?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Restructure brl_conflict_other
[Samba.git] / source3 / smbd / reply.c
blob1bb606f52b3735c88c326320523646deb17594c5
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const uint8_t *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
535 {
536 int msg_type = CVAL(inbuf,0);
537 int msg_flags = CVAL(inbuf,1);
538 /*
539 * We only really use 4 bytes of the outbuf, but for the smb_setlen
540 * calculation & friends (srv_send_smb uses that) we need the full smb
541 * header.
542 */
543 char outbuf[smb_size];
544
545 memset(outbuf, '\0', sizeof(outbuf));
546
547 smb_setlen(outbuf,0);
548
549 switch (msg_type) {
550 case NBSSrequest: /* session request */
551 {
552 /* inbuf_size is guarenteed to be at least 4. */
553 fstring name1,name2;
554 int name_type1, name_type2;
555 int name_len1, name_len2;
556
557 *name1 = *name2 = 0;
558
559 if (sconn->nbt.got_session) {
560 exit_server_cleanly("multiple session request not permitted");
561 }
562
563 SCVAL(outbuf,0,NBSSpositive);
564 SCVAL(outbuf,3,0);
565
566 /* inbuf_size is guaranteed to be at least 4. */
567 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
568 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
569 DEBUG(0,("Invalid name length in session request\n"));
570 reply_called_name_not_present(outbuf);
571 break;
572 }
573 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
574 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
575 DEBUG(0,("Invalid name length in session request\n"));
576 reply_called_name_not_present(outbuf);
577 break;
578 }
579
580 name_type1 = name_extract((unsigned char *)inbuf,
581 inbuf_size,(unsigned int)4,name1);
582 name_type2 = name_extract((unsigned char *)inbuf,
583 inbuf_size,(unsigned int)(4 + name_len1),name2);
584
585 if (name_type1 == -1 || name_type2 == -1) {
586 DEBUG(0,("Invalid name type in session request\n"));
587 reply_called_name_not_present(outbuf);
588 break;
589 }
590
591 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
592 name1, name_type1, name2, name_type2));
593
594 if (netbios_session_retarget(sconn, name1, name_type1)) {
595 exit_server_cleanly("retargeted client");
596 }
597
598 /*
599 * Windows NT/2k uses "*SMBSERVER" and XP uses
600 * "*SMBSERV" arrggg!!!
601 */
602 if (strequal(name1, "*SMBSERVER ")
603 || strequal(name1, "*SMBSERV ")) {
604 char *raddr;
605
606 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
607 talloc_tos());
608 if (raddr == NULL) {
609 exit_server_cleanly("could not allocate raddr");
610 }
611
612 fstrcpy(name1, raddr);
613 }
614
615 set_local_machine_name(name1, True);
616 set_remote_machine_name(name2, True);
617
618 if (is_ipaddress(sconn->remote_hostname)) {
619 char *p = discard_const_p(char, sconn->remote_hostname);
620
621 talloc_free(p);
622
623 sconn->remote_hostname = talloc_strdup(sconn,
624 get_remote_machine_name());
625 if (sconn->remote_hostname == NULL) {
626 exit_server_cleanly("could not copy remote name");
627 }
628 sconn->conn->remote_hostname = sconn->remote_hostname;
629 }
630
631 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
632 get_local_machine_name(), get_remote_machine_name(),
633 name_type2));
634
635 if (name_type2 == 'R') {
636 /* We are being asked for a pathworks session ---
637 no thanks! */
638 reply_called_name_not_present(outbuf);
639 break;
640 }
641
642 reload_services(sconn, conn_snum_used, true);
643 reopen_logs();
644
645 sconn->nbt.got_session = true;
646 break;
647 }
648
649 case 0x89: /* session keepalive request
650 (some old clients produce this?) */
651 SCVAL(outbuf,0,NBSSkeepalive);
652 SCVAL(outbuf,3,0);
653 break;
654
655 case NBSSpositive: /* positive session response */
656 case NBSSnegative: /* negative session response */
657 case NBSSretarget: /* retarget session response */
658 DEBUG(0,("Unexpected session response\n"));
659 break;
660
661 case NBSSkeepalive: /* session keepalive */
662 default:
663 return;
664 }
665
666 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
667 msg_type, msg_flags));
668
669 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
670
671 if (CVAL(outbuf, 0) != 0x82) {
672 exit_server_cleanly("invalid netbios session");
673 }
674 return;
675 }
676
677 /****************************************************************************
678 Reply to a tcon.
679 conn POINTER CAN BE NULL HERE !
680 ****************************************************************************/
681
682 void reply_tcon(struct smb_request *req)
683 {
684 connection_struct *conn = req->conn;
685 const char *service;
686 char *service_buf = NULL;
687 char *password = NULL;
688 char *dev = NULL;
689 int pwlen=0;
690 NTSTATUS nt_status;
691 const uint8_t *p;
692 const char *p2;
693 TALLOC_CTX *ctx = talloc_tos();
694 struct smbd_server_connection *sconn = req->sconn;
695 NTTIME now = timeval_to_nttime(&req->request_time);
696
697 START_PROFILE(SMBtcon);
698
699 if (req->buflen < 4) {
700 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
701 END_PROFILE(SMBtcon);
702 return;
703 }
704
705 p = req->buf + 1;
706 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
707 p += 1;
708 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
709 p += pwlen+1;
710 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
711 p += 1;
712
713 if (service_buf == NULL || password == NULL || dev == NULL) {
714 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
715 END_PROFILE(SMBtcon);
716 return;
717 }
718 p2 = strrchr_m(service_buf,'\\');
719 if (p2) {
720 service = p2+1;
721 } else {
722 service = service_buf;
723 }
724
725 conn = make_connection(sconn, now, service, dev,
726 req->vuid,&nt_status);
727 req->conn = conn;
728
729 if (!conn) {
730 reply_nterror(req, nt_status);
731 END_PROFILE(SMBtcon);
732 return;
733 }
734
735 reply_outbuf(req, 2, 0);
736 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
737 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
738 SSVAL(req->outbuf,smb_tid,conn->cnum);
739
740 DEBUG(3,("tcon service=%s cnum=%d\n",
741 service, conn->cnum));
742
743 END_PROFILE(SMBtcon);
744 return;
745 }
746
747 /****************************************************************************
748 Reply to a tcon and X.
749 conn POINTER CAN BE NULL HERE !
750 ****************************************************************************/
751
752 void reply_tcon_and_X(struct smb_request *req)
753 {
754 connection_struct *conn = req->conn;
755 const char *service = NULL;
756 TALLOC_CTX *ctx = talloc_tos();
757 /* what the cleint thinks the device is */
758 char *client_devicetype = NULL;
759 /* what the server tells the client the share represents */
760 const char *server_devicetype;
761 NTSTATUS nt_status;
762 int passlen;
763 char *path = NULL;
764 const uint8_t *p;
765 const char *q;
766 uint16_t tcon_flags;
767 struct smbXsrv_session *session = NULL;
768 NTTIME now = timeval_to_nttime(&req->request_time);
769 bool session_key_updated = false;
770 uint16_t optional_support = 0;
771 struct smbd_server_connection *sconn = req->sconn;
772
773 START_PROFILE(SMBtconX);
774
775 if (req->wct < 4) {
776 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
777 END_PROFILE(SMBtconX);
778 return;
779 }
780
781 passlen = SVAL(req->vwv+3, 0);
782 tcon_flags = SVAL(req->vwv+2, 0);
783
784 /* we might have to close an old one */
785 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
786 struct smbXsrv_tcon *tcon;
787 NTSTATUS status;
788
789 tcon = conn->tcon;
790 req->conn = NULL;
791 conn = NULL;
792
793 /*
794 * TODO: cancel all outstanding requests on the tcon
795 */
796 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
797 if (!NT_STATUS_IS_OK(status)) {
798 DEBUG(0, ("reply_tcon_and_X: "
799 "smbXsrv_tcon_disconnect() failed: %s\n",
800 nt_errstr(status)));
801 /*
802 * If we hit this case, there is something completely
803 * wrong, so we better disconnect the transport connection.
804 */
805 END_PROFILE(SMBtconX);
806 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
807 return;
808 }
809
810 TALLOC_FREE(tcon);
811 }
812
813 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
814 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
815 END_PROFILE(SMBtconX);
816 return;
817 }
818
819 if (sconn->smb1.negprot.encrypted_passwords) {
820 p = req->buf + passlen;
821 } else {
822 p = req->buf + passlen + 1;
823 }
824
825 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
826
827 if (path == NULL) {
828 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
829 END_PROFILE(SMBtconX);
830 return;
831 }
832
833 /*
834 * the service name can be either: \\server\share
835 * or share directly like on the DELL PowerVault 705
836 */
837 if (*path=='\\') {
838 q = strchr_m(path+2,'\\');
839 if (!q) {
840 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
841 END_PROFILE(SMBtconX);
842 return;
843 }
844 service = q+1;
845 } else {
846 service = path;
847 }
848
849 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
850 &client_devicetype, p,
851 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
852
853 if (client_devicetype == NULL) {
854 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
855 END_PROFILE(SMBtconX);
856 return;
857 }
858
859 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
860
861 nt_status = smb1srv_session_lookup(req->sconn->conn,
862 req->vuid, now, &session);
863 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
864 reply_force_doserror(req, ERRSRV, ERRbaduid);
865 END_PROFILE(SMBtconX);
866 return;
867 }
868 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
869 reply_nterror(req, nt_status);
870 END_PROFILE(SMBtconX);
871 return;
872 }
873 if (!NT_STATUS_IS_OK(nt_status)) {
874 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
875 END_PROFILE(SMBtconX);
876 return;
877 }
878
879 if (session->global->auth_session_info == NULL) {
880 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
881 END_PROFILE(SMBtconX);
882 return;
883 }
884
885 /*
886 * If there is no application key defined yet
887 * we create one.
888 *
889 * This means we setup the application key on the
890 * first tcon that happens via the given session.
891 *
892 * Once the application key is defined, it does not
893 * change any more.
894 */
895 if (session->global->application_key.length == 0 &&
896 session->global->signing_key.length > 0)
897 {
898 struct smbXsrv_session *x = session;
899 struct auth_session_info *session_info =
900 session->global->auth_session_info;
901 uint8_t session_key[16];
902
903 ZERO_STRUCT(session_key);
904 memcpy(session_key, x->global->signing_key.data,
905 MIN(x->global->signing_key.length, sizeof(session_key)));
906
907 /*
908 * The application key is truncated/padded to 16 bytes
909 */
910 x->global->application_key = data_blob_talloc(x->global,
911 session_key,
912 sizeof(session_key));
913 ZERO_STRUCT(session_key);
914 if (x->global->application_key.data == NULL) {
915 reply_nterror(req, NT_STATUS_NO_MEMORY);
916 END_PROFILE(SMBtconX);
917 return;
918 }
919
920 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
921 smb_key_derivation(x->global->application_key.data,
922 x->global->application_key.length,
923 x->global->application_key.data);
924 optional_support |= SMB_EXTENDED_SIGNATURES;
925 }
926
927 /*
928 * Place the application key into the session_info
929 */
930 data_blob_clear_free(&session_info->session_key);
931 session_info->session_key = data_blob_dup_talloc(session_info,
932 x->global->application_key);
933 if (session_info->session_key.data == NULL) {
934 data_blob_clear_free(&x->global->application_key);
935 reply_nterror(req, NT_STATUS_NO_MEMORY);
936 END_PROFILE(SMBtconX);
937 return;
938 }
939 session_key_updated = true;
940 }
941
942 conn = make_connection(sconn, now, service, client_devicetype,
943 req->vuid, &nt_status);
944 req->conn =conn;
945
946 if (!conn) {
947 if (session_key_updated) {
948 struct smbXsrv_session *x = session;
949 struct auth_session_info *session_info =
950 session->global->auth_session_info;
951 data_blob_clear_free(&x->global->application_key);
952 data_blob_clear_free(&session_info->session_key);
953 }
954 reply_nterror(req, nt_status);
955 END_PROFILE(SMBtconX);
956 return;
957 }
958
959 if ( IS_IPC(conn) )
960 server_devicetype = "IPC";
961 else if ( IS_PRINT(conn) )
962 server_devicetype = "LPT1:";
963 else
964 server_devicetype = "A:";
965
966 if (get_Protocol() < PROTOCOL_NT1) {
967 reply_outbuf(req, 2, 0);
968 if (message_push_string(&req->outbuf, server_devicetype,
969 STR_TERMINATE|STR_ASCII) == -1) {
970 reply_nterror(req, NT_STATUS_NO_MEMORY);
971 END_PROFILE(SMBtconX);
972 return;
973 }
974 } else {
975 /* NT sets the fstype of IPC$ to the null string */
976 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
977
978 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
979 /* Return permissions. */
980 uint32 perm1 = 0;
981 uint32 perm2 = 0;
982
983 reply_outbuf(req, 7, 0);
984
985 if (IS_IPC(conn)) {
986 perm1 = FILE_ALL_ACCESS;
987 perm2 = FILE_ALL_ACCESS;
988 } else {
989 perm1 = conn->share_access;
990 }
991
992 SIVAL(req->outbuf, smb_vwv3, perm1);
993 SIVAL(req->outbuf, smb_vwv5, perm2);
994 } else {
995 reply_outbuf(req, 3, 0);
996 }
997
998 if ((message_push_string(&req->outbuf, server_devicetype,
999 STR_TERMINATE|STR_ASCII) == -1)
1000 || (message_push_string(&req->outbuf, fstype,
1001 STR_TERMINATE) == -1)) {
1002 reply_nterror(req, NT_STATUS_NO_MEMORY);
1003 END_PROFILE(SMBtconX);
1004 return;
1005 }
1006
1007 /* what does setting this bit do? It is set by NT4 and
1008 may affect the ability to autorun mounted cdroms */
1009 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1010 optional_support |=
1011 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1012
1013 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1014 DEBUG(2,("Serving %s as a Dfs root\n",
1015 lp_servicename(ctx, SNUM(conn)) ));
1016 optional_support |= SMB_SHARE_IN_DFS;
1017 }
1018
1019 SSVAL(req->outbuf, smb_vwv2, optional_support);
1020 }
1021
1022 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1023 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1024
1025 DEBUG(3,("tconX service=%s \n",
1026 service));
1027
1028 /* set the incoming and outgoing tid to the just created one */
1029 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1030 SSVAL(req->outbuf,smb_tid,conn->cnum);
1031
1032 END_PROFILE(SMBtconX);
1033
1034 req->tid = conn->cnum;
1035 }
1036
1037 /****************************************************************************
1038 Reply to an unknown type.
1039 ****************************************************************************/
1040
1041 void reply_unknown_new(struct smb_request *req, uint8 type)
1042 {
1043 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1044 smb_fn_name(type), type, type));
1045 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1046 return;
1047 }
1048
1049 /****************************************************************************
1050 Reply to an ioctl.
1051 conn POINTER CAN BE NULL HERE !
1052 ****************************************************************************/
1053
1054 void reply_ioctl(struct smb_request *req)
1055 {
1056 connection_struct *conn = req->conn;
1057 uint16 device;
1058 uint16 function;
1059 uint32 ioctl_code;
1060 int replysize;
1061 char *p;
1062
1063 START_PROFILE(SMBioctl);
1064
1065 if (req->wct < 3) {
1066 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1067 END_PROFILE(SMBioctl);
1068 return;
1069 }
1070
1071 device = SVAL(req->vwv+1, 0);
1072 function = SVAL(req->vwv+2, 0);
1073 ioctl_code = (device << 16) + function;
1074
1075 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1076
1077 switch (ioctl_code) {
1078 case IOCTL_QUERY_JOB_INFO:
1079 replysize = 32;
1080 break;
1081 default:
1082 reply_force_doserror(req, ERRSRV, ERRnosupport);
1083 END_PROFILE(SMBioctl);
1084 return;
1085 }
1086
1087 reply_outbuf(req, 8, replysize+1);
1088 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1089 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1090 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1091 p = smb_buf(req->outbuf);
1092 memset(p, '\0', replysize+1); /* valgrind-safe. */
1093 p += 1; /* Allow for alignment */
1094
1095 switch (ioctl_code) {
1096 case IOCTL_QUERY_JOB_INFO:
1097 {
1098 files_struct *fsp = file_fsp(
1099 req, SVAL(req->vwv+0, 0));
1100 if (!fsp) {
1101 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1102 END_PROFILE(SMBioctl);
1103 return;
1104 }
1105 /* Job number */
1106 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1107
1108 srvstr_push((char *)req->outbuf, req->flags2, p+2,
1109 lp_netbios_name(), 15,
1110 STR_TERMINATE|STR_ASCII);
1111 if (conn) {
1112 srvstr_push((char *)req->outbuf, req->flags2,
1113 p+18,
1114 lp_servicename(talloc_tos(),
1115 SNUM(conn)),
1116 13, STR_TERMINATE|STR_ASCII);
1117 } else {
1118 memset(p+18, 0, 13);
1119 }
1120 break;
1121 }
1122 }
1123
1124 END_PROFILE(SMBioctl);
1125 return;
1126 }
1127
1128 /****************************************************************************
1129 Strange checkpath NTSTATUS mapping.
1130 ****************************************************************************/
1131
1132 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1133 {
1134 /* Strange DOS error code semantics only for checkpath... */
1135 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1136 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1137 /* We need to map to ERRbadpath */
1138 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1139 }
1140 }
1141 return status;
1142 }
1143
1144 /****************************************************************************
1145 Reply to a checkpath.
1146 ****************************************************************************/
1147
1148 void reply_checkpath(struct smb_request *req)
1149 {
1150 connection_struct *conn = req->conn;
1151 struct smb_filename *smb_fname = NULL;
1152 char *name = NULL;
1153 NTSTATUS status;
1154 TALLOC_CTX *ctx = talloc_tos();
1155
1156 START_PROFILE(SMBcheckpath);
1157
1158 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1159 STR_TERMINATE, &status);
1160
1161 if (!NT_STATUS_IS_OK(status)) {
1162 status = map_checkpath_error(req->flags2, status);
1163 reply_nterror(req, status);
1164 END_PROFILE(SMBcheckpath);
1165 return;
1166 }
1167
1168 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1169
1170 status = filename_convert(ctx,
1171 conn,
1172 req->flags2 & FLAGS2_DFS_PATHNAMES,
1173 name,
1174 0,
1175 NULL,
1176 &smb_fname);
1177
1178 if (!NT_STATUS_IS_OK(status)) {
1179 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1180 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1181 ERRSRV, ERRbadpath);
1182 END_PROFILE(SMBcheckpath);
1183 return;
1184 }
1185 goto path_err;
1186 }
1187
1188 if (!VALID_STAT(smb_fname->st) &&
1189 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1190 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1191 smb_fname_str_dbg(smb_fname), strerror(errno)));
1192 status = map_nt_error_from_unix(errno);
1193 goto path_err;
1194 }
1195
1196 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1197 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1198 ERRDOS, ERRbadpath);
1199 goto out;
1200 }
1201
1202 reply_outbuf(req, 0, 0);
1203
1204 path_err:
1205 /* We special case this - as when a Windows machine
1206 is parsing a path is steps through the components
1207 one at a time - if a component fails it expects
1208 ERRbadpath, not ERRbadfile.
1209 */
1210 status = map_checkpath_error(req->flags2, status);
1211 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1212 /*
1213 * Windows returns different error codes if
1214 * the parent directory is valid but not the
1215 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1216 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1217 * if the path is invalid.
1218 */
1219 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1220 ERRDOS, ERRbadpath);
1221 goto out;
1222 }
1223
1224 reply_nterror(req, status);
1225
1226 out:
1227 TALLOC_FREE(smb_fname);
1228 END_PROFILE(SMBcheckpath);
1229 return;
1230 }
1231
1232 /****************************************************************************
1233 Reply to a getatr.
1234 ****************************************************************************/
1235
1236 void reply_getatr(struct smb_request *req)
1237 {
1238 connection_struct *conn = req->conn;
1239 struct smb_filename *smb_fname = NULL;
1240 char *fname = NULL;
1241 int mode=0;
1242 off_t size=0;
1243 time_t mtime=0;
1244 const char *p;
1245 NTSTATUS status;
1246 TALLOC_CTX *ctx = talloc_tos();
1247 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1248
1249 START_PROFILE(SMBgetatr);
1250
1251 p = (const char *)req->buf + 1;
1252 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1253 if (!NT_STATUS_IS_OK(status)) {
1254 reply_nterror(req, status);
1255 goto out;
1256 }
1257
1258 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1259 under WfWg - weird! */
1260 if (*fname == '\0') {
1261 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1262 if (!CAN_WRITE(conn)) {
1263 mode |= FILE_ATTRIBUTE_READONLY;
1264 }
1265 size = 0;
1266 mtime = 0;
1267 } else {
1268 status = filename_convert(ctx,
1269 conn,
1270 req->flags2 & FLAGS2_DFS_PATHNAMES,
1271 fname,
1272 0,
1273 NULL,
1274 &smb_fname);
1275 if (!NT_STATUS_IS_OK(status)) {
1276 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1277 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1278 ERRSRV, ERRbadpath);
1279 goto out;
1280 }
1281 reply_nterror(req, status);
1282 goto out;
1283 }
1284 if (!VALID_STAT(smb_fname->st) &&
1285 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1286 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1287 smb_fname_str_dbg(smb_fname),
1288 strerror(errno)));
1289 reply_nterror(req, map_nt_error_from_unix(errno));
1290 goto out;
1291 }
1292
1293 mode = dos_mode(conn, smb_fname);
1294 size = smb_fname->st.st_ex_size;
1295
1296 if (ask_sharemode) {
1297 struct timespec write_time_ts;
1298 struct file_id fileid;
1299
1300 ZERO_STRUCT(write_time_ts);
1301 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1302 get_file_infos(fileid, 0, NULL, &write_time_ts);
1303 if (!null_timespec(write_time_ts)) {
1304 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1305 }
1306 }
1307
1308 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1309 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1310 size = 0;
1311 }
1312 }
1313
1314 reply_outbuf(req, 10, 0);
1315
1316 SSVAL(req->outbuf,smb_vwv0,mode);
1317 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1318 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1319 } else {
1320 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1321 }
1322 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1323
1324 if (get_Protocol() >= PROTOCOL_NT1) {
1325 SSVAL(req->outbuf, smb_flg2,
1326 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1327 }
1328
1329 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1330 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1331
1332 out:
1333 TALLOC_FREE(smb_fname);
1334 TALLOC_FREE(fname);
1335 END_PROFILE(SMBgetatr);
1336 return;
1337 }
1338
1339 /****************************************************************************
1340 Reply to a setatr.
1341 ****************************************************************************/
1342
1343 void reply_setatr(struct smb_request *req)
1344 {
1345 struct smb_file_time ft;
1346 connection_struct *conn = req->conn;
1347 struct smb_filename *smb_fname = NULL;
1348 char *fname = NULL;
1349 int mode;
1350 time_t mtime;
1351 const char *p;
1352 NTSTATUS status;
1353 TALLOC_CTX *ctx = talloc_tos();
1354
1355 START_PROFILE(SMBsetatr);
1356
1357 ZERO_STRUCT(ft);
1358
1359 if (req->wct < 2) {
1360 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1361 goto out;
1362 }
1363
1364 p = (const char *)req->buf + 1;
1365 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1366 if (!NT_STATUS_IS_OK(status)) {
1367 reply_nterror(req, status);
1368 goto out;
1369 }
1370
1371 status = filename_convert(ctx,
1372 conn,
1373 req->flags2 & FLAGS2_DFS_PATHNAMES,
1374 fname,
1375 0,
1376 NULL,
1377 &smb_fname);
1378 if (!NT_STATUS_IS_OK(status)) {
1379 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1380 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1381 ERRSRV, ERRbadpath);
1382 goto out;
1383 }
1384 reply_nterror(req, status);
1385 goto out;
1386 }
1387
1388 if (smb_fname->base_name[0] == '.' &&
1389 smb_fname->base_name[1] == '\0') {
1390 /*
1391 * Not sure here is the right place to catch this
1392 * condition. Might be moved to somewhere else later -- vl
1393 */
1394 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1395 goto out;
1396 }
1397
1398 mode = SVAL(req->vwv+0, 0);
1399 mtime = srv_make_unix_date3(req->vwv+1);
1400
1401 if (mode != FILE_ATTRIBUTE_NORMAL) {
1402 if (VALID_STAT_OF_DIR(smb_fname->st))
1403 mode |= FILE_ATTRIBUTE_DIRECTORY;
1404 else
1405 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1406
1407 status = check_access(conn, NULL, smb_fname,
1408 FILE_WRITE_ATTRIBUTES);
1409 if (!NT_STATUS_IS_OK(status)) {
1410 reply_nterror(req, status);
1411 goto out;
1412 }
1413
1414 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1415 false) != 0) {
1416 reply_nterror(req, map_nt_error_from_unix(errno));
1417 goto out;
1418 }
1419 }
1420
1421 ft.mtime = convert_time_t_to_timespec(mtime);
1422 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1423 if (!NT_STATUS_IS_OK(status)) {
1424 reply_nterror(req, status);
1425 goto out;
1426 }
1427
1428 reply_outbuf(req, 0, 0);
1429
1430 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1431 mode));
1432 out:
1433 TALLOC_FREE(smb_fname);
1434 END_PROFILE(SMBsetatr);
1435 return;
1436 }
1437
1438 /****************************************************************************
1439 Reply to a dskattr.
1440 ****************************************************************************/
1441
1442 void reply_dskattr(struct smb_request *req)
1443 {
1444 connection_struct *conn = req->conn;
1445 uint64_t dfree,dsize,bsize;
1446 START_PROFILE(SMBdskattr);
1447
1448 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1449 reply_nterror(req, map_nt_error_from_unix(errno));
1450 END_PROFILE(SMBdskattr);
1451 return;
1452 }
1453
1454 reply_outbuf(req, 5, 0);
1455
1456 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1457 double total_space, free_space;
1458 /* we need to scale this to a number that DOS6 can handle. We
1459 use floating point so we can handle large drives on systems
1460 that don't have 64 bit integers
1461
1462 we end up displaying a maximum of 2G to DOS systems
1463 */
1464 total_space = dsize * (double)bsize;
1465 free_space = dfree * (double)bsize;
1466
1467 dsize = (uint64_t)((total_space+63*512) / (64*512));
1468 dfree = (uint64_t)((free_space+63*512) / (64*512));
1469
1470 if (dsize > 0xFFFF) dsize = 0xFFFF;
1471 if (dfree > 0xFFFF) dfree = 0xFFFF;
1472
1473 SSVAL(req->outbuf,smb_vwv0,dsize);
1474 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1475 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1476 SSVAL(req->outbuf,smb_vwv3,dfree);
1477 } else {
1478 SSVAL(req->outbuf,smb_vwv0,dsize);
1479 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1480 SSVAL(req->outbuf,smb_vwv2,512);
1481 SSVAL(req->outbuf,smb_vwv3,dfree);
1482 }
1483
1484 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1485
1486 END_PROFILE(SMBdskattr);
1487 return;
1488 }
1489
1490 /*
1491 * Utility function to split the filename from the directory.
1492 */
1493 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1494 char **fname_dir_out,
1495 char **fname_mask_out)
1496 {
1497 const char *p = NULL;
1498 char *fname_dir = NULL;
1499 char *fname_mask = NULL;
1500
1501 p = strrchr_m(fname_in, '/');
1502 if (!p) {
1503 fname_dir = talloc_strdup(ctx, ".");
1504 fname_mask = talloc_strdup(ctx, fname_in);
1505 } else {
1506 fname_dir = talloc_strndup(ctx, fname_in,
1507 PTR_DIFF(p, fname_in));
1508 fname_mask = talloc_strdup(ctx, p+1);
1509 }
1510
1511 if (!fname_dir || !fname_mask) {
1512 TALLOC_FREE(fname_dir);
1513 TALLOC_FREE(fname_mask);
1514 return NT_STATUS_NO_MEMORY;
1515 }
1516
1517 *fname_dir_out = fname_dir;
1518 *fname_mask_out = fname_mask;
1519 return NT_STATUS_OK;
1520 }
1521
1522 /****************************************************************************
1523 Reply to a search.
1524 Can be called from SMBsearch, SMBffirst or SMBfunique.
1525 ****************************************************************************/
1526
1527 void reply_search(struct smb_request *req)
1528 {
1529 connection_struct *conn = req->conn;
1530 char *path = NULL;
1531 const char *mask = NULL;
1532 char *directory = NULL;
1533 struct smb_filename *smb_fname = NULL;
1534 char *fname = NULL;
1535 off_t size;
1536 uint32 mode;
1537 struct timespec date;
1538 uint32 dirtype;
1539 unsigned int numentries = 0;
1540 unsigned int maxentries = 0;
1541 bool finished = False;
1542 const char *p;
1543 int status_len;
1544 char status[21];
1545 int dptr_num= -1;
1546 bool check_descend = False;
1547 bool expect_close = False;
1548 NTSTATUS nt_status;
1549 bool mask_contains_wcard = False;
1550 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1551 TALLOC_CTX *ctx = talloc_tos();
1552 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1553 struct dptr_struct *dirptr = NULL;
1554 struct smbd_server_connection *sconn = req->sconn;
1555
1556 START_PROFILE(SMBsearch);
1557
1558 if (req->wct < 2) {
1559 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1560 goto out;
1561 }
1562
1563 if (lp_posix_pathnames()) {
1564 reply_unknown_new(req, req->cmd);
1565 goto out;
1566 }
1567
1568 /* If we were called as SMBffirst then we must expect close. */
1569 if(req->cmd == SMBffirst) {
1570 expect_close = True;
1571 }
1572
1573 reply_outbuf(req, 1, 3);
1574 maxentries = SVAL(req->vwv+0, 0);
1575 dirtype = SVAL(req->vwv+1, 0);
1576 p = (const char *)req->buf + 1;
1577 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1578 &nt_status, &mask_contains_wcard);
1579 if (!NT_STATUS_IS_OK(nt_status)) {
1580 reply_nterror(req, nt_status);
1581 goto out;
1582 }
1583
1584 p++;
1585 status_len = SVAL(p, 0);
1586 p += 2;
1587
1588 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1589
1590 if (status_len == 0) {
1591 nt_status = filename_convert(ctx, conn,
1592 req->flags2 & FLAGS2_DFS_PATHNAMES,
1593 path,
1594 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1595 &mask_contains_wcard,
1596 &smb_fname);
1597 if (!NT_STATUS_IS_OK(nt_status)) {
1598 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1599 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1600 ERRSRV, ERRbadpath);
1601 goto out;
1602 }
1603 reply_nterror(req, nt_status);
1604 goto out;
1605 }
1606
1607 directory = smb_fname->base_name;
1608
1609 p = strrchr_m(directory,'/');
1610 if ((p != NULL) && (*directory != '/')) {
1611 mask = p + 1;
1612 directory = talloc_strndup(ctx, directory,
1613 PTR_DIFF(p, directory));
1614 } else {
1615 mask = directory;
1616 directory = talloc_strdup(ctx,".");
1617 }
1618
1619 if (!directory) {
1620 reply_nterror(req, NT_STATUS_NO_MEMORY);
1621 goto out;
1622 }
1623
1624 memset((char *)status,'\0',21);
1625 SCVAL(status,0,(dirtype & 0x1F));
1626
1627 nt_status = dptr_create(conn,
1628 NULL, /* req */
1629 NULL, /* fsp */
1630 directory,
1631 True,
1632 expect_close,
1633 req->smbpid,
1634 mask,
1635 mask_contains_wcard,
1636 dirtype,
1637 &dirptr);
1638 if (!NT_STATUS_IS_OK(nt_status)) {
1639 reply_nterror(req, nt_status);
1640 goto out;
1641 }
1642 dptr_num = dptr_dnum(dirptr);
1643 } else {
1644 int status_dirtype;
1645 const char *dirpath;
1646
1647 memcpy(status,p,21);
1648 status_dirtype = CVAL(status,0) & 0x1F;
1649 if (status_dirtype != (dirtype & 0x1F)) {
1650 dirtype = status_dirtype;
1651 }
1652
1653 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1654 if (!dirptr) {
1655 goto SearchEmpty;
1656 }
1657 dirpath = dptr_path(sconn, dptr_num);
1658 directory = talloc_strdup(ctx, dirpath);
1659 if (!directory) {
1660 reply_nterror(req, NT_STATUS_NO_MEMORY);
1661 goto out;
1662 }
1663
1664 mask = dptr_wcard(sconn, dptr_num);
1665 if (!mask) {
1666 goto SearchEmpty;
1667 }
1668 /*
1669 * For a 'continue' search we have no string. So
1670 * check from the initial saved string.
1671 */
1672 mask_contains_wcard = ms_has_wild(mask);
1673 dirtype = dptr_attr(sconn, dptr_num);
1674 }
1675
1676 DEBUG(4,("dptr_num is %d\n",dptr_num));
1677
1678 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1679 dptr_init_search_op(dirptr);
1680
1681 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1682 char buf[DIR_STRUCT_SIZE];
1683 memcpy(buf,status,21);
1684 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1685 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1686 reply_nterror(req, NT_STATUS_NO_MEMORY);
1687 goto out;
1688 }
1689 dptr_fill(sconn, buf+12,dptr_num);
1690 if (dptr_zero(buf+12) && (status_len==0)) {
1691 numentries = 1;
1692 } else {
1693 numentries = 0;
1694 }
1695 if (message_push_blob(&req->outbuf,
1696 data_blob_const(buf, sizeof(buf)))
1697 == -1) {
1698 reply_nterror(req, NT_STATUS_NO_MEMORY);
1699 goto out;
1700 }
1701 } else {
1702 unsigned int i;
1703 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1704 size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
1705
1706 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1707
1708 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1709 directory,lp_dont_descend(ctx, SNUM(conn))));
1710 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1711 check_descend = True;
1712 }
1713
1714 for (i=numentries;(i<maxentries) && !finished;i++) {
1715 finished = !get_dir_entry(ctx,
1716 dirptr,
1717 mask,
1718 dirtype,
1719 &fname,
1720 &size,
1721 &mode,
1722 &date,
1723 check_descend,
1724 ask_sharemode);
1725 if (!finished) {
1726 char buf[DIR_STRUCT_SIZE];
1727 memcpy(buf,status,21);
1728 if (!make_dir_struct(ctx,
1729 buf,
1730 mask,
1731 fname,
1732 size,
1733 mode,
1734 convert_timespec_to_time_t(date),
1735 !allow_long_path_components)) {
1736 reply_nterror(req, NT_STATUS_NO_MEMORY);
1737 goto out;
1738 }
1739 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1740 break;
1741 }
1742 if (message_push_blob(&req->outbuf,
1743 data_blob_const(buf, sizeof(buf)))
1744 == -1) {
1745 reply_nterror(req, NT_STATUS_NO_MEMORY);
1746 goto out;
1747 }
1748 numentries++;
1749 }
1750 }
1751 }
1752
1753 SearchEmpty:
1754
1755 /* If we were called as SMBffirst with smb_search_id == NULL
1756 and no entries were found then return error and close dirptr
1757 (X/Open spec) */
1758
1759 if (numentries == 0) {
1760 dptr_close(sconn, &dptr_num);
1761 } else if(expect_close && status_len == 0) {
1762 /* Close the dptr - we know it's gone */
1763 dptr_close(sconn, &dptr_num);
1764 }
1765
1766 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1767 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1768 dptr_close(sconn, &dptr_num);
1769 }
1770
1771 if ((numentries == 0) && !mask_contains_wcard) {
1772 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1773 goto out;
1774 }
1775
1776 SSVAL(req->outbuf,smb_vwv0,numentries);
1777 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1778 SCVAL(smb_buf(req->outbuf),0,5);
1779 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1780
1781 /* The replies here are never long name. */
1782 SSVAL(req->outbuf, smb_flg2,
1783 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1784 if (!allow_long_path_components) {
1785 SSVAL(req->outbuf, smb_flg2,
1786 SVAL(req->outbuf, smb_flg2)
1787 & (~FLAGS2_LONG_PATH_COMPONENTS));
1788 }
1789
1790 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1791 SSVAL(req->outbuf, smb_flg2,
1792 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1793
1794 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1795 smb_fn_name(req->cmd),
1796 mask,
1797 directory,
1798 dirtype,
1799 numentries,
1800 maxentries ));
1801 out:
1802 TALLOC_FREE(directory);
1803 TALLOC_FREE(smb_fname);
1804 END_PROFILE(SMBsearch);
1805 return;
1806 }
1807
1808 /****************************************************************************
1809 Reply to a fclose (stop directory search).
1810 ****************************************************************************/
1811
1812 void reply_fclose(struct smb_request *req)
1813 {
1814 int status_len;
1815 char status[21];
1816 int dptr_num= -2;
1817 const char *p;
1818 char *path = NULL;
1819 NTSTATUS err;
1820 bool path_contains_wcard = False;
1821 TALLOC_CTX *ctx = talloc_tos();
1822 struct smbd_server_connection *sconn = req->sconn;
1823
1824 START_PROFILE(SMBfclose);
1825
1826 if (lp_posix_pathnames()) {
1827 reply_unknown_new(req, req->cmd);
1828 END_PROFILE(SMBfclose);
1829 return;
1830 }
1831
1832 p = (const char *)req->buf + 1;
1833 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1834 &err, &path_contains_wcard);
1835 if (!NT_STATUS_IS_OK(err)) {
1836 reply_nterror(req, err);
1837 END_PROFILE(SMBfclose);
1838 return;
1839 }
1840 p++;
1841 status_len = SVAL(p,0);
1842 p += 2;
1843
1844 if (status_len == 0) {
1845 reply_force_doserror(req, ERRSRV, ERRsrverror);
1846 END_PROFILE(SMBfclose);
1847 return;
1848 }
1849
1850 memcpy(status,p,21);
1851
1852 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1853 /* Close the dptr - we know it's gone */
1854 dptr_close(sconn, &dptr_num);
1855 }
1856
1857 reply_outbuf(req, 1, 0);
1858 SSVAL(req->outbuf,smb_vwv0,0);
1859
1860 DEBUG(3,("search close\n"));
1861
1862 END_PROFILE(SMBfclose);
1863 return;
1864 }
1865
1866 /****************************************************************************
1867 Reply to an open.
1868 ****************************************************************************/
1869
1870 void reply_open(struct smb_request *req)
1871 {
1872 connection_struct *conn = req->conn;
1873 struct smb_filename *smb_fname = NULL;
1874 char *fname = NULL;
1875 uint32 fattr=0;
1876 off_t size = 0;
1877 time_t mtime=0;
1878 int info;
1879 files_struct *fsp;
1880 int oplock_request;
1881 int deny_mode;
1882 uint32 dos_attr;
1883 uint32 access_mask;
1884 uint32 share_mode;
1885 uint32 create_disposition;
1886 uint32 create_options = 0;
1887 uint32_t private_flags = 0;
1888 NTSTATUS status;
1889 TALLOC_CTX *ctx = talloc_tos();
1890
1891 START_PROFILE(SMBopen);
1892
1893 if (req->wct < 2) {
1894 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1895 goto out;
1896 }
1897
1898 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1899 deny_mode = SVAL(req->vwv+0, 0);
1900 dos_attr = SVAL(req->vwv+1, 0);
1901
1902 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1903 STR_TERMINATE, &status);
1904 if (!NT_STATUS_IS_OK(status)) {
1905 reply_nterror(req, status);
1906 goto out;
1907 }
1908
1909 if (!map_open_params_to_ntcreate(fname, deny_mode,
1910 OPENX_FILE_EXISTS_OPEN, &access_mask,
1911 &share_mode, &create_disposition,
1912 &create_options, &private_flags)) {
1913 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1914 goto out;
1915 }
1916
1917 status = filename_convert(ctx,
1918 conn,
1919 req->flags2 & FLAGS2_DFS_PATHNAMES,
1920 fname,
1921 UCF_PREP_CREATEFILE,
1922 NULL,
1923 &smb_fname);
1924 if (!NT_STATUS_IS_OK(status)) {
1925 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1926 reply_botherror(req,
1927 NT_STATUS_PATH_NOT_COVERED,
1928 ERRSRV, ERRbadpath);
1929 goto out;
1930 }
1931 reply_nterror(req, status);
1932 goto out;
1933 }
1934
1935 status = SMB_VFS_CREATE_FILE(
1936 conn, /* conn */
1937 req, /* req */
1938 0, /* root_dir_fid */
1939 smb_fname, /* fname */
1940 access_mask, /* access_mask */
1941 share_mode, /* share_access */
1942 create_disposition, /* create_disposition*/
1943 create_options, /* create_options */
1944 dos_attr, /* file_attributes */
1945 oplock_request, /* oplock_request */
1946 0, /* allocation_size */
1947 private_flags,
1948 NULL, /* sd */
1949 NULL, /* ea_list */
1950 &fsp, /* result */
1951 &info); /* pinfo */
1952
1953 if (!NT_STATUS_IS_OK(status)) {
1954 if (open_was_deferred(req->sconn, req->mid)) {
1955 /* We have re-scheduled this call. */
1956 goto out;
1957 }
1958 reply_openerror(req, status);
1959 goto out;
1960 }
1961
1962 /* Ensure we're pointing at the correct stat struct. */
1963 TALLOC_FREE(smb_fname);
1964 smb_fname = fsp->fsp_name;
1965
1966 size = smb_fname->st.st_ex_size;
1967 fattr = dos_mode(conn, smb_fname);
1968
1969 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1970
1971 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1972 DEBUG(3,("attempt to open a directory %s\n",
1973 fsp_str_dbg(fsp)));
1974 close_file(req, fsp, ERROR_CLOSE);
1975 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1976 ERRDOS, ERRnoaccess);
1977 goto out;
1978 }
1979
1980 reply_outbuf(req, 7, 0);
1981 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1982 SSVAL(req->outbuf,smb_vwv1,fattr);
1983 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1984 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1985 } else {
1986 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1987 }
1988 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1989 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1990
1991 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1992 SCVAL(req->outbuf,smb_flg,
1993 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1994 }
1995
1996 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1997 SCVAL(req->outbuf,smb_flg,
1998 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1999 }
2000 out:
2001 END_PROFILE(SMBopen);
2002 return;
2003 }
2004
2005 /****************************************************************************
2006 Reply to an open and X.
2007 ****************************************************************************/
2008
2009 void reply_open_and_X(struct smb_request *req)
2010 {
2011 connection_struct *conn = req->conn;
2012 struct smb_filename *smb_fname = NULL;
2013 char *fname = NULL;
2014 uint16 open_flags;
2015 int deny_mode;
2016 uint32 smb_attr;
2017 /* Breakout the oplock request bits so we can set the
2018 reply bits separately. */
2019 int ex_oplock_request;
2020 int core_oplock_request;
2021 int oplock_request;
2022 #if 0
2023 int smb_sattr = SVAL(req->vwv+4, 0);
2024 uint32 smb_time = make_unix_date3(req->vwv+6);
2025 #endif
2026 int smb_ofun;
2027 uint32 fattr=0;
2028 int mtime=0;
2029 int smb_action = 0;
2030 files_struct *fsp;
2031 NTSTATUS status;
2032 uint64_t allocation_size;
2033 ssize_t retval = -1;
2034 uint32 access_mask;
2035 uint32 share_mode;
2036 uint32 create_disposition;
2037 uint32 create_options = 0;
2038 uint32_t private_flags = 0;
2039 TALLOC_CTX *ctx = talloc_tos();
2040
2041 START_PROFILE(SMBopenX);
2042
2043 if (req->wct < 15) {
2044 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2045 goto out;
2046 }
2047
2048 open_flags = SVAL(req->vwv+2, 0);
2049 deny_mode = SVAL(req->vwv+3, 0);
2050 smb_attr = SVAL(req->vwv+5, 0);
2051 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2052 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2053 oplock_request = ex_oplock_request | core_oplock_request;
2054 smb_ofun = SVAL(req->vwv+8, 0);
2055 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2056
2057 /* If it's an IPC, pass off the pipe handler. */
2058 if (IS_IPC(conn)) {
2059 if (lp_nt_pipe_support()) {
2060 reply_open_pipe_and_X(conn, req);
2061 } else {
2062 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2063 }
2064 goto out;
2065 }
2066
2067 /* XXXX we need to handle passed times, sattr and flags */
2068 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2069 STR_TERMINATE, &status);
2070 if (!NT_STATUS_IS_OK(status)) {
2071 reply_nterror(req, status);
2072 goto out;
2073 }
2074
2075 if (!map_open_params_to_ntcreate(fname, deny_mode,
2076 smb_ofun,
2077 &access_mask, &share_mode,
2078 &create_disposition,
2079 &create_options,
2080 &private_flags)) {
2081 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2082 goto out;
2083 }
2084
2085 status = filename_convert(ctx,
2086 conn,
2087 req->flags2 & FLAGS2_DFS_PATHNAMES,
2088 fname,
2089 UCF_PREP_CREATEFILE,
2090 NULL,
2091 &smb_fname);
2092 if (!NT_STATUS_IS_OK(status)) {
2093 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2094 reply_botherror(req,
2095 NT_STATUS_PATH_NOT_COVERED,
2096 ERRSRV, ERRbadpath);
2097 goto out;
2098 }
2099 reply_nterror(req, status);
2100 goto out;
2101 }
2102
2103 status = SMB_VFS_CREATE_FILE(
2104 conn, /* conn */
2105 req, /* req */
2106 0, /* root_dir_fid */
2107 smb_fname, /* fname */
2108 access_mask, /* access_mask */
2109 share_mode, /* share_access */
2110 create_disposition, /* create_disposition*/
2111 create_options, /* create_options */
2112 smb_attr, /* file_attributes */
2113 oplock_request, /* oplock_request */
2114 0, /* allocation_size */
2115 private_flags,
2116 NULL, /* sd */
2117 NULL, /* ea_list */
2118 &fsp, /* result */
2119 &smb_action); /* pinfo */
2120
2121 if (!NT_STATUS_IS_OK(status)) {
2122 if (open_was_deferred(req->sconn, req->mid)) {
2123 /* We have re-scheduled this call. */
2124 goto out;
2125 }
2126 reply_openerror(req, status);
2127 goto out;
2128 }
2129
2130 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2131 if the file is truncated or created. */
2132 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2133 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2134 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2135 close_file(req, fsp, ERROR_CLOSE);
2136 reply_nterror(req, NT_STATUS_DISK_FULL);
2137 goto out;
2138 }
2139 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2140 if (retval < 0) {
2141 close_file(req, fsp, ERROR_CLOSE);
2142 reply_nterror(req, NT_STATUS_DISK_FULL);
2143 goto out;
2144 }
2145 status = vfs_stat_fsp(fsp);
2146 if (!NT_STATUS_IS_OK(status)) {
2147 close_file(req, fsp, ERROR_CLOSE);
2148 reply_nterror(req, status);
2149 goto out;
2150 }
2151 }
2152
2153 fattr = dos_mode(conn, fsp->fsp_name);
2154 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2155 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2156 close_file(req, fsp, ERROR_CLOSE);
2157 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2158 goto out;
2159 }
2160
2161 /* If the caller set the extended oplock request bit
2162 and we granted one (by whatever means) - set the
2163 correct bit for extended oplock reply.
2164 */
2165
2166 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2167 smb_action |= EXTENDED_OPLOCK_GRANTED;
2168 }
2169
2170 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2171 smb_action |= EXTENDED_OPLOCK_GRANTED;
2172 }
2173
2174 /* If the caller set the core oplock request bit
2175 and we granted one (by whatever means) - set the
2176 correct bit for core oplock reply.
2177 */
2178
2179 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2180 reply_outbuf(req, 19, 0);
2181 } else {
2182 reply_outbuf(req, 15, 0);
2183 }
2184
2185 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2186 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2187
2188 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2189 SCVAL(req->outbuf, smb_flg,
2190 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2191 }
2192
2193 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2194 SCVAL(req->outbuf, smb_flg,
2195 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2196 }
2197
2198 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2199 SSVAL(req->outbuf,smb_vwv3,fattr);
2200 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2201 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2202 } else {
2203 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2204 }
2205 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2206 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2207 SSVAL(req->outbuf,smb_vwv11,smb_action);
2208
2209 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2210 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2211 }
2212
2213 out:
2214 TALLOC_FREE(smb_fname);
2215 END_PROFILE(SMBopenX);
2216 return;
2217 }
2218
2219 /****************************************************************************
2220 Reply to a SMBulogoffX.
2221 ****************************************************************************/
2222
2223 void reply_ulogoffX(struct smb_request *req)
2224 {
2225 struct smbd_server_connection *sconn = req->sconn;
2226 struct user_struct *vuser;
2227 struct smbXsrv_session *session = NULL;
2228 NTSTATUS status;
2229
2230 START_PROFILE(SMBulogoffX);
2231
2232 vuser = get_valid_user_struct(sconn, req->vuid);
2233
2234 if(vuser == NULL) {
2235 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2236 (unsigned long long)req->vuid));
2237
2238 req->vuid = UID_FIELD_INVALID;
2239 reply_force_doserror(req, ERRSRV, ERRbaduid);
2240 END_PROFILE(SMBulogoffX);
2241 return;
2242 }
2243
2244 session = vuser->session;
2245 vuser = NULL;
2246
2247 /*
2248 * TODO: cancel all outstanding requests on the session
2249 */
2250 status = smbXsrv_session_logoff(session);
2251 if (!NT_STATUS_IS_OK(status)) {
2252 DEBUG(0, ("reply_ulogoff: "
2253 "smbXsrv_session_logoff() failed: %s\n",
2254 nt_errstr(status)));
2255 /*
2256 * If we hit this case, there is something completely
2257 * wrong, so we better disconnect the transport connection.
2258 */
2259 END_PROFILE(SMBulogoffX);
2260 exit_server(__location__ ": smbXsrv_session_logoff failed");
2261 return;
2262 }
2263
2264 TALLOC_FREE(session);
2265
2266 reply_outbuf(req, 2, 0);
2267 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2268 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2269
2270 DEBUG(3, ("ulogoffX vuid=%llu\n",
2271 (unsigned long long)req->vuid));
2272
2273 END_PROFILE(SMBulogoffX);
2274 req->vuid = UID_FIELD_INVALID;
2275 }
2276
2277 /****************************************************************************
2278 Reply to a mknew or a create.
2279 ****************************************************************************/
2280
2281 void reply_mknew(struct smb_request *req)
2282 {
2283 connection_struct *conn = req->conn;
2284 struct smb_filename *smb_fname = NULL;
2285 char *fname = NULL;
2286 uint32 fattr = 0;
2287 struct smb_file_time ft;
2288 files_struct *fsp;
2289 int oplock_request = 0;
2290 NTSTATUS status;
2291 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2292 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2293 uint32 create_disposition;
2294 uint32 create_options = 0;
2295 TALLOC_CTX *ctx = talloc_tos();
2296
2297 START_PROFILE(SMBcreate);
2298 ZERO_STRUCT(ft);
2299
2300 if (req->wct < 3) {
2301 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2302 goto out;
2303 }
2304
2305 fattr = SVAL(req->vwv+0, 0);
2306 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2307
2308 /* mtime. */
2309 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2310
2311 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2312 STR_TERMINATE, &status);
2313 if (!NT_STATUS_IS_OK(status)) {
2314 reply_nterror(req, status);
2315 goto out;
2316 }
2317
2318 status = filename_convert(ctx,
2319 conn,
2320 req->flags2 & FLAGS2_DFS_PATHNAMES,
2321 fname,
2322 UCF_PREP_CREATEFILE,
2323 NULL,
2324 &smb_fname);
2325 if (!NT_STATUS_IS_OK(status)) {
2326 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2327 reply_botherror(req,
2328 NT_STATUS_PATH_NOT_COVERED,
2329 ERRSRV, ERRbadpath);
2330 goto out;
2331 }
2332 reply_nterror(req, status);
2333 goto out;
2334 }
2335
2336 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2337 DEBUG(0,("Attempt to create file (%s) with volid set - "
2338 "please report this\n",
2339 smb_fname_str_dbg(smb_fname)));
2340 }
2341
2342 if(req->cmd == SMBmknew) {
2343 /* We should fail if file exists. */
2344 create_disposition = FILE_CREATE;
2345 } else {
2346 /* Create if file doesn't exist, truncate if it does. */
2347 create_disposition = FILE_OVERWRITE_IF;
2348 }
2349
2350 status = SMB_VFS_CREATE_FILE(
2351 conn, /* conn */
2352 req, /* req */
2353 0, /* root_dir_fid */
2354 smb_fname, /* fname */
2355 access_mask, /* access_mask */
2356 share_mode, /* share_access */
2357 create_disposition, /* create_disposition*/
2358 create_options, /* create_options */
2359 fattr, /* file_attributes */
2360 oplock_request, /* oplock_request */
2361 0, /* allocation_size */
2362 0, /* private_flags */
2363 NULL, /* sd */
2364 NULL, /* ea_list */
2365 &fsp, /* result */
2366 NULL); /* pinfo */
2367
2368 if (!NT_STATUS_IS_OK(status)) {
2369 if (open_was_deferred(req->sconn, req->mid)) {
2370 /* We have re-scheduled this call. */
2371 goto out;
2372 }
2373 reply_openerror(req, status);
2374 goto out;
2375 }
2376
2377 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2378 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2379 if (!NT_STATUS_IS_OK(status)) {
2380 END_PROFILE(SMBcreate);
2381 goto out;
2382 }
2383
2384 reply_outbuf(req, 1, 0);
2385 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2386
2387 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2388 SCVAL(req->outbuf,smb_flg,
2389 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2390 }
2391
2392 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2393 SCVAL(req->outbuf,smb_flg,
2394 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2395 }
2396
2397 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2398 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2399 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2400 (unsigned int)fattr));
2401
2402 out:
2403 TALLOC_FREE(smb_fname);
2404 END_PROFILE(SMBcreate);
2405 return;
2406 }
2407
2408 /****************************************************************************
2409 Reply to a create temporary file.
2410 ****************************************************************************/
2411
2412 void reply_ctemp(struct smb_request *req)
2413 {
2414 connection_struct *conn = req->conn;
2415 struct smb_filename *smb_fname = NULL;
2416 char *wire_name = NULL;
2417 char *fname = NULL;
2418 uint32 fattr;
2419 files_struct *fsp;
2420 int oplock_request;
2421 char *s;
2422 NTSTATUS status;
2423 int i;
2424 TALLOC_CTX *ctx = talloc_tos();
2425
2426 START_PROFILE(SMBctemp);
2427
2428 if (req->wct < 3) {
2429 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2430 goto out;
2431 }
2432
2433 fattr = SVAL(req->vwv+0, 0);
2434 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2435
2436 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2437 STR_TERMINATE, &status);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 reply_nterror(req, status);
2440 goto out;
2441 }
2442
2443 for (i = 0; i < 10; i++) {
2444 if (*wire_name) {
2445 fname = talloc_asprintf(ctx,
2446 "%s/TMP%s",
2447 wire_name,
2448 generate_random_str_list(ctx, 5, "0123456789"));
2449 } else {
2450 fname = talloc_asprintf(ctx,
2451 "TMP%s",
2452 generate_random_str_list(ctx, 5, "0123456789"));
2453 }
2454
2455 if (!fname) {
2456 reply_nterror(req, NT_STATUS_NO_MEMORY);
2457 goto out;
2458 }
2459
2460 status = filename_convert(ctx, conn,
2461 req->flags2 & FLAGS2_DFS_PATHNAMES,
2462 fname,
2463 UCF_PREP_CREATEFILE,
2464 NULL,
2465 &smb_fname);
2466 if (!NT_STATUS_IS_OK(status)) {
2467 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2468 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2469 ERRSRV, ERRbadpath);
2470 goto out;
2471 }
2472 reply_nterror(req, status);
2473 goto out;
2474 }
2475
2476 /* Create the file. */
2477 status = SMB_VFS_CREATE_FILE(
2478 conn, /* conn */
2479 req, /* req */
2480 0, /* root_dir_fid */
2481 smb_fname, /* fname */
2482 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2483 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2484 FILE_CREATE, /* create_disposition*/
2485 0, /* create_options */
2486 fattr, /* file_attributes */
2487 oplock_request, /* oplock_request */
2488 0, /* allocation_size */
2489 0, /* private_flags */
2490 NULL, /* sd */
2491 NULL, /* ea_list */
2492 &fsp, /* result */
2493 NULL); /* pinfo */
2494
2495 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2496 TALLOC_FREE(fname);
2497 TALLOC_FREE(smb_fname);
2498 continue;
2499 }
2500
2501 if (!NT_STATUS_IS_OK(status)) {
2502 if (open_was_deferred(req->sconn, req->mid)) {
2503 /* We have re-scheduled this call. */
2504 goto out;
2505 }
2506 reply_openerror(req, status);
2507 goto out;
2508 }
2509
2510 break;
2511 }
2512
2513 if (i == 10) {
2514 /* Collision after 10 times... */
2515 reply_nterror(req, status);
2516 goto out;
2517 }
2518
2519 reply_outbuf(req, 1, 0);
2520 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2521
2522 /* the returned filename is relative to the directory */
2523 s = strrchr_m(fsp->fsp_name->base_name, '/');
2524 if (!s) {
2525 s = fsp->fsp_name->base_name;
2526 } else {
2527 s++;
2528 }
2529
2530 #if 0
2531 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2532 thing in the byte section. JRA */
2533 SSVALS(p, 0, -1); /* what is this? not in spec */
2534 #endif
2535 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2536 == -1) {
2537 reply_nterror(req, NT_STATUS_NO_MEMORY);
2538 goto out;
2539 }
2540
2541 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2542 SCVAL(req->outbuf, smb_flg,
2543 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2544 }
2545
2546 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2547 SCVAL(req->outbuf, smb_flg,
2548 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2549 }
2550
2551 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2552 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2553 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2554 out:
2555 TALLOC_FREE(smb_fname);
2556 TALLOC_FREE(wire_name);
2557 END_PROFILE(SMBctemp);
2558 return;
2559 }
2560
2561 /*******************************************************************
2562 Check if a user is allowed to rename a file.
2563 ********************************************************************/
2564
2565 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2566 uint16 dirtype)
2567 {
2568 if (!CAN_WRITE(conn)) {
2569 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2570 }
2571
2572 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2573 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2574 /* Only bother to read the DOS attribute if we might deny the
2575 rename on the grounds of attribute missmatch. */
2576 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2577 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2578 return NT_STATUS_NO_SUCH_FILE;
2579 }
2580 }
2581
2582 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2583 if (fsp->posix_open) {
2584 return NT_STATUS_OK;
2585 }
2586
2587 /* If no pathnames are open below this
2588 directory, allow the rename. */
2589
2590 if (file_find_subpath(fsp)) {
2591 return NT_STATUS_ACCESS_DENIED;
2592 }
2593 return NT_STATUS_OK;
2594 }
2595
2596 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2597 return NT_STATUS_OK;
2598 }
2599
2600 return NT_STATUS_ACCESS_DENIED;
2601 }
2602
2603 /*******************************************************************
2604 * unlink a file with all relevant access checks
2605 *******************************************************************/
2606
2607 static NTSTATUS do_unlink(connection_struct *conn,
2608 struct smb_request *req,
2609 struct smb_filename *smb_fname,
2610 uint32 dirtype)
2611 {
2612 uint32 fattr;
2613 files_struct *fsp;
2614 uint32 dirtype_orig = dirtype;
2615 NTSTATUS status;
2616 int ret;
2617 bool posix_paths = lp_posix_pathnames();
2618
2619 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2620 smb_fname_str_dbg(smb_fname),
2621 dirtype));
2622
2623 if (!CAN_WRITE(conn)) {
2624 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2625 }
2626
2627 if (posix_paths) {
2628 ret = SMB_VFS_LSTAT(conn, smb_fname);
2629 } else {
2630 ret = SMB_VFS_STAT(conn, smb_fname);
2631 }
2632 if (ret != 0) {
2633 return map_nt_error_from_unix(errno);
2634 }
2635
2636 fattr = dos_mode(conn, smb_fname);
2637
2638 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2639 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2640 }
2641
2642 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2643 if (!dirtype) {
2644 return NT_STATUS_NO_SUCH_FILE;
2645 }
2646
2647 if (!dir_check_ftype(fattr, dirtype)) {
2648 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2649 return NT_STATUS_FILE_IS_A_DIRECTORY;
2650 }
2651 return NT_STATUS_NO_SUCH_FILE;
2652 }
2653
2654 if (dirtype_orig & 0x8000) {
2655 /* These will never be set for POSIX. */
2656 return NT_STATUS_NO_SUCH_FILE;
2657 }
2658
2659 #if 0
2660 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2661 return NT_STATUS_FILE_IS_A_DIRECTORY;
2662 }
2663
2664 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2665 return NT_STATUS_NO_SUCH_FILE;
2666 }
2667
2668 if (dirtype & 0xFF00) {
2669 /* These will never be set for POSIX. */
2670 return NT_STATUS_NO_SUCH_FILE;
2671 }
2672
2673 dirtype &= 0xFF;
2674 if (!dirtype) {
2675 return NT_STATUS_NO_SUCH_FILE;
2676 }
2677
2678 /* Can't delete a directory. */
2679 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2680 return NT_STATUS_FILE_IS_A_DIRECTORY;
2681 }
2682 #endif
2683
2684 #if 0 /* JRATEST */
2685 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2686 return NT_STATUS_OBJECT_NAME_INVALID;
2687 #endif /* JRATEST */
2688
2689 /* On open checks the open itself will check the share mode, so
2690 don't do it here as we'll get it wrong. */
2691
2692 status = SMB_VFS_CREATE_FILE
2693 (conn, /* conn */
2694 req, /* req */
2695 0, /* root_dir_fid */
2696 smb_fname, /* fname */
2697 DELETE_ACCESS, /* access_mask */
2698 FILE_SHARE_NONE, /* share_access */
2699 FILE_OPEN, /* create_disposition*/
2700 FILE_NON_DIRECTORY_FILE, /* create_options */
2701 /* file_attributes */
2702 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2703 FILE_ATTRIBUTE_NORMAL,
2704 0, /* oplock_request */
2705 0, /* allocation_size */
2706 0, /* private_flags */
2707 NULL, /* sd */
2708 NULL, /* ea_list */
2709 &fsp, /* result */
2710 NULL); /* pinfo */
2711
2712 if (!NT_STATUS_IS_OK(status)) {
2713 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2714 nt_errstr(status)));
2715 return status;
2716 }
2717
2718 status = can_set_delete_on_close(fsp, fattr);
2719 if (!NT_STATUS_IS_OK(status)) {
2720 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2721 "(%s)\n",
2722 smb_fname_str_dbg(smb_fname),
2723 nt_errstr(status)));
2724 close_file(req, fsp, NORMAL_CLOSE);
2725 return status;
2726 }
2727
2728 /* The set is across all open files on this dev/inode pair. */
2729 if (!set_delete_on_close(fsp, True,
2730 conn->session_info->security_token,
2731 conn->session_info->unix_token)) {
2732 close_file(req, fsp, NORMAL_CLOSE);
2733 return NT_STATUS_ACCESS_DENIED;
2734 }
2735
2736 return close_file(req, fsp, NORMAL_CLOSE);
2737 }
2738
2739 /****************************************************************************
2740 The guts of the unlink command, split out so it may be called by the NT SMB
2741 code.
2742 ****************************************************************************/
2743
2744 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2745 uint32 dirtype, struct smb_filename *smb_fname,
2746 bool has_wild)
2747 {
2748 char *fname_dir = NULL;
2749 char *fname_mask = NULL;
2750 int count=0;
2751 NTSTATUS status = NT_STATUS_OK;
2752 TALLOC_CTX *ctx = talloc_tos();
2753
2754 /* Split up the directory from the filename/mask. */
2755 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2756 &fname_dir, &fname_mask);
2757 if (!NT_STATUS_IS_OK(status)) {
2758 goto out;
2759 }
2760
2761 /*
2762 * We should only check the mangled cache
2763 * here if unix_convert failed. This means
2764 * that the path in 'mask' doesn't exist
2765 * on the file system and so we need to look
2766 * for a possible mangle. This patch from
2767 * Tine Smukavec <valentin.smukavec@hermes.si>.
2768 */
2769
2770 if (!VALID_STAT(smb_fname->st) &&
2771 mangle_is_mangled(fname_mask, conn->params)) {
2772 char *new_mask = NULL;
2773 mangle_lookup_name_from_8_3(ctx, fname_mask,
2774 &new_mask, conn->params);
2775 if (new_mask) {
2776 TALLOC_FREE(fname_mask);
2777 fname_mask = new_mask;
2778 }
2779 }
2780
2781 if (!has_wild) {
2782
2783 /*
2784 * Only one file needs to be unlinked. Append the mask back
2785 * onto the directory.
2786 */
2787 TALLOC_FREE(smb_fname->base_name);
2788 if (ISDOT(fname_dir)) {
2789 /* Ensure we use canonical names on open. */
2790 smb_fname->base_name = talloc_asprintf(smb_fname,
2791 "%s",
2792 fname_mask);
2793 } else {
2794 smb_fname->base_name = talloc_asprintf(smb_fname,
2795 "%s/%s",
2796 fname_dir,
2797 fname_mask);
2798 }
2799 if (!smb_fname->base_name) {
2800 status = NT_STATUS_NO_MEMORY;
2801 goto out;
2802 }
2803 if (dirtype == 0) {
2804 dirtype = FILE_ATTRIBUTE_NORMAL;
2805 }
2806
2807 status = check_name(conn, smb_fname->base_name);
2808 if (!NT_STATUS_IS_OK(status)) {
2809 goto out;
2810 }
2811
2812 status = do_unlink(conn, req, smb_fname, dirtype);
2813 if (!NT_STATUS_IS_OK(status)) {
2814 goto out;
2815 }
2816
2817 count++;
2818 } else {
2819 struct smb_Dir *dir_hnd = NULL;
2820 long offset = 0;
2821 const char *dname = NULL;
2822 char *talloced = NULL;
2823
2824 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2825 status = NT_STATUS_OBJECT_NAME_INVALID;
2826 goto out;
2827 }
2828
2829 if (strequal(fname_mask,"????????.???")) {
2830 TALLOC_FREE(fname_mask);
2831 fname_mask = talloc_strdup(ctx, "*");
2832 if (!fname_mask) {
2833 status = NT_STATUS_NO_MEMORY;
2834 goto out;
2835 }
2836 }
2837
2838 status = check_name(conn, fname_dir);
2839 if (!NT_STATUS_IS_OK(status)) {
2840 goto out;
2841 }
2842
2843 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2844 dirtype);
2845 if (dir_hnd == NULL) {
2846 status = map_nt_error_from_unix(errno);
2847 goto out;
2848 }
2849
2850 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2851 the pattern matches against the long name, otherwise the short name
2852 We don't implement this yet XXXX
2853 */
2854
2855 status = NT_STATUS_NO_SUCH_FILE;
2856
2857 while ((dname = ReadDirName(dir_hnd, &offset,
2858 &smb_fname->st, &talloced))) {
2859 TALLOC_CTX *frame = talloc_stackframe();
2860
2861 if (!is_visible_file(conn, fname_dir, dname,
2862 &smb_fname->st, true)) {
2863 TALLOC_FREE(frame);
2864 TALLOC_FREE(talloced);
2865 continue;
2866 }
2867
2868 /* Quick check for "." and ".." */
2869 if (ISDOT(dname) || ISDOTDOT(dname)) {
2870 TALLOC_FREE(frame);
2871 TALLOC_FREE(talloced);
2872 continue;
2873 }
2874
2875 if(!mask_match(dname, fname_mask,
2876 conn->case_sensitive)) {
2877 TALLOC_FREE(frame);
2878 TALLOC_FREE(talloced);
2879 continue;
2880 }
2881
2882 TALLOC_FREE(smb_fname->base_name);
2883 if (ISDOT(fname_dir)) {
2884 /* Ensure we use canonical names on open. */
2885 smb_fname->base_name =
2886 talloc_asprintf(smb_fname, "%s",
2887 dname);
2888 } else {
2889 smb_fname->base_name =
2890 talloc_asprintf(smb_fname, "%s/%s",
2891 fname_dir, dname);
2892 }
2893
2894 if (!smb_fname->base_name) {
2895 TALLOC_FREE(dir_hnd);
2896 status = NT_STATUS_NO_MEMORY;
2897 TALLOC_FREE(frame);
2898 TALLOC_FREE(talloced);
2899 goto out;
2900 }
2901
2902 status = check_name(conn, smb_fname->base_name);
2903 if (!NT_STATUS_IS_OK(status)) {
2904 TALLOC_FREE(dir_hnd);
2905 TALLOC_FREE(frame);
2906 TALLOC_FREE(talloced);
2907 goto out;
2908 }
2909
2910 status = do_unlink(conn, req, smb_fname, dirtype);
2911 if (!NT_STATUS_IS_OK(status)) {
2912 TALLOC_FREE(dir_hnd);
2913 TALLOC_FREE(frame);
2914 TALLOC_FREE(talloced);
2915 goto out;
2916 }
2917
2918 count++;
2919 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2920 smb_fname->base_name));
2921
2922 TALLOC_FREE(frame);
2923 TALLOC_FREE(talloced);
2924 }
2925 TALLOC_FREE(dir_hnd);
2926 }
2927
2928 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2929 status = map_nt_error_from_unix(errno);
2930 }
2931
2932 out:
2933 TALLOC_FREE(fname_dir);
2934 TALLOC_FREE(fname_mask);
2935 return status;
2936 }
2937
2938 /****************************************************************************
2939 Reply to a unlink
2940 ****************************************************************************/
2941
2942 void reply_unlink(struct smb_request *req)
2943 {
2944 connection_struct *conn = req->conn;
2945 char *name = NULL;
2946 struct smb_filename *smb_fname = NULL;
2947 uint32 dirtype;
2948 NTSTATUS status;
2949 bool path_contains_wcard = False;
2950 TALLOC_CTX *ctx = talloc_tos();
2951
2952 START_PROFILE(SMBunlink);
2953
2954 if (req->wct < 1) {
2955 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2956 goto out;
2957 }
2958
2959 dirtype = SVAL(req->vwv+0, 0);
2960
2961 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2962 STR_TERMINATE, &status,
2963 &path_contains_wcard);
2964 if (!NT_STATUS_IS_OK(status)) {
2965 reply_nterror(req, status);
2966 goto out;
2967 }
2968
2969 status = filename_convert(ctx, conn,
2970 req->flags2 & FLAGS2_DFS_PATHNAMES,
2971 name,
2972 UCF_COND_ALLOW_WCARD_LCOMP,
2973 &path_contains_wcard,
2974 &smb_fname);
2975 if (!NT_STATUS_IS_OK(status)) {
2976 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2977 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2978 ERRSRV, ERRbadpath);
2979 goto out;
2980 }
2981 reply_nterror(req, status);
2982 goto out;
2983 }
2984
2985 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2986
2987 status = unlink_internals(conn, req, dirtype, smb_fname,
2988 path_contains_wcard);
2989 if (!NT_STATUS_IS_OK(status)) {
2990 if (open_was_deferred(req->sconn, req->mid)) {
2991 /* We have re-scheduled this call. */
2992 goto out;
2993 }
2994 reply_nterror(req, status);
2995 goto out;
2996 }
2997
2998 reply_outbuf(req, 0, 0);
2999 out:
3000 TALLOC_FREE(smb_fname);
3001 END_PROFILE(SMBunlink);
3002 return;
3003 }
3004
3005 /****************************************************************************
3006 Fail for readbraw.
3007 ****************************************************************************/
3008
3009 static void fail_readraw(void)
3010 {
3011 const char *errstr = talloc_asprintf(talloc_tos(),
3012 "FAIL ! reply_readbraw: socket write fail (%s)",
3013 strerror(errno));
3014 if (!errstr) {
3015 errstr = "";
3016 }
3017 exit_server_cleanly(errstr);
3018 }
3019
3020 /****************************************************************************
3021 Fake (read/write) sendfile. Returns -1 on read or write fail.
3022 ****************************************************************************/
3023
3024 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3025 {
3026 size_t bufsize;
3027 size_t tosend = nread;
3028 char *buf;
3029
3030 if (nread == 0) {
3031 return 0;
3032 }
3033
3034 bufsize = MIN(nread, 65536);
3035
3036 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3037 return -1;
3038 }
3039
3040 while (tosend > 0) {
3041 ssize_t ret;
3042 size_t cur_read;
3043
3044 if (tosend > bufsize) {
3045 cur_read = bufsize;
3046 } else {
3047 cur_read = tosend;
3048 }
3049 ret = read_file(fsp,buf,startpos,cur_read);
3050 if (ret == -1) {
3051 SAFE_FREE(buf);
3052 return -1;
3053 }
3054
3055 /* If we had a short read, fill with zeros. */
3056 if (ret < cur_read) {
3057 memset(buf + ret, '\0', cur_read - ret);
3058 }
3059
3060 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3061 != cur_read) {
3062 char addr[INET6_ADDRSTRLEN];
3063 /*
3064 * Try and give an error message saying what
3065 * client failed.
3066 */
3067 DEBUG(0, ("write_data failed for client %s. "
3068 "Error %s\n",
3069 get_peer_addr(fsp->conn->sconn->sock, addr,
3070 sizeof(addr)),
3071 strerror(errno)));
3072 SAFE_FREE(buf);
3073 return -1;
3074 }
3075 tosend -= cur_read;
3076 startpos += cur_read;
3077 }
3078
3079 SAFE_FREE(buf);
3080 return (ssize_t)nread;
3081 }
3082
3083 /****************************************************************************
3084 Deal with the case of sendfile reading less bytes from the file than
3085 requested. Fill with zeros (all we can do).
3086 ****************************************************************************/
3087
3088 void sendfile_short_send(files_struct *fsp,
3089 ssize_t nread,
3090 size_t headersize,
3091 size_t smb_maxcnt)
3092 {
3093 #define SHORT_SEND_BUFSIZE 1024
3094 if (nread < headersize) {
3095 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3096 "header for file %s (%s). Terminating\n",
3097 fsp_str_dbg(fsp), strerror(errno)));
3098 exit_server_cleanly("sendfile_short_send failed");
3099 }
3100
3101 nread -= headersize;
3102
3103 if (nread < smb_maxcnt) {
3104 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3105 if (!buf) {
3106 exit_server_cleanly("sendfile_short_send: "
3107 "malloc failed");
3108 }
3109
3110 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3111 "with zeros !\n", fsp_str_dbg(fsp)));
3112
3113 while (nread < smb_maxcnt) {
3114 /*
3115 * We asked for the real file size and told sendfile
3116 * to not go beyond the end of the file. But it can
3117 * happen that in between our fstat call and the
3118 * sendfile call the file was truncated. This is very
3119 * bad because we have already announced the larger
3120 * number of bytes to the client.
3121 *
3122 * The best we can do now is to send 0-bytes, just as
3123 * a read from a hole in a sparse file would do.
3124 *
3125 * This should happen rarely enough that I don't care
3126 * about efficiency here :-)
3127 */
3128 size_t to_write;
3129
3130 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3131 if (write_data(fsp->conn->sconn->sock, buf, to_write)
3132 != to_write) {
3133 char addr[INET6_ADDRSTRLEN];
3134 /*
3135 * Try and give an error message saying what
3136 * client failed.
3137 */
3138 DEBUG(0, ("write_data failed for client %s. "
3139 "Error %s\n",
3140 get_peer_addr(
3141 fsp->conn->sconn->sock, addr,
3142 sizeof(addr)),
3143 strerror(errno)));
3144 exit_server_cleanly("sendfile_short_send: "
3145 "write_data failed");
3146 }
3147 nread += to_write;
3148 }
3149 SAFE_FREE(buf);
3150 }
3151 }
3152
3153 /****************************************************************************
3154 Return a readbraw error (4 bytes of zero).
3155 ****************************************************************************/
3156
3157 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3158 {
3159 char header[4];
3160
3161 SIVAL(header,0,0);
3162
3163 smbd_lock_socket(sconn);
3164 if (write_data(sconn->sock,header,4) != 4) {
3165 char addr[INET6_ADDRSTRLEN];
3166 /*
3167 * Try and give an error message saying what
3168 * client failed.
3169 */
3170 DEBUG(0, ("write_data failed for client %s. "
3171 "Error %s\n",
3172 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3173 strerror(errno)));
3174
3175 fail_readraw();
3176 }
3177 smbd_unlock_socket(sconn);
3178 }
3179
3180 /****************************************************************************
3181 Use sendfile in readbraw.
3182 ****************************************************************************/
3183
3184 static void send_file_readbraw(connection_struct *conn,
3185 struct smb_request *req,
3186 files_struct *fsp,
3187 off_t startpos,
3188 size_t nread,
3189 ssize_t mincount)
3190 {
3191 struct smbd_server_connection *sconn = req->sconn;
3192 char *outbuf = NULL;
3193 ssize_t ret=0;
3194
3195 /*
3196 * We can only use sendfile on a non-chained packet
3197 * but we can use on a non-oplocked file. tridge proved this
3198 * on a train in Germany :-). JRA.
3199 * reply_readbraw has already checked the length.
3200 */
3201
3202 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3203 (fsp->wcp == NULL) &&
3204 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3205 ssize_t sendfile_read = -1;
3206 char header[4];
3207 DATA_BLOB header_blob;
3208
3209 _smb_setlen(header,nread);
3210 header_blob = data_blob_const(header, 4);
3211
3212 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3213 &header_blob, startpos,
3214 nread);
3215 if (sendfile_read == -1) {
3216 /* Returning ENOSYS means no data at all was sent.
3217 * Do this as a normal read. */
3218 if (errno == ENOSYS) {
3219 goto normal_readbraw;
3220 }
3221
3222 /*
3223 * Special hack for broken Linux with no working sendfile. If we
3224 * return EINTR we sent the header but not the rest of the data.
3225 * Fake this up by doing read/write calls.
3226 */
3227 if (errno == EINTR) {
3228 /* Ensure we don't do this again. */
3229 set_use_sendfile(SNUM(conn), False);
3230 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3231
3232 if (fake_sendfile(fsp, startpos, nread) == -1) {
3233 DEBUG(0,("send_file_readbraw: "
3234 "fake_sendfile failed for "
3235 "file %s (%s).\n",
3236 fsp_str_dbg(fsp),
3237 strerror(errno)));
3238 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3239 }
3240 return;
3241 }
3242
3243 DEBUG(0,("send_file_readbraw: sendfile failed for "
3244 "file %s (%s). Terminating\n",
3245 fsp_str_dbg(fsp), strerror(errno)));
3246 exit_server_cleanly("send_file_readbraw sendfile failed");
3247 } else if (sendfile_read == 0) {
3248 /*
3249 * Some sendfile implementations return 0 to indicate
3250 * that there was a short read, but nothing was
3251 * actually written to the socket. In this case,
3252 * fallback to the normal read path so the header gets
3253 * the correct byte count.
3254 */
3255 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3256 "bytes falling back to the normal read: "
3257 "%s\n", fsp_str_dbg(fsp)));
3258 goto normal_readbraw;
3259 }
3260
3261 /* Deal with possible short send. */
3262 if (sendfile_read != 4+nread) {
3263 sendfile_short_send(fsp, sendfile_read, 4, nread);
3264 }
3265 return;
3266 }
3267
3268 normal_readbraw:
3269
3270 outbuf = talloc_array(NULL, char, nread+4);
3271 if (!outbuf) {
3272 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3273 (unsigned)(nread+4)));
3274 reply_readbraw_error(sconn);
3275 return;
3276 }
3277
3278 if (nread > 0) {
3279 ret = read_file(fsp,outbuf+4,startpos,nread);
3280 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3281 if (ret < mincount)
3282 ret = 0;
3283 #else
3284 if (ret < nread)
3285 ret = 0;
3286 #endif
3287 }
3288
3289 _smb_setlen(outbuf,ret);
3290 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3291 char addr[INET6_ADDRSTRLEN];
3292 /*
3293 * Try and give an error message saying what
3294 * client failed.
3295 */
3296 DEBUG(0, ("write_data failed for client %s. "
3297 "Error %s\n",
3298 get_peer_addr(fsp->conn->sconn->sock, addr,
3299 sizeof(addr)),
3300 strerror(errno)));
3301
3302 fail_readraw();
3303 }
3304
3305 TALLOC_FREE(outbuf);
3306 }
3307
3308 /****************************************************************************
3309 Reply to a readbraw (core+ protocol).
3310 ****************************************************************************/
3311
3312 void reply_readbraw(struct smb_request *req)
3313 {
3314 connection_struct *conn = req->conn;
3315 struct smbd_server_connection *sconn = req->sconn;
3316 ssize_t maxcount,mincount;
3317 size_t nread = 0;
3318 off_t startpos;
3319 files_struct *fsp;
3320 struct lock_struct lock;
3321 off_t size = 0;
3322
3323 START_PROFILE(SMBreadbraw);
3324
3325 if (srv_is_signing_active(sconn) || req->encrypted) {
3326 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3327 "raw reads/writes are disallowed.");
3328 }
3329
3330 if (req->wct < 8) {
3331 reply_readbraw_error(sconn);
3332 END_PROFILE(SMBreadbraw);
3333 return;
3334 }
3335
3336 if (sconn->smb1.echo_handler.trusted_fde) {
3337 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3338 "'async smb echo handler = yes'\n"));
3339 reply_readbraw_error(sconn);
3340 END_PROFILE(SMBreadbraw);
3341 return;
3342 }
3343
3344 /*
3345 * Special check if an oplock break has been issued
3346 * and the readraw request croses on the wire, we must
3347 * return a zero length response here.
3348 */
3349
3350 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3351
3352 /*
3353 * We have to do a check_fsp by hand here, as
3354 * we must always return 4 zero bytes on error,
3355 * not a NTSTATUS.
3356 */
3357
3358 if (!fsp || !conn || conn != fsp->conn ||
3359 req->vuid != fsp->vuid ||
3360 fsp->is_directory || fsp->fh->fd == -1) {
3361 /*
3362 * fsp could be NULL here so use the value from the packet. JRA.
3363 */
3364 DEBUG(3,("reply_readbraw: fnum %d not valid "
3365 "- cache prime?\n",
3366 (int)SVAL(req->vwv+0, 0)));
3367 reply_readbraw_error(sconn);
3368 END_PROFILE(SMBreadbraw);
3369 return;
3370 }
3371
3372 /* Do a "by hand" version of CHECK_READ. */
3373 if (!(fsp->can_read ||
3374 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3375 (fsp->access_mask & FILE_EXECUTE)))) {
3376 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3377 (int)SVAL(req->vwv+0, 0)));
3378 reply_readbraw_error(sconn);
3379 END_PROFILE(SMBreadbraw);
3380 return;
3381 }
3382
3383 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3384
3385 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3386 if(req->wct == 10) {
3387 /*
3388 * This is a large offset (64 bit) read.
3389 */
3390
3391 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3392
3393 if(startpos < 0) {
3394 DEBUG(0,("reply_readbraw: negative 64 bit "
3395 "readraw offset (%.0f) !\n",
3396 (double)startpos ));
3397 reply_readbraw_error(sconn);
3398 END_PROFILE(SMBreadbraw);
3399 return;
3400 }
3401 }
3402
3403 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3404 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3405
3406 /* ensure we don't overrun the packet size */
3407 maxcount = MIN(65535,maxcount);
3408
3409 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3410 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3411 &lock);
3412
3413 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3414 reply_readbraw_error(sconn);
3415 END_PROFILE(SMBreadbraw);
3416 return;
3417 }
3418
3419 if (fsp_stat(fsp) == 0) {
3420 size = fsp->fsp_name->st.st_ex_size;
3421 }
3422
3423 if (startpos >= size) {
3424 nread = 0;
3425 } else {
3426 nread = MIN(maxcount,(size - startpos));
3427 }
3428
3429 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3430 if (nread < mincount)
3431 nread = 0;
3432 #endif
3433
3434 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3435 "min=%lu nread=%lu\n",
3436 fsp_fnum_dbg(fsp), (double)startpos,
3437 (unsigned long)maxcount,
3438 (unsigned long)mincount,
3439 (unsigned long)nread ) );
3440
3441 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3442
3443 DEBUG(5,("reply_readbraw finished\n"));
3444
3445 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3446
3447 END_PROFILE(SMBreadbraw);
3448 return;
3449 }
3450
3451 #undef DBGC_CLASS
3452 #define DBGC_CLASS DBGC_LOCKING
3453
3454 /****************************************************************************
3455 Reply to a lockread (core+ protocol).
3456 ****************************************************************************/
3457
3458 void reply_lockread(struct smb_request *req)
3459 {
3460 connection_struct *conn = req->conn;
3461 ssize_t nread = -1;
3462 char *data;
3463 off_t startpos;
3464 size_t numtoread;
3465 size_t maxtoread;
3466 NTSTATUS status;
3467 files_struct *fsp;
3468 struct byte_range_lock *br_lck = NULL;
3469 char *p = NULL;
3470 struct smbd_server_connection *sconn = req->sconn;
3471
3472 START_PROFILE(SMBlockread);
3473
3474 if (req->wct < 5) {
3475 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3476 END_PROFILE(SMBlockread);
3477 return;
3478 }
3479
3480 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3481
3482 if (!check_fsp(conn, req, fsp)) {
3483 END_PROFILE(SMBlockread);
3484 return;
3485 }
3486
3487 if (!CHECK_READ(fsp,req)) {
3488 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3489 END_PROFILE(SMBlockread);
3490 return;
3491 }
3492
3493 numtoread = SVAL(req->vwv+1, 0);
3494 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3495
3496 /*
3497 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3498 * protocol request that predates the read/write lock concept.
3499 * Thus instead of asking for a read lock here we need to ask
3500 * for a write lock. JRA.
3501 * Note that the requested lock size is unaffected by max_send.
3502 */
3503
3504 br_lck = do_lock(req->sconn->msg_ctx,
3505 fsp,
3506 (uint64_t)req->smbpid,
3507 (uint64_t)numtoread,
3508 (uint64_t)startpos,
3509 WRITE_LOCK,
3510 WINDOWS_LOCK,
3511 False, /* Non-blocking lock. */
3512 &status,
3513 NULL);
3514 TALLOC_FREE(br_lck);
3515
3516 if (NT_STATUS_V(status)) {
3517 reply_nterror(req, status);
3518 END_PROFILE(SMBlockread);
3519 return;
3520 }
3521
3522 /*
3523 * However the requested READ size IS affected by max_send. Insanity.... JRA.
3524 */
3525 maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3526
3527 if (numtoread > maxtoread) {
3528 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3529 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3530 (unsigned int)numtoread, (unsigned int)maxtoread,
3531 (unsigned int)sconn->smb1.sessions.max_send));
3532 numtoread = maxtoread;
3533 }
3534
3535 reply_outbuf(req, 5, numtoread + 3);
3536
3537 data = smb_buf(req->outbuf) + 3;
3538
3539 nread = read_file(fsp,data,startpos,numtoread);
3540
3541 if (nread < 0) {
3542 reply_nterror(req, map_nt_error_from_unix(errno));
3543 END_PROFILE(SMBlockread);
3544 return;
3545 }
3546
3547 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3548
3549 SSVAL(req->outbuf,smb_vwv0,nread);
3550 SSVAL(req->outbuf,smb_vwv5,nread+3);
3551 p = smb_buf(req->outbuf);
3552 SCVAL(p,0,0); /* pad byte. */
3553 SSVAL(p,1,nread);
3554
3555 DEBUG(3,("lockread %s num=%d nread=%d\n",
3556 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3557
3558 END_PROFILE(SMBlockread);
3559 return;
3560 }
3561
3562 #undef DBGC_CLASS
3563 #define DBGC_CLASS DBGC_ALL
3564
3565 /****************************************************************************
3566 Reply to a read.
3567 ****************************************************************************/
3568
3569 void reply_read(struct smb_request *req)
3570 {
3571 connection_struct *conn = req->conn;
3572 size_t numtoread;
3573 size_t maxtoread;
3574 ssize_t nread = 0;
3575 char *data;
3576 off_t startpos;
3577 files_struct *fsp;
3578 struct lock_struct lock;
3579 struct smbd_server_connection *sconn = req->sconn;
3580
3581 START_PROFILE(SMBread);
3582
3583 if (req->wct < 3) {
3584 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3585 END_PROFILE(SMBread);
3586 return;
3587 }
3588
3589 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3590
3591 if (!check_fsp(conn, req, fsp)) {
3592 END_PROFILE(SMBread);
3593 return;
3594 }
3595
3596 if (!CHECK_READ(fsp,req)) {
3597 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3598 END_PROFILE(SMBread);
3599 return;
3600 }
3601
3602 numtoread = SVAL(req->vwv+1, 0);
3603 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3604
3605 /*
3606 * The requested read size cannot be greater than max_send. JRA.
3607 */
3608 maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3609
3610 if (numtoread > maxtoread) {
3611 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3612 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3613 (unsigned int)numtoread, (unsigned int)maxtoread,
3614 (unsigned int)sconn->smb1.sessions.max_send));
3615 numtoread = maxtoread;
3616 }
3617
3618 reply_outbuf(req, 5, numtoread+3);
3619
3620 data = smb_buf(req->outbuf) + 3;
3621
3622 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3623 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3624 &lock);
3625
3626 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3627 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3628 END_PROFILE(SMBread);
3629 return;
3630 }
3631
3632 if (numtoread > 0)
3633 nread = read_file(fsp,data,startpos,numtoread);
3634
3635 if (nread < 0) {
3636 reply_nterror(req, map_nt_error_from_unix(errno));
3637 goto strict_unlock;
3638 }
3639
3640 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3641
3642 SSVAL(req->outbuf,smb_vwv0,nread);
3643 SSVAL(req->outbuf,smb_vwv5,nread+3);
3644 SCVAL(smb_buf(req->outbuf),0,1);
3645 SSVAL(smb_buf(req->outbuf),1,nread);
3646
3647 DEBUG(3, ("read %s num=%d nread=%d\n",
3648 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3649
3650 strict_unlock:
3651 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3652
3653 END_PROFILE(SMBread);
3654 return;
3655 }
3656
3657 /****************************************************************************
3658 Setup readX header.
3659 ****************************************************************************/
3660
3661 static int setup_readX_header(struct smb_request *req, char *outbuf,
3662 size_t smb_maxcnt)
3663 {
3664 int outsize;
3665
3666 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3667
3668 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3669
3670 SCVAL(outbuf,smb_vwv0,0xFF);
3671 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3672 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3673 SSVAL(outbuf,smb_vwv6,
3674 (smb_wct - 4) /* offset from smb header to wct */
3675 + 1 /* the wct field */
3676 + 12 * sizeof(uint16_t) /* vwv */
3677 + 2); /* the buflen field */
3678 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3679 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3680 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3681 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3682 return outsize;
3683 }
3684
3685 /****************************************************************************
3686 Reply to a read and X - possibly using sendfile.
3687 ****************************************************************************/
3688
3689 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3690 files_struct *fsp, off_t startpos,
3691 size_t smb_maxcnt)
3692 {
3693 ssize_t nread = -1;
3694 struct lock_struct lock;
3695 int saved_errno = 0;
3696
3697 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3698 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3699 &lock);
3700
3701 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3702 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3703 return;
3704 }
3705
3706 /*
3707 * We can only use sendfile on a non-chained packet
3708 * but we can use on a non-oplocked file. tridge proved this
3709 * on a train in Germany :-). JRA.
3710 */
3711
3712 if (!req_is_in_chain(req) &&
3713 !req->encrypted &&
3714 (fsp->base_fsp == NULL) &&
3715 (fsp->wcp == NULL) &&
3716 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3717 uint8 headerbuf[smb_size + 12 * 2];
3718 DATA_BLOB header;
3719
3720 if(fsp_stat(fsp) == -1) {
3721 reply_nterror(req, map_nt_error_from_unix(errno));
3722 goto strict_unlock;
3723 }
3724
3725 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3726 (startpos > fsp->fsp_name->st.st_ex_size) ||
3727 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3728 /*
3729 * We already know that we would do a short read, so don't
3730 * try the sendfile() path.
3731 */
3732 goto nosendfile_read;
3733 }
3734
3735 /*
3736 * Set up the packet header before send. We
3737 * assume here the sendfile will work (get the
3738 * correct amount of data).
3739 */
3740
3741 header = data_blob_const(headerbuf, sizeof(headerbuf));
3742
3743 construct_reply_common_req(req, (char *)headerbuf);
3744 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3745
3746 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3747 startpos, smb_maxcnt);
3748 if (nread == -1) {
3749 /* Returning ENOSYS means no data at all was sent.
3750 Do this as a normal read. */
3751 if (errno == ENOSYS) {
3752 goto normal_read;
3753 }
3754
3755 /*
3756 * Special hack for broken Linux with no working sendfile. If we
3757 * return EINTR we sent the header but not the rest of the data.
3758 * Fake this up by doing read/write calls.
3759 */
3760
3761 if (errno == EINTR) {
3762 /* Ensure we don't do this again. */
3763 set_use_sendfile(SNUM(conn), False);
3764 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3765 nread = fake_sendfile(fsp, startpos,
3766 smb_maxcnt);
3767 if (nread == -1) {
3768 DEBUG(0,("send_file_readX: "
3769 "fake_sendfile failed for "
3770 "file %s (%s).\n",
3771 fsp_str_dbg(fsp),
3772 strerror(errno)));
3773 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3774 }
3775 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3776 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3777 /* No outbuf here means successful sendfile. */
3778 goto strict_unlock;
3779 }
3780
3781 DEBUG(0,("send_file_readX: sendfile failed for file "
3782 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3783 strerror(errno)));
3784 exit_server_cleanly("send_file_readX sendfile failed");
3785 } else if (nread == 0) {
3786 /*
3787 * Some sendfile implementations return 0 to indicate
3788 * that there was a short read, but nothing was
3789 * actually written to the socket. In this case,
3790 * fallback to the normal read path so the header gets
3791 * the correct byte count.
3792 */
3793 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3794 "falling back to the normal read: %s\n",
3795 fsp_str_dbg(fsp)));
3796 goto normal_read;
3797 }
3798
3799 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3800 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3801
3802 /* Deal with possible short send. */
3803 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3804 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3805 }
3806 /* No outbuf here means successful sendfile. */
3807 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3808 SMB_PERFCOUNT_END(&req->pcd);
3809 goto strict_unlock;
3810 }
3811
3812 normal_read:
3813
3814 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3815 uint8 headerbuf[smb_size + 2*12];
3816
3817 construct_reply_common_req(req, (char *)headerbuf);
3818 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3819
3820 /* Send out the header. */
3821 if (write_data(req->sconn->sock, (char *)headerbuf,
3822 sizeof(headerbuf)) != sizeof(headerbuf)) {
3823
3824 char addr[INET6_ADDRSTRLEN];
3825 /*
3826 * Try and give an error message saying what
3827 * client failed.
3828 */
3829 DEBUG(0, ("write_data failed for client %s. "
3830 "Error %s\n",
3831 get_peer_addr(req->sconn->sock, addr,
3832 sizeof(addr)),
3833 strerror(errno)));
3834
3835 DEBUG(0,("send_file_readX: write_data failed for file "
3836 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3837 strerror(errno)));
3838 exit_server_cleanly("send_file_readX sendfile failed");
3839 }
3840 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3841 if (nread == -1) {
3842 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3843 "file %s (%s).\n", fsp_str_dbg(fsp),
3844 strerror(errno)));
3845 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3846 }
3847 goto strict_unlock;
3848 }
3849
3850 nosendfile_read:
3851
3852 reply_outbuf(req, 12, smb_maxcnt);
3853 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3854 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3855
3856 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3857 saved_errno = errno;
3858
3859 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3860
3861 if (nread < 0) {
3862 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3863 return;
3864 }
3865
3866 setup_readX_header(req, (char *)req->outbuf, nread);
3867
3868 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3869 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3870 return;
3871
3872 strict_unlock:
3873 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3874 TALLOC_FREE(req->outbuf);
3875 return;
3876 }
3877
3878 /****************************************************************************
3879 Work out how much space we have for a read return.
3880 ****************************************************************************/
3881
3882 static size_t calc_max_read_pdu(const struct smb_request *req)
3883 {
3884 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3885 return req->sconn->smb1.sessions.max_send;
3886 }
3887
3888 if (!lp_large_readwrite()) {
3889 return req->sconn->smb1.sessions.max_send;
3890 }
3891
3892 if (req_is_in_chain(req)) {
3893 return req->sconn->smb1.sessions.max_send;
3894 }
3895
3896 if (req->encrypted) {
3897 /*
3898 * Don't take encrypted traffic up to the
3899 * limit. There are padding considerations
3900 * that make that tricky.
3901 */
3902 return req->sconn->smb1.sessions.max_send;
3903 }
3904
3905 if (srv_is_signing_active(req->sconn)) {
3906 return 0x1FFFF;
3907 }
3908
3909 if (!lp_unix_extensions()) {
3910 return 0x1FFFF;
3911 }
3912
3913 /*
3914 * We can do ultra-large POSIX reads.
3915 */
3916 return 0xFFFFFF;
3917 }
3918
3919 /****************************************************************************
3920 Calculate how big a read can be. Copes with all clients. It's always
3921 safe to return a short read - Windows does this.
3922 ****************************************************************************/
3923
3924 static size_t calc_read_size(const struct smb_request *req,
3925 size_t upper_size,
3926 size_t lower_size)
3927 {
3928 size_t max_pdu = calc_max_read_pdu(req);
3929 size_t total_size = 0;
3930 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3931 size_t max_len = max_pdu - hdr_len;
3932
3933 /*
3934 * Windows explicitly ignores upper size of 0xFFFF.
3935 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3936 * We must do the same as these will never fit even in
3937 * an extended size NetBIOS packet.
3938 */
3939 if (upper_size == 0xFFFF) {
3940 upper_size = 0;
3941 }
3942
3943 if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3944 upper_size = 0;
3945 }
3946
3947 total_size = ((upper_size<<16) | lower_size);
3948
3949 /*
3950 * LARGE_READX test shows it's always safe to return
3951 * a short read. Windows does so.
3952 */
3953 return MIN(total_size, max_len);
3954 }
3955
3956 /****************************************************************************
3957 Reply to a read and X.
3958 ****************************************************************************/
3959
3960 void reply_read_and_X(struct smb_request *req)
3961 {
3962 connection_struct *conn = req->conn;
3963 files_struct *fsp;
3964 off_t startpos;
3965 size_t smb_maxcnt;
3966 size_t upper_size;
3967 bool big_readX = False;
3968 #if 0
3969 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3970 #endif
3971
3972 START_PROFILE(SMBreadX);
3973
3974 if ((req->wct != 10) && (req->wct != 12)) {
3975 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3976 return;
3977 }
3978
3979 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3980 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3981 smb_maxcnt = SVAL(req->vwv+5, 0);
3982
3983 /* If it's an IPC, pass off the pipe handler. */
3984 if (IS_IPC(conn)) {
3985 reply_pipe_read_and_X(req);
3986 END_PROFILE(SMBreadX);
3987 return;
3988 }
3989
3990 if (!check_fsp(conn, req, fsp)) {
3991 END_PROFILE(SMBreadX);
3992 return;
3993 }
3994
3995 if (!CHECK_READ(fsp,req)) {
3996 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3997 END_PROFILE(SMBreadX);
3998 return;
3999 }
4000
4001 upper_size = SVAL(req->vwv+7, 0);
4002 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4003 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4004 /*
4005 * This is a heuristic to avoid keeping large
4006 * outgoing buffers around over long-lived aio
4007 * requests.
4008 */
4009 big_readX = True;
4010 }
4011
4012 if (req->wct == 12) {
4013 /*
4014 * This is a large offset (64 bit) read.
4015 */
4016 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4017
4018 }
4019
4020 if (!big_readX) {
4021 NTSTATUS status = schedule_aio_read_and_X(conn,
4022 req,
4023 fsp,
4024 startpos,
4025 smb_maxcnt);
4026 if (NT_STATUS_IS_OK(status)) {
4027 /* Read scheduled - we're done. */
4028 goto out;
4029 }
4030 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4031 /* Real error - report to client. */
4032 END_PROFILE(SMBreadX);
4033 reply_nterror(req, status);
4034 return;
4035 }
4036 /* NT_STATUS_RETRY - fall back to sync read. */
4037 }
4038
4039 smbd_lock_socket(req->sconn);
4040 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4041 smbd_unlock_socket(req->sconn);
4042
4043 out:
4044 END_PROFILE(SMBreadX);
4045 return;
4046 }
4047
4048 /****************************************************************************
4049 Error replies to writebraw must have smb_wct == 1. Fix this up.
4050 ****************************************************************************/
4051
4052 void error_to_writebrawerr(struct smb_request *req)
4053 {
4054 uint8 *old_outbuf = req->outbuf;
4055
4056 reply_outbuf(req, 1, 0);
4057
4058 memcpy(req->outbuf, old_outbuf, smb_size);
4059 TALLOC_FREE(old_outbuf);
4060 }
4061
4062 /****************************************************************************
4063 Read 4 bytes of a smb packet and return the smb length of the packet.
4064 Store the result in the buffer. This version of the function will
4065 never return a session keepalive (length of zero).
4066 Timeout is in milliseconds.
4067 ****************************************************************************/
4068
4069 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4070 size_t *len)
4071 {
4072 uint8_t msgtype = NBSSkeepalive;
4073
4074 while (msgtype == NBSSkeepalive) {
4075 NTSTATUS status;
4076
4077 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4078 len);
4079 if (!NT_STATUS_IS_OK(status)) {
4080 char addr[INET6_ADDRSTRLEN];
4081 /* Try and give an error message
4082 * saying what client failed. */
4083 DEBUG(0, ("read_fd_with_timeout failed for "
4084 "client %s read error = %s.\n",
4085 get_peer_addr(fd,addr,sizeof(addr)),
4086 nt_errstr(status)));
4087 return status;
4088 }
4089
4090 msgtype = CVAL(inbuf, 0);
4091 }
4092
4093 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4094 (unsigned long)len));
4095
4096 return NT_STATUS_OK;
4097 }
4098
4099 /****************************************************************************
4100 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4101 ****************************************************************************/
4102
4103 void reply_writebraw(struct smb_request *req)
4104 {
4105 connection_struct *conn = req->conn;
4106 char *buf = NULL;
4107 ssize_t nwritten=0;
4108 ssize_t total_written=0;
4109 size_t numtowrite=0;
4110 size_t tcount;
4111 off_t startpos;
4112 const char *data=NULL;
4113 bool write_through;
4114 files_struct *fsp;
4115 struct lock_struct lock;
4116 NTSTATUS status;
4117
4118 START_PROFILE(SMBwritebraw);
4119
4120 /*
4121 * If we ever reply with an error, it must have the SMB command
4122 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4123 * we're finished.
4124 */
4125 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4126
4127 if (srv_is_signing_active(req->sconn)) {
4128 END_PROFILE(SMBwritebraw);
4129 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4130 "raw reads/writes are disallowed.");
4131 }
4132
4133 if (req->wct < 12) {
4134 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4135 error_to_writebrawerr(req);
4136 END_PROFILE(SMBwritebraw);
4137 return;
4138 }
4139
4140 if (req->sconn->smb1.echo_handler.trusted_fde) {
4141 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4142 "'async smb echo handler = yes'\n"));
4143 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4144 error_to_writebrawerr(req);
4145 END_PROFILE(SMBwritebraw);
4146 return;
4147 }
4148
4149 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4150 if (!check_fsp(conn, req, fsp)) {
4151 error_to_writebrawerr(req);
4152 END_PROFILE(SMBwritebraw);
4153 return;
4154 }
4155
4156 if (!CHECK_WRITE(fsp)) {
4157 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4158 error_to_writebrawerr(req);
4159 END_PROFILE(SMBwritebraw);
4160 return;
4161 }
4162
4163 tcount = IVAL(req->vwv+1, 0);
4164 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4165 write_through = BITSETW(req->vwv+7,0);
4166
4167 /* We have to deal with slightly different formats depending
4168 on whether we are using the core+ or lanman1.0 protocol */
4169
4170 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4171 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4172 data = smb_buf_const(req->inbuf);
4173 } else {
4174 numtowrite = SVAL(req->vwv+10, 0);
4175 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4176 }
4177
4178 /* Ensure we don't write bytes past the end of this packet. */
4179 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4181 error_to_writebrawerr(req);
4182 END_PROFILE(SMBwritebraw);
4183 return;
4184 }
4185
4186 if (!fsp->print_file) {
4187 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4188 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4189 &lock);
4190
4191 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4192 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4193 error_to_writebrawerr(req);
4194 END_PROFILE(SMBwritebraw);
4195 return;
4196 }
4197 }
4198
4199 if (numtowrite>0) {
4200 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4201 }
4202
4203 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4204 "wrote=%d sync=%d\n",
4205 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4206 (int)nwritten, (int)write_through));
4207
4208 if (nwritten < (ssize_t)numtowrite) {
4209 reply_nterror(req, NT_STATUS_DISK_FULL);
4210 error_to_writebrawerr(req);
4211 goto strict_unlock;
4212 }
4213
4214 total_written = nwritten;
4215
4216 /* Allocate a buffer of 64k + length. */
4217 buf = talloc_array(NULL, char, 65540);
4218 if (!buf) {
4219 reply_nterror(req, NT_STATUS_NO_MEMORY);
4220 error_to_writebrawerr(req);
4221 goto strict_unlock;
4222 }
4223
4224 /* Return a SMBwritebraw message to the redirector to tell
4225 * it to send more bytes */
4226
4227 memcpy(buf, req->inbuf, smb_size);
4228 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4229 SCVAL(buf,smb_com,SMBwritebraw);
4230 SSVALS(buf,smb_vwv0,0xFFFF);
4231 show_msg(buf);
4232 if (!srv_send_smb(req->sconn,
4233 buf,
4234 false, 0, /* no signing */
4235 IS_CONN_ENCRYPTED(conn),
4236 &req->pcd)) {
4237 exit_server_cleanly("reply_writebraw: srv_send_smb "
4238 "failed.");
4239 }
4240
4241 /* Now read the raw data into the buffer and write it */
4242 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4243 &numtowrite);
4244 if (!NT_STATUS_IS_OK(status)) {
4245 exit_server_cleanly("secondary writebraw failed");
4246 }
4247
4248 /* Set up outbuf to return the correct size */
4249 reply_outbuf(req, 1, 0);
4250
4251 if (numtowrite != 0) {
4252
4253 if (numtowrite > 0xFFFF) {
4254 DEBUG(0,("reply_writebraw: Oversize secondary write "
4255 "raw requested (%u). Terminating\n",
4256 (unsigned int)numtowrite ));
4257 exit_server_cleanly("secondary writebraw failed");
4258 }
4259
4260 if (tcount > nwritten+numtowrite) {
4261 DEBUG(3,("reply_writebraw: Client overestimated the "
4262 "write %d %d %d\n",
4263 (int)tcount,(int)nwritten,(int)numtowrite));
4264 }
4265
4266 status = read_data(req->sconn->sock, buf+4, numtowrite);
4267
4268 if (!NT_STATUS_IS_OK(status)) {
4269 char addr[INET6_ADDRSTRLEN];
4270 /* Try and give an error message
4271 * saying what client failed. */
4272 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4273 "raw read failed (%s) for client %s. "
4274 "Terminating\n", nt_errstr(status),
4275 get_peer_addr(req->sconn->sock, addr,
4276 sizeof(addr))));
4277 exit_server_cleanly("secondary writebraw failed");
4278 }
4279
4280 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4281 if (nwritten == -1) {
4282 TALLOC_FREE(buf);
4283 reply_nterror(req, map_nt_error_from_unix(errno));
4284 error_to_writebrawerr(req);
4285 goto strict_unlock;
4286 }
4287
4288 if (nwritten < (ssize_t)numtowrite) {
4289 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4290 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4291 }
4292
4293 if (nwritten > 0) {
4294 total_written += nwritten;
4295 }
4296 }
4297
4298 TALLOC_FREE(buf);
4299 SSVAL(req->outbuf,smb_vwv0,total_written);
4300
4301 status = sync_file(conn, fsp, write_through);
4302 if (!NT_STATUS_IS_OK(status)) {
4303 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4304 fsp_str_dbg(fsp), nt_errstr(status)));
4305 reply_nterror(req, status);
4306 error_to_writebrawerr(req);
4307 goto strict_unlock;
4308 }
4309
4310 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4311 "wrote=%d\n",
4312 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4313 (int)total_written));
4314
4315 if (!fsp->print_file) {
4316 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4317 }
4318
4319 /* We won't return a status if write through is not selected - this
4320 * follows what WfWg does */
4321 END_PROFILE(SMBwritebraw);
4322
4323 if (!write_through && total_written==tcount) {
4324
4325 #if RABBIT_PELLET_FIX
4326 /*
4327 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4328 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4329 * JRA.
4330 */
4331 if (!send_keepalive(req->sconn->sock)) {
4332 exit_server_cleanly("reply_writebraw: send of "
4333 "keepalive failed");
4334 }
4335 #endif
4336 TALLOC_FREE(req->outbuf);
4337 }
4338 return;
4339
4340 strict_unlock:
4341 if (!fsp->print_file) {
4342 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4343 }
4344
4345 END_PROFILE(SMBwritebraw);
4346 return;
4347 }
4348
4349 #undef DBGC_CLASS
4350 #define DBGC_CLASS DBGC_LOCKING
4351
4352 /****************************************************************************
4353 Reply to a writeunlock (core+).
4354 ****************************************************************************/
4355
4356 void reply_writeunlock(struct smb_request *req)
4357 {
4358 connection_struct *conn = req->conn;
4359 ssize_t nwritten = -1;
4360 size_t numtowrite;
4361 off_t startpos;
4362 const char *data;
4363 NTSTATUS status = NT_STATUS_OK;
4364 files_struct *fsp;
4365 struct lock_struct lock;
4366 int saved_errno = 0;
4367
4368 START_PROFILE(SMBwriteunlock);
4369
4370 if (req->wct < 5) {
4371 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4372 END_PROFILE(SMBwriteunlock);
4373 return;
4374 }
4375
4376 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4377
4378 if (!check_fsp(conn, req, fsp)) {
4379 END_PROFILE(SMBwriteunlock);
4380 return;
4381 }
4382
4383 if (!CHECK_WRITE(fsp)) {
4384 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4385 END_PROFILE(SMBwriteunlock);
4386 return;
4387 }
4388
4389 numtowrite = SVAL(req->vwv+1, 0);
4390 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4391 data = (const char *)req->buf + 3;
4392
4393 if (!fsp->print_file && numtowrite > 0) {
4394 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4395 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4396 &lock);
4397
4398 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4399 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4400 END_PROFILE(SMBwriteunlock);
4401 return;
4402 }
4403 }
4404
4405 /* The special X/Open SMB protocol handling of
4406 zero length writes is *NOT* done for
4407 this call */
4408 if(numtowrite == 0) {
4409 nwritten = 0;
4410 } else {
4411 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4412 saved_errno = errno;
4413 }
4414
4415 status = sync_file(conn, fsp, False /* write through */);
4416 if (!NT_STATUS_IS_OK(status)) {
4417 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4418 fsp_str_dbg(fsp), nt_errstr(status)));
4419 reply_nterror(req, status);
4420 goto strict_unlock;
4421 }
4422
4423 if(nwritten < 0) {
4424 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4425 goto strict_unlock;
4426 }
4427
4428 if((nwritten < numtowrite) && (numtowrite != 0)) {
4429 reply_nterror(req, NT_STATUS_DISK_FULL);
4430 goto strict_unlock;
4431 }
4432
4433 if (numtowrite && !fsp->print_file) {
4434 status = do_unlock(req->sconn->msg_ctx,
4435 fsp,
4436 (uint64_t)req->smbpid,
4437 (uint64_t)numtowrite,
4438 (uint64_t)startpos,
4439 WINDOWS_LOCK);
4440
4441 if (NT_STATUS_V(status)) {
4442 reply_nterror(req, status);
4443 goto strict_unlock;
4444 }
4445 }
4446
4447 reply_outbuf(req, 1, 0);
4448
4449 SSVAL(req->outbuf,smb_vwv0,nwritten);
4450
4451 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4452 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4453
4454 strict_unlock:
4455 if (numtowrite && !fsp->print_file) {
4456 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4457 }
4458
4459 END_PROFILE(SMBwriteunlock);
4460 return;
4461 }
4462
4463 #undef DBGC_CLASS
4464 #define DBGC_CLASS DBGC_ALL
4465
4466 /****************************************************************************
4467 Reply to a write.
4468 ****************************************************************************/
4469
4470 void reply_write(struct smb_request *req)
4471 {
4472 connection_struct *conn = req->conn;
4473 size_t numtowrite;
4474 ssize_t nwritten = -1;
4475 off_t startpos;
4476 const char *data;
4477 files_struct *fsp;
4478 struct lock_struct lock;
4479 NTSTATUS status;
4480 int saved_errno = 0;
4481
4482 START_PROFILE(SMBwrite);
4483
4484 if (req->wct < 5) {
4485 END_PROFILE(SMBwrite);
4486 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4487 return;
4488 }
4489
4490 /* If it's an IPC, pass off the pipe handler. */
4491 if (IS_IPC(conn)) {
4492 reply_pipe_write(req);
4493 END_PROFILE(SMBwrite);
4494 return;
4495 }
4496
4497 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4498
4499 if (!check_fsp(conn, req, fsp)) {
4500 END_PROFILE(SMBwrite);
4501 return;
4502 }
4503
4504 if (!CHECK_WRITE(fsp)) {
4505 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4506 END_PROFILE(SMBwrite);
4507 return;
4508 }
4509
4510 numtowrite = SVAL(req->vwv+1, 0);
4511 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4512 data = (const char *)req->buf + 3;
4513
4514 if (!fsp->print_file) {
4515 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4516 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4517 &lock);
4518
4519 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4520 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4521 END_PROFILE(SMBwrite);
4522 return;
4523 }
4524 }
4525
4526 /*
4527 * X/Open SMB protocol says that if smb_vwv1 is
4528 * zero then the file size should be extended or
4529 * truncated to the size given in smb_vwv[2-3].
4530 */
4531
4532 if(numtowrite == 0) {
4533 /*
4534 * This is actually an allocate call, and set EOF. JRA.
4535 */
4536 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4537 if (nwritten < 0) {
4538 reply_nterror(req, NT_STATUS_DISK_FULL);
4539 goto strict_unlock;
4540 }
4541 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4542 if (nwritten < 0) {
4543 reply_nterror(req, NT_STATUS_DISK_FULL);
4544 goto strict_unlock;
4545 }
4546 trigger_write_time_update_immediate(fsp);
4547 } else {
4548 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4549 }
4550
4551 status = sync_file(conn, fsp, False);
4552 if (!NT_STATUS_IS_OK(status)) {
4553 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4554 fsp_str_dbg(fsp), nt_errstr(status)));
4555 reply_nterror(req, status);
4556 goto strict_unlock;
4557 }
4558
4559 if(nwritten < 0) {
4560 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4561 goto strict_unlock;
4562 }
4563
4564 if((nwritten == 0) && (numtowrite != 0)) {
4565 reply_nterror(req, NT_STATUS_DISK_FULL);
4566 goto strict_unlock;
4567 }
4568
4569 reply_outbuf(req, 1, 0);
4570
4571 SSVAL(req->outbuf,smb_vwv0,nwritten);
4572
4573 if (nwritten < (ssize_t)numtowrite) {
4574 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4575 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4576 }
4577
4578 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4579
4580 strict_unlock:
4581 if (!fsp->print_file) {
4582 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4583 }
4584
4585 END_PROFILE(SMBwrite);
4586 return;
4587 }
4588
4589 /****************************************************************************
4590 Ensure a buffer is a valid writeX for recvfile purposes.
4591 ****************************************************************************/
4592
4593 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4594 (2*14) + /* word count (including bcc) */ \
4595 1 /* pad byte */)
4596
4597 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4598 const uint8_t *inbuf)
4599 {
4600 size_t numtowrite;
4601 unsigned int doff = 0;
4602 size_t len = smb_len_large(inbuf);
4603 uint16_t fnum;
4604 struct smbXsrv_open *op = NULL;
4605 struct files_struct *fsp = NULL;
4606 NTSTATUS status;
4607
4608 if (is_encrypted_packet(sconn, inbuf)) {
4609 /* Can't do this on encrypted
4610 * connections. */
4611 return false;
4612 }
4613
4614 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4615 return false;
4616 }
4617
4618 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4619 CVAL(inbuf,smb_wct) != 14) {
4620 DEBUG(10,("is_valid_writeX_buffer: chained or "
4621 "invalid word length.\n"));
4622 return false;
4623 }
4624
4625 fnum = SVAL(inbuf, smb_vwv2);
4626 status = smb1srv_open_lookup(sconn->conn,
4627 fnum,
4628 0, /* now */
4629 &op);
4630 if (!NT_STATUS_IS_OK(status)) {
4631 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4632 return false;
4633 }
4634 fsp = op->compat;
4635 if (fsp == NULL) {
4636 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4637 return false;
4638 }
4639 if (fsp->conn == NULL) {
4640 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4641 return false;
4642 }
4643
4644 if (IS_IPC(fsp->conn)) {
4645 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4646 return false;
4647 }
4648 if (IS_PRINT(fsp->conn)) {
4649 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4650 return false;
4651 }
4652 doff = SVAL(inbuf,smb_vwv11);
4653
4654 numtowrite = SVAL(inbuf,smb_vwv10);
4655
4656 if (len > doff && len - doff > 0xFFFF) {
4657 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4658 }
4659
4660 if (numtowrite == 0) {
4661 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4662 return false;
4663 }
4664
4665 /* Ensure the sizes match up. */
4666 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4667 /* no pad byte...old smbclient :-( */
4668 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4669 (unsigned int)doff,
4670 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4671 return false;
4672 }
4673
4674 if (len - doff != numtowrite) {
4675 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4676 "len = %u, doff = %u, numtowrite = %u\n",
4677 (unsigned int)len,
4678 (unsigned int)doff,
4679 (unsigned int)numtowrite ));
4680 return false;
4681 }
4682
4683 DEBUG(10,("is_valid_writeX_buffer: true "
4684 "len = %u, doff = %u, numtowrite = %u\n",
4685 (unsigned int)len,
4686 (unsigned int)doff,
4687 (unsigned int)numtowrite ));
4688
4689 return true;
4690 }
4691
4692 /****************************************************************************
4693 Reply to a write and X.
4694 ****************************************************************************/
4695
4696 void reply_write_and_X(struct smb_request *req)
4697 {
4698 connection_struct *conn = req->conn;
4699 files_struct *fsp;
4700 struct lock_struct lock;
4701 off_t startpos;
4702 size_t numtowrite;
4703 bool write_through;
4704 ssize_t nwritten;
4705 unsigned int smb_doff;
4706 unsigned int smblen;
4707 const char *data;
4708 NTSTATUS status;
4709 int saved_errno = 0;
4710
4711 START_PROFILE(SMBwriteX);
4712
4713 if ((req->wct != 12) && (req->wct != 14)) {
4714 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4715 goto out;
4716 }
4717
4718 numtowrite = SVAL(req->vwv+10, 0);
4719 smb_doff = SVAL(req->vwv+11, 0);
4720 smblen = smb_len(req->inbuf);
4721
4722 if (req->unread_bytes > 0xFFFF ||
4723 (smblen > smb_doff &&
4724 smblen - smb_doff > 0xFFFF)) {
4725 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4726 }
4727
4728 if (req->unread_bytes) {
4729 /* Can't do a recvfile write on IPC$ */
4730 if (IS_IPC(conn)) {
4731 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4732 goto out;
4733 }
4734 if (numtowrite != req->unread_bytes) {
4735 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4736 goto out;
4737 }
4738 } else {
4739 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4740 smb_doff + numtowrite > smblen) {
4741 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4742 goto out;
4743 }
4744 }
4745
4746 /* If it's an IPC, pass off the pipe handler. */
4747 if (IS_IPC(conn)) {
4748 if (req->unread_bytes) {
4749 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4750 goto out;
4751 }
4752 reply_pipe_write_and_X(req);
4753 goto out;
4754 }
4755
4756 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4757 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4758 write_through = BITSETW(req->vwv+7,0);
4759
4760 if (!check_fsp(conn, req, fsp)) {
4761 goto out;
4762 }
4763
4764 if (!CHECK_WRITE(fsp)) {
4765 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4766 goto out;
4767 }
4768
4769 data = smb_base(req->inbuf) + smb_doff;
4770
4771 if(req->wct == 14) {
4772 /*
4773 * This is a large offset (64 bit) write.
4774 */
4775 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4776
4777 }
4778
4779 /* X/Open SMB protocol says that, unlike SMBwrite
4780 if the length is zero then NO truncation is
4781 done, just a write of zero. To truncate a file,
4782 use SMBwrite. */
4783
4784 if(numtowrite == 0) {
4785 nwritten = 0;
4786 } else {
4787 if (req->unread_bytes == 0) {
4788 status = schedule_aio_write_and_X(conn,
4789 req,
4790 fsp,
4791 data,
4792 startpos,
4793 numtowrite);
4794
4795 if (NT_STATUS_IS_OK(status)) {
4796 /* write scheduled - we're done. */
4797 goto out;
4798 }
4799 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4800 /* Real error - report to client. */
4801 reply_nterror(req, status);
4802 goto out;
4803 }
4804 /* NT_STATUS_RETRY - fall through to sync write. */
4805 }
4806
4807 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4808 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4809 &lock);
4810
4811 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4812 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4813 goto out;
4814 }
4815
4816 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4817 saved_errno = errno;
4818
4819 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4820 }
4821
4822 if(nwritten < 0) {
4823 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4824 goto out;
4825 }
4826
4827 if((nwritten == 0) && (numtowrite != 0)) {
4828 reply_nterror(req, NT_STATUS_DISK_FULL);
4829 goto out;
4830 }
4831
4832 reply_outbuf(req, 6, 0);
4833 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4834 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4835 SSVAL(req->outbuf,smb_vwv2,nwritten);
4836 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4837
4838 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4839 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4840
4841 status = sync_file(conn, fsp, write_through);
4842 if (!NT_STATUS_IS_OK(status)) {
4843 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4844 fsp_str_dbg(fsp), nt_errstr(status)));
4845 reply_nterror(req, status);
4846 goto out;
4847 }
4848
4849 END_PROFILE(SMBwriteX);
4850 return;
4851
4852 out:
4853 if (req->unread_bytes) {
4854 /* writeX failed. drain socket. */
4855 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4856 req->unread_bytes) {
4857 smb_panic("failed to drain pending bytes");
4858 }
4859 req->unread_bytes = 0;
4860 }
4861
4862 END_PROFILE(SMBwriteX);
4863 return;
4864 }
4865
4866 /****************************************************************************
4867 Reply to a lseek.
4868 ****************************************************************************/
4869
4870 void reply_lseek(struct smb_request *req)
4871 {
4872 connection_struct *conn = req->conn;
4873 off_t startpos;
4874 off_t res= -1;
4875 int mode,umode;
4876 files_struct *fsp;
4877
4878 START_PROFILE(SMBlseek);
4879
4880 if (req->wct < 4) {
4881 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4882 END_PROFILE(SMBlseek);
4883 return;
4884 }
4885
4886 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4887
4888 if (!check_fsp(conn, req, fsp)) {
4889 return;
4890 }
4891
4892 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4893
4894 mode = SVAL(req->vwv+1, 0) & 3;
4895 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4896 startpos = (off_t)IVALS(req->vwv+2, 0);
4897
4898 switch (mode) {
4899 case 0:
4900 umode = SEEK_SET;
4901 res = startpos;
4902 break;
4903 case 1:
4904 umode = SEEK_CUR;
4905 res = fsp->fh->pos + startpos;
4906 break;
4907 case 2:
4908 umode = SEEK_END;
4909 break;
4910 default:
4911 umode = SEEK_SET;
4912 res = startpos;
4913 break;
4914 }
4915
4916 if (umode == SEEK_END) {
4917 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4918 if(errno == EINVAL) {
4919 off_t current_pos = startpos;
4920
4921 if(fsp_stat(fsp) == -1) {
4922 reply_nterror(req,
4923 map_nt_error_from_unix(errno));
4924 END_PROFILE(SMBlseek);
4925 return;
4926 }
4927
4928 current_pos += fsp->fsp_name->st.st_ex_size;
4929 if(current_pos < 0)
4930 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4931 }
4932 }
4933
4934 if(res == -1) {
4935 reply_nterror(req, map_nt_error_from_unix(errno));
4936 END_PROFILE(SMBlseek);
4937 return;
4938 }
4939 }
4940
4941 fsp->fh->pos = res;
4942
4943 reply_outbuf(req, 2, 0);
4944 SIVAL(req->outbuf,smb_vwv0,res);
4945
4946 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4947 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4948
4949 END_PROFILE(SMBlseek);
4950 return;
4951 }
4952
4953 /****************************************************************************
4954 Reply to a flush.
4955 ****************************************************************************/
4956
4957 void reply_flush(struct smb_request *req)
4958 {
4959 connection_struct *conn = req->conn;
4960 uint16 fnum;
4961 files_struct *fsp;
4962
4963 START_PROFILE(SMBflush);
4964
4965 if (req->wct < 1) {
4966 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4967 return;
4968 }
4969
4970 fnum = SVAL(req->vwv+0, 0);
4971 fsp = file_fsp(req, fnum);
4972
4973 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4974 return;
4975 }
4976
4977 if (!fsp) {
4978 file_sync_all(conn);
4979 } else {
4980 NTSTATUS status = sync_file(conn, fsp, True);
4981 if (!NT_STATUS_IS_OK(status)) {
4982 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4983 fsp_str_dbg(fsp), nt_errstr(status)));
4984 reply_nterror(req, status);
4985 END_PROFILE(SMBflush);
4986 return;
4987 }
4988 }
4989
4990 reply_outbuf(req, 0, 0);
4991
4992 DEBUG(3,("flush\n"));
4993 END_PROFILE(SMBflush);
4994 return;
4995 }
4996
4997 /****************************************************************************
4998 Reply to a exit.
4999 conn POINTER CAN BE NULL HERE !
5000 ****************************************************************************/
5001
5002 void reply_exit(struct smb_request *req)
5003 {
5004 START_PROFILE(SMBexit);
5005
5006 file_close_pid(req->sconn, req->smbpid, req->vuid);
5007
5008 reply_outbuf(req, 0, 0);
5009
5010 DEBUG(3,("exit\n"));
5011
5012 END_PROFILE(SMBexit);
5013 return;
5014 }
5015
5016 struct reply_close_state {
5017 files_struct *fsp;
5018 struct smb_request *smbreq;
5019 };
5020
5021 static void do_smb1_close(struct tevent_req *req);
5022
5023 void reply_close(struct smb_request *req)
5024 {
5025 connection_struct *conn = req->conn;
5026 NTSTATUS status = NT_STATUS_OK;
5027 files_struct *fsp = NULL;
5028 START_PROFILE(SMBclose);
5029
5030 if (req->wct < 3) {
5031 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5032 END_PROFILE(SMBclose);
5033 return;
5034 }
5035
5036 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5037
5038 /*
5039 * We can only use check_fsp if we know it's not a directory.
5040 */
5041
5042 if (!check_fsp_open(conn, req, fsp)) {
5043 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5044 END_PROFILE(SMBclose);
5045 return;
5046 }
5047
5048 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5049 fsp->is_directory ? "directory" : "file",
5050 fsp->fh->fd, fsp_fnum_dbg(fsp),
5051 conn->num_files_open));
5052
5053 if (!fsp->is_directory) {
5054 time_t t;
5055
5056 /*
5057 * Take care of any time sent in the close.
5058 */
5059
5060 t = srv_make_unix_date3(req->vwv+1);
5061 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5062 }
5063
5064 if (fsp->num_aio_requests != 0) {
5065
5066 struct reply_close_state *state;
5067
5068 DEBUG(10, ("closing with aio %u requests pending\n",
5069 fsp->num_aio_requests));
5070
5071 /*
5072 * We depend on the aio_extra destructor to take care of this
5073 * close request once fsp->num_aio_request drops to 0.
5074 */
5075
5076 fsp->deferred_close = tevent_wait_send(
5077 fsp, fsp->conn->sconn->ev_ctx);
5078 if (fsp->deferred_close == NULL) {
5079 status = NT_STATUS_NO_MEMORY;
5080 goto done;
5081 }
5082
5083 state = talloc(fsp, struct reply_close_state);
5084 if (state == NULL) {
5085 TALLOC_FREE(fsp->deferred_close);
5086 status = NT_STATUS_NO_MEMORY;
5087 goto done;
5088 }
5089 state->fsp = fsp;
5090 state->smbreq = talloc_move(fsp, &req);
5091 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5092 state);
5093 END_PROFILE(SMBclose);
5094 return;
5095 }
5096
5097 /*
5098 * close_file() returns the unix errno if an error was detected on
5099 * close - normally this is due to a disk full error. If not then it
5100 * was probably an I/O error.
5101 */
5102
5103 status = close_file(req, fsp, NORMAL_CLOSE);
5104 done:
5105 if (!NT_STATUS_IS_OK(status)) {
5106 reply_nterror(req, status);
5107 END_PROFILE(SMBclose);
5108 return;
5109 }
5110
5111 reply_outbuf(req, 0, 0);
5112 END_PROFILE(SMBclose);
5113 return;
5114 }
5115
5116 static void do_smb1_close(struct tevent_req *req)
5117 {
5118 struct reply_close_state *state = tevent_req_callback_data(
5119 req, struct reply_close_state);
5120 struct smb_request *smbreq;
5121 NTSTATUS status;
5122 int ret;
5123
5124 ret = tevent_wait_recv(req);
5125 TALLOC_FREE(req);
5126 if (ret != 0) {
5127 DEBUG(10, ("tevent_wait_recv returned %s\n",
5128 strerror(ret)));
5129 /*
5130 * Continue anyway, this should never happen
5131 */
5132 }
5133
5134 /*
5135 * fsp->smb2_close_request right now is a talloc grandchild of
5136 * fsp. When we close_file(fsp), it would go with it. No chance to
5137 * reply...
5138 */
5139 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5140
5141 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5142 if (NT_STATUS_IS_OK(status)) {
5143 reply_outbuf(smbreq, 0, 0);
5144 } else {
5145 reply_nterror(smbreq, status);
5146 }
5147 if (!srv_send_smb(smbreq->sconn,
5148 (char *)smbreq->outbuf,
5149 true,
5150 smbreq->seqnum+1,
5151 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5152 NULL)) {
5153 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5154 "failed.");
5155 }
5156 TALLOC_FREE(smbreq);
5157 }
5158
5159 /****************************************************************************
5160 Reply to a writeclose (Core+ protocol).
5161 ****************************************************************************/
5162
5163 void reply_writeclose(struct smb_request *req)
5164 {
5165 connection_struct *conn = req->conn;
5166 size_t numtowrite;
5167 ssize_t nwritten = -1;
5168 NTSTATUS close_status = NT_STATUS_OK;
5169 off_t startpos;
5170 const char *data;
5171 struct timespec mtime;
5172 files_struct *fsp;
5173 struct lock_struct lock;
5174
5175 START_PROFILE(SMBwriteclose);
5176
5177 if (req->wct < 6) {
5178 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5179 END_PROFILE(SMBwriteclose);
5180 return;
5181 }
5182
5183 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5184
5185 if (!check_fsp(conn, req, fsp)) {
5186 END_PROFILE(SMBwriteclose);
5187 return;
5188 }
5189 if (!CHECK_WRITE(fsp)) {
5190 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5191 END_PROFILE(SMBwriteclose);
5192 return;
5193 }
5194
5195 numtowrite = SVAL(req->vwv+1, 0);
5196 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5197 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5198 data = (const char *)req->buf + 1;
5199
5200 if (fsp->print_file == NULL) {
5201 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5202 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5203 &lock);
5204
5205 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5206 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5207 END_PROFILE(SMBwriteclose);
5208 return;
5209 }
5210 }
5211
5212 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5213
5214 if (fsp->print_file == NULL) {
5215 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5216 }
5217
5218 set_close_write_time(fsp, mtime);
5219
5220 /*
5221 * More insanity. W2K only closes the file if writelen > 0.
5222 * JRA.
5223 */
5224
5225 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5226 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5227 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5228
5229 if (numtowrite) {
5230 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5231 "file %s\n", fsp_str_dbg(fsp)));
5232 close_status = close_file(req, fsp, NORMAL_CLOSE);
5233 fsp = NULL;
5234 }
5235
5236 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5237 reply_nterror(req, NT_STATUS_DISK_FULL);
5238 goto out;
5239 }
5240
5241 if(!NT_STATUS_IS_OK(close_status)) {
5242 reply_nterror(req, close_status);
5243 goto out;
5244 }
5245
5246 reply_outbuf(req, 1, 0);
5247
5248 SSVAL(req->outbuf,smb_vwv0,nwritten);
5249
5250 out:
5251
5252 END_PROFILE(SMBwriteclose);
5253 return;
5254 }
5255
5256 #undef DBGC_CLASS
5257 #define DBGC_CLASS DBGC_LOCKING
5258
5259 /****************************************************************************
5260 Reply to a lock.
5261 ****************************************************************************/
5262
5263 void reply_lock(struct smb_request *req)
5264 {
5265 connection_struct *conn = req->conn;
5266 uint64_t count,offset;
5267 NTSTATUS status;
5268 files_struct *fsp;
5269 struct byte_range_lock *br_lck = NULL;
5270
5271 START_PROFILE(SMBlock);
5272
5273 if (req->wct < 5) {
5274 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5275 END_PROFILE(SMBlock);
5276 return;
5277 }
5278
5279 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5280
5281 if (!check_fsp(conn, req, fsp)) {
5282 END_PROFILE(SMBlock);
5283 return;
5284 }
5285
5286 count = (uint64_t)IVAL(req->vwv+1, 0);
5287 offset = (uint64_t)IVAL(req->vwv+3, 0);
5288
5289 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5290 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5291
5292 br_lck = do_lock(req->sconn->msg_ctx,
5293 fsp,
5294 (uint64_t)req->smbpid,
5295 count,
5296 offset,
5297 WRITE_LOCK,
5298 WINDOWS_LOCK,
5299 False, /* Non-blocking lock. */
5300 &status,
5301 NULL);
5302
5303 TALLOC_FREE(br_lck);
5304
5305 if (NT_STATUS_V(status)) {
5306 reply_nterror(req, status);
5307 END_PROFILE(SMBlock);
5308 return;
5309 }
5310
5311 reply_outbuf(req, 0, 0);
5312
5313 END_PROFILE(SMBlock);
5314 return;
5315 }
5316
5317 /****************************************************************************
5318 Reply to a unlock.
5319 ****************************************************************************/
5320
5321 void reply_unlock(struct smb_request *req)
5322 {
5323 connection_struct *conn = req->conn;
5324 uint64_t count,offset;
5325 NTSTATUS status;
5326 files_struct *fsp;
5327
5328 START_PROFILE(SMBunlock);
5329
5330 if (req->wct < 5) {
5331 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5332 END_PROFILE(SMBunlock);
5333 return;
5334 }
5335
5336 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5337
5338 if (!check_fsp(conn, req, fsp)) {
5339 END_PROFILE(SMBunlock);
5340 return;
5341 }
5342
5343 count = (uint64_t)IVAL(req->vwv+1, 0);
5344 offset = (uint64_t)IVAL(req->vwv+3, 0);
5345
5346 status = do_unlock(req->sconn->msg_ctx,
5347 fsp,
5348 (uint64_t)req->smbpid,
5349 count,
5350 offset,
5351 WINDOWS_LOCK);
5352
5353 if (NT_STATUS_V(status)) {
5354 reply_nterror(req, status);
5355 END_PROFILE(SMBunlock);
5356 return;
5357 }
5358
5359 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5360 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5361
5362 reply_outbuf(req, 0, 0);
5363
5364 END_PROFILE(SMBunlock);
5365 return;
5366 }
5367
5368 #undef DBGC_CLASS
5369 #define DBGC_CLASS DBGC_ALL
5370
5371 /****************************************************************************
5372 Reply to a tdis.
5373 conn POINTER CAN BE NULL HERE !
5374 ****************************************************************************/
5375
5376 void reply_tdis(struct smb_request *req)
5377 {
5378 NTSTATUS status;
5379 connection_struct *conn = req->conn;
5380 struct smbXsrv_tcon *tcon;
5381
5382 START_PROFILE(SMBtdis);
5383
5384 if (!conn) {
5385 DEBUG(4,("Invalid connection in tdis\n"));
5386 reply_force_doserror(req, ERRSRV, ERRinvnid);
5387 END_PROFILE(SMBtdis);
5388 return;
5389 }
5390
5391 tcon = conn->tcon;
5392 req->conn = NULL;
5393
5394 /*
5395 * TODO: cancel all outstanding requests on the tcon
5396 */
5397 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5398 if (!NT_STATUS_IS_OK(status)) {
5399 DEBUG(0, ("reply_tdis: "
5400 "smbXsrv_tcon_disconnect() failed: %s\n",
5401 nt_errstr(status)));
5402 /*
5403 * If we hit this case, there is something completely
5404 * wrong, so we better disconnect the transport connection.
5405 */
5406 END_PROFILE(SMBtdis);
5407 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5408 return;
5409 }
5410
5411 TALLOC_FREE(tcon);
5412
5413 reply_outbuf(req, 0, 0);
5414 END_PROFILE(SMBtdis);
5415 return;
5416 }
5417
5418 /****************************************************************************
5419 Reply to a echo.
5420 conn POINTER CAN BE NULL HERE !
5421 ****************************************************************************/
5422
5423 void reply_echo(struct smb_request *req)
5424 {
5425 connection_struct *conn = req->conn;
5426 struct smb_perfcount_data local_pcd;
5427 struct smb_perfcount_data *cur_pcd;
5428 int smb_reverb;
5429 int seq_num;
5430
5431 START_PROFILE(SMBecho);
5432
5433 smb_init_perfcount_data(&local_pcd);
5434
5435 if (req->wct < 1) {
5436 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5437 END_PROFILE(SMBecho);
5438 return;
5439 }
5440
5441 smb_reverb = SVAL(req->vwv+0, 0);
5442
5443 reply_outbuf(req, 1, req->buflen);
5444
5445 /* copy any incoming data back out */
5446 if (req->buflen > 0) {
5447 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5448 }
5449
5450 if (smb_reverb > 100) {
5451 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5452 smb_reverb = 100;
5453 }
5454
5455 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5456
5457 /* this makes sure we catch the request pcd */
5458 if (seq_num == smb_reverb) {
5459 cur_pcd = &req->pcd;
5460 } else {
5461 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5462 cur_pcd = &local_pcd;
5463 }
5464
5465 SSVAL(req->outbuf,smb_vwv0,seq_num);
5466
5467 show_msg((char *)req->outbuf);
5468 if (!srv_send_smb(req->sconn,
5469 (char *)req->outbuf,
5470 true, req->seqnum+1,
5471 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5472 cur_pcd))
5473 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5474 }
5475
5476 DEBUG(3,("echo %d times\n", smb_reverb));
5477
5478 TALLOC_FREE(req->outbuf);
5479
5480 END_PROFILE(SMBecho);
5481 return;
5482 }
5483
5484 /****************************************************************************
5485 Reply to a printopen.
5486 ****************************************************************************/
5487
5488 void reply_printopen(struct smb_request *req)
5489 {
5490 connection_struct *conn = req->conn;
5491 files_struct *fsp;
5492 NTSTATUS status;
5493
5494 START_PROFILE(SMBsplopen);
5495
5496 if (req->wct < 2) {
5497 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5498 END_PROFILE(SMBsplopen);
5499 return;
5500 }
5501
5502 if (!CAN_PRINT(conn)) {
5503 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5504 END_PROFILE(SMBsplopen);
5505 return;
5506 }
5507
5508 status = file_new(req, conn, &fsp);
5509 if(!NT_STATUS_IS_OK(status)) {
5510 reply_nterror(req, status);
5511 END_PROFILE(SMBsplopen);
5512 return;
5513 }
5514
5515 /* Open for exclusive use, write only. */
5516 status = print_spool_open(fsp, NULL, req->vuid);
5517
5518 if (!NT_STATUS_IS_OK(status)) {
5519 file_free(req, fsp);
5520 reply_nterror(req, status);
5521 END_PROFILE(SMBsplopen);
5522 return;
5523 }
5524
5525 reply_outbuf(req, 1, 0);
5526 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5527
5528 DEBUG(3,("openprint fd=%d %s\n",
5529 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5530
5531 END_PROFILE(SMBsplopen);
5532 return;
5533 }
5534
5535 /****************************************************************************
5536 Reply to a printclose.
5537 ****************************************************************************/
5538
5539 void reply_printclose(struct smb_request *req)
5540 {
5541 connection_struct *conn = req->conn;
5542 files_struct *fsp;
5543 NTSTATUS status;
5544
5545 START_PROFILE(SMBsplclose);
5546
5547 if (req->wct < 1) {
5548 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5549 END_PROFILE(SMBsplclose);
5550 return;
5551 }
5552
5553 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5554
5555 if (!check_fsp(conn, req, fsp)) {
5556 END_PROFILE(SMBsplclose);
5557 return;
5558 }
5559
5560 if (!CAN_PRINT(conn)) {
5561 reply_force_doserror(req, ERRSRV, ERRerror);
5562 END_PROFILE(SMBsplclose);
5563 return;
5564 }
5565
5566 DEBUG(3,("printclose fd=%d %s\n",
5567 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5568
5569 status = close_file(req, fsp, NORMAL_CLOSE);
5570
5571 if(!NT_STATUS_IS_OK(status)) {
5572 reply_nterror(req, status);
5573 END_PROFILE(SMBsplclose);
5574 return;
5575 }
5576
5577 reply_outbuf(req, 0, 0);
5578
5579 END_PROFILE(SMBsplclose);
5580 return;
5581 }
5582
5583 /****************************************************************************
5584 Reply to a printqueue.
5585 ****************************************************************************/
5586
5587 void reply_printqueue(struct smb_request *req)
5588 {
5589 connection_struct *conn = req->conn;
5590 int max_count;
5591 int start_index;
5592
5593 START_PROFILE(SMBsplretq);
5594
5595 if (req->wct < 2) {
5596 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5597 END_PROFILE(SMBsplretq);
5598 return;
5599 }
5600
5601 max_count = SVAL(req->vwv+0, 0);
5602 start_index = SVAL(req->vwv+1, 0);
5603
5604 /* we used to allow the client to get the cnum wrong, but that
5605 is really quite gross and only worked when there was only
5606 one printer - I think we should now only accept it if they
5607 get it right (tridge) */
5608 if (!CAN_PRINT(conn)) {
5609 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5610 END_PROFILE(SMBsplretq);
5611 return;
5612 }
5613
5614 reply_outbuf(req, 2, 3);
5615 SSVAL(req->outbuf,smb_vwv0,0);
5616 SSVAL(req->outbuf,smb_vwv1,0);
5617 SCVAL(smb_buf(req->outbuf),0,1);
5618 SSVAL(smb_buf(req->outbuf),1,0);
5619
5620 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5621 start_index, max_count));
5622
5623 {
5624 TALLOC_CTX *mem_ctx = talloc_tos();
5625 NTSTATUS status;
5626 WERROR werr;
5627 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5628 struct rpc_pipe_client *cli = NULL;
5629 struct dcerpc_binding_handle *b = NULL;
5630 struct policy_handle handle;
5631 struct spoolss_DevmodeContainer devmode_ctr;
5632 union spoolss_JobInfo *info;
5633 uint32_t count;
5634 uint32_t num_to_get;
5635 uint32_t first;
5636 uint32_t i;
5637
5638 ZERO_STRUCT(handle);
5639
5640 status = rpc_pipe_open_interface(conn,
5641 &ndr_table_spoolss,
5642 conn->session_info,
5643 conn->sconn->remote_address,
5644 conn->sconn->msg_ctx,
5645 &cli);
5646 if (!NT_STATUS_IS_OK(status)) {
5647 DEBUG(0, ("reply_printqueue: "
5648 "could not connect to spoolss: %s\n",
5649 nt_errstr(status)));
5650 reply_nterror(req, status);
5651 goto out;
5652 }
5653 b = cli->binding_handle;
5654
5655 ZERO_STRUCT(devmode_ctr);
5656
5657 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5658 sharename,
5659 NULL, devmode_ctr,
5660 SEC_FLAG_MAXIMUM_ALLOWED,
5661 &handle,
5662 &werr);
5663 if (!NT_STATUS_IS_OK(status)) {
5664 reply_nterror(req, status);
5665 goto out;
5666 }
5667 if (!W_ERROR_IS_OK(werr)) {
5668 reply_nterror(req, werror_to_ntstatus(werr));
5669 goto out;
5670 }
5671
5672 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5673 &handle,
5674 0, /* firstjob */
5675 0xff, /* numjobs */
5676 2, /* level */
5677 0, /* offered */
5678 &count,
5679 &info);
5680 if (!W_ERROR_IS_OK(werr)) {
5681 reply_nterror(req, werror_to_ntstatus(werr));
5682 goto out;
5683 }
5684
5685 if (max_count > 0) {
5686 first = start_index;
5687 } else {
5688 first = start_index + max_count + 1;
5689 }
5690
5691 if (first >= count) {
5692 num_to_get = first;
5693 } else {
5694 num_to_get = first + MIN(ABS(max_count), count - first);
5695 }
5696
5697 for (i = first; i < num_to_get; i++) {
5698 char blob[28];
5699 char *p = blob;
5700 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5701 int qstatus;
5702 uint16_t qrapjobid = pjobid_to_rap(sharename,
5703 info[i].info2.job_id);
5704
5705 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5706 qstatus = 2;
5707 } else {
5708 qstatus = 3;
5709 }
5710
5711 srv_put_dos_date2(p, 0, qtime);
5712 SCVAL(p, 4, qstatus);
5713 SSVAL(p, 5, qrapjobid);
5714 SIVAL(p, 7, info[i].info2.size);
5715 SCVAL(p, 11, 0);
5716 srvstr_push(blob, req->flags2, p+12,
5717 info[i].info2.notify_name, 16, STR_ASCII);
5718
5719 if (message_push_blob(
5720 &req->outbuf,
5721 data_blob_const(
5722 blob, sizeof(blob))) == -1) {
5723 reply_nterror(req, NT_STATUS_NO_MEMORY);
5724 goto out;
5725 }
5726 }
5727
5728 if (count > 0) {
5729 SSVAL(req->outbuf,smb_vwv0,count);
5730 SSVAL(req->outbuf,smb_vwv1,
5731 (max_count>0?first+count:first-1));
5732 SCVAL(smb_buf(req->outbuf),0,1);
5733 SSVAL(smb_buf(req->outbuf),1,28*count);
5734 }
5735
5736
5737 DEBUG(3, ("%u entries returned in queue\n",
5738 (unsigned)count));
5739
5740 out:
5741 if (b && is_valid_policy_hnd(&handle)) {
5742 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5743 }
5744
5745 }
5746
5747 END_PROFILE(SMBsplretq);
5748 return;
5749 }
5750
5751 /****************************************************************************
5752 Reply to a printwrite.
5753 ****************************************************************************/
5754
5755 void reply_printwrite(struct smb_request *req)
5756 {
5757 connection_struct *conn = req->conn;
5758 int numtowrite;
5759 const char *data;
5760 files_struct *fsp;
5761
5762 START_PROFILE(SMBsplwr);
5763
5764 if (req->wct < 1) {
5765 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5766 END_PROFILE(SMBsplwr);
5767 return;
5768 }
5769
5770 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5771
5772 if (!check_fsp(conn, req, fsp)) {
5773 END_PROFILE(SMBsplwr);
5774 return;
5775 }
5776
5777 if (!fsp->print_file) {
5778 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5779 END_PROFILE(SMBsplwr);
5780 return;
5781 }
5782
5783 if (!CHECK_WRITE(fsp)) {
5784 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5785 END_PROFILE(SMBsplwr);
5786 return;
5787 }
5788
5789 numtowrite = SVAL(req->buf, 1);
5790
5791 if (req->buflen < numtowrite + 3) {
5792 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5793 END_PROFILE(SMBsplwr);
5794 return;
5795 }
5796
5797 data = (const char *)req->buf + 3;
5798
5799 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5800 reply_nterror(req, map_nt_error_from_unix(errno));
5801 END_PROFILE(SMBsplwr);
5802 return;
5803 }
5804
5805 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5806
5807 END_PROFILE(SMBsplwr);
5808 return;
5809 }
5810
5811 /****************************************************************************
5812 Reply to a mkdir.
5813 ****************************************************************************/
5814
5815 void reply_mkdir(struct smb_request *req)
5816 {
5817 connection_struct *conn = req->conn;
5818 struct smb_filename *smb_dname = NULL;
5819 char *directory = NULL;
5820 NTSTATUS status;
5821 TALLOC_CTX *ctx = talloc_tos();
5822
5823 START_PROFILE(SMBmkdir);
5824
5825 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5826 STR_TERMINATE, &status);
5827 if (!NT_STATUS_IS_OK(status)) {
5828 reply_nterror(req, status);
5829 goto out;
5830 }
5831
5832 status = filename_convert(ctx, conn,
5833 req->flags2 & FLAGS2_DFS_PATHNAMES,
5834 directory,
5835 UCF_PREP_CREATEFILE,
5836 NULL,
5837 &smb_dname);
5838 if (!NT_STATUS_IS_OK(status)) {
5839 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5840 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5841 ERRSRV, ERRbadpath);
5842 goto out;
5843 }
5844 reply_nterror(req, status);
5845 goto out;
5846 }
5847
5848 status = create_directory(conn, req, smb_dname);
5849
5850 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5851
5852 if (!NT_STATUS_IS_OK(status)) {
5853
5854 if (!use_nt_status()
5855 && NT_STATUS_EQUAL(status,
5856 NT_STATUS_OBJECT_NAME_COLLISION)) {
5857 /*
5858 * Yes, in the DOS error code case we get a
5859 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5860 * samba4 torture test.
5861 */
5862 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5863 }
5864
5865 reply_nterror(req, status);
5866 goto out;
5867 }
5868
5869 reply_outbuf(req, 0, 0);
5870
5871 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5872 out:
5873 TALLOC_FREE(smb_dname);
5874 END_PROFILE(SMBmkdir);
5875 return;
5876 }
5877
5878 /****************************************************************************
5879 Reply to a rmdir.
5880 ****************************************************************************/
5881
5882 void reply_rmdir(struct smb_request *req)
5883 {
5884 connection_struct *conn = req->conn;
5885 struct smb_filename *smb_dname = NULL;
5886 char *directory = NULL;
5887 NTSTATUS status;
5888 TALLOC_CTX *ctx = talloc_tos();
5889 files_struct *fsp = NULL;
5890 int info = 0;
5891 struct smbd_server_connection *sconn = req->sconn;
5892
5893 START_PROFILE(SMBrmdir);
5894
5895 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5896 STR_TERMINATE, &status);
5897 if (!NT_STATUS_IS_OK(status)) {
5898 reply_nterror(req, status);
5899 goto out;
5900 }
5901
5902 status = filename_convert(ctx, conn,
5903 req->flags2 & FLAGS2_DFS_PATHNAMES,
5904 directory,
5905 0,
5906 NULL,
5907 &smb_dname);
5908 if (!NT_STATUS_IS_OK(status)) {
5909 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5910 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5911 ERRSRV, ERRbadpath);
5912 goto out;
5913 }
5914 reply_nterror(req, status);
5915 goto out;
5916 }
5917
5918 if (is_ntfs_stream_smb_fname(smb_dname)) {
5919 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5920 goto out;
5921 }
5922
5923 status = SMB_VFS_CREATE_FILE(
5924 conn, /* conn */
5925 req, /* req */
5926 0, /* root_dir_fid */
5927 smb_dname, /* fname */
5928 DELETE_ACCESS, /* access_mask */
5929 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5930 FILE_SHARE_DELETE),
5931 FILE_OPEN, /* create_disposition*/
5932 FILE_DIRECTORY_FILE, /* create_options */
5933 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5934 0, /* oplock_request */
5935 0, /* allocation_size */
5936 0, /* private_flags */
5937 NULL, /* sd */
5938 NULL, /* ea_list */
5939 &fsp, /* result */
5940 &info); /* pinfo */
5941
5942 if (!NT_STATUS_IS_OK(status)) {
5943 if (open_was_deferred(req->sconn, req->mid)) {
5944 /* We have re-scheduled this call. */
5945 goto out;
5946 }
5947 reply_nterror(req, status);
5948 goto out;
5949 }
5950
5951 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5952 if (!NT_STATUS_IS_OK(status)) {
5953 close_file(req, fsp, ERROR_CLOSE);
5954 reply_nterror(req, status);
5955 goto out;
5956 }
5957
5958 if (!set_delete_on_close(fsp, true,
5959 conn->session_info->security_token,
5960 conn->session_info->unix_token)) {
5961 close_file(req, fsp, ERROR_CLOSE);
5962 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5963 goto out;
5964 }
5965
5966 status = close_file(req, fsp, NORMAL_CLOSE);
5967 if (!NT_STATUS_IS_OK(status)) {
5968 reply_nterror(req, status);
5969 } else {
5970 reply_outbuf(req, 0, 0);
5971 }
5972
5973 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5974
5975 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5976 out:
5977 TALLOC_FREE(smb_dname);
5978 END_PROFILE(SMBrmdir);
5979 return;
5980 }
5981
5982 /*******************************************************************
5983 Resolve wildcards in a filename rename.
5984 ********************************************************************/
5985
5986 static bool resolve_wildcards(TALLOC_CTX *ctx,
5987 const char *name1,
5988 const char *name2,
5989 char **pp_newname)
5990 {
5991 char *name2_copy = NULL;
5992 char *root1 = NULL;
5993 char *root2 = NULL;
5994 char *ext1 = NULL;
5995 char *ext2 = NULL;
5996 char *p,*p2, *pname1, *pname2;
5997
5998 name2_copy = talloc_strdup(ctx, name2);
5999 if (!name2_copy) {
6000 return False;
6001 }
6002
6003 pname1 = strrchr_m(name1,'/');
6004 pname2 = strrchr_m(name2_copy,'/');
6005
6006 if (!pname1 || !pname2) {
6007 return False;
6008 }
6009
6010 /* Truncate the copy of name2 at the last '/' */
6011 *pname2 = '\0';
6012
6013 /* Now go past the '/' */
6014 pname1++;
6015 pname2++;
6016
6017 root1 = talloc_strdup(ctx, pname1);
6018 root2 = talloc_strdup(ctx, pname2);
6019
6020 if (!root1 || !root2) {
6021 return False;
6022 }
6023
6024 p = strrchr_m(root1,'.');
6025 if (p) {
6026 *p = 0;
6027 ext1 = talloc_strdup(ctx, p+1);
6028 } else {
6029 ext1 = talloc_strdup(ctx, "");
6030 }
6031 p = strrchr_m(root2,'.');
6032 if (p) {
6033 *p = 0;
6034 ext2 = talloc_strdup(ctx, p+1);
6035 } else {
6036 ext2 = talloc_strdup(ctx, "");
6037 }
6038
6039 if (!ext1 || !ext2) {
6040 return False;
6041 }
6042
6043 p = root1;
6044 p2 = root2;
6045 while (*p2) {
6046 if (*p2 == '?') {
6047 /* Hmmm. Should this be mb-aware ? */
6048 *p2 = *p;
6049 p2++;
6050 } else if (*p2 == '*') {
6051 *p2 = '\0';
6052 root2 = talloc_asprintf(ctx, "%s%s",
6053 root2,
6054 p);
6055 if (!root2) {
6056 return False;
6057 }
6058 break;
6059 } else {
6060 p2++;
6061 }
6062 if (*p) {
6063 p++;
6064 }
6065 }
6066
6067 p = ext1;
6068 p2 = ext2;
6069 while (*p2) {
6070 if (*p2 == '?') {
6071 /* Hmmm. Should this be mb-aware ? */
6072 *p2 = *p;
6073 p2++;
6074 } else if (*p2 == '*') {
6075 *p2 = '\0';
6076 ext2 = talloc_asprintf(ctx, "%s%s",
6077 ext2,
6078 p);
6079 if (!ext2) {
6080 return False;
6081 }
6082 break;
6083 } else {
6084 p2++;
6085 }
6086 if (*p) {
6087 p++;
6088 }
6089 }
6090
6091 if (*ext2) {
6092 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6093 name2_copy,
6094 root2,
6095 ext2);
6096 } else {
6097 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6098 name2_copy,
6099 root2);
6100 }
6101
6102 if (!*pp_newname) {
6103 return False;
6104 }
6105
6106 return True;
6107 }
6108
6109 /****************************************************************************
6110 Ensure open files have their names updated. Updated to notify other smbd's
6111 asynchronously.
6112 ****************************************************************************/
6113
6114 static void rename_open_files(connection_struct *conn,
6115 struct share_mode_lock *lck,
6116 struct file_id id,
6117 uint32_t orig_name_hash,
6118 const struct smb_filename *smb_fname_dst)
6119 {
6120 files_struct *fsp;
6121 bool did_rename = False;
6122 NTSTATUS status;
6123 uint32_t new_name_hash = 0;
6124
6125 for(fsp = file_find_di_first(conn->sconn, id); fsp;
6126 fsp = file_find_di_next(fsp)) {
6127 /* fsp_name is a relative path under the fsp. To change this for other
6128 sharepaths we need to manipulate relative paths. */
6129 /* TODO - create the absolute path and manipulate the newname
6130 relative to the sharepath. */
6131 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6132 continue;
6133 }
6134 if (fsp->name_hash != orig_name_hash) {
6135 continue;
6136 }
6137 DEBUG(10, ("rename_open_files: renaming file %s "
6138 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6139 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6140 smb_fname_str_dbg(smb_fname_dst)));
6141
6142 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6143 if (NT_STATUS_IS_OK(status)) {
6144 did_rename = True;
6145 new_name_hash = fsp->name_hash;
6146 }
6147 }
6148
6149 if (!did_rename) {
6150 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6151 "for %s\n", file_id_string_tos(&id),
6152 smb_fname_str_dbg(smb_fname_dst)));
6153 }
6154
6155 /* Send messages to all smbd's (not ourself) that the name has changed. */
6156 rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6157 orig_name_hash, new_name_hash,
6158 smb_fname_dst);
6159
6160 }
6161
6162 /****************************************************************************
6163 We need to check if the source path is a parent directory of the destination
6164 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6165 refuse the rename with a sharing violation. Under UNIX the above call can
6166 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6167 probably need to check that the client is a Windows one before disallowing
6168 this as a UNIX client (one with UNIX extensions) can know the source is a
6169 symlink and make this decision intelligently. Found by an excellent bug
6170 report from <AndyLiebman@aol.com>.
6171 ****************************************************************************/
6172
6173 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6174 const struct smb_filename *smb_fname_dst)
6175 {
6176 const char *psrc = smb_fname_src->base_name;
6177 const char *pdst = smb_fname_dst->base_name;
6178 size_t slen;
6179
6180 if (psrc[0] == '.' && psrc[1] == '/') {
6181 psrc += 2;
6182 }
6183 if (pdst[0] == '.' && pdst[1] == '/') {
6184 pdst += 2;
6185 }
6186 if ((slen = strlen(psrc)) > strlen(pdst)) {
6187 return False;
6188 }
6189 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6190 }
6191
6192 /*
6193 * Do the notify calls from a rename
6194 */
6195
6196 static void notify_rename(connection_struct *conn, bool is_dir,
6197 const struct smb_filename *smb_fname_src,
6198 const struct smb_filename *smb_fname_dst)
6199 {
6200 char *parent_dir_src = NULL;
6201 char *parent_dir_dst = NULL;
6202 uint32 mask;
6203
6204 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6205 : FILE_NOTIFY_CHANGE_FILE_NAME;
6206
6207 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6208 &parent_dir_src, NULL) ||
6209 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6210 &parent_dir_dst, NULL)) {
6211 goto out;
6212 }
6213
6214 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6215 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6216 smb_fname_src->base_name);
6217 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6218 smb_fname_dst->base_name);
6219 }
6220 else {
6221 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6222 smb_fname_src->base_name);
6223 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6224 smb_fname_dst->base_name);
6225 }
6226
6227 /* this is a strange one. w2k3 gives an additional event for
6228 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6229 files, but not directories */
6230 if (!is_dir) {
6231 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6232 FILE_NOTIFY_CHANGE_ATTRIBUTES
6233 |FILE_NOTIFY_CHANGE_CREATION,
6234 smb_fname_dst->base_name);
6235 }
6236 out:
6237 TALLOC_FREE(parent_dir_src);
6238 TALLOC_FREE(parent_dir_dst);
6239 }
6240
6241 /****************************************************************************
6242 Returns an error if the parent directory for a filename is open in an
6243 incompatible way.
6244 ****************************************************************************/
6245
6246 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6247 const struct smb_filename *smb_fname_dst_in)
6248 {
6249 char *parent_dir = NULL;
6250 struct smb_filename smb_fname_parent;
6251 struct file_id id;
6252 files_struct *fsp = NULL;
6253 int ret;
6254
6255 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6256 &parent_dir, NULL)) {
6257 return NT_STATUS_NO_MEMORY;
6258 }
6259 ZERO_STRUCT(smb_fname_parent);
6260 smb_fname_parent.base_name = parent_dir;
6261
6262 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6263 if (ret == -1) {
6264 return map_nt_error_from_unix(errno);
6265 }
6266
6267 /*
6268 * We're only checking on this smbd here, mostly good
6269 * enough.. and will pass tests.
6270 */
6271
6272 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6273 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6274 fsp = file_find_di_next(fsp)) {
6275 if (fsp->access_mask & DELETE_ACCESS) {
6276 return NT_STATUS_SHARING_VIOLATION;
6277 }
6278 }
6279 return NT_STATUS_OK;
6280 }
6281
6282 /****************************************************************************
6283 Rename an open file - given an fsp.
6284 ****************************************************************************/
6285
6286 NTSTATUS rename_internals_fsp(connection_struct *conn,
6287 files_struct *fsp,
6288 const struct smb_filename *smb_fname_dst_in,
6289 uint32 attrs,
6290 bool replace_if_exists)
6291 {
6292 TALLOC_CTX *ctx = talloc_tos();
6293 struct smb_filename *smb_fname_dst = NULL;
6294 NTSTATUS status = NT_STATUS_OK;
6295 struct share_mode_lock *lck = NULL;
6296 bool dst_exists, old_is_stream, new_is_stream;
6297
6298 status = check_name(conn, smb_fname_dst_in->base_name);
6299 if (!NT_STATUS_IS_OK(status)) {
6300 return status;
6301 }
6302
6303 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6304 if (!NT_STATUS_IS_OK(status)) {
6305 return status;
6306 }
6307
6308 /* Make a copy of the dst smb_fname structs */
6309
6310 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6311 if (smb_fname_dst == NULL) {
6312 status = NT_STATUS_NO_MEMORY;
6313 goto out;
6314 }
6315
6316 /*
6317 * Check for special case with case preserving and not
6318 * case sensitive. If the old last component differs from the original
6319 * last component only by case, then we should allow
6320 * the rename (user is trying to change the case of the
6321 * filename).
6322 */
6323 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6324 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6325 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6326 char *last_slash;
6327 char *fname_dst_lcomp_base_mod = NULL;
6328 struct smb_filename *smb_fname_orig_lcomp = NULL;
6329
6330 /*
6331 * Get the last component of the destination name.
6332 */
6333 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6334 if (last_slash) {
6335 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6336 } else {
6337 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6338 }
6339 if (!fname_dst_lcomp_base_mod) {
6340 status = NT_STATUS_NO_MEMORY;
6341 goto out;
6342 }
6343
6344 /*
6345 * Create an smb_filename struct using the original last
6346 * component of the destination.
6347 */
6348 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6349 ctx, smb_fname_dst->original_lcomp, NULL);
6350 if (smb_fname_orig_lcomp == NULL) {
6351 status = NT_STATUS_NO_MEMORY;
6352 TALLOC_FREE(fname_dst_lcomp_base_mod);
6353 goto out;
6354 }
6355
6356 /* If the base names only differ by case, use original. */
6357 if(!strcsequal(fname_dst_lcomp_base_mod,
6358 smb_fname_orig_lcomp->base_name)) {
6359 char *tmp;
6360 /*
6361 * Replace the modified last component with the
6362 * original.
6363 */
6364 if (last_slash) {
6365 *last_slash = '\0'; /* Truncate at the '/' */
6366 tmp = talloc_asprintf(smb_fname_dst,
6367 "%s/%s",
6368 smb_fname_dst->base_name,
6369 smb_fname_orig_lcomp->base_name);
6370 } else {
6371 tmp = talloc_asprintf(smb_fname_dst,
6372 "%s",
6373 smb_fname_orig_lcomp->base_name);
6374 }
6375 if (tmp == NULL) {
6376 status = NT_STATUS_NO_MEMORY;
6377 TALLOC_FREE(fname_dst_lcomp_base_mod);
6378 TALLOC_FREE(smb_fname_orig_lcomp);
6379 goto out;
6380 }
6381 TALLOC_FREE(smb_fname_dst->base_name);
6382 smb_fname_dst->base_name = tmp;
6383 }
6384
6385 /* If the stream_names only differ by case, use original. */
6386 if(!strcsequal(smb_fname_dst->stream_name,
6387 smb_fname_orig_lcomp->stream_name)) {
6388 char *tmp = NULL;
6389 /* Use the original stream. */
6390 tmp = talloc_strdup(smb_fname_dst,
6391 smb_fname_orig_lcomp->stream_name);
6392 if (tmp == NULL) {
6393 status = NT_STATUS_NO_MEMORY;
6394 TALLOC_FREE(fname_dst_lcomp_base_mod);
6395 TALLOC_FREE(smb_fname_orig_lcomp);
6396 goto out;
6397 }
6398 TALLOC_FREE(smb_fname_dst->stream_name);
6399 smb_fname_dst->stream_name = tmp;
6400 }
6401 TALLOC_FREE(fname_dst_lcomp_base_mod);
6402 TALLOC_FREE(smb_fname_orig_lcomp);
6403 }
6404
6405 /*
6406 * If the src and dest names are identical - including case,
6407 * don't do the rename, just return success.
6408 */
6409
6410 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6411 strcsequal(fsp->fsp_name->stream_name,
6412 smb_fname_dst->stream_name)) {
6413 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6414 "- returning success\n",
6415 smb_fname_str_dbg(smb_fname_dst)));
6416 status = NT_STATUS_OK;
6417 goto out;
6418 }
6419
6420 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6421 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6422
6423 /* Return the correct error code if both names aren't streams. */
6424 if (!old_is_stream && new_is_stream) {
6425 status = NT_STATUS_OBJECT_NAME_INVALID;
6426 goto out;
6427 }
6428
6429 if (old_is_stream && !new_is_stream) {
6430 status = NT_STATUS_INVALID_PARAMETER;
6431 goto out;
6432 }
6433
6434 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6435
6436 if(!replace_if_exists && dst_exists) {
6437 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6438 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6439 smb_fname_str_dbg(smb_fname_dst)));
6440 status = NT_STATUS_OBJECT_NAME_COLLISION;
6441 goto out;
6442 }
6443
6444 if (dst_exists) {
6445 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6446 &smb_fname_dst->st);
6447 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6448 fileid);
6449 /* The file can be open when renaming a stream */
6450 if (dst_fsp && !new_is_stream) {
6451 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6452 status = NT_STATUS_ACCESS_DENIED;
6453 goto out;
6454 }
6455 }
6456
6457 /* Ensure we have a valid stat struct for the source. */
6458 status = vfs_stat_fsp(fsp);
6459 if (!NT_STATUS_IS_OK(status)) {
6460 goto out;
6461 }
6462
6463 status = can_rename(conn, fsp, attrs);
6464
6465 if (!NT_STATUS_IS_OK(status)) {
6466 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6467 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6468 smb_fname_str_dbg(smb_fname_dst)));
6469 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6470 status = NT_STATUS_ACCESS_DENIED;
6471 goto out;
6472 }
6473
6474 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6475 status = NT_STATUS_ACCESS_DENIED;
6476 }
6477
6478 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6479
6480 /*
6481 * We have the file open ourselves, so not being able to get the
6482 * corresponding share mode lock is a fatal error.
6483 */
6484
6485 SMB_ASSERT(lck != NULL);
6486
6487 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6488 uint32 create_options = fsp->fh->private_options;
6489
6490 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6491 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6492 smb_fname_str_dbg(smb_fname_dst)));
6493
6494 if (!fsp->is_directory &&
6495 !lp_posix_pathnames() &&
6496 (lp_map_archive(SNUM(conn)) ||
6497 lp_store_dos_attributes(SNUM(conn)))) {
6498 /* We must set the archive bit on the newly
6499 renamed file. */
6500 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6501 uint32_t old_dosmode = dos_mode(conn,
6502 smb_fname_dst);
6503 file_set_dosmode(conn,
6504 smb_fname_dst,
6505 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6506 NULL,
6507 true);
6508 }
6509 }
6510
6511 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6512 smb_fname_dst);
6513
6514 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6515 smb_fname_dst);
6516
6517 /*
6518 * A rename acts as a new file create w.r.t. allowing an initial delete
6519 * on close, probably because in Windows there is a new handle to the
6520 * new file. If initial delete on close was requested but not
6521 * originally set, we need to set it here. This is probably not 100% correct,
6522 * but will work for the CIFSFS client which in non-posix mode
6523 * depends on these semantics. JRA.
6524 */
6525
6526 if (create_options & FILE_DELETE_ON_CLOSE) {
6527 status = can_set_delete_on_close(fsp, 0);
6528
6529 if (NT_STATUS_IS_OK(status)) {
6530 /* Note that here we set the *inital* delete on close flag,
6531 * not the regular one. The magic gets handled in close. */
6532 fsp->initial_delete_on_close = True;
6533 }
6534 }
6535 TALLOC_FREE(lck);
6536 status = NT_STATUS_OK;
6537 goto out;
6538 }
6539
6540 TALLOC_FREE(lck);
6541
6542 if (errno == ENOTDIR || errno == EISDIR) {
6543 status = NT_STATUS_OBJECT_NAME_COLLISION;
6544 } else {
6545 status = map_nt_error_from_unix(errno);
6546 }
6547
6548 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6549 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6550 smb_fname_str_dbg(smb_fname_dst)));
6551
6552 out:
6553 TALLOC_FREE(smb_fname_dst);
6554
6555 return status;
6556 }
6557
6558 /****************************************************************************
6559 The guts of the rename command, split out so it may be called by the NT SMB
6560 code.
6561 ****************************************************************************/
6562
6563 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6564 connection_struct *conn,
6565 struct smb_request *req,
6566 struct smb_filename *smb_fname_src,
6567 struct smb_filename *smb_fname_dst,
6568 uint32 attrs,
6569 bool replace_if_exists,
6570 bool src_has_wild,
6571 bool dest_has_wild,
6572 uint32_t access_mask)
6573 {
6574 char *fname_src_dir = NULL;
6575 char *fname_src_mask = NULL;
6576 int count=0;
6577 NTSTATUS status = NT_STATUS_OK;
6578 struct smb_Dir *dir_hnd = NULL;
6579 const char *dname = NULL;
6580 char *talloced = NULL;
6581 long offset = 0;
6582 int create_options = 0;
6583 bool posix_pathnames = lp_posix_pathnames();
6584 int rc;
6585
6586 /*
6587 * Split the old name into directory and last component
6588 * strings. Note that unix_convert may have stripped off a
6589 * leading ./ from both name and newname if the rename is
6590 * at the root of the share. We need to make sure either both
6591 * name and newname contain a / character or neither of them do
6592 * as this is checked in resolve_wildcards().
6593 */
6594
6595 /* Split up the directory from the filename/mask. */
6596 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6597 &fname_src_dir, &fname_src_mask);
6598 if (!NT_STATUS_IS_OK(status)) {
6599 status = NT_STATUS_NO_MEMORY;
6600 goto out;
6601 }
6602
6603 /*
6604 * We should only check the mangled cache
6605 * here if unix_convert failed. This means
6606 * that the path in 'mask' doesn't exist
6607 * on the file system and so we need to look
6608 * for a possible mangle. This patch from
6609 * Tine Smukavec <valentin.smukavec@hermes.si>.
6610 */
6611
6612 if (!VALID_STAT(smb_fname_src->st) &&
6613 mangle_is_mangled(fname_src_mask, conn->params)) {
6614 char *new_mask = NULL;
6615 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6616 conn->params);
6617 if (new_mask) {
6618 TALLOC_FREE(fname_src_mask);
6619 fname_src_mask = new_mask;
6620 }
6621 }
6622
6623 if (!src_has_wild) {
6624 files_struct *fsp;
6625
6626 /*
6627 * Only one file needs to be renamed. Append the mask back
6628 * onto the directory.
6629 */
6630 TALLOC_FREE(smb_fname_src->base_name);
6631 if (ISDOT(fname_src_dir)) {
6632 /* Ensure we use canonical names on open. */
6633 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6634 "%s",
6635 fname_src_mask);
6636 } else {
6637 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6638 "%s/%s",
6639 fname_src_dir,
6640 fname_src_mask);
6641 }
6642 if (!smb_fname_src->base_name) {
6643 status = NT_STATUS_NO_MEMORY;
6644 goto out;
6645 }
6646
6647 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6648 "case_preserve = %d, short case preserve = %d, "
6649 "directory = %s, newname = %s, "
6650 "last_component_dest = %s\n",
6651 conn->case_sensitive, conn->case_preserve,
6652 conn->short_case_preserve,
6653 smb_fname_str_dbg(smb_fname_src),
6654 smb_fname_str_dbg(smb_fname_dst),
6655 smb_fname_dst->original_lcomp));
6656
6657 /* The dest name still may have wildcards. */
6658 if (dest_has_wild) {
6659 char *fname_dst_mod = NULL;
6660 if (!resolve_wildcards(smb_fname_dst,
6661 smb_fname_src->base_name,
6662 smb_fname_dst->base_name,
6663 &fname_dst_mod)) {
6664 DEBUG(6, ("rename_internals: resolve_wildcards "
6665 "%s %s failed\n",
6666 smb_fname_src->base_name,
6667 smb_fname_dst->base_name));
6668 status = NT_STATUS_NO_MEMORY;
6669 goto out;
6670 }
6671 TALLOC_FREE(smb_fname_dst->base_name);
6672 smb_fname_dst->base_name = fname_dst_mod;
6673 }
6674
6675 ZERO_STRUCT(smb_fname_src->st);
6676 if (posix_pathnames) {
6677 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6678 } else {
6679 rc = SMB_VFS_STAT(conn, smb_fname_src);
6680 }
6681 if (rc == -1) {
6682 status = map_nt_error_from_unix_common(errno);
6683 goto out;
6684 }
6685
6686 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6687 create_options |= FILE_DIRECTORY_FILE;
6688 }
6689
6690 status = SMB_VFS_CREATE_FILE(
6691 conn, /* conn */
6692 req, /* req */
6693 0, /* root_dir_fid */
6694 smb_fname_src, /* fname */
6695 access_mask, /* access_mask */
6696 (FILE_SHARE_READ | /* share_access */
6697 FILE_SHARE_WRITE),
6698 FILE_OPEN, /* create_disposition*/
6699 create_options, /* create_options */
6700 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6701 0, /* oplock_request */
6702 0, /* allocation_size */
6703 0, /* private_flags */
6704 NULL, /* sd */
6705 NULL, /* ea_list */
6706 &fsp, /* result */
6707 NULL); /* pinfo */
6708
6709 if (!NT_STATUS_IS_OK(status)) {
6710 DEBUG(3, ("Could not open rename source %s: %s\n",
6711 smb_fname_str_dbg(smb_fname_src),
6712 nt_errstr(status)));
6713 goto out;
6714 }
6715
6716 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6717 attrs, replace_if_exists);
6718
6719 close_file(req, fsp, NORMAL_CLOSE);
6720
6721 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6722 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6723 smb_fname_str_dbg(smb_fname_dst)));
6724
6725 goto out;
6726 }
6727
6728 /*
6729 * Wildcards - process each file that matches.
6730 */
6731 if (strequal(fname_src_mask, "????????.???")) {
6732 TALLOC_FREE(fname_src_mask);
6733 fname_src_mask = talloc_strdup(ctx, "*");
6734 if (!fname_src_mask) {
6735 status = NT_STATUS_NO_MEMORY;
6736 goto out;
6737 }
6738 }
6739
6740 status = check_name(conn, fname_src_dir);
6741 if (!NT_STATUS_IS_OK(status)) {
6742 goto out;
6743 }
6744
6745 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6746 attrs);
6747 if (dir_hnd == NULL) {
6748 status = map_nt_error_from_unix(errno);
6749 goto out;
6750 }
6751
6752 status = NT_STATUS_NO_SUCH_FILE;
6753 /*
6754 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6755 * - gentest fix. JRA
6756 */
6757
6758 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6759 &talloced))) {
6760 files_struct *fsp = NULL;
6761 char *destname = NULL;
6762 bool sysdir_entry = False;
6763
6764 /* Quick check for "." and ".." */
6765 if (ISDOT(dname) || ISDOTDOT(dname)) {
6766 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6767 sysdir_entry = True;
6768 } else {
6769 TALLOC_FREE(talloced);
6770 continue;
6771 }
6772 }
6773
6774 if (!is_visible_file(conn, fname_src_dir, dname,
6775 &smb_fname_src->st, false)) {
6776 TALLOC_FREE(talloced);
6777 continue;
6778 }
6779
6780 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6781 TALLOC_FREE(talloced);
6782 continue;
6783 }
6784
6785 if (sysdir_entry) {
6786 status = NT_STATUS_OBJECT_NAME_INVALID;
6787 break;
6788 }
6789
6790 TALLOC_FREE(smb_fname_src->base_name);
6791 if (ISDOT(fname_src_dir)) {
6792 /* Ensure we use canonical names on open. */
6793 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6794 "%s",
6795 dname);
6796 } else {
6797 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6798 "%s/%s",
6799 fname_src_dir,
6800 dname);
6801 }
6802 if (!smb_fname_src->base_name) {
6803 status = NT_STATUS_NO_MEMORY;
6804 goto out;
6805 }
6806
6807 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6808 smb_fname_dst->base_name,
6809 &destname)) {
6810 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6811 smb_fname_src->base_name, destname));
6812 TALLOC_FREE(talloced);
6813 continue;
6814 }
6815 if (!destname) {
6816 status = NT_STATUS_NO_MEMORY;
6817 goto out;
6818 }
6819
6820 TALLOC_FREE(smb_fname_dst->base_name);
6821 smb_fname_dst->base_name = destname;
6822
6823 ZERO_STRUCT(smb_fname_src->st);
6824 if (posix_pathnames) {
6825 SMB_VFS_LSTAT(conn, smb_fname_src);
6826 } else {
6827 SMB_VFS_STAT(conn, smb_fname_src);
6828 }
6829
6830 create_options = 0;
6831
6832 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6833 create_options |= FILE_DIRECTORY_FILE;
6834 }
6835
6836 status = SMB_VFS_CREATE_FILE(
6837 conn, /* conn */
6838 req, /* req */
6839 0, /* root_dir_fid */
6840 smb_fname_src, /* fname */
6841 access_mask, /* access_mask */
6842 (FILE_SHARE_READ | /* share_access */
6843 FILE_SHARE_WRITE),
6844 FILE_OPEN, /* create_disposition*/
6845 create_options, /* create_options */
6846 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6847 0, /* oplock_request */
6848 0, /* allocation_size */
6849 0, /* private_flags */
6850 NULL, /* sd */
6851 NULL, /* ea_list */
6852 &fsp, /* result */
6853 NULL); /* pinfo */
6854
6855 if (!NT_STATUS_IS_OK(status)) {
6856 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6857 "returned %s rename %s -> %s\n",
6858 nt_errstr(status),
6859 smb_fname_str_dbg(smb_fname_src),
6860 smb_fname_str_dbg(smb_fname_dst)));
6861 break;
6862 }
6863
6864 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6865 dname);
6866 if (!smb_fname_dst->original_lcomp) {
6867 status = NT_STATUS_NO_MEMORY;
6868 goto out;
6869 }
6870
6871 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6872 attrs, replace_if_exists);
6873
6874 close_file(req, fsp, NORMAL_CLOSE);
6875
6876 if (!NT_STATUS_IS_OK(status)) {
6877 DEBUG(3, ("rename_internals_fsp returned %s for "
6878 "rename %s -> %s\n", nt_errstr(status),
6879 smb_fname_str_dbg(smb_fname_src),
6880 smb_fname_str_dbg(smb_fname_dst)));
6881 break;
6882 }
6883
6884 count++;
6885
6886 DEBUG(3,("rename_internals: doing rename on %s -> "
6887 "%s\n", smb_fname_str_dbg(smb_fname_src),
6888 smb_fname_str_dbg(smb_fname_src)));
6889 TALLOC_FREE(talloced);
6890 }
6891 TALLOC_FREE(dir_hnd);
6892
6893 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6894 status = map_nt_error_from_unix(errno);
6895 }
6896
6897 out:
6898 TALLOC_FREE(talloced);
6899 TALLOC_FREE(fname_src_dir);
6900 TALLOC_FREE(fname_src_mask);
6901 return status;
6902 }
6903
6904 /****************************************************************************
6905 Reply to a mv.
6906 ****************************************************************************/
6907
6908 void reply_mv(struct smb_request *req)
6909 {
6910 connection_struct *conn = req->conn;
6911 char *name = NULL;
6912 char *newname = NULL;
6913 const char *p;
6914 uint32 attrs;
6915 NTSTATUS status;
6916 bool src_has_wcard = False;
6917 bool dest_has_wcard = False;
6918 TALLOC_CTX *ctx = talloc_tos();
6919 struct smb_filename *smb_fname_src = NULL;
6920 struct smb_filename *smb_fname_dst = NULL;
6921 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6922 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6923 bool stream_rename = false;
6924
6925 START_PROFILE(SMBmv);
6926
6927 if (req->wct < 1) {
6928 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6929 goto out;
6930 }
6931
6932 attrs = SVAL(req->vwv+0, 0);
6933
6934 p = (const char *)req->buf + 1;
6935 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6936 &status, &src_has_wcard);
6937 if (!NT_STATUS_IS_OK(status)) {
6938 reply_nterror(req, status);
6939 goto out;
6940 }
6941 p++;
6942 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6943 &status, &dest_has_wcard);
6944 if (!NT_STATUS_IS_OK(status)) {
6945 reply_nterror(req, status);
6946 goto out;
6947 }
6948
6949 if (!lp_posix_pathnames()) {
6950 /* The newname must begin with a ':' if the
6951 name contains a ':'. */
6952 if (strchr_m(name, ':')) {
6953 if (newname[0] != ':') {
6954 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6955 goto out;
6956 }
6957 stream_rename = true;
6958 }
6959 }
6960
6961 status = filename_convert(ctx,
6962 conn,
6963 req->flags2 & FLAGS2_DFS_PATHNAMES,
6964 name,
6965 src_ucf_flags,
6966 &src_has_wcard,
6967 &smb_fname_src);
6968
6969 if (!NT_STATUS_IS_OK(status)) {
6970 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6971 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6972 ERRSRV, ERRbadpath);
6973 goto out;
6974 }
6975 reply_nterror(req, status);
6976 goto out;
6977 }
6978
6979 status = filename_convert(ctx,
6980 conn,
6981 req->flags2 & FLAGS2_DFS_PATHNAMES,
6982 newname,
6983 dst_ucf_flags,
6984 &dest_has_wcard,
6985 &smb_fname_dst);
6986
6987 if (!NT_STATUS_IS_OK(status)) {
6988 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6989 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6990 ERRSRV, ERRbadpath);
6991 goto out;
6992 }
6993 reply_nterror(req, status);
6994 goto out;
6995 }
6996
6997 if (stream_rename) {
6998 /* smb_fname_dst->base_name must be the same as
6999 smb_fname_src->base_name. */
7000 TALLOC_FREE(smb_fname_dst->base_name);
7001 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7002 smb_fname_src->base_name);
7003 if (!smb_fname_dst->base_name) {
7004 reply_nterror(req, NT_STATUS_NO_MEMORY);
7005 goto out;
7006 }
7007 }
7008
7009 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7010 smb_fname_str_dbg(smb_fname_dst)));
7011
7012 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7013 attrs, False, src_has_wcard, dest_has_wcard,
7014 DELETE_ACCESS);
7015 if (!NT_STATUS_IS_OK(status)) {
7016 if (open_was_deferred(req->sconn, req->mid)) {
7017 /* We have re-scheduled this call. */
7018 goto out;
7019 }
7020 reply_nterror(req, status);
7021 goto out;
7022 }
7023
7024 reply_outbuf(req, 0, 0);
7025 out:
7026 TALLOC_FREE(smb_fname_src);
7027 TALLOC_FREE(smb_fname_dst);
7028 END_PROFILE(SMBmv);
7029 return;
7030 }
7031
7032 /*******************************************************************
7033 Copy a file as part of a reply_copy.
7034 ******************************************************************/
7035
7036 /*
7037 * TODO: check error codes on all callers
7038 */
7039
7040 NTSTATUS copy_file(TALLOC_CTX *ctx,
7041 connection_struct *conn,
7042 struct smb_filename *smb_fname_src,
7043 struct smb_filename *smb_fname_dst,
7044 int ofun,
7045 int count,
7046 bool target_is_directory)
7047 {
7048 struct smb_filename *smb_fname_dst_tmp = NULL;
7049 off_t ret=-1;
7050 files_struct *fsp1,*fsp2;
7051 uint32 dosattrs;
7052 uint32 new_create_disposition;
7053 NTSTATUS status;
7054
7055
7056 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7057 if (smb_fname_dst_tmp == NULL) {
7058 return NT_STATUS_NO_MEMORY;
7059 }
7060
7061 /*
7062 * If the target is a directory, extract the last component from the
7063 * src filename and append it to the dst filename
7064 */
7065 if (target_is_directory) {
7066 const char *p;
7067
7068 /* dest/target can't be a stream if it's a directory. */
7069 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7070
7071 p = strrchr_m(smb_fname_src->base_name,'/');
7072 if (p) {
7073 p++;
7074 } else {
7075 p = smb_fname_src->base_name;
7076 }
7077 smb_fname_dst_tmp->base_name =
7078 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7079 p);
7080 if (!smb_fname_dst_tmp->base_name) {
7081 status = NT_STATUS_NO_MEMORY;
7082 goto out;
7083 }
7084 }
7085
7086 status = vfs_file_exist(conn, smb_fname_src);
7087 if (!NT_STATUS_IS_OK(status)) {
7088 goto out;
7089 }
7090
7091 if (!target_is_directory && count) {
7092 new_create_disposition = FILE_OPEN;
7093 } else {
7094 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7095 0, ofun,
7096 NULL, NULL,
7097 &new_create_disposition,
7098 NULL,
7099 NULL)) {
7100 status = NT_STATUS_INVALID_PARAMETER;
7101 goto out;
7102 }
7103 }
7104
7105 /* Open the src file for reading. */
7106 status = SMB_VFS_CREATE_FILE(
7107 conn, /* conn */
7108 NULL, /* req */
7109 0, /* root_dir_fid */
7110 smb_fname_src, /* fname */
7111 FILE_GENERIC_READ, /* access_mask */
7112 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7113 FILE_OPEN, /* create_disposition*/
7114 0, /* create_options */
7115 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7116 INTERNAL_OPEN_ONLY, /* oplock_request */
7117 0, /* allocation_size */
7118 0, /* private_flags */
7119 NULL, /* sd */
7120 NULL, /* ea_list */
7121 &fsp1, /* result */
7122 NULL); /* psbuf */
7123
7124 if (!NT_STATUS_IS_OK(status)) {
7125 goto out;
7126 }
7127
7128 dosattrs = dos_mode(conn, smb_fname_src);
7129
7130 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7131 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7132 }
7133
7134 /* Open the dst file for writing. */
7135 status = SMB_VFS_CREATE_FILE(
7136 conn, /* conn */
7137 NULL, /* req */
7138 0, /* root_dir_fid */
7139 smb_fname_dst, /* fname */
7140 FILE_GENERIC_WRITE, /* access_mask */
7141 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7142 new_create_disposition, /* create_disposition*/
7143 0, /* create_options */
7144 dosattrs, /* file_attributes */
7145 INTERNAL_OPEN_ONLY, /* oplock_request */
7146 0, /* allocation_size */
7147 0, /* private_flags */
7148 NULL, /* sd */
7149 NULL, /* ea_list */
7150 &fsp2, /* result */
7151 NULL); /* psbuf */
7152
7153 if (!NT_STATUS_IS_OK(status)) {
7154 close_file(NULL, fsp1, ERROR_CLOSE);
7155 goto out;
7156 }
7157
7158 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7159 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7160 if (ret == -1) {
7161 DEBUG(0, ("error - vfs lseek returned error %s\n",
7162 strerror(errno)));
7163 status = map_nt_error_from_unix(errno);
7164 close_file(NULL, fsp1, ERROR_CLOSE);
7165 close_file(NULL, fsp2, ERROR_CLOSE);
7166 goto out;
7167 }
7168 }
7169
7170 /* Do the actual copy. */
7171 if (smb_fname_src->st.st_ex_size) {
7172 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7173 } else {
7174 ret = 0;
7175 }
7176
7177 close_file(NULL, fsp1, NORMAL_CLOSE);
7178
7179 /* Ensure the modtime is set correctly on the destination file. */
7180 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7181
7182 /*
7183 * As we are opening fsp1 read-only we only expect
7184 * an error on close on fsp2 if we are out of space.
7185 * Thus we don't look at the error return from the
7186 * close of fsp1.
7187 */
7188 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7189
7190 if (!NT_STATUS_IS_OK(status)) {
7191 goto out;
7192 }
7193
7194 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7195 status = NT_STATUS_DISK_FULL;
7196 goto out;
7197 }
7198
7199 status = NT_STATUS_OK;
7200
7201 out:
7202 TALLOC_FREE(smb_fname_dst_tmp);
7203 return status;
7204 }
7205
7206 /****************************************************************************
7207 Reply to a file copy.
7208 ****************************************************************************/
7209
7210 void reply_copy(struct smb_request *req)
7211 {
7212 connection_struct *conn = req->conn;
7213 struct smb_filename *smb_fname_src = NULL;
7214 struct smb_filename *smb_fname_dst = NULL;
7215 char *fname_src = NULL;
7216 char *fname_dst = NULL;
7217 char *fname_src_mask = NULL;
7218 char *fname_src_dir = NULL;
7219 const char *p;
7220 int count=0;
7221 int error = ERRnoaccess;
7222 int tid2;
7223 int ofun;
7224 int flags;
7225 bool target_is_directory=False;
7226 bool source_has_wild = False;
7227 bool dest_has_wild = False;
7228 NTSTATUS status;
7229 TALLOC_CTX *ctx = talloc_tos();
7230
7231 START_PROFILE(SMBcopy);
7232
7233 if (req->wct < 3) {
7234 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7235 goto out;
7236 }
7237
7238 tid2 = SVAL(req->vwv+0, 0);
7239 ofun = SVAL(req->vwv+1, 0);
7240 flags = SVAL(req->vwv+2, 0);
7241
7242 p = (const char *)req->buf;
7243 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7244 &status, &source_has_wild);
7245 if (!NT_STATUS_IS_OK(status)) {
7246 reply_nterror(req, status);
7247 goto out;
7248 }
7249 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7250 &status, &dest_has_wild);
7251 if (!NT_STATUS_IS_OK(status)) {
7252 reply_nterror(req, status);
7253 goto out;
7254 }
7255
7256 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7257
7258 if (tid2 != conn->cnum) {
7259 /* can't currently handle inter share copies XXXX */
7260 DEBUG(3,("Rejecting inter-share copy\n"));
7261 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7262 goto out;
7263 }
7264
7265 status = filename_convert(ctx, conn,
7266 req->flags2 & FLAGS2_DFS_PATHNAMES,
7267 fname_src,
7268 UCF_COND_ALLOW_WCARD_LCOMP,
7269 &source_has_wild,
7270 &smb_fname_src);
7271 if (!NT_STATUS_IS_OK(status)) {
7272 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7273 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7274 ERRSRV, ERRbadpath);
7275 goto out;
7276 }
7277 reply_nterror(req, status);
7278 goto out;
7279 }
7280
7281 status = filename_convert(ctx, conn,
7282 req->flags2 & FLAGS2_DFS_PATHNAMES,
7283 fname_dst,
7284 UCF_COND_ALLOW_WCARD_LCOMP,
7285 &dest_has_wild,
7286 &smb_fname_dst);
7287 if (!NT_STATUS_IS_OK(status)) {
7288 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7289 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7290 ERRSRV, ERRbadpath);
7291 goto out;
7292 }
7293 reply_nterror(req, status);
7294 goto out;
7295 }
7296
7297 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7298
7299 if ((flags&1) && target_is_directory) {
7300 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7301 goto out;
7302 }
7303
7304 if ((flags&2) && !target_is_directory) {
7305 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7306 goto out;
7307 }
7308
7309 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7310 /* wants a tree copy! XXXX */
7311 DEBUG(3,("Rejecting tree copy\n"));
7312 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7313 goto out;
7314 }
7315
7316 /* Split up the directory from the filename/mask. */
7317 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7318 &fname_src_dir, &fname_src_mask);
7319 if (!NT_STATUS_IS_OK(status)) {
7320 reply_nterror(req, NT_STATUS_NO_MEMORY);
7321 goto out;
7322 }
7323
7324 /*
7325 * We should only check the mangled cache
7326 * here if unix_convert failed. This means
7327 * that the path in 'mask' doesn't exist
7328 * on the file system and so we need to look
7329 * for a possible mangle. This patch from
7330 * Tine Smukavec <valentin.smukavec@hermes.si>.
7331 */
7332 if (!VALID_STAT(smb_fname_src->st) &&
7333 mangle_is_mangled(fname_src_mask, conn->params)) {
7334 char *new_mask = NULL;
7335 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7336 &new_mask, conn->params);
7337
7338 /* Use demangled name if one was successfully found. */
7339 if (new_mask) {
7340 TALLOC_FREE(fname_src_mask);
7341 fname_src_mask = new_mask;
7342 }
7343 }
7344
7345 if (!source_has_wild) {
7346
7347 /*
7348 * Only one file needs to be copied. Append the mask back onto
7349 * the directory.
7350 */
7351 TALLOC_FREE(smb_fname_src->base_name);
7352 if (ISDOT(fname_src_dir)) {
7353 /* Ensure we use canonical names on open. */
7354 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7355 "%s",
7356 fname_src_mask);
7357 } else {
7358 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7359 "%s/%s",
7360 fname_src_dir,
7361 fname_src_mask);
7362 }
7363 if (!smb_fname_src->base_name) {
7364 reply_nterror(req, NT_STATUS_NO_MEMORY);
7365 goto out;
7366 }
7367
7368 if (dest_has_wild) {
7369 char *fname_dst_mod = NULL;
7370 if (!resolve_wildcards(smb_fname_dst,
7371 smb_fname_src->base_name,
7372 smb_fname_dst->base_name,
7373 &fname_dst_mod)) {
7374 reply_nterror(req, NT_STATUS_NO_MEMORY);
7375 goto out;
7376 }
7377 TALLOC_FREE(smb_fname_dst->base_name);
7378 smb_fname_dst->base_name = fname_dst_mod;
7379 }
7380
7381 status = check_name(conn, smb_fname_src->base_name);
7382 if (!NT_STATUS_IS_OK(status)) {
7383 reply_nterror(req, status);
7384 goto out;
7385 }
7386
7387 status = check_name(conn, smb_fname_dst->base_name);
7388 if (!NT_STATUS_IS_OK(status)) {
7389 reply_nterror(req, status);
7390 goto out;
7391 }
7392
7393 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7394 ofun, count, target_is_directory);
7395
7396 if(!NT_STATUS_IS_OK(status)) {
7397 reply_nterror(req, status);
7398 goto out;
7399 } else {
7400 count++;
7401 }
7402 } else {
7403 struct smb_Dir *dir_hnd = NULL;
7404 const char *dname = NULL;
7405 char *talloced = NULL;
7406 long offset = 0;
7407
7408 /*
7409 * There is a wildcard that requires us to actually read the
7410 * src dir and copy each file matching the mask to the dst.
7411 * Right now streams won't be copied, but this could
7412 * presumably be added with a nested loop for reach dir entry.
7413 */
7414 SMB_ASSERT(!smb_fname_src->stream_name);
7415 SMB_ASSERT(!smb_fname_dst->stream_name);
7416
7417 smb_fname_src->stream_name = NULL;
7418 smb_fname_dst->stream_name = NULL;
7419
7420 if (strequal(fname_src_mask,"????????.???")) {
7421 TALLOC_FREE(fname_src_mask);
7422 fname_src_mask = talloc_strdup(ctx, "*");
7423 if (!fname_src_mask) {
7424 reply_nterror(req, NT_STATUS_NO_MEMORY);
7425 goto out;
7426 }
7427 }
7428
7429 status = check_name(conn, fname_src_dir);
7430 if (!NT_STATUS_IS_OK(status)) {
7431 reply_nterror(req, status);
7432 goto out;
7433 }
7434
7435 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7436 if (dir_hnd == NULL) {
7437 status = map_nt_error_from_unix(errno);
7438 reply_nterror(req, status);
7439 goto out;
7440 }
7441
7442 error = ERRbadfile;
7443
7444 /* Iterate over the src dir copying each entry to the dst. */
7445 while ((dname = ReadDirName(dir_hnd, &offset,
7446 &smb_fname_src->st, &talloced))) {
7447 char *destname = NULL;
7448
7449 if (ISDOT(dname) || ISDOTDOT(dname)) {
7450 TALLOC_FREE(talloced);
7451 continue;
7452 }
7453
7454 if (!is_visible_file(conn, fname_src_dir, dname,
7455 &smb_fname_src->st, false)) {
7456 TALLOC_FREE(talloced);
7457 continue;
7458 }
7459
7460 if(!mask_match(dname, fname_src_mask,
7461 conn->case_sensitive)) {
7462 TALLOC_FREE(talloced);
7463 continue;
7464 }
7465
7466 error = ERRnoaccess;
7467
7468 /* Get the src smb_fname struct setup. */
7469 TALLOC_FREE(smb_fname_src->base_name);
7470 if (ISDOT(fname_src_dir)) {
7471 /* Ensure we use canonical names on open. */
7472 smb_fname_src->base_name =
7473 talloc_asprintf(smb_fname_src, "%s",
7474 dname);
7475 } else {
7476 smb_fname_src->base_name =
7477 talloc_asprintf(smb_fname_src, "%s/%s",
7478 fname_src_dir, dname);
7479 }
7480
7481 if (!smb_fname_src->base_name) {
7482 TALLOC_FREE(dir_hnd);
7483 TALLOC_FREE(talloced);
7484 reply_nterror(req, NT_STATUS_NO_MEMORY);
7485 goto out;
7486 }
7487
7488 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7489 smb_fname_dst->base_name,
7490 &destname)) {
7491 TALLOC_FREE(talloced);
7492 continue;
7493 }
7494 if (!destname) {
7495 TALLOC_FREE(dir_hnd);
7496 TALLOC_FREE(talloced);
7497 reply_nterror(req, NT_STATUS_NO_MEMORY);
7498 goto out;
7499 }
7500
7501 TALLOC_FREE(smb_fname_dst->base_name);
7502 smb_fname_dst->base_name = destname;
7503
7504 status = check_name(conn, smb_fname_src->base_name);
7505 if (!NT_STATUS_IS_OK(status)) {
7506 TALLOC_FREE(dir_hnd);
7507 TALLOC_FREE(talloced);
7508 reply_nterror(req, status);
7509 goto out;
7510 }
7511
7512 status = check_name(conn, smb_fname_dst->base_name);
7513 if (!NT_STATUS_IS_OK(status)) {
7514 TALLOC_FREE(dir_hnd);
7515 TALLOC_FREE(talloced);
7516 reply_nterror(req, status);
7517 goto out;
7518 }
7519
7520 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7521 smb_fname_src->base_name,
7522 smb_fname_dst->base_name));
7523
7524 status = copy_file(ctx, conn, smb_fname_src,
7525 smb_fname_dst, ofun, count,
7526 target_is_directory);
7527 if (NT_STATUS_IS_OK(status)) {
7528 count++;
7529 }
7530
7531 TALLOC_FREE(talloced);
7532 }
7533 TALLOC_FREE(dir_hnd);
7534 }
7535
7536 if (count == 0) {
7537 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7538 goto out;
7539 }
7540
7541 reply_outbuf(req, 1, 0);
7542 SSVAL(req->outbuf,smb_vwv0,count);
7543 out:
7544 TALLOC_FREE(smb_fname_src);
7545 TALLOC_FREE(smb_fname_dst);
7546 TALLOC_FREE(fname_src);
7547 TALLOC_FREE(fname_dst);
7548 TALLOC_FREE(fname_src_mask);
7549 TALLOC_FREE(fname_src_dir);
7550
7551 END_PROFILE(SMBcopy);
7552 return;
7553 }
7554
7555 #undef DBGC_CLASS
7556 #define DBGC_CLASS DBGC_LOCKING
7557
7558 /****************************************************************************
7559 Get a lock pid, dealing with large count requests.
7560 ****************************************************************************/
7561
7562 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7563 bool large_file_format)
7564 {
7565 if(!large_file_format)
7566 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7567 else
7568 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7569 }
7570
7571 /****************************************************************************
7572 Get a lock count, dealing with large count requests.
7573 ****************************************************************************/
7574
7575 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7576 bool large_file_format)
7577 {
7578 uint64_t count = 0;
7579
7580 if(!large_file_format) {
7581 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7582 } else {
7583 /*
7584 * No BVAL, this is reversed!
7585 */
7586 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7587 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7588 }
7589
7590 return count;
7591 }
7592
7593 /****************************************************************************
7594 Get a lock offset, dealing with large offset requests.
7595 ****************************************************************************/
7596
7597 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7598 bool large_file_format)
7599 {
7600 uint64_t offset = 0;
7601
7602 if(!large_file_format) {
7603 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7604 } else {
7605 /*
7606 * No BVAL, this is reversed!
7607 */
7608 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7609 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7610 }
7611
7612 return offset;
7613 }
7614
7615 NTSTATUS smbd_do_locking(struct smb_request *req,
7616 files_struct *fsp,
7617 uint8_t type,
7618 int32_t timeout,
7619 uint16_t num_locks,
7620 struct smbd_lock_element *locks,
7621 bool *async)
7622 {
7623 connection_struct *conn = req->conn;
7624 int i;
7625 NTSTATUS status = NT_STATUS_OK;
7626
7627 *async = false;
7628
7629 /* Setup the timeout in seconds. */
7630
7631 if (!lp_blocking_locks(SNUM(conn))) {
7632 timeout = 0;
7633 }
7634
7635 for(i = 0; i < (int)num_locks; i++) {
7636 struct smbd_lock_element *e = &locks[i];
7637
7638 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7639 "%llu, file %s timeout = %d\n",
7640 (double)e->offset,
7641 (double)e->count,
7642 (unsigned long long)e->smblctx,
7643 fsp_str_dbg(fsp),
7644 (int)timeout));
7645
7646 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7647 struct blocking_lock_record *blr = NULL;
7648
7649 if (num_locks > 1) {
7650 /*
7651 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7652 * if the lock vector contains one entry. When given mutliple cancel
7653 * requests in a single PDU we expect the server to return an
7654 * error. Windows servers seem to accept the request but only
7655 * cancel the first lock.
7656 * JRA - Do what Windows does (tm) :-).
7657 */
7658
7659 #if 0
7660 /* MS-CIFS (2.2.4.32.1) behavior. */
7661 return NT_STATUS_DOS(ERRDOS,
7662 ERRcancelviolation);
7663 #else
7664 /* Windows behavior. */
7665 if (i != 0) {
7666 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7667 "cancel request\n"));
7668 continue;
7669 }
7670 #endif
7671 }
7672
7673 if (lp_blocking_locks(SNUM(conn))) {
7674
7675 /* Schedule a message to ourselves to
7676 remove the blocking lock record and
7677 return the right error. */
7678
7679 blr = blocking_lock_cancel_smb1(fsp,
7680 e->smblctx,
7681 e->offset,
7682 e->count,
7683 WINDOWS_LOCK,
7684 type,
7685 NT_STATUS_FILE_LOCK_CONFLICT);
7686 if (blr == NULL) {
7687 return NT_STATUS_DOS(
7688 ERRDOS,
7689 ERRcancelviolation);
7690 }
7691 }
7692 /* Remove a matching pending lock. */
7693 status = do_lock_cancel(fsp,
7694 e->smblctx,
7695 e->count,
7696 e->offset,
7697 WINDOWS_LOCK);
7698 } else {
7699 bool blocking_lock = timeout ? true : false;
7700 bool defer_lock = false;
7701 struct byte_range_lock *br_lck;
7702 uint64_t block_smblctx;
7703
7704 br_lck = do_lock(req->sconn->msg_ctx,
7705 fsp,
7706 e->smblctx,
7707 e->count,
7708 e->offset,
7709 e->brltype,
7710 WINDOWS_LOCK,
7711 blocking_lock,
7712 &status,
7713 &block_smblctx);
7714
7715 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7716 /* Windows internal resolution for blocking locks seems
7717 to be about 200ms... Don't wait for less than that. JRA. */
7718 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7719 timeout = lp_lock_spin_time();
7720 }
7721 defer_lock = true;
7722 }
7723
7724 /* If a lock sent with timeout of zero would fail, and
7725 * this lock has been requested multiple times,
7726 * according to brl_lock_failed() we convert this
7727 * request to a blocking lock with a timeout of between
7728 * 150 - 300 milliseconds.
7729 *
7730 * If lp_lock_spin_time() has been set to 0, we skip
7731 * this blocking retry and fail immediately.
7732 *
7733 * Replacement for do_lock_spin(). JRA. */
7734
7735 if (!req->sconn->using_smb2 &&
7736 br_lck && lp_blocking_locks(SNUM(conn)) &&
7737 lp_lock_spin_time() && !blocking_lock &&
7738 NT_STATUS_EQUAL((status),
7739 NT_STATUS_FILE_LOCK_CONFLICT))
7740 {
7741 defer_lock = true;
7742 timeout = lp_lock_spin_time();
7743 }
7744
7745 if (br_lck && defer_lock) {
7746 /*
7747 * A blocking lock was requested. Package up
7748 * this smb into a queued request and push it
7749 * onto the blocking lock queue.
7750 */
7751 if(push_blocking_lock_request(br_lck,
7752 req,
7753 fsp,
7754 timeout,
7755 i,
7756 e->smblctx,
7757 e->brltype,
7758 WINDOWS_LOCK,
7759 e->offset,
7760 e->count,
7761 block_smblctx)) {
7762 TALLOC_FREE(br_lck);
7763 *async = true;
7764 return NT_STATUS_OK;
7765 }
7766 }
7767
7768 TALLOC_FREE(br_lck);
7769 }
7770
7771 if (!NT_STATUS_IS_OK(status)) {
7772 break;
7773 }
7774 }
7775
7776 /* If any of the above locks failed, then we must unlock
7777 all of the previous locks (X/Open spec). */
7778
7779 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7780
7781 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7782 i = -1; /* we want to skip the for loop */
7783 }
7784
7785 /*
7786 * Ensure we don't do a remove on the lock that just failed,
7787 * as under POSIX rules, if we have a lock already there, we
7788 * will delete it (and we shouldn't) .....
7789 */
7790 for(i--; i >= 0; i--) {
7791 struct smbd_lock_element *e = &locks[i];
7792
7793 do_unlock(req->sconn->msg_ctx,
7794 fsp,
7795 e->smblctx,
7796 e->count,
7797 e->offset,
7798 WINDOWS_LOCK);
7799 }
7800 return status;
7801 }
7802
7803 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
7804 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
7805
7806 return NT_STATUS_OK;
7807 }
7808
7809 NTSTATUS smbd_do_unlocking(struct smb_request *req,
7810 files_struct *fsp,
7811 uint16_t num_ulocks,
7812 struct smbd_lock_element *ulocks)
7813 {
7814 int i;
7815
7816 for(i = 0; i < (int)num_ulocks; i++) {
7817 struct smbd_lock_element *e = &ulocks[i];
7818 NTSTATUS status;
7819
7820 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
7821 "pid %u, file %s\n", __func__,
7822 (double)e->offset,
7823 (double)e->count,
7824 (unsigned int)e->smblctx,
7825 fsp_str_dbg(fsp)));
7826
7827 if (e->brltype != UNLOCK_LOCK) {
7828 /* this can only happen with SMB2 */
7829 return NT_STATUS_INVALID_PARAMETER;
7830 }
7831
7832 status = do_unlock(req->sconn->msg_ctx,
7833 fsp,
7834 e->smblctx,
7835 e->count,
7836 e->offset,
7837 WINDOWS_LOCK);
7838
7839 DEBUG(10, ("%s: unlock returned %s\n", __func__,
7840 nt_errstr(status)));
7841
7842 if (!NT_STATUS_IS_OK(status)) {
7843 return status;
7844 }
7845 }
7846
7847 DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
7848 num_ulocks));
7849
7850 return NT_STATUS_OK;
7851 }
7852
7853 /****************************************************************************
7854 Reply to a lockingX request.
7855 ****************************************************************************/
7856
7857 void reply_lockingX(struct smb_request *req)
7858 {
7859 connection_struct *conn = req->conn;
7860 files_struct *fsp;
7861 unsigned char locktype;
7862 unsigned char oplocklevel;
7863 uint16 num_ulocks;
7864 uint16 num_locks;
7865 int32 lock_timeout;
7866 int i;
7867 const uint8_t *data;
7868 bool large_file_format;
7869 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7870 struct smbd_lock_element *ulocks;
7871 struct smbd_lock_element *locks;
7872 bool async = false;
7873
7874 START_PROFILE(SMBlockingX);
7875
7876 if (req->wct < 8) {
7877 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7878 END_PROFILE(SMBlockingX);
7879 return;
7880 }
7881
7882 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7883 locktype = CVAL(req->vwv+3, 0);
7884 oplocklevel = CVAL(req->vwv+3, 1);
7885 num_ulocks = SVAL(req->vwv+6, 0);
7886 num_locks = SVAL(req->vwv+7, 0);
7887 lock_timeout = IVAL(req->vwv+4, 0);
7888 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7889
7890 if (!check_fsp(conn, req, fsp)) {
7891 END_PROFILE(SMBlockingX);
7892 return;
7893 }
7894
7895 data = req->buf;
7896
7897 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7898 /* we don't support these - and CANCEL_LOCK makes w2k
7899 and XP reboot so I don't really want to be
7900 compatible! (tridge) */
7901 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7902 END_PROFILE(SMBlockingX);
7903 return;
7904 }
7905
7906 /* Check if this is an oplock break on a file
7907 we have granted an oplock on.
7908 */
7909 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7910 /* Client can insist on breaking to none. */
7911 bool break_to_none = (oplocklevel == 0);
7912 bool result;
7913
7914 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7915 "for %s\n", (unsigned int)oplocklevel,
7916 fsp_fnum_dbg(fsp)));
7917
7918 /*
7919 * Make sure we have granted an exclusive or batch oplock on
7920 * this file.
7921 */
7922
7923 if (fsp->oplock_type == 0) {
7924
7925 /* The Samba4 nbench simulator doesn't understand
7926 the difference between break to level2 and break
7927 to none from level2 - it sends oplock break
7928 replies in both cases. Don't keep logging an error
7929 message here - just ignore it. JRA. */
7930
7931 DEBUG(5,("reply_lockingX: Error : oplock break from "
7932 "client for %s (oplock=%d) and no "
7933 "oplock granted on this file (%s).\n",
7934 fsp_fnum_dbg(fsp), fsp->oplock_type,
7935 fsp_str_dbg(fsp)));
7936
7937 /* if this is a pure oplock break request then don't
7938 * send a reply */
7939 if (num_locks == 0 && num_ulocks == 0) {
7940 END_PROFILE(SMBlockingX);
7941 return;
7942 } else {
7943 END_PROFILE(SMBlockingX);
7944 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7945 return;
7946 }
7947 }
7948
7949 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7950 (break_to_none)) {
7951 result = remove_oplock(fsp);
7952 } else {
7953 result = downgrade_oplock(fsp);
7954 }
7955
7956 if (!result) {
7957 DEBUG(0, ("reply_lockingX: error in removing "
7958 "oplock on file %s\n", fsp_str_dbg(fsp)));
7959 /* Hmmm. Is this panic justified? */
7960 smb_panic("internal tdb error");
7961 }
7962
7963 /* if this is a pure oplock break request then don't send a
7964 * reply */
7965 if (num_locks == 0 && num_ulocks == 0) {
7966 /* Sanity check - ensure a pure oplock break is not a
7967 chained request. */
7968 if(CVAL(req->vwv+0, 0) != 0xff)
7969 DEBUG(0,("reply_lockingX: Error : pure oplock "
7970 "break is a chained %d request !\n",
7971 (unsigned int)CVAL(req->vwv+0, 0)));
7972 END_PROFILE(SMBlockingX);
7973 return;
7974 }
7975 }
7976
7977 if (req->buflen <
7978 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7979 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7980 END_PROFILE(SMBlockingX);
7981 return;
7982 }
7983
7984 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7985 if (ulocks == NULL) {
7986 reply_nterror(req, NT_STATUS_NO_MEMORY);
7987 END_PROFILE(SMBlockingX);
7988 return;
7989 }
7990
7991 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7992 if (locks == NULL) {
7993 reply_nterror(req, NT_STATUS_NO_MEMORY);
7994 END_PROFILE(SMBlockingX);
7995 return;
7996 }
7997
7998 /* Data now points at the beginning of the list
7999 of smb_unlkrng structs */
8000 for(i = 0; i < (int)num_ulocks; i++) {
8001 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8002 ulocks[i].count = get_lock_count(data, i, large_file_format);
8003 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8004 ulocks[i].brltype = UNLOCK_LOCK;
8005 }
8006
8007 /* Now do any requested locks */
8008 data += ((large_file_format ? 20 : 10)*num_ulocks);
8009
8010 /* Data now points at the beginning of the list
8011 of smb_lkrng structs */
8012
8013 for(i = 0; i < (int)num_locks; i++) {
8014 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8015 locks[i].count = get_lock_count(data, i, large_file_format);
8016 locks[i].offset = get_lock_offset(data, i, large_file_format);
8017
8018 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8019 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8020 locks[i].brltype = PENDING_READ_LOCK;
8021 } else {
8022 locks[i].brltype = READ_LOCK;
8023 }
8024 } else {
8025 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8026 locks[i].brltype = PENDING_WRITE_LOCK;
8027 } else {
8028 locks[i].brltype = WRITE_LOCK;
8029 }
8030 }
8031 }
8032
8033 status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8034 if (!NT_STATUS_IS_OK(status)) {
8035 END_PROFILE(SMBlockingX);
8036 reply_nterror(req, status);
8037 return;
8038 }
8039
8040 status = smbd_do_locking(req, fsp,
8041 locktype, lock_timeout,
8042 num_locks, locks,
8043 &async);
8044 if (!NT_STATUS_IS_OK(status)) {
8045 END_PROFILE(SMBlockingX);
8046 reply_nterror(req, status);
8047 return;
8048 }
8049 if (async) {
8050 END_PROFILE(SMBlockingX);
8051 return;
8052 }
8053
8054 reply_outbuf(req, 2, 0);
8055 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8056 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8057
8058 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8059 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8060
8061 END_PROFILE(SMBlockingX);
8062 }
8063
8064 #undef DBGC_CLASS
8065 #define DBGC_CLASS DBGC_ALL
8066
8067 /****************************************************************************
8068 Reply to a SMBreadbmpx (read block multiplex) request.
8069 Always reply with an error, if someone has a platform really needs this,
8070 please contact vl@samba.org
8071 ****************************************************************************/
8072
8073 void reply_readbmpx(struct smb_request *req)
8074 {
8075 START_PROFILE(SMBreadBmpx);
8076 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8077 END_PROFILE(SMBreadBmpx);
8078 return;
8079 }
8080
8081 /****************************************************************************
8082 Reply to a SMBreadbs (read block multiplex secondary) request.
8083 Always reply with an error, if someone has a platform really needs this,
8084 please contact vl@samba.org
8085 ****************************************************************************/
8086
8087 void reply_readbs(struct smb_request *req)
8088 {
8089 START_PROFILE(SMBreadBs);
8090 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8091 END_PROFILE(SMBreadBs);
8092 return;
8093 }
8094
8095 /****************************************************************************
8096 Reply to a SMBsetattrE.
8097 ****************************************************************************/
8098
8099 void reply_setattrE(struct smb_request *req)
8100 {
8101 connection_struct *conn = req->conn;
8102 struct smb_file_time ft;
8103 files_struct *fsp;
8104 NTSTATUS status;
8105
8106 START_PROFILE(SMBsetattrE);
8107 ZERO_STRUCT(ft);
8108
8109 if (req->wct < 7) {
8110 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8111 goto out;
8112 }
8113
8114 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8115
8116 if(!fsp || (fsp->conn != conn)) {
8117 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8118 goto out;
8119 }
8120
8121 /*
8122 * Convert the DOS times into unix times.
8123 */
8124
8125 ft.atime = convert_time_t_to_timespec(
8126 srv_make_unix_date2(req->vwv+3));
8127 ft.mtime = convert_time_t_to_timespec(
8128 srv_make_unix_date2(req->vwv+5));
8129 ft.create_time = convert_time_t_to_timespec(
8130 srv_make_unix_date2(req->vwv+1));
8131
8132 reply_outbuf(req, 0, 0);
8133
8134 /*
8135 * Patch from Ray Frush <frush@engr.colostate.edu>
8136 * Sometimes times are sent as zero - ignore them.
8137 */
8138
8139 /* Ensure we have a valid stat struct for the source. */
8140 status = vfs_stat_fsp(fsp);
8141 if (!NT_STATUS_IS_OK(status)) {
8142 reply_nterror(req, status);
8143 goto out;
8144 }
8145
8146 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8147 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8148 goto out;
8149 }
8150
8151 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8152 if (!NT_STATUS_IS_OK(status)) {
8153 reply_nterror(req, status);
8154 goto out;
8155 }
8156
8157 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8158 " createtime=%u\n",
8159 fsp_fnum_dbg(fsp),
8160 (unsigned int)ft.atime.tv_sec,
8161 (unsigned int)ft.mtime.tv_sec,
8162 (unsigned int)ft.create_time.tv_sec
8163 ));
8164 out:
8165 END_PROFILE(SMBsetattrE);
8166 return;
8167 }
8168
8169
8170 /* Back from the dead for OS/2..... JRA. */
8171
8172 /****************************************************************************
8173 Reply to a SMBwritebmpx (write block multiplex primary) request.
8174 Always reply with an error, if someone has a platform really needs this,
8175 please contact vl@samba.org
8176 ****************************************************************************/
8177
8178 void reply_writebmpx(struct smb_request *req)
8179 {
8180 START_PROFILE(SMBwriteBmpx);
8181 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8182 END_PROFILE(SMBwriteBmpx);
8183 return;
8184 }
8185
8186 /****************************************************************************
8187 Reply to a SMBwritebs (write block multiplex secondary) request.
8188 Always reply with an error, if someone has a platform really needs this,
8189 please contact vl@samba.org
8190 ****************************************************************************/
8191
8192 void reply_writebs(struct smb_request *req)
8193 {
8194 START_PROFILE(SMBwriteBs);
8195 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8196 END_PROFILE(SMBwriteBs);
8197 return;
8198 }
8199
8200 /****************************************************************************
8201 Reply to a SMBgetattrE.
8202 ****************************************************************************/
8203
8204 void reply_getattrE(struct smb_request *req)
8205 {
8206 connection_struct *conn = req->conn;
8207 int mode;
8208 files_struct *fsp;
8209 struct timespec create_ts;
8210
8211 START_PROFILE(SMBgetattrE);
8212
8213 if (req->wct < 1) {
8214 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8215 END_PROFILE(SMBgetattrE);
8216 return;
8217 }
8218
8219 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8220
8221 if(!fsp || (fsp->conn != conn)) {
8222 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8223 END_PROFILE(SMBgetattrE);
8224 return;
8225 }
8226
8227 /* Do an fstat on this file */
8228 if(fsp_stat(fsp)) {
8229 reply_nterror(req, map_nt_error_from_unix(errno));
8230 END_PROFILE(SMBgetattrE);
8231 return;
8232 }
8233
8234 mode = dos_mode(conn, fsp->fsp_name);
8235
8236 /*
8237 * Convert the times into dos times. Set create
8238 * date to be last modify date as UNIX doesn't save
8239 * this.
8240 */
8241
8242 reply_outbuf(req, 11, 0);
8243
8244 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8245 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8246 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8247 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8248 /* Should we check pending modtime here ? JRA */
8249 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8250 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8251
8252 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8253 SIVAL(req->outbuf, smb_vwv6, 0);
8254 SIVAL(req->outbuf, smb_vwv8, 0);
8255 } else {
8256 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8257 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8258 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8259 }
8260 SSVAL(req->outbuf,smb_vwv10, mode);
8261
8262 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8263
8264 END_PROFILE(SMBgetattrE);
8265 return;
8266 }
Samba GIT mirror