FILE_SHARE_READ | /* share_access */
6244 FILE_SHARE_WRITE),
6245 FILE_OPEN, /* create_disposition*/
6246 create_options, /* create_options */
6247 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6248 0, /* oplock_request */
6249 0, /* allocation_size */
6250 NULL, /* sd */
6251 NULL, /* ea_list */
6252 &fsp, /* result */
6253 NULL, /* pinfo */
6254 &smb_fname->st); /* psbuf */
6255
6256 if (!NT_STATUS_IS_OK(status)) {
6257 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6258 "returned %s rename %s -> %s\n",
6259 nt_errstr(status), directory, newname));
6260 break;
6261 }
6262
6263 status = rename_internals_fsp(conn, fsp, destname, dname,
6264 attrs, replace_if_exists);
6265
6266 close_file(req, fsp, NORMAL_CLOSE);
6267
6268 if (!NT_STATUS_IS_OK(status)) {
6269 DEBUG(3, ("rename_internals_fsp returned %s for "
6270 "rename %s -> %s\n", nt_errstr(status),
6271 directory, newname));
6272 break;
6273 }
6274
6275 count++;
6276
6277 DEBUG(3,("rename_internals: doing rename on %s -> "
6278 "%s\n",fname,destname));
6279
6280 TALLOC_FREE(fname);
6281 TALLOC_FREE(destname);
6282 }
6283 TALLOC_FREE(dir_hnd);
6284
6285 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6286 status = map_nt_error_from_unix(errno);
6287 }
6288
6289 out:
6290 TALLOC_FREE(smb_fname);
6291 TALLOC_FREE(smb_fname_new);
6292 return status;
6293 }
6294
6295 /****************************************************************************
6296 Reply to a mv.
6297 ****************************************************************************/
6298
6299 void reply_mv(struct smb_request *req)
6300 {
6301 connection_struct *conn = req->conn;
6302 char *name = NULL;
6303 char *newname = NULL;
6304 const char *p;
6305 uint32 attrs;
6306 NTSTATUS status;
6307 bool src_has_wcard = False;
6308 bool dest_has_wcard = False;
6309 TALLOC_CTX *ctx = talloc_tos();
6310
6311 START_PROFILE(SMBmv);
6312
6313 if (req->wct < 1) {
6314 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6315 END_PROFILE(SMBmv);
6316 return;
6317 }
6318
6319 attrs = SVAL(req->vwv+0, 0);
6320
6321 p = (const char *)req->buf + 1;
6322 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6323 &status, &src_has_wcard);
6324 if (!NT_STATUS_IS_OK(status)) {
6325 reply_nterror(req, status);
6326 END_PROFILE(SMBmv);
6327 return;
6328 }
6329 p++;
6330 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6331 &status, &dest_has_wcard);
6332 if (!NT_STATUS_IS_OK(status)) {
6333 reply_nterror(req, status);
6334 END_PROFILE(SMBmv);
6335 return;
6336 }
6337
6338 status = resolve_dfspath_wcard(ctx, conn,
6339 req->flags2 & FLAGS2_DFS_PATHNAMES,
6340 name,
6341 &name,
6342 &src_has_wcard);
6343 if (!NT_STATUS_IS_OK(status)) {
6344 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6345 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6346 ERRSRV, ERRbadpath);
6347 END_PROFILE(SMBmv);
6348 return;
6349 }
6350 reply_nterror(req, status);
6351 END_PROFILE(SMBmv);
6352 return;
6353 }
6354
6355 status = resolve_dfspath_wcard(ctx, conn,
6356 req->flags2 & FLAGS2_DFS_PATHNAMES,
6357 newname,
6358 &newname,
6359 &dest_has_wcard);
6360 if (!NT_STATUS_IS_OK(status)) {
6361 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6362 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6363 ERRSRV, ERRbadpath);
6364 END_PROFILE(SMBmv);
6365 return;
6366 }
6367 reply_nterror(req, status);
6368 END_PROFILE(SMBmv);
6369 return;
6370 }
6371
6372 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6373
6374 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6375 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6376 if (!NT_STATUS_IS_OK(status)) {
6377 if (open_was_deferred(req->mid)) {
6378 /* We have re-scheduled this call. */
6379 END_PROFILE(SMBmv);
6380 return;
6381 }
6382 reply_nterror(req, status);
6383 END_PROFILE(SMBmv);
6384 return;
6385 }
6386
6387 reply_outbuf(req, 0, 0);
6388
6389 END_PROFILE(SMBmv);
6390 return;
6391 }
6392
6393 /*******************************************************************
6394 Copy a file as part of a reply_copy.
6395 ******************************************************************/
6396
6397 /*
6398 * TODO: check error codes on all callers
6399 */
6400
6401 NTSTATUS copy_file(TALLOC_CTX *ctx,
6402 connection_struct *conn,
6403 const char *src,
6404 const char *dest1,
6405 int ofun,
6406 int count,
6407 bool target_is_directory)
6408 {
6409 SMB_STRUCT_STAT src_sbuf, sbuf2;
6410 SMB_OFF_T ret=-1;
6411 files_struct *fsp1,*fsp2;
6412 char *dest = NULL;
6413 uint32 dosattrs;
6414 uint32 new_create_disposition;
6415 NTSTATUS status;
6416
6417 dest = talloc_strdup(ctx, dest1);
6418 if (!dest) {
6419 return NT_STATUS_NO_MEMORY;
6420 }
6421 if (target_is_directory) {
6422 const char *p = strrchr_m(src,'/');
6423 if (p) {
6424 p++;
6425 } else {
6426 p = src;
6427 }
6428 dest = talloc_asprintf_append(dest,
6429 "/%s",
6430 p);
6431 if (!dest) {
6432 return NT_STATUS_NO_MEMORY;
6433 }
6434 }
6435
6436 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6437 TALLOC_FREE(dest);
6438 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6439 }
6440
6441 if (!target_is_directory && count) {
6442 new_create_disposition = FILE_OPEN;
6443 } else {
6444 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6445 NULL, NULL, &new_create_disposition, NULL)) {
6446 TALLOC_FREE(dest);
6447 return NT_STATUS_INVALID_PARAMETER;
6448 }
6449 }
6450
6451 status = SMB_VFS_CREATE_FILE(
6452 conn, /* conn */
6453 NULL, /* req */
6454 0, /* root_dir_fid */
6455 src, /* fname */
6456 0, /* create_file_flags */
6457 FILE_GENERIC_READ, /* access_mask */
6458 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6459 FILE_OPEN, /* create_disposition*/
6460 0, /* create_options */
6461 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6462 INTERNAL_OPEN_ONLY, /* oplock_request */
6463 0, /* allocation_size */
6464 NULL, /* sd */
6465 NULL, /* ea_list */
6466 &fsp1, /* result */
6467 NULL, /* pinfo */
6468 &src_sbuf); /* psbuf */
6469
6470 if (!NT_STATUS_IS_OK(status)) {
6471 TALLOC_FREE(dest);
6472 return status;
6473 }
6474
6475 dosattrs = dos_mode(conn, src, &src_sbuf);
6476 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6477 ZERO_STRUCTP(&sbuf2);
6478 }
6479
6480 status = SMB_VFS_CREATE_FILE(
6481 conn, /* conn */
6482 NULL, /* req */
6483 0, /* root_dir_fid */
6484 dest, /* fname */
6485 0, /* create_file_flags */
6486 FILE_GENERIC_WRITE, /* access_mask */
6487 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6488 new_create_disposition, /* create_disposition*/
6489 0, /* create_options */
6490 dosattrs, /* file_attributes */
6491 INTERNAL_OPEN_ONLY, /* oplock_request */
6492 0, /* allocation_size */
6493 NULL, /* sd */
6494 NULL, /* ea_list */
6495 &fsp2, /* result */
6496 NULL, /* pinfo */
6497 &sbuf2); /* psbuf */
6498
6499 TALLOC_FREE(dest);
6500
6501 if (!NT_STATUS_IS_OK(status)) {
6502 close_file(NULL, fsp1, ERROR_CLOSE);
6503 return status;
6504 }
6505
6506 if ((ofun&3) == 1) {
6507 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6508 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6509 /*
6510 * Stop the copy from occurring.
6511 */
6512 ret = -1;
6513 src_sbuf.st_ex_size = 0;
6514 }
6515 }
6516
6517 if (src_sbuf.st_ex_size) {
6518 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_ex_size);
6519 }
6520
6521 close_file(NULL, fsp1, NORMAL_CLOSE);
6522
6523 /* Ensure the modtime is set correctly on the destination file. */
6524 set_close_write_time(fsp2, src_sbuf.st_ex_mtime);
6525
6526 /*
6527 * As we are opening fsp1 read-only we only expect
6528 * an error on close on fsp2 if we are out of space.
6529 * Thus we don't look at the error return from the
6530 * close of fsp1.
6531 */
6532 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6533
6534 if (!NT_STATUS_IS_OK(status)) {
6535 return status;
6536 }
6537
6538 if (ret != (SMB_OFF_T)src_sbuf.st_ex_size) {
6539 return NT_STATUS_DISK_FULL;
6540 }
6541
6542 return NT_STATUS_OK;
6543 }
6544
6545 /****************************************************************************
6546 Reply to a file copy.
6547 ****************************************************************************/
6548
6549 void reply_copy(struct smb_request *req)
6550 {
6551 connection_struct *conn = req->conn;
6552 struct smb_filename *smb_fname = NULL;
6553 struct smb_filename *smb_fname_new = NULL;
6554 char *name = NULL;
6555 char *newname = NULL;
6556 char *directory = NULL;
6557 const char *mask = NULL;
6558 const char mask_star[] = "*";
6559 const char *p;
6560 int count=0;
6561 int error = ERRnoaccess;
6562 int err = 0;
6563 int tid2;
6564 int ofun;
6565 int flags;
6566 bool target_is_directory=False;
6567 bool source_has_wild = False;
6568 bool dest_has_wild = False;
6569 NTSTATUS status;
6570 TALLOC_CTX *ctx = talloc_tos();
6571
6572 START_PROFILE(SMBcopy);
6573
6574 if (req->wct < 3) {
6575 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6576 goto out;
6577 }
6578
6579 tid2 = SVAL(req->vwv+0, 0);
6580 ofun = SVAL(req->vwv+1, 0);
6581 flags = SVAL(req->vwv+2, 0);
6582
6583 p = (const char *)req->buf;
6584 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6585 &status, &source_has_wild);
6586 if (!NT_STATUS_IS_OK(status)) {
6587 reply_nterror(req, status);
6588 goto out;
6589 }
6590 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6591 &status, &dest_has_wild);
6592 if (!NT_STATUS_IS_OK(status)) {
6593 reply_nterror(req, status);
6594 goto out;
6595 }
6596
6597 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6598
6599 if (tid2 != conn->cnum) {
6600 /* can't currently handle inter share copies XXXX */
6601 DEBUG(3,("Rejecting inter-share copy\n"));
6602 reply_doserror(req, ERRSRV, ERRinvdevice);
6603 goto out;
6604 }
6605
6606 status = resolve_dfspath_wcard(ctx, conn,
6607 req->flags2 & FLAGS2_DFS_PATHNAMES,
6608 name,
6609 &name,
6610 &source_has_wild);
6611 if (!NT_STATUS_IS_OK(status)) {
6612 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6613 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6614 ERRSRV, ERRbadpath);
6615 goto out;
6616 }
6617 reply_nterror(req, status);
6618 goto out;
6619 }
6620
6621 status = resolve_dfspath_wcard(ctx, conn,
6622 req->flags2 & FLAGS2_DFS_PATHNAMES,
6623 newname,
6624 &newname,
6625 &dest_has_wild);
6626 if (!NT_STATUS_IS_OK(status)) {
6627 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6628 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6629 ERRSRV, ERRbadpath);
6630 goto out;
6631 }
6632 reply_nterror(req, status);
6633 goto out;
6634 }
6635
6636 status = unix_convert(ctx, conn, name, &smb_fname,
6637 source_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
6638 if (!NT_STATUS_IS_OK(status)) {
6639 reply_nterror(req, status);
6640 goto out;
6641 }
6642
6643 status = get_full_smb_filename(ctx, smb_fname, &name);
6644 if (!NT_STATUS_IS_OK(status)) {
6645 reply_nterror(req, status);
6646 goto out;
6647 }
6648
6649 status = unix_convert(ctx, conn, newname, &smb_fname_new,
6650 dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
6651 if (!NT_STATUS_IS_OK(status)) {
6652 reply_nterror(req, status);
6653 goto out;
6654 }
6655
6656 status = get_full_smb_filename(ctx, smb_fname_new, &newname);
6657 if (!NT_STATUS_IS_OK(status)) {
6658 reply_nterror(req, status);
6659 goto out;
6660 }
6661
6662 target_is_directory = VALID_STAT_OF_DIR(smb_fname_new->st);
6663
6664 if ((flags&1) && target_is_directory) {
6665 reply_doserror(req, ERRDOS, ERRbadfile);
6666 goto out;
6667 }
6668
6669 if ((flags&2) && !target_is_directory) {
6670 reply_doserror(req, ERRDOS, ERRbadpath);
6671 goto out;
6672 }
6673
6674 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname->st)) {
6675 /* wants a tree copy! XXXX */
6676 DEBUG(3,("Rejecting tree copy\n"));
6677 reply_doserror(req, ERRSRV, ERRerror);
6678 goto out;
6679 }
6680
6681 p = strrchr_m(name,'/');
6682 if (p != NULL) {
6683 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6684 mask = p+1;
6685 } else {
6686 directory = talloc_strdup(ctx, "./");
6687 mask = name;
6688 }
6689
6690 if (!directory) {
6691 reply_nterror(req, NT_STATUS_NO_MEMORY);
6692 goto out;
6693 }
6694
6695 /*
6696 * We should only check the mangled cache
6697 * here if unix_convert failed. This means
6698 * that the path in 'mask' doesn't exist
6699 * on the file system and so we need to look
6700 * for a possible mangle. This patch from
6701 * Tine Smukavec <valentin.smukavec@hermes.si>.
6702 */
6703
6704 if (!VALID_STAT(smb_fname->st) &&
6705 mangle_is_mangled(mask, conn->params)) {
6706 char *new_mask = NULL;
6707 mangle_lookup_name_from_8_3(ctx,
6708 mask,
6709 &new_mask,
6710 conn->params );
6711 if (new_mask) {
6712 mask = new_mask;
6713 }
6714 }
6715
6716 if (!source_has_wild) {
6717 directory = talloc_asprintf_append(directory,
6718 "/%s",
6719 mask);
6720 if (dest_has_wild) {
6721 char *mod_newname = NULL;
6722 if (!resolve_wildcards(ctx,
6723 directory,newname,&mod_newname)) {
6724 reply_nterror(req, NT_STATUS_NO_MEMORY);
6725 goto out;
6726 }
6727 newname = mod_newname;
6728 }
6729
6730 status = check_name(conn, directory);
6731 if (!NT_STATUS_IS_OK(status)) {
6732 reply_nterror(req, status);
6733 goto out;
6734 }
6735
6736 status = check_name(conn, newname);
6737 if (!NT_STATUS_IS_OK(status)) {
6738 reply_nterror(req, status);
6739 goto out;
6740 }
6741
6742 status = copy_file(ctx,conn,directory,newname,ofun,
6743 count,target_is_directory);
6744
6745 if(!NT_STATUS_IS_OK(status)) {
6746 reply_nterror(req, status);
6747 goto out;
6748 } else {
6749 count++;
6750 }
6751 } else {
6752 struct smb_Dir *dir_hnd = NULL;
6753 const char *dname = NULL;
6754 long offset = 0;
6755
6756 if (strequal(mask,"????????.???")) {
6757 mask = mask_star;
6758 }
6759
6760 status = check_name(conn, directory);
6761 if (!NT_STATUS_IS_OK(status)) {
6762 reply_nterror(req, status);
6763 goto out;
6764 }
6765
6766 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6767 if (dir_hnd == NULL) {
6768 status = map_nt_error_from_unix(errno);
6769 reply_nterror(req, status);
6770 goto out;
6771 }
6772
6773 error = ERRbadfile;
6774
6775 while ((dname = ReadDirName(dir_hnd, &offset,
6776 &smb_fname->st))) {
6777 char *destname = NULL;
6778 char *fname = NULL;
6779
6780 if (ISDOT(dname) || ISDOTDOT(dname)) {
6781 continue;
6782 }
6783
6784 if (!is_visible_file(conn, directory, dname,
6785 &smb_fname->st, False)) {
6786 continue;
6787 }
6788
6789 if(!mask_match(dname, mask, conn->case_sensitive)) {
6790 continue;
6791 }
6792
6793 error = ERRnoaccess;
6794 fname = talloc_asprintf(ctx,
6795 "%s/%s",
6796 directory,
6797 dname);
6798 if (!fname) {
6799 TALLOC_FREE(dir_hnd);
6800 reply_nterror(req, NT_STATUS_NO_MEMORY);
6801 goto out;
6802 }
6803
6804 if (!resolve_wildcards(ctx,
6805 fname,newname,&destname)) {
6806 continue;
6807 }
6808 if (!destname) {
6809 TALLOC_FREE(dir_hnd);
6810 reply_nterror(req, NT_STATUS_NO_MEMORY);
6811 goto out;
6812 }
6813
6814 status = check_name(conn, fname);
6815 if (!NT_STATUS_IS_OK(status)) {
6816 TALLOC_FREE(dir_hnd);
6817 reply_nterror(req, status);
6818 goto out;
6819 }
6820
6821 status = check_name(conn, destname);
6822 if (!NT_STATUS_IS_OK(status)) {
6823 TALLOC_FREE(dir_hnd);
6824 reply_nterror(req, status);
6825 goto out;
6826 }
6827
6828 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6829
6830 status = copy_file(ctx,conn,fname,destname,ofun,
6831 count,target_is_directory);
6832 if (NT_STATUS_IS_OK(status)) {
6833 count++;
6834 }
6835 TALLOC_FREE(fname);
6836 TALLOC_FREE(destname);
6837 }
6838 TALLOC_FREE(dir_hnd);
6839 }
6840
6841 if (count == 0) {
6842 if(err) {
6843 /* Error on close... */
6844 errno = err;
6845 reply_unixerror(req, ERRHRD, ERRgeneral);
6846 goto out;
6847 }
6848
6849 reply_doserror(req, ERRDOS, error);
6850 goto out;
6851 }
6852
6853 reply_outbuf(req, 1, 0);
6854 SSVAL(req->outbuf,smb_vwv0,count);
6855 out:
6856 TALLOC_FREE(smb_fname);
6857 TALLOC_FREE(smb_fname_new);
6858 END_PROFILE(SMBcopy);
6859 return;
6860 }
6861
6862 #undef DBGC_CLASS
6863 #define DBGC_CLASS DBGC_LOCKING
6864
6865 /****************************************************************************
6866 Get a lock pid, dealing with large count requests.
6867 ****************************************************************************/
6868
6869 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6870 bool large_file_format)
6871 {
6872 if(!large_file_format)
6873 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6874 else
6875 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6876 }
6877
6878 /****************************************************************************
6879 Get a lock count, dealing with large count requests.
6880 ****************************************************************************/
6881
6882 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6883 bool large_file_format)
6884 {
6885 uint64_t count = 0;
6886
6887 if(!large_file_format) {
6888 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6889 } else {
6890
6891 #if defined(HAVE_LONGLONG)
6892 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6893 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6894 #else /* HAVE_LONGLONG */
6895
6896 /*
6897 * NT4.x seems to be broken in that it sends large file (64 bit)
6898 * lockingX calls even if the CAP_LARGE_FILES was *not*
6899 * negotiated. For boxes without large unsigned ints truncate the
6900 * lock count by dropping the top 32 bits.
6901 */
6902
6903 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6904 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6905 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6906 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6907 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6908 }
6909
6910 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6911 #endif /* HAVE_LONGLONG */
6912 }
6913
6914 return count;
6915 }
6916
6917 #if !defined(HAVE_LONGLONG)
6918 /****************************************************************************
6919 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6920 ****************************************************************************/
6921
6922 static uint32 map_lock_offset(uint32 high, uint32 low)
6923 {
6924 unsigned int i;
6925 uint32 mask = 0;
6926 uint32 highcopy = high;
6927
6928 /*
6929 * Try and find out how many significant bits there are in high.
6930 */
6931
6932 for(i = 0; highcopy; i++)
6933 highcopy >>= 1;
6934
6935 /*
6936 * We use 31 bits not 32 here as POSIX
6937 * lock offsets may not be negative.
6938 */
6939
6940 mask = (~0) << (31 - i);
6941
6942 if(low & mask)
6943 return 0; /* Fail. */
6944
6945 high <<= (31 - i);
6946
6947 return (high|low);
6948 }
6949 #endif /* !defined(HAVE_LONGLONG) */
6950
6951 /****************************************************************************
6952 Get a lock offset, dealing with large offset requests.
6953 ****************************************************************************/
6954
6955 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6956 bool large_file_format, bool *err)
6957 {
6958 uint64_t offset = 0;
6959
6960 *err = False;
6961
6962 if(!large_file_format) {
6963 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6964 } else {
6965
6966 #if defined(HAVE_LONGLONG)
6967 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6968 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6969 #else /* HAVE_LONGLONG */
6970
6971 /*
6972 * NT4.x seems to be broken in that it sends large file (64 bit)
6973 * lockingX calls even if the CAP_LARGE_FILES was *not*
6974 * negotiated. For boxes without large unsigned ints mangle the
6975 * lock offset by mapping the top 32 bits onto the lower 32.
6976 */
6977
6978 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6979 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6980 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6981 uint32 new_low = 0;
6982
6983 if((new_low = map_lock_offset(high, low)) == 0) {
6984 *err = True;
6985 return (uint64_t)-1;
6986 }
6987
6988 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6989 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6990 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6991 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6992 }
6993
6994 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6995 #endif /* HAVE_LONGLONG */
6996 }
6997
6998 return offset;
6999 }
7000
7001 /****************************************************************************
7002 Reply to a lockingX request.
7003 ****************************************************************************/
7004
7005 void reply_lockingX(struct smb_request *req)
7006 {
7007 connection_struct *conn = req->conn;
7008 files_struct *fsp;
7009 unsigned char locktype;
7010 unsigned char oplocklevel;
7011 uint16 num_ulocks;
7012 uint16 num_locks;
7013 uint64_t count = 0, offset = 0;
7014 uint32 lock_pid;
7015 int32 lock_timeout;
7016 int i;
7017 const uint8_t *data;
7018 bool large_file_format;
7019 bool err;
7020 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7021
7022 START_PROFILE(SMBlockingX);
7023
7024 if (req->wct < 8) {
7025 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7026 END_PROFILE(SMBlockingX);
7027 return;
7028 }
7029
7030 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7031 locktype = CVAL(req->vwv+3, 0);
7032 oplocklevel = CVAL(req->vwv+3, 1);
7033 num_ulocks = SVAL(req->vwv+6, 0);
7034 num_locks = SVAL(req->vwv+7, 0);
7035 lock_timeout = IVAL(req->vwv+4, 0);
7036 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7037
7038 if (!check_fsp(conn, req, fsp)) {
7039 END_PROFILE(SMBlockingX);
7040 return;
7041 }
7042
7043 data = req->buf;
7044
7045 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7046 /* we don't support these - and CANCEL_LOCK makes w2k
7047 and XP reboot so I don't really want to be
7048 compatible! (tridge) */
7049 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
7050 END_PROFILE(SMBlockingX);
7051 return;
7052 }
7053
7054 /* Check if this is an oplock break on a file
7055 we have granted an oplock on.
7056 */
7057 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7058 /* Client can insist on breaking to none. */
7059 bool break_to_none = (oplocklevel == 0);
7060 bool result;
7061
7062 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7063 "for fnum = %d\n", (unsigned int)oplocklevel,
7064 fsp->fnum ));
7065
7066 /*
7067 * Make sure we have granted an exclusive or batch oplock on
7068 * this file.
7069 */
7070
7071 if (fsp->oplock_type == 0) {
7072
7073 /* The Samba4 nbench simulator doesn't understand
7074 the difference between break to level2 and break
7075 to none from level2 - it sends oplock break
7076 replies in both cases. Don't keep logging an error
7077 message here - just ignore it. JRA. */
7078
7079 DEBUG(5,("reply_lockingX: Error : oplock break from "
7080 "client for fnum = %d (oplock=%d) and no "
7081 "oplock granted on this file (%s).\n",
7082 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
7083
7084 /* if this is a pure oplock break request then don't
7085 * send a reply */
7086 if (num_locks == 0 && num_ulocks == 0) {
7087 END_PROFILE(SMBlockingX);
7088 return;
7089 } else {
7090 END_PROFILE(SMBlockingX);
7091 reply_doserror(req, ERRDOS, ERRlock);
7092 return;
7093 }
7094 }
7095
7096 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7097 (break_to_none)) {
7098 result = remove_oplock(fsp);
7099 } else {
7100 result = downgrade_oplock(fsp);
7101 }
7102
7103 if (!result) {
7104 DEBUG(0, ("reply_lockingX: error in removing "
7105 "oplock on file %s\n", fsp->fsp_name));
7106 /* Hmmm. Is this panic justified? */
7107 smb_panic("internal tdb error");
7108 }
7109
7110 reply_to_oplock_break_requests(fsp);
7111
7112 /* if this is a pure oplock break request then don't send a
7113 * reply */
7114 if (num_locks == 0 && num_ulocks == 0) {
7115 /* Sanity check - ensure a pure oplock break is not a
7116 chained request. */
7117 if(CVAL(req->vwv+0, 0) != 0xff)
7118 DEBUG(0,("reply_lockingX: Error : pure oplock "
7119 "break is a chained %d request !\n",
7120 (unsigned int)CVAL(req->vwv+0, 0)));
7121 END_PROFILE(SMBlockingX);
7122 return;
7123 }
7124 }
7125
7126 if (req->buflen <
7127 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7128 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7129 END_PROFILE(SMBlockingX);
7130 return;
7131 }
7132
7133 /* Data now points at the beginning of the list
7134 of smb_unlkrng structs */
7135 for(i = 0; i < (int)num_ulocks; i++) {
7136 lock_pid = get_lock_pid( data, i, large_file_format);
7137 count = get_lock_count( data, i, large_file_format);
7138 offset = get_lock_offset( data, i, large_file_format, &err);
7139
7140 /*
7141 * There is no error code marked "stupid client bug".... :-).
7142 */
7143 if(err) {
7144 END_PROFILE(SMBlockingX);
7145 reply_doserror(req, ERRDOS, ERRnoaccess);
7146 return;
7147 }
7148
7149 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
7150 "pid %u, file %s\n", (double)offset, (double)count,
7151 (unsigned int)lock_pid, fsp->fsp_name ));
7152
7153 status = do_unlock(smbd_messaging_context(),
7154 fsp,
7155 lock_pid,
7156 count,
7157 offset,
7158 WINDOWS_LOCK);
7159
7160 DEBUG(10, ("reply_lockingX: unlock returned %s\n",
7161 nt_errstr(status)));
7162
7163 if (NT_STATUS_V(status)) {
7164 END_PROFILE(SMBlockingX);
7165 reply_nterror(req, status);
7166 return;
7167 }
7168 }
7169
7170 /* Setup the timeout in seconds. */
7171
7172 if (!lp_blocking_locks(SNUM(conn))) {
7173 lock_timeout = 0;
7174 }
7175
7176 /* Now do any requested locks */
7177 data += ((large_file_format ? 20 : 10)*num_ulocks);
7178
7179 /* Data now points at the beginning of the list
7180 of smb_lkrng structs */
7181
7182 for(i = 0; i < (int)num_locks; i++) {
7183 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
7184 READ_LOCK:WRITE_LOCK);
7185 lock_pid = get_lock_pid( data, i, large_file_format);
7186 count = get_lock_count( data, i, large_file_format);
7187 offset = get_lock_offset( data, i, large_file_format, &err);
7188
7189 /*
7190 * There is no error code marked "stupid client bug".... :-).
7191 */
7192 if(err) {
7193 END_PROFILE(SMBlockingX);
7194 reply_doserror(req, ERRDOS, ERRnoaccess);
7195 return;
7196 }
7197
7198 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
7199 "%u, file %s timeout = %d\n", (double)offset,
7200 (double)count, (unsigned int)lock_pid,
7201 fsp->fsp_name, (int)lock_timeout ));
7202
7203 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7204 struct blocking_lock_record *blr = NULL;
7205
7206 if (lp_blocking_locks(SNUM(conn))) {
7207
7208 /* Schedule a message to ourselves to
7209 remove the blocking lock record and
7210 return the right error. */
7211
7212 blr = blocking_lock_cancel(fsp,
7213 lock_pid,
7214 offset,
7215 count,
7216 WINDOWS_LOCK,
7217 locktype,
7218 NT_STATUS_FILE_LOCK_CONFLICT);
7219 if (blr == NULL) {
7220 END_PROFILE(SMBlockingX);
7221 reply_nterror(
7222 req,
7223 NT_STATUS_DOS(
7224 ERRDOS,
7225 ERRcancelviolation));
7226 return;
7227 }
7228 }
7229 /* Remove a matching pending lock. */
7230 status = do_lock_cancel(fsp,
7231 lock_pid,
7232 count,
7233 offset,
7234 WINDOWS_LOCK,
7235 blr);
7236 } else {
7237 bool blocking_lock = lock_timeout ? True : False;
7238 bool defer_lock = False;
7239 struct byte_range_lock *br_lck;
7240 uint32 block_smbpid;
7241
7242 br_lck = do_lock(smbd_messaging_context(),
7243 fsp,
7244 lock_pid,
7245 count,
7246 offset,
7247 lock_type,
7248 WINDOWS_LOCK,
7249 blocking_lock,
7250 &status,
7251 &block_smbpid,
7252 NULL);
7253
7254 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7255 /* Windows internal resolution for blocking locks seems
7256 to be about 200ms... Don't wait for less than that. JRA. */
7257 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7258 lock_timeout = lp_lock_spin_time();
7259 }
7260 defer_lock = True;
7261 }
7262
7263 /* This heuristic seems to match W2K3 very well. If a
7264 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7265 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7266 far as I can tell. Replacement for do_lock_spin(). JRA. */
7267
7268 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7269 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7270 defer_lock = True;
7271 lock_timeout = lp_lock_spin_time();
7272 }
7273
7274 if (br_lck && defer_lock) {
7275 /*
7276 * A blocking lock was requested. Package up
7277 * this smb into a queued request and push it
7278 * onto the blocking lock queue.
7279 */
7280 if(push_blocking_lock_request(br_lck,
7281 req,
7282 fsp,
7283 lock_timeout,
7284 i,
7285 lock_pid,
7286 lock_type,
7287 WINDOWS_LOCK,
7288 offset,
7289 count,
7290 block_smbpid)) {
7291 TALLOC_FREE(br_lck);
7292 END_PROFILE(SMBlockingX);
7293 return;
7294 }
7295 }
7296
7297 TALLOC_FREE(br_lck);
7298 }
7299
7300 if (NT_STATUS_V(status)) {
7301 END_PROFILE(SMBlockingX);
7302 reply_nterror(req, status);
7303 return;
7304 }
7305 }
7306
7307 /* If any of the above locks failed, then we must unlock
7308 all of the previous locks (X/Open spec). */
7309
7310 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7311 (i != num_locks) &&
7312 (num_locks != 0)) {
7313 /*
7314 * Ensure we don't do a remove on the lock that just failed,
7315 * as under POSIX rules, if we have a lock already there, we
7316 * will delete it (and we shouldn't) .....
7317 */
7318 for(i--; i >= 0; i--) {
7319 lock_pid = get_lock_pid( data, i, large_file_format);
7320 count = get_lock_count( data, i, large_file_format);
7321 offset = get_lock_offset( data, i, large_file_format,
7322 &err);
7323
7324 /*
7325 * There is no error code marked "stupid client
7326 * bug".... :-).
7327 */
7328 if(err) {
7329 END_PROFILE(SMBlockingX);
7330 reply_doserror(req, ERRDOS, ERRnoaccess);
7331 return;
7332 }
7333
7334 do_unlock(smbd_messaging_context(),
7335 fsp,
7336 lock_pid,
7337 count,
7338 offset,
7339 WINDOWS_LOCK);
7340 }
7341 END_PROFILE(SMBlockingX);
7342 reply_nterror(req, status);
7343 return;
7344 }
7345
7346 reply_outbuf(req, 2, 0);
7347
7348 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7349 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7350
7351 END_PROFILE(SMBlockingX);
7352 chain_reply(req);
7353 }
7354
7355 #undef DBGC_CLASS
7356 #define DBGC_CLASS DBGC_ALL
7357
7358 /****************************************************************************
7359 Reply to a SMBreadbmpx (read block multiplex) request.
7360 Always reply with an error, if someone has a platform really needs this,
7361 please contact vl@samba.org
7362 ****************************************************************************/
7363
7364 void reply_readbmpx(struct smb_request *req)
7365 {
7366 START_PROFILE(SMBreadBmpx);
7367 reply_doserror(req, ERRSRV, ERRuseSTD);
7368 END_PROFILE(SMBreadBmpx);
7369 return;
7370 }
7371
7372 /****************************************************************************
7373 Reply to a SMBreadbs (read block multiplex secondary) request.
7374 Always reply with an error, if someone has a platform really needs this,
7375 please contact vl@samba.org
7376 ****************************************************************************/
7377
7378 void reply_readbs(struct smb_request *req)
7379 {
7380 START_PROFILE(SMBreadBs);
7381 reply_doserror(req, ERRSRV, ERRuseSTD);
7382 END_PROFILE(SMBreadBs);
7383 return;
7384 }
7385
7386 /****************************************************************************
7387 Reply to a SMBsetattrE.
7388 ****************************************************************************/
7389
7390 void reply_setattrE(struct smb_request *req)
7391 {
7392 connection_struct *conn = req->conn;
7393 struct smb_file_time ft;
7394 files_struct *fsp;
7395 SMB_STRUCT_STAT sbuf;
7396 NTSTATUS status;
7397
7398 START_PROFILE(SMBsetattrE);
7399 ZERO_STRUCT(ft);
7400
7401 if (req->wct < 7) {
7402 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7403 END_PROFILE(SMBsetattrE);
7404 return;
7405 }
7406
7407 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7408
7409 if(!fsp || (fsp->conn != conn)) {
7410 reply_doserror(req, ERRDOS, ERRbadfid);
7411 END_PROFILE(SMBsetattrE);
7412 return;
7413 }
7414
7415
7416 /*
7417 * Convert the DOS times into unix times.
7418 */
7419
7420 ft.atime = convert_time_t_to_timespec(
7421 srv_make_unix_date2(req->vwv+3));
7422 ft.mtime = convert_time_t_to_timespec(
7423 srv_make_unix_date2(req->vwv+5));
7424 ft.create_time = convert_time_t_to_timespec(
7425 srv_make_unix_date2(req->vwv+1));
7426
7427 reply_outbuf(req, 0, 0);
7428
7429 /*
7430 * Patch from Ray Frush <frush@engr.colostate.edu>
7431 * Sometimes times are sent as zero - ignore them.
7432 */
7433
7434 /* Ensure we have a valid stat struct for the source. */
7435 if (fsp->fh->fd != -1) {
7436 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7437 status = map_nt_error_from_unix(errno);
7438 reply_nterror(req, status);
7439 END_PROFILE(SMBsetattrE);
7440 return;
7441 }
7442 } else {
7443 int ret = -1;
7444
7445 if (fsp->posix_open) {
7446 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7447 } else {
7448 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7449 }
7450 if (ret == -1) {
7451 status = map_nt_error_from_unix(errno);
7452 reply_nterror(req, status);
7453 END_PROFILE(SMBsetattrE);
7454 return;
7455 }
7456 }
7457
7458 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7459 &sbuf, &ft, true);
7460 if (!NT_STATUS_IS_OK(status)) {
7461 reply_doserror(req, ERRDOS, ERRnoaccess);
7462 END_PROFILE(SMBsetattrE);
7463 return;
7464 }
7465
7466 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7467 " createtime=%u\n",
7468 fsp->fnum,
7469 (unsigned int)ft.atime.tv_sec,
7470 (unsigned int)ft.mtime.tv_sec,
7471 (unsigned int)ft.create_time.tv_sec
7472 ));
7473
7474 END_PROFILE(SMBsetattrE);
7475 return;
7476 }
7477
7478
7479 /* Back from the dead for OS/2..... JRA. */
7480
7481 /****************************************************************************
7482 Reply to a SMBwritebmpx (write block multiplex primary) request.
7483 Always reply with an error, if someone has a platform really needs this,
7484 please contact vl@samba.org
7485 ****************************************************************************/
7486
7487 void reply_writebmpx(struct smb_request *req)
7488 {
7489 START_PROFILE(SMBwriteBmpx);
7490 reply_doserror(req, ERRSRV, ERRuseSTD);
7491 END_PROFILE(SMBwriteBmpx);
7492 return;
7493 }
7494
7495 /****************************************************************************
7496 Reply to a SMBwritebs (write block multiplex secondary) request.
7497 Always reply with an error, if someone has a platform really needs this,
7498 please contact vl@samba.org
7499 ****************************************************************************/
7500
7501 void reply_writebs(struct smb_request *req)
7502 {
7503 START_PROFILE(SMBwriteBs);
7504 reply_doserror(req, ERRSRV, ERRuseSTD);
7505 END_PROFILE(SMBwriteBs);
7506 return;
7507 }
7508
7509 /****************************************************************************
7510 Reply to a SMBgetattrE.
7511 ****************************************************************************/
7512
7513 void reply_getattrE(struct smb_request *req)
7514 {
7515 connection_struct *conn = req->conn;
7516 SMB_STRUCT_STAT sbuf;
7517 int mode;
7518 files_struct *fsp;
7519 struct timespec create_ts;
7520
7521 START_PROFILE(SMBgetattrE);
7522
7523 if (req->wct < 1) {
7524 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7525 END_PROFILE(SMBgetattrE);
7526 return;
7527 }
7528
7529 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7530
7531 if(!fsp || (fsp->conn != conn)) {
7532 reply_doserror(req, ERRDOS, ERRbadfid);
7533 END_PROFILE(SMBgetattrE);
7534 return;
7535 }
7536
7537 /* Do an fstat on this file */
7538 if(fsp_stat(fsp, &sbuf)) {
7539 reply_unixerror(req, ERRDOS, ERRnoaccess);
7540 END_PROFILE(SMBgetattrE);
7541 return;
7542 }
7543
7544 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7545
7546 /*
7547 * Convert the times into dos times. Set create
7548 * date to be last modify date as UNIX doesn't save
7549 * this.
7550 */
7551
7552 reply_outbuf(req, 11, 0);
7553
7554 create_ts = sbuf.st_ex_btime;
7555 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7556 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7557 convert_timespec_to_time_t(sbuf.st_ex_atime));
7558 /* Should we check pending modtime here ? JRA */
7559 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7560 convert_timespec_to_time_t(sbuf.st_ex_mtime));
7561
7562 if (mode & aDIR) {
7563 SIVAL(req->outbuf, smb_vwv6, 0);
7564 SIVAL(req->outbuf, smb_vwv8, 0);
7565 } else {
7566 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7567 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_ex_size);
7568 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7569 }
7570 SSVAL(req->outbuf,smb_vwv10, mode);
7571
7572 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7573
7574 END_PROFILE(SMBgetattrE);
7575 return;
7576 }
Samba GIT mirror