?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix Coverity ID 2582: FORWARD_NULL
[Samba.git] / source3 / smbd / reply.c
bloba804884ef7be9f564e96c8ea0af7391803fca8f6
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "rpc_client/cli_spoolss.h"
36 #include "rpc_client/init_spoolss.h"
37 #include "rpc_server/rpc_ncacn_np.h"
38 #include "libcli/security/security.h"
39 #include "libsmb/nmblib.h"
40 #include "auth.h"
41 #include "smbprofile.h"
42
43 /****************************************************************************
44 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
45 path or anything including wildcards.
46 We're assuming here that '/' is not the second byte in any multibyte char
47 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
48 set.
49 ****************************************************************************/
50
51 /* Custom version for processing POSIX paths. */
52 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
53
54 static NTSTATUS check_path_syntax_internal(char *path,
55 bool posix_path,
56 bool *p_last_component_contains_wcard)
57 {
58 char *d = path;
59 const char *s = path;
60 NTSTATUS ret = NT_STATUS_OK;
61 bool start_of_name_component = True;
62 bool stream_started = false;
63
64 *p_last_component_contains_wcard = False;
65
66 while (*s) {
67 if (stream_started) {
68 switch (*s) {
69 case '/':
70 case '\\':
71 return NT_STATUS_OBJECT_NAME_INVALID;
72 case ':':
73 if (s[1] == '\0') {
74 return NT_STATUS_OBJECT_NAME_INVALID;
75 }
76 if (strchr_m(&s[1], ':')) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 break;
80 }
81 }
82
83 if ((*s == ':') && !posix_path && !stream_started) {
84 if (*p_last_component_contains_wcard) {
85 return NT_STATUS_OBJECT_NAME_INVALID;
86 }
87 /* Stream names allow more characters than file names.
88 We're overloading posix_path here to allow a wider
89 range of characters. If stream_started is true this
90 is still a Windows path even if posix_path is true.
91 JRA.
92 */
93 stream_started = true;
94 start_of_name_component = false;
95 posix_path = true;
96
97 if (s[1] == '\0') {
98 return NT_STATUS_OBJECT_NAME_INVALID;
99 }
100 }
101
102 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
103 /*
104 * Safe to assume is not the second part of a mb char
105 * as this is handled below.
106 */
107 /* Eat multiple '/' or '\\' */
108 while (IS_PATH_SEP(*s,posix_path)) {
109 s++;
110 }
111 if ((d != path) && (*s != '\0')) {
112 /* We only care about non-leading or trailing '/' or '\\' */
113 *d++ = '/';
114 }
115
116 start_of_name_component = True;
117 /* New component. */
118 *p_last_component_contains_wcard = False;
119 continue;
120 }
121
122 if (start_of_name_component) {
123 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
124 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
125
126 /*
127 * No mb char starts with '.' so we're safe checking the directory separator here.
128 */
129
130 /* If we just added a '/' - delete it */
131 if ((d > path) && (*(d-1) == '/')) {
132 *(d-1) = '\0';
133 d--;
134 }
135
136 /* Are we at the start ? Can't go back further if so. */
137 if (d <= path) {
138 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
139 break;
140 }
141 /* Go back one level... */
142 /* We know this is safe as '/' cannot be part of a mb sequence. */
143 /* NOTE - if this assumption is invalid we are not in good shape... */
144 /* Decrement d first as d points to the *next* char to write into. */
145 for (d--; d > path; d--) {
146 if (*d == '/')
147 break;
148 }
149 s += 2; /* Else go past the .. */
150 /* We're still at the start of a name component, just the previous one. */
151 continue;
152
153 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
154 if (posix_path) {
155 /* Eat the '.' */
156 s++;
157 continue;
158 }
159 }
160
161 }
162
163 if (!(*s & 0x80)) {
164 if (!posix_path) {
165 if (*s <= 0x1f || *s == '|') {
166 return NT_STATUS_OBJECT_NAME_INVALID;
167 }
168 switch (*s) {
169 case '*':
170 case '?':
171 case '<':
172 case '>':
173 case '"':
174 *p_last_component_contains_wcard = True;
175 break;
176 default:
177 break;
178 }
179 }
180 *d++ = *s++;
181 } else {
182 size_t siz;
183 /* Get the size of the next MB character. */
184 next_codepoint(s,&siz);
185 switch(siz) {
186 case 5:
187 *d++ = *s++;
188 /*fall through*/
189 case 4:
190 *d++ = *s++;
191 /*fall through*/
192 case 3:
193 *d++ = *s++;
194 /*fall through*/
195 case 2:
196 *d++ = *s++;
197 /*fall through*/
198 case 1:
199 *d++ = *s++;
200 break;
201 default:
202 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
203 *d = '\0';
204 return NT_STATUS_INVALID_PARAMETER;
205 }
206 }
207 start_of_name_component = False;
208 }
209
210 *d = '\0';
211
212 return ret;
213 }
214
215 /****************************************************************************
216 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
217 No wildcards allowed.
218 ****************************************************************************/
219
220 NTSTATUS check_path_syntax(char *path)
221 {
222 bool ignore;
223 return check_path_syntax_internal(path, False, &ignore);
224 }
225
226 /****************************************************************************
227 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
228 Wildcards allowed - p_contains_wcard returns true if the last component contained
229 a wildcard.
230 ****************************************************************************/
231
232 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
233 {
234 return check_path_syntax_internal(path, False, p_contains_wcard);
235 }
236
237 /****************************************************************************
238 Check the path for a POSIX client.
239 We're assuming here that '/' is not the second byte in any multibyte char
240 set (a safe assumption).
241 ****************************************************************************/
242
243 NTSTATUS check_path_syntax_posix(char *path)
244 {
245 bool ignore;
246 return check_path_syntax_internal(path, True, &ignore);
247 }
248
249 /****************************************************************************
250 Pull a string and check the path allowing a wilcard - provide for error return.
251 ****************************************************************************/
252
253 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
254 const char *base_ptr,
255 uint16 smb_flags2,
256 char **pp_dest,
257 const char *src,
258 size_t src_len,
259 int flags,
260 NTSTATUS *err,
261 bool *contains_wcard)
262 {
263 size_t ret;
264
265 *pp_dest = NULL;
266
267 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
268 src_len, flags);
269
270 if (!*pp_dest) {
271 *err = NT_STATUS_INVALID_PARAMETER;
272 return ret;
273 }
274
275 *contains_wcard = False;
276
277 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
278 /*
279 * For a DFS path the function parse_dfs_path()
280 * will do the path processing, just make a copy.
281 */
282 *err = NT_STATUS_OK;
283 return ret;
284 }
285
286 if (lp_posix_pathnames()) {
287 *err = check_path_syntax_posix(*pp_dest);
288 } else {
289 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
290 }
291
292 return ret;
293 }
294
295 /****************************************************************************
296 Pull a string and check the path - provide for error return.
297 ****************************************************************************/
298
299 size_t srvstr_get_path(TALLOC_CTX *ctx,
300 const char *base_ptr,
301 uint16 smb_flags2,
302 char **pp_dest,
303 const char *src,
304 size_t src_len,
305 int flags,
306 NTSTATUS *err)
307 {
308 bool ignore;
309 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
310 src_len, flags, err, &ignore);
311 }
312
313 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
314 char **pp_dest, const char *src, int flags,
315 NTSTATUS *err, bool *contains_wcard)
316 {
317 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
318 pp_dest, src, smbreq_bufrem(req, src),
319 flags, err, contains_wcard);
320 }
321
322 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
323 char **pp_dest, const char *src, int flags,
324 NTSTATUS *err)
325 {
326 bool ignore;
327 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
328 flags, err, &ignore);
329 }
330
331 /****************************************************************************
332 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
333 ****************************************************************************/
334
335 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
336 files_struct *fsp)
337 {
338 if ((fsp == NULL) || (conn == NULL)) {
339 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
340 return False;
341 }
342 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
343 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
344 return False;
345 }
346 return True;
347 }
348
349 /****************************************************************************
350 Check if we have a correct fsp pointing to a file.
351 ****************************************************************************/
352
353 bool check_fsp(connection_struct *conn, struct smb_request *req,
354 files_struct *fsp)
355 {
356 if (!check_fsp_open(conn, req, fsp)) {
357 return False;
358 }
359 if (fsp->is_directory) {
360 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
361 return False;
362 }
363 if (fsp->fh->fd == -1) {
364 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
365 return False;
366 }
367 fsp->num_smb_operations++;
368 return True;
369 }
370
371 /****************************************************************************
372 Check if we have a correct fsp pointing to a quota fake file. Replacement for
373 the CHECK_NTQUOTA_HANDLE_OK macro.
374 ****************************************************************************/
375
376 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
377 files_struct *fsp)
378 {
379 if (!check_fsp_open(conn, req, fsp)) {
380 return false;
381 }
382
383 if (fsp->is_directory) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle == NULL) {
388 return false;
389 }
390
391 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
392 return false;
393 }
394
395 if (fsp->fake_file_handle->private_data == NULL) {
396 return false;
397 }
398
399 return true;
400 }
401
402 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
403 const char *name, int name_type)
404 {
405 char *trim_name;
406 char *trim_name_type;
407 const char *retarget_parm;
408 char *retarget;
409 char *p;
410 int retarget_type = 0x20;
411 int retarget_port = 139;
412 struct sockaddr_storage retarget_addr;
413 struct sockaddr_in *in_addr;
414 bool ret = false;
415 uint8_t outbuf[10];
416
417 if (get_socket_port(sconn->sock) != 139) {
418 return false;
419 }
420
421 trim_name = talloc_strdup(talloc_tos(), name);
422 if (trim_name == NULL) {
423 goto fail;
424 }
425 trim_char(trim_name, ' ', ' ');
426
427 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
428 name_type);
429 if (trim_name_type == NULL) {
430 goto fail;
431 }
432
433 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
434 trim_name_type, NULL);
435 if (retarget_parm == NULL) {
436 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
437 trim_name, NULL);
438 }
439 if (retarget_parm == NULL) {
440 goto fail;
441 }
442
443 retarget = talloc_strdup(trim_name, retarget_parm);
444 if (retarget == NULL) {
445 goto fail;
446 }
447
448 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
449
450 p = strchr(retarget, ':');
451 if (p != NULL) {
452 *p++ = '\0';
453 retarget_port = atoi(p);
454 }
455
456 p = strchr_m(retarget, '#');
457 if (p != NULL) {
458 *p++ = '\0';
459 if (sscanf(p, "%x", &retarget_type) != 1) {
460 goto fail;
461 }
462 }
463
464 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
465 if (!ret) {
466 DEBUG(10, ("could not resolve %s\n", retarget));
467 goto fail;
468 }
469
470 if (retarget_addr.ss_family != AF_INET) {
471 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
472 goto fail;
473 }
474
475 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
476
477 _smb_setlen(outbuf, 6);
478 SCVAL(outbuf, 0, 0x84);
479 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
480 *(uint16_t *)(outbuf+8) = htons(retarget_port);
481
482 if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
483 NULL)) {
484 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
485 "failed.");
486 }
487
488 ret = true;
489 fail:
490 TALLOC_FREE(trim_name);
491 return ret;
492 }
493
494 static void reply_called_name_not_present(char *outbuf)
495 {
496 smb_setlen(outbuf, 1);
497 SCVAL(outbuf, 0, 0x83);
498 SCVAL(outbuf, 4, 0x82);
499 }
500
501 /****************************************************************************
502 Reply to a (netbios-level) special message.
503 ****************************************************************************/
504
505 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
506 {
507 int msg_type = CVAL(inbuf,0);
508 int msg_flags = CVAL(inbuf,1);
509 /*
510 * We only really use 4 bytes of the outbuf, but for the smb_setlen
511 * calculation & friends (srv_send_smb uses that) we need the full smb
512 * header.
513 */
514 char outbuf[smb_size];
515
516 memset(outbuf, '\0', sizeof(outbuf));
517
518 smb_setlen(outbuf,0);
519
520 switch (msg_type) {
521 case 0x81: /* session request */
522 {
523 /* inbuf_size is guarenteed to be at least 4. */
524 fstring name1,name2;
525 int name_type1, name_type2;
526 int name_len1, name_len2;
527
528 *name1 = *name2 = 0;
529
530 if (sconn->nbt.got_session) {
531 exit_server_cleanly("multiple session request not permitted");
532 }
533
534 SCVAL(outbuf,0,0x82);
535 SCVAL(outbuf,3,0);
536
537 /* inbuf_size is guaranteed to be at least 4. */
538 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
539 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
540 DEBUG(0,("Invalid name length in session request\n"));
541 reply_called_name_not_present(outbuf);
542 break;
543 }
544 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
545 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
546 DEBUG(0,("Invalid name length in session request\n"));
547 reply_called_name_not_present(outbuf);
548 break;
549 }
550
551 name_type1 = name_extract((unsigned char *)inbuf,
552 inbuf_size,(unsigned int)4,name1);
553 name_type2 = name_extract((unsigned char *)inbuf,
554 inbuf_size,(unsigned int)(4 + name_len1),name2);
555
556 if (name_type1 == -1 || name_type2 == -1) {
557 DEBUG(0,("Invalid name type in session request\n"));
558 reply_called_name_not_present(outbuf);
559 break;
560 }
561
562 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
563 name1, name_type1, name2, name_type2));
564
565 if (netbios_session_retarget(sconn, name1, name_type1)) {
566 exit_server_cleanly("retargeted client");
567 }
568
569 /*
570 * Windows NT/2k uses "*SMBSERVER" and XP uses
571 * "*SMBSERV" arrggg!!!
572 */
573 if (strequal(name1, "*SMBSERVER ")
574 || strequal(name1, "*SMBSERV ")) {
575 fstrcpy(name1, sconn->client_id.addr);
576 }
577
578 set_local_machine_name(name1, True);
579 set_remote_machine_name(name2, True);
580
581 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
582 get_local_machine_name(), get_remote_machine_name(),
583 name_type2));
584
585 if (name_type2 == 'R') {
586 /* We are being asked for a pathworks session ---
587 no thanks! */
588 reply_called_name_not_present(outbuf);
589 break;
590 }
591
592 /* only add the client's machine name to the list
593 of possibly valid usernames if we are operating
594 in share mode security */
595 if (lp_security() == SEC_SHARE) {
596 add_session_user(sconn, get_remote_machine_name());
597 }
598
599 reload_services(sconn->msg_ctx, sconn->sock, True);
600 reopen_logs();
601
602 sconn->nbt.got_session = true;
603 break;
604 }
605
606 case 0x89: /* session keepalive request
607 (some old clients produce this?) */
608 SCVAL(outbuf,0,SMBkeepalive);
609 SCVAL(outbuf,3,0);
610 break;
611
612 case 0x82: /* positive session response */
613 case 0x83: /* negative session response */
614 case 0x84: /* retarget session response */
615 DEBUG(0,("Unexpected session response\n"));
616 break;
617
618 case SMBkeepalive: /* session keepalive */
619 default:
620 return;
621 }
622
623 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
624 msg_type, msg_flags));
625
626 srv_send_smb(sconn, outbuf, false, 0, false, NULL);
627
628 if (CVAL(outbuf, 0) != 0x82) {
629 exit_server_cleanly("invalid netbios session");
630 }
631 return;
632 }
633
634 /****************************************************************************
635 Reply to a tcon.
636 conn POINTER CAN BE NULL HERE !
637 ****************************************************************************/
638
639 void reply_tcon(struct smb_request *req)
640 {
641 connection_struct *conn = req->conn;
642 const char *service;
643 char *service_buf = NULL;
644 char *password = NULL;
645 char *dev = NULL;
646 int pwlen=0;
647 NTSTATUS nt_status;
648 const char *p;
649 DATA_BLOB password_blob;
650 TALLOC_CTX *ctx = talloc_tos();
651 struct smbd_server_connection *sconn = req->sconn;
652
653 START_PROFILE(SMBtcon);
654
655 if (req->buflen < 4) {
656 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
657 END_PROFILE(SMBtcon);
658 return;
659 }
660
661 p = (const char *)req->buf + 1;
662 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
663 p += 1;
664 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
665 p += pwlen+1;
666 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
667 p += 1;
668
669 if (service_buf == NULL || password == NULL || dev == NULL) {
670 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
671 END_PROFILE(SMBtcon);
672 return;
673 }
674 p = strrchr_m(service_buf,'\\');
675 if (p) {
676 service = p+1;
677 } else {
678 service = service_buf;
679 }
680
681 password_blob = data_blob(password, pwlen+1);
682
683 conn = make_connection(sconn,service,password_blob,dev,
684 req->vuid,&nt_status);
685 req->conn = conn;
686
687 data_blob_clear_free(&password_blob);
688
689 if (!conn) {
690 reply_nterror(req, nt_status);
691 END_PROFILE(SMBtcon);
692 return;
693 }
694
695 reply_outbuf(req, 2, 0);
696 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
697 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
698 SSVAL(req->outbuf,smb_tid,conn->cnum);
699
700 DEBUG(3,("tcon service=%s cnum=%d\n",
701 service, conn->cnum));
702
703 END_PROFILE(SMBtcon);
704 return;
705 }
706
707 /****************************************************************************
708 Reply to a tcon and X.
709 conn POINTER CAN BE NULL HERE !
710 ****************************************************************************/
711
712 void reply_tcon_and_X(struct smb_request *req)
713 {
714 connection_struct *conn = req->conn;
715 const char *service = NULL;
716 DATA_BLOB password;
717 TALLOC_CTX *ctx = talloc_tos();
718 /* what the cleint thinks the device is */
719 char *client_devicetype = NULL;
720 /* what the server tells the client the share represents */
721 const char *server_devicetype;
722 NTSTATUS nt_status;
723 int passlen;
724 char *path = NULL;
725 const char *p, *q;
726 uint16 tcon_flags;
727 struct smbd_server_connection *sconn = req->sconn;
728
729 START_PROFILE(SMBtconX);
730
731 if (req->wct < 4) {
732 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
733 END_PROFILE(SMBtconX);
734 return;
735 }
736
737 passlen = SVAL(req->vwv+3, 0);
738 tcon_flags = SVAL(req->vwv+2, 0);
739
740 /* we might have to close an old one */
741 if ((tcon_flags & 0x1) && conn) {
742 close_cnum(conn,req->vuid);
743 req->conn = NULL;
744 conn = NULL;
745 }
746
747 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
748 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
749 END_PROFILE(SMBtconX);
750 return;
751 }
752
753 if (sconn->smb1.negprot.encrypted_passwords) {
754 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
755 if (lp_security() == SEC_SHARE) {
756 /*
757 * Security = share always has a pad byte
758 * after the password.
759 */
760 p = (const char *)req->buf + passlen + 1;
761 } else {
762 p = (const char *)req->buf + passlen;
763 }
764 } else {
765 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
766 /* Ensure correct termination */
767 password.data[passlen]=0;
768 p = (const char *)req->buf + passlen + 1;
769 }
770
771 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
772
773 if (path == NULL) {
774 data_blob_clear_free(&password);
775 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
776 END_PROFILE(SMBtconX);
777 return;
778 }
779
780 /*
781 * the service name can be either: \\server\share
782 * or share directly like on the DELL PowerVault 705
783 */
784 if (*path=='\\') {
785 q = strchr_m(path+2,'\\');
786 if (!q) {
787 data_blob_clear_free(&password);
788 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
789 END_PROFILE(SMBtconX);
790 return;
791 }
792 service = q+1;
793 } else {
794 service = path;
795 }
796
797 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
798 &client_devicetype, p,
799 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
800
801 if (client_devicetype == NULL) {
802 data_blob_clear_free(&password);
803 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
804 END_PROFILE(SMBtconX);
805 return;
806 }
807
808 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
809
810 conn = make_connection(sconn, service, password, client_devicetype,
811 req->vuid, &nt_status);
812 req->conn =conn;
813
814 data_blob_clear_free(&password);
815
816 if (!conn) {
817 reply_nterror(req, nt_status);
818 END_PROFILE(SMBtconX);
819 return;
820 }
821
822 if ( IS_IPC(conn) )
823 server_devicetype = "IPC";
824 else if ( IS_PRINT(conn) )
825 server_devicetype = "LPT1:";
826 else
827 server_devicetype = "A:";
828
829 if (get_Protocol() < PROTOCOL_NT1) {
830 reply_outbuf(req, 2, 0);
831 if (message_push_string(&req->outbuf, server_devicetype,
832 STR_TERMINATE|STR_ASCII) == -1) {
833 reply_nterror(req, NT_STATUS_NO_MEMORY);
834 END_PROFILE(SMBtconX);
835 return;
836 }
837 } else {
838 /* NT sets the fstype of IPC$ to the null string */
839 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
840
841 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
842 /* Return permissions. */
843 uint32 perm1 = 0;
844 uint32 perm2 = 0;
845
846 reply_outbuf(req, 7, 0);
847
848 if (IS_IPC(conn)) {
849 perm1 = FILE_ALL_ACCESS;
850 perm2 = FILE_ALL_ACCESS;
851 } else {
852 perm1 = CAN_WRITE(conn) ?
853 SHARE_ALL_ACCESS :
854 SHARE_READ_ONLY;
855 }
856
857 SIVAL(req->outbuf, smb_vwv3, perm1);
858 SIVAL(req->outbuf, smb_vwv5, perm2);
859 } else {
860 reply_outbuf(req, 3, 0);
861 }
862
863 if ((message_push_string(&req->outbuf, server_devicetype,
864 STR_TERMINATE|STR_ASCII) == -1)
865 || (message_push_string(&req->outbuf, fstype,
866 STR_TERMINATE) == -1)) {
867 reply_nterror(req, NT_STATUS_NO_MEMORY);
868 END_PROFILE(SMBtconX);
869 return;
870 }
871
872 /* what does setting this bit do? It is set by NT4 and
873 may affect the ability to autorun mounted cdroms */
874 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
875 (lp_csc_policy(SNUM(conn)) << 2));
876
877 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
878 DEBUG(2,("Serving %s as a Dfs root\n",
879 lp_servicename(SNUM(conn)) ));
880 SSVAL(req->outbuf, smb_vwv2,
881 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
882 }
883 }
884
885
886 DEBUG(3,("tconX service=%s \n",
887 service));
888
889 /* set the incoming and outgoing tid to the just created one */
890 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
891 SSVAL(req->outbuf,smb_tid,conn->cnum);
892
893 END_PROFILE(SMBtconX);
894
895 req->tid = conn->cnum;
896 chain_reply(req);
897 return;
898 }
899
900 /****************************************************************************
901 Reply to an unknown type.
902 ****************************************************************************/
903
904 void reply_unknown_new(struct smb_request *req, uint8 type)
905 {
906 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
907 smb_fn_name(type), type, type));
908 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
909 return;
910 }
911
912 /****************************************************************************
913 Reply to an ioctl.
914 conn POINTER CAN BE NULL HERE !
915 ****************************************************************************/
916
917 void reply_ioctl(struct smb_request *req)
918 {
919 connection_struct *conn = req->conn;
920 uint16 device;
921 uint16 function;
922 uint32 ioctl_code;
923 int replysize;
924 char *p;
925
926 START_PROFILE(SMBioctl);
927
928 if (req->wct < 3) {
929 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
930 END_PROFILE(SMBioctl);
931 return;
932 }
933
934 device = SVAL(req->vwv+1, 0);
935 function = SVAL(req->vwv+2, 0);
936 ioctl_code = (device << 16) + function;
937
938 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
939
940 switch (ioctl_code) {
941 case IOCTL_QUERY_JOB_INFO:
942 replysize = 32;
943 break;
944 default:
945 reply_force_doserror(req, ERRSRV, ERRnosupport);
946 END_PROFILE(SMBioctl);
947 return;
948 }
949
950 reply_outbuf(req, 8, replysize+1);
951 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
952 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
953 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
954 p = smb_buf(req->outbuf);
955 memset(p, '\0', replysize+1); /* valgrind-safe. */
956 p += 1; /* Allow for alignment */
957
958 switch (ioctl_code) {
959 case IOCTL_QUERY_JOB_INFO:
960 {
961 files_struct *fsp = file_fsp(
962 req, SVAL(req->vwv+0, 0));
963 if (!fsp) {
964 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
965 END_PROFILE(SMBioctl);
966 return;
967 }
968 /* Job number */
969 if (fsp->print_file) {
970 SSVAL(p, 0, fsp->print_file->rap_jobid);
971 } else {
972 SSVAL(p, 0, 0);
973 }
974 srvstr_push((char *)req->outbuf, req->flags2, p+2,
975 lp_netbios_name(), 15,
976 STR_TERMINATE|STR_ASCII);
977 if (conn) {
978 srvstr_push((char *)req->outbuf, req->flags2,
979 p+18, lp_servicename(SNUM(conn)),
980 13, STR_TERMINATE|STR_ASCII);
981 } else {
982 memset(p+18, 0, 13);
983 }
984 break;
985 }
986 }
987
988 END_PROFILE(SMBioctl);
989 return;
990 }
991
992 /****************************************************************************
993 Strange checkpath NTSTATUS mapping.
994 ****************************************************************************/
995
996 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
997 {
998 /* Strange DOS error code semantics only for checkpath... */
999 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1000 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1001 /* We need to map to ERRbadpath */
1002 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1003 }
1004 }
1005 return status;
1006 }
1007
1008 /****************************************************************************
1009 Reply to a checkpath.
1010 ****************************************************************************/
1011
1012 void reply_checkpath(struct smb_request *req)
1013 {
1014 connection_struct *conn = req->conn;
1015 struct smb_filename *smb_fname = NULL;
1016 char *name = NULL;
1017 NTSTATUS status;
1018 TALLOC_CTX *ctx = talloc_tos();
1019
1020 START_PROFILE(SMBcheckpath);
1021
1022 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1023 STR_TERMINATE, &status);
1024
1025 if (!NT_STATUS_IS_OK(status)) {
1026 status = map_checkpath_error(req->flags2, status);
1027 reply_nterror(req, status);
1028 END_PROFILE(SMBcheckpath);
1029 return;
1030 }
1031
1032 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1033
1034 status = filename_convert(ctx,
1035 conn,
1036 req->flags2 & FLAGS2_DFS_PATHNAMES,
1037 name,
1038 0,
1039 NULL,
1040 &smb_fname);
1041
1042 if (!NT_STATUS_IS_OK(status)) {
1043 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1044 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1045 ERRSRV, ERRbadpath);
1046 END_PROFILE(SMBcheckpath);
1047 return;
1048 }
1049 goto path_err;
1050 }
1051
1052 if (!VALID_STAT(smb_fname->st) &&
1053 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1054 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1055 smb_fname_str_dbg(smb_fname), strerror(errno)));
1056 status = map_nt_error_from_unix(errno);
1057 goto path_err;
1058 }
1059
1060 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1061 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1062 ERRDOS, ERRbadpath);
1063 goto out;
1064 }
1065
1066 reply_outbuf(req, 0, 0);
1067
1068 path_err:
1069 /* We special case this - as when a Windows machine
1070 is parsing a path is steps through the components
1071 one at a time - if a component fails it expects
1072 ERRbadpath, not ERRbadfile.
1073 */
1074 status = map_checkpath_error(req->flags2, status);
1075 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1076 /*
1077 * Windows returns different error codes if
1078 * the parent directory is valid but not the
1079 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1080 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1081 * if the path is invalid.
1082 */
1083 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1084 ERRDOS, ERRbadpath);
1085 goto out;
1086 }
1087
1088 reply_nterror(req, status);
1089
1090 out:
1091 TALLOC_FREE(smb_fname);
1092 END_PROFILE(SMBcheckpath);
1093 return;
1094 }
1095
1096 /****************************************************************************
1097 Reply to a getatr.
1098 ****************************************************************************/
1099
1100 void reply_getatr(struct smb_request *req)
1101 {
1102 connection_struct *conn = req->conn;
1103 struct smb_filename *smb_fname = NULL;
1104 char *fname = NULL;
1105 int mode=0;
1106 SMB_OFF_T size=0;
1107 time_t mtime=0;
1108 const char *p;
1109 NTSTATUS status;
1110 TALLOC_CTX *ctx = talloc_tos();
1111 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1112
1113 START_PROFILE(SMBgetatr);
1114
1115 p = (const char *)req->buf + 1;
1116 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 reply_nterror(req, status);
1119 goto out;
1120 }
1121
1122 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1123 under WfWg - weird! */
1124 if (*fname == '\0') {
1125 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1126 if (!CAN_WRITE(conn)) {
1127 mode |= FILE_ATTRIBUTE_READONLY;
1128 }
1129 size = 0;
1130 mtime = 0;
1131 } else {
1132 status = filename_convert(ctx,
1133 conn,
1134 req->flags2 & FLAGS2_DFS_PATHNAMES,
1135 fname,
1136 0,
1137 NULL,
1138 &smb_fname);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1141 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1142 ERRSRV, ERRbadpath);
1143 goto out;
1144 }
1145 reply_nterror(req, status);
1146 goto out;
1147 }
1148 if (!VALID_STAT(smb_fname->st) &&
1149 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1150 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1151 smb_fname_str_dbg(smb_fname),
1152 strerror(errno)));
1153 reply_nterror(req, map_nt_error_from_unix(errno));
1154 goto out;
1155 }
1156
1157 mode = dos_mode(conn, smb_fname);
1158 size = smb_fname->st.st_ex_size;
1159
1160 if (ask_sharemode) {
1161 struct timespec write_time_ts;
1162 struct file_id fileid;
1163
1164 ZERO_STRUCT(write_time_ts);
1165 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1166 get_file_infos(fileid, 0, NULL, &write_time_ts);
1167 if (!null_timespec(write_time_ts)) {
1168 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1169 }
1170 }
1171
1172 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1173 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1174 size = 0;
1175 }
1176 }
1177
1178 reply_outbuf(req, 10, 0);
1179
1180 SSVAL(req->outbuf,smb_vwv0,mode);
1181 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1182 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1183 } else {
1184 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1185 }
1186 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1187
1188 if (get_Protocol() >= PROTOCOL_NT1) {
1189 SSVAL(req->outbuf, smb_flg2,
1190 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1191 }
1192
1193 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1194 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1195
1196 out:
1197 TALLOC_FREE(smb_fname);
1198 TALLOC_FREE(fname);
1199 END_PROFILE(SMBgetatr);
1200 return;
1201 }
1202
1203 /****************************************************************************
1204 Reply to a setatr.
1205 ****************************************************************************/
1206
1207 void reply_setatr(struct smb_request *req)
1208 {
1209 struct smb_file_time ft;
1210 connection_struct *conn = req->conn;
1211 struct smb_filename *smb_fname = NULL;
1212 char *fname = NULL;
1213 int mode;
1214 time_t mtime;
1215 const char *p;
1216 NTSTATUS status;
1217 TALLOC_CTX *ctx = talloc_tos();
1218
1219 START_PROFILE(SMBsetatr);
1220
1221 ZERO_STRUCT(ft);
1222
1223 if (req->wct < 2) {
1224 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1225 goto out;
1226 }
1227
1228 p = (const char *)req->buf + 1;
1229 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1230 if (!NT_STATUS_IS_OK(status)) {
1231 reply_nterror(req, status);
1232 goto out;
1233 }
1234
1235 status = filename_convert(ctx,
1236 conn,
1237 req->flags2 & FLAGS2_DFS_PATHNAMES,
1238 fname,
1239 0,
1240 NULL,
1241 &smb_fname);
1242 if (!NT_STATUS_IS_OK(status)) {
1243 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1244 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1245 ERRSRV, ERRbadpath);
1246 goto out;
1247 }
1248 reply_nterror(req, status);
1249 goto out;
1250 }
1251
1252 if (smb_fname->base_name[0] == '.' &&
1253 smb_fname->base_name[1] == '\0') {
1254 /*
1255 * Not sure here is the right place to catch this
1256 * condition. Might be moved to somewhere else later -- vl
1257 */
1258 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1259 goto out;
1260 }
1261
1262 mode = SVAL(req->vwv+0, 0);
1263 mtime = srv_make_unix_date3(req->vwv+1);
1264
1265 ft.mtime = convert_time_t_to_timespec(mtime);
1266 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1267 if (!NT_STATUS_IS_OK(status)) {
1268 reply_nterror(req, status);
1269 goto out;
1270 }
1271
1272 if (mode != FILE_ATTRIBUTE_NORMAL) {
1273 if (VALID_STAT_OF_DIR(smb_fname->st))
1274 mode |= FILE_ATTRIBUTE_DIRECTORY;
1275 else
1276 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1277
1278 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1279 false) != 0) {
1280 reply_nterror(req, map_nt_error_from_unix(errno));
1281 goto out;
1282 }
1283 }
1284
1285 reply_outbuf(req, 0, 0);
1286
1287 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1288 mode));
1289 out:
1290 TALLOC_FREE(smb_fname);
1291 END_PROFILE(SMBsetatr);
1292 return;
1293 }
1294
1295 /****************************************************************************
1296 Reply to a dskattr.
1297 ****************************************************************************/
1298
1299 void reply_dskattr(struct smb_request *req)
1300 {
1301 connection_struct *conn = req->conn;
1302 uint64_t dfree,dsize,bsize;
1303 START_PROFILE(SMBdskattr);
1304
1305 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1306 reply_nterror(req, map_nt_error_from_unix(errno));
1307 END_PROFILE(SMBdskattr);
1308 return;
1309 }
1310
1311 reply_outbuf(req, 5, 0);
1312
1313 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1314 double total_space, free_space;
1315 /* we need to scale this to a number that DOS6 can handle. We
1316 use floating point so we can handle large drives on systems
1317 that don't have 64 bit integers
1318
1319 we end up displaying a maximum of 2G to DOS systems
1320 */
1321 total_space = dsize * (double)bsize;
1322 free_space = dfree * (double)bsize;
1323
1324 dsize = (uint64_t)((total_space+63*512) / (64*512));
1325 dfree = (uint64_t)((free_space+63*512) / (64*512));
1326
1327 if (dsize > 0xFFFF) dsize = 0xFFFF;
1328 if (dfree > 0xFFFF) dfree = 0xFFFF;
1329
1330 SSVAL(req->outbuf,smb_vwv0,dsize);
1331 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1332 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1333 SSVAL(req->outbuf,smb_vwv3,dfree);
1334 } else {
1335 SSVAL(req->outbuf,smb_vwv0,dsize);
1336 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1337 SSVAL(req->outbuf,smb_vwv2,512);
1338 SSVAL(req->outbuf,smb_vwv3,dfree);
1339 }
1340
1341 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1342
1343 END_PROFILE(SMBdskattr);
1344 return;
1345 }
1346
1347 /*
1348 * Utility function to split the filename from the directory.
1349 */
1350 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1351 char **fname_dir_out,
1352 char **fname_mask_out)
1353 {
1354 const char *p = NULL;
1355 char *fname_dir = NULL;
1356 char *fname_mask = NULL;
1357
1358 p = strrchr_m(fname_in, '/');
1359 if (!p) {
1360 fname_dir = talloc_strdup(ctx, ".");
1361 fname_mask = talloc_strdup(ctx, fname_in);
1362 } else {
1363 fname_dir = talloc_strndup(ctx, fname_in,
1364 PTR_DIFF(p, fname_in));
1365 fname_mask = talloc_strdup(ctx, p+1);
1366 }
1367
1368 if (!fname_dir || !fname_mask) {
1369 TALLOC_FREE(fname_dir);
1370 TALLOC_FREE(fname_mask);
1371 return NT_STATUS_NO_MEMORY;
1372 }
1373
1374 *fname_dir_out = fname_dir;
1375 *fname_mask_out = fname_mask;
1376 return NT_STATUS_OK;
1377 }
1378
1379 /****************************************************************************
1380 Reply to a search.
1381 Can be called from SMBsearch, SMBffirst or SMBfunique.
1382 ****************************************************************************/
1383
1384 void reply_search(struct smb_request *req)
1385 {
1386 connection_struct *conn = req->conn;
1387 char *path = NULL;
1388 const char *mask = NULL;
1389 char *directory = NULL;
1390 struct smb_filename *smb_fname = NULL;
1391 char *fname = NULL;
1392 SMB_OFF_T size;
1393 uint32 mode;
1394 struct timespec date;
1395 uint32 dirtype;
1396 unsigned int numentries = 0;
1397 unsigned int maxentries = 0;
1398 bool finished = False;
1399 const char *p;
1400 int status_len;
1401 char status[21];
1402 int dptr_num= -1;
1403 bool check_descend = False;
1404 bool expect_close = False;
1405 NTSTATUS nt_status;
1406 bool mask_contains_wcard = False;
1407 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1408 TALLOC_CTX *ctx = talloc_tos();
1409 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1410 struct dptr_struct *dirptr = NULL;
1411 struct smbd_server_connection *sconn = req->sconn;
1412
1413 START_PROFILE(SMBsearch);
1414
1415 if (req->wct < 2) {
1416 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1417 goto out;
1418 }
1419
1420 if (lp_posix_pathnames()) {
1421 reply_unknown_new(req, req->cmd);
1422 goto out;
1423 }
1424
1425 /* If we were called as SMBffirst then we must expect close. */
1426 if(req->cmd == SMBffirst) {
1427 expect_close = True;
1428 }
1429
1430 reply_outbuf(req, 1, 3);
1431 maxentries = SVAL(req->vwv+0, 0);
1432 dirtype = SVAL(req->vwv+1, 0);
1433 p = (const char *)req->buf + 1;
1434 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1435 &nt_status, &mask_contains_wcard);
1436 if (!NT_STATUS_IS_OK(nt_status)) {
1437 reply_nterror(req, nt_status);
1438 goto out;
1439 }
1440
1441 p++;
1442 status_len = SVAL(p, 0);
1443 p += 2;
1444
1445 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1446
1447 if (status_len == 0) {
1448 nt_status = filename_convert(ctx, conn,
1449 req->flags2 & FLAGS2_DFS_PATHNAMES,
1450 path,
1451 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1452 &mask_contains_wcard,
1453 &smb_fname);
1454 if (!NT_STATUS_IS_OK(nt_status)) {
1455 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1456 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1457 ERRSRV, ERRbadpath);
1458 goto out;
1459 }
1460 reply_nterror(req, nt_status);
1461 goto out;
1462 }
1463
1464 directory = smb_fname->base_name;
1465
1466 p = strrchr_m(directory,'/');
1467 if ((p != NULL) && (*directory != '/')) {
1468 mask = p + 1;
1469 directory = talloc_strndup(ctx, directory,
1470 PTR_DIFF(p, directory));
1471 } else {
1472 mask = directory;
1473 directory = talloc_strdup(ctx,".");
1474 }
1475
1476 if (!directory) {
1477 reply_nterror(req, NT_STATUS_NO_MEMORY);
1478 goto out;
1479 }
1480
1481 memset((char *)status,'\0',21);
1482 SCVAL(status,0,(dirtype & 0x1F));
1483
1484 nt_status = dptr_create(conn,
1485 NULL, /* fsp */
1486 directory,
1487 True,
1488 expect_close,
1489 req->smbpid,
1490 mask,
1491 mask_contains_wcard,
1492 dirtype,
1493 &dirptr);
1494 if (!NT_STATUS_IS_OK(nt_status)) {
1495 reply_nterror(req, nt_status);
1496 goto out;
1497 }
1498 dptr_num = dptr_dnum(dirptr);
1499 } else {
1500 int status_dirtype;
1501 const char *dirpath;
1502
1503 memcpy(status,p,21);
1504 status_dirtype = CVAL(status,0) & 0x1F;
1505 if (status_dirtype != (dirtype & 0x1F)) {
1506 dirtype = status_dirtype;
1507 }
1508
1509 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1510 if (!dirptr) {
1511 goto SearchEmpty;
1512 }
1513 dirpath = dptr_path(sconn, dptr_num);
1514 directory = talloc_strdup(ctx, dirpath);
1515 if (!directory) {
1516 reply_nterror(req, NT_STATUS_NO_MEMORY);
1517 goto out;
1518 }
1519
1520 mask = dptr_wcard(sconn, dptr_num);
1521 if (!mask) {
1522 goto SearchEmpty;
1523 }
1524 /*
1525 * For a 'continue' search we have no string. So
1526 * check from the initial saved string.
1527 */
1528 mask_contains_wcard = ms_has_wild(mask);
1529 dirtype = dptr_attr(sconn, dptr_num);
1530 }
1531
1532 DEBUG(4,("dptr_num is %d\n",dptr_num));
1533
1534 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1535 dptr_init_search_op(dirptr);
1536
1537 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1538 char buf[DIR_STRUCT_SIZE];
1539 memcpy(buf,status,21);
1540 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1541 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1542 reply_nterror(req, NT_STATUS_NO_MEMORY);
1543 goto out;
1544 }
1545 dptr_fill(sconn, buf+12,dptr_num);
1546 if (dptr_zero(buf+12) && (status_len==0)) {
1547 numentries = 1;
1548 } else {
1549 numentries = 0;
1550 }
1551 if (message_push_blob(&req->outbuf,
1552 data_blob_const(buf, sizeof(buf)))
1553 == -1) {
1554 reply_nterror(req, NT_STATUS_NO_MEMORY);
1555 goto out;
1556 }
1557 } else {
1558 unsigned int i;
1559 maxentries = MIN(
1560 maxentries,
1561 ((BUFFER_SIZE -
1562 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1563 /DIR_STRUCT_SIZE));
1564
1565 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1566 directory,lp_dontdescend(SNUM(conn))));
1567 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1568 check_descend = True;
1569 }
1570
1571 for (i=numentries;(i<maxentries) && !finished;i++) {
1572 finished = !get_dir_entry(ctx,
1573 dirptr,
1574 mask,
1575 dirtype,
1576 &fname,
1577 &size,
1578 &mode,
1579 &date,
1580 check_descend,
1581 ask_sharemode);
1582 if (!finished) {
1583 char buf[DIR_STRUCT_SIZE];
1584 memcpy(buf,status,21);
1585 if (!make_dir_struct(ctx,
1586 buf,
1587 mask,
1588 fname,
1589 size,
1590 mode,
1591 convert_timespec_to_time_t(date),
1592 !allow_long_path_components)) {
1593 reply_nterror(req, NT_STATUS_NO_MEMORY);
1594 goto out;
1595 }
1596 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1597 break;
1598 }
1599 if (message_push_blob(&req->outbuf,
1600 data_blob_const(buf, sizeof(buf)))
1601 == -1) {
1602 reply_nterror(req, NT_STATUS_NO_MEMORY);
1603 goto out;
1604 }
1605 numentries++;
1606 }
1607 }
1608 }
1609
1610 SearchEmpty:
1611
1612 /* If we were called as SMBffirst with smb_search_id == NULL
1613 and no entries were found then return error and close dirptr
1614 (X/Open spec) */
1615
1616 if (numentries == 0) {
1617 dptr_close(sconn, &dptr_num);
1618 } else if(expect_close && status_len == 0) {
1619 /* Close the dptr - we know it's gone */
1620 dptr_close(sconn, &dptr_num);
1621 }
1622
1623 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1624 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1625 dptr_close(sconn, &dptr_num);
1626 }
1627
1628 if ((numentries == 0) && !mask_contains_wcard) {
1629 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1630 goto out;
1631 }
1632
1633 SSVAL(req->outbuf,smb_vwv0,numentries);
1634 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1635 SCVAL(smb_buf(req->outbuf),0,5);
1636 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1637
1638 /* The replies here are never long name. */
1639 SSVAL(req->outbuf, smb_flg2,
1640 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1641 if (!allow_long_path_components) {
1642 SSVAL(req->outbuf, smb_flg2,
1643 SVAL(req->outbuf, smb_flg2)
1644 & (~FLAGS2_LONG_PATH_COMPONENTS));
1645 }
1646
1647 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1648 SSVAL(req->outbuf, smb_flg2,
1649 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1650
1651 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1652 smb_fn_name(req->cmd),
1653 mask,
1654 directory,
1655 dirtype,
1656 numentries,
1657 maxentries ));
1658 out:
1659 TALLOC_FREE(directory);
1660 TALLOC_FREE(smb_fname);
1661 END_PROFILE(SMBsearch);
1662 return;
1663 }
1664
1665 /****************************************************************************
1666 Reply to a fclose (stop directory search).
1667 ****************************************************************************/
1668
1669 void reply_fclose(struct smb_request *req)
1670 {
1671 int status_len;
1672 char status[21];
1673 int dptr_num= -2;
1674 const char *p;
1675 char *path = NULL;
1676 NTSTATUS err;
1677 bool path_contains_wcard = False;
1678 TALLOC_CTX *ctx = talloc_tos();
1679 struct smbd_server_connection *sconn = req->sconn;
1680
1681 START_PROFILE(SMBfclose);
1682
1683 if (lp_posix_pathnames()) {
1684 reply_unknown_new(req, req->cmd);
1685 END_PROFILE(SMBfclose);
1686 return;
1687 }
1688
1689 p = (const char *)req->buf + 1;
1690 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1691 &err, &path_contains_wcard);
1692 if (!NT_STATUS_IS_OK(err)) {
1693 reply_nterror(req, err);
1694 END_PROFILE(SMBfclose);
1695 return;
1696 }
1697 p++;
1698 status_len = SVAL(p,0);
1699 p += 2;
1700
1701 if (status_len == 0) {
1702 reply_force_doserror(req, ERRSRV, ERRsrverror);
1703 END_PROFILE(SMBfclose);
1704 return;
1705 }
1706
1707 memcpy(status,p,21);
1708
1709 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1710 /* Close the dptr - we know it's gone */
1711 dptr_close(sconn, &dptr_num);
1712 }
1713
1714 reply_outbuf(req, 1, 0);
1715 SSVAL(req->outbuf,smb_vwv0,0);
1716
1717 DEBUG(3,("search close\n"));
1718
1719 END_PROFILE(SMBfclose);
1720 return;
1721 }
1722
1723 /****************************************************************************
1724 Reply to an open.
1725 ****************************************************************************/
1726
1727 void reply_open(struct smb_request *req)
1728 {
1729 connection_struct *conn = req->conn;
1730 struct smb_filename *smb_fname = NULL;
1731 char *fname = NULL;
1732 uint32 fattr=0;
1733 SMB_OFF_T size = 0;
1734 time_t mtime=0;
1735 int info;
1736 files_struct *fsp;
1737 int oplock_request;
1738 int deny_mode;
1739 uint32 dos_attr;
1740 uint32 access_mask;
1741 uint32 share_mode;
1742 uint32 create_disposition;
1743 uint32 create_options = 0;
1744 uint32_t private_flags = 0;
1745 NTSTATUS status;
1746 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1747 TALLOC_CTX *ctx = talloc_tos();
1748
1749 START_PROFILE(SMBopen);
1750
1751 if (req->wct < 2) {
1752 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1753 goto out;
1754 }
1755
1756 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1757 deny_mode = SVAL(req->vwv+0, 0);
1758 dos_attr = SVAL(req->vwv+1, 0);
1759
1760 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1761 STR_TERMINATE, &status);
1762 if (!NT_STATUS_IS_OK(status)) {
1763 reply_nterror(req, status);
1764 goto out;
1765 }
1766
1767 status = filename_convert(ctx,
1768 conn,
1769 req->flags2 & FLAGS2_DFS_PATHNAMES,
1770 fname,
1771 0,
1772 NULL,
1773 &smb_fname);
1774 if (!NT_STATUS_IS_OK(status)) {
1775 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1776 reply_botherror(req,
1777 NT_STATUS_PATH_NOT_COVERED,
1778 ERRSRV, ERRbadpath);
1779 goto out;
1780 }
1781 reply_nterror(req, status);
1782 goto out;
1783 }
1784
1785 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1786 OPENX_FILE_EXISTS_OPEN, &access_mask,
1787 &share_mode, &create_disposition,
1788 &create_options, &private_flags)) {
1789 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1790 goto out;
1791 }
1792
1793 status = SMB_VFS_CREATE_FILE(
1794 conn, /* conn */
1795 req, /* req */
1796 0, /* root_dir_fid */
1797 smb_fname, /* fname */
1798 access_mask, /* access_mask */
1799 share_mode, /* share_access */
1800 create_disposition, /* create_disposition*/
1801 create_options, /* create_options */
1802 dos_attr, /* file_attributes */
1803 oplock_request, /* oplock_request */
1804 0, /* allocation_size */
1805 private_flags,
1806 NULL, /* sd */
1807 NULL, /* ea_list */
1808 &fsp, /* result */
1809 &info); /* pinfo */
1810
1811 if (!NT_STATUS_IS_OK(status)) {
1812 if (open_was_deferred(req->mid)) {
1813 /* We have re-scheduled this call. */
1814 goto out;
1815 }
1816 reply_openerror(req, status);
1817 goto out;
1818 }
1819
1820 size = smb_fname->st.st_ex_size;
1821 fattr = dos_mode(conn, smb_fname);
1822
1823 /* Deal with other possible opens having a modified
1824 write time. JRA. */
1825 if (ask_sharemode) {
1826 struct timespec write_time_ts;
1827
1828 ZERO_STRUCT(write_time_ts);
1829 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1830 if (!null_timespec(write_time_ts)) {
1831 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1832 }
1833 }
1834
1835 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1836
1837 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1838 DEBUG(3,("attempt to open a directory %s\n",
1839 fsp_str_dbg(fsp)));
1840 close_file(req, fsp, ERROR_CLOSE);
1841 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1842 ERRDOS, ERRnoaccess);
1843 goto out;
1844 }
1845
1846 reply_outbuf(req, 7, 0);
1847 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1848 SSVAL(req->outbuf,smb_vwv1,fattr);
1849 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1850 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1851 } else {
1852 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1853 }
1854 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1855 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1856
1857 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1858 SCVAL(req->outbuf,smb_flg,
1859 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1860 }
1861
1862 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1863 SCVAL(req->outbuf,smb_flg,
1864 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1865 }
1866 out:
1867 TALLOC_FREE(smb_fname);
1868 END_PROFILE(SMBopen);
1869 return;
1870 }
1871
1872 /****************************************************************************
1873 Reply to an open and X.
1874 ****************************************************************************/
1875
1876 void reply_open_and_X(struct smb_request *req)
1877 {
1878 connection_struct *conn = req->conn;
1879 struct smb_filename *smb_fname = NULL;
1880 char *fname = NULL;
1881 uint16 open_flags;
1882 int deny_mode;
1883 uint32 smb_attr;
1884 /* Breakout the oplock request bits so we can set the
1885 reply bits separately. */
1886 int ex_oplock_request;
1887 int core_oplock_request;
1888 int oplock_request;
1889 #if 0
1890 int smb_sattr = SVAL(req->vwv+4, 0);
1891 uint32 smb_time = make_unix_date3(req->vwv+6);
1892 #endif
1893 int smb_ofun;
1894 uint32 fattr=0;
1895 int mtime=0;
1896 int smb_action = 0;
1897 files_struct *fsp;
1898 NTSTATUS status;
1899 uint64_t allocation_size;
1900 ssize_t retval = -1;
1901 uint32 access_mask;
1902 uint32 share_mode;
1903 uint32 create_disposition;
1904 uint32 create_options = 0;
1905 uint32_t private_flags = 0;
1906 TALLOC_CTX *ctx = talloc_tos();
1907
1908 START_PROFILE(SMBopenX);
1909
1910 if (req->wct < 15) {
1911 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1912 goto out;
1913 }
1914
1915 open_flags = SVAL(req->vwv+2, 0);
1916 deny_mode = SVAL(req->vwv+3, 0);
1917 smb_attr = SVAL(req->vwv+5, 0);
1918 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1919 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1920 oplock_request = ex_oplock_request | core_oplock_request;
1921 smb_ofun = SVAL(req->vwv+8, 0);
1922 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1923
1924 /* If it's an IPC, pass off the pipe handler. */
1925 if (IS_IPC(conn)) {
1926 if (lp_nt_pipe_support()) {
1927 reply_open_pipe_and_X(conn, req);
1928 } else {
1929 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1930 }
1931 goto out;
1932 }
1933
1934 /* XXXX we need to handle passed times, sattr and flags */
1935 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1936 STR_TERMINATE, &status);
1937 if (!NT_STATUS_IS_OK(status)) {
1938 reply_nterror(req, status);
1939 goto out;
1940 }
1941
1942 status = filename_convert(ctx,
1943 conn,
1944 req->flags2 & FLAGS2_DFS_PATHNAMES,
1945 fname,
1946 0,
1947 NULL,
1948 &smb_fname);
1949 if (!NT_STATUS_IS_OK(status)) {
1950 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1951 reply_botherror(req,
1952 NT_STATUS_PATH_NOT_COVERED,
1953 ERRSRV, ERRbadpath);
1954 goto out;
1955 }
1956 reply_nterror(req, status);
1957 goto out;
1958 }
1959
1960 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1961 &access_mask, &share_mode,
1962 &create_disposition,
1963 &create_options,
1964 &private_flags)) {
1965 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1966 goto out;
1967 }
1968
1969 status = SMB_VFS_CREATE_FILE(
1970 conn, /* conn */
1971 req, /* req */
1972 0, /* root_dir_fid */
1973 smb_fname, /* fname */
1974 access_mask, /* access_mask */
1975 share_mode, /* share_access */
1976 create_disposition, /* create_disposition*/
1977 create_options, /* create_options */
1978 smb_attr, /* file_attributes */
1979 oplock_request, /* oplock_request */
1980 0, /* allocation_size */
1981 private_flags,
1982 NULL, /* sd */
1983 NULL, /* ea_list */
1984 &fsp, /* result */
1985 &smb_action); /* pinfo */
1986
1987 if (!NT_STATUS_IS_OK(status)) {
1988 if (open_was_deferred(req->mid)) {
1989 /* We have re-scheduled this call. */
1990 goto out;
1991 }
1992 reply_openerror(req, status);
1993 goto out;
1994 }
1995
1996 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1997 if the file is truncated or created. */
1998 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1999 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2000 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2001 close_file(req, fsp, ERROR_CLOSE);
2002 reply_nterror(req, NT_STATUS_DISK_FULL);
2003 goto out;
2004 }
2005 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
2006 if (retval < 0) {
2007 close_file(req, fsp, ERROR_CLOSE);
2008 reply_nterror(req, NT_STATUS_DISK_FULL);
2009 goto out;
2010 }
2011 status = vfs_stat_fsp(fsp);
2012 if (!NT_STATUS_IS_OK(status)) {
2013 close_file(req, fsp, ERROR_CLOSE);
2014 reply_nterror(req, status);
2015 goto out;
2016 }
2017 }
2018
2019 fattr = dos_mode(conn, fsp->fsp_name);
2020 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2021 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2022 close_file(req, fsp, ERROR_CLOSE);
2023 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2024 goto out;
2025 }
2026
2027 /* If the caller set the extended oplock request bit
2028 and we granted one (by whatever means) - set the
2029 correct bit for extended oplock reply.
2030 */
2031
2032 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2033 smb_action |= EXTENDED_OPLOCK_GRANTED;
2034 }
2035
2036 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2037 smb_action |= EXTENDED_OPLOCK_GRANTED;
2038 }
2039
2040 /* If the caller set the core oplock request bit
2041 and we granted one (by whatever means) - set the
2042 correct bit for core oplock reply.
2043 */
2044
2045 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2046 reply_outbuf(req, 19, 0);
2047 } else {
2048 reply_outbuf(req, 15, 0);
2049 }
2050
2051 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2052 SCVAL(req->outbuf, smb_flg,
2053 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2054 }
2055
2056 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2057 SCVAL(req->outbuf, smb_flg,
2058 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2059 }
2060
2061 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2062 SSVAL(req->outbuf,smb_vwv3,fattr);
2063 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2064 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2065 } else {
2066 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2067 }
2068 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2069 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2070 SSVAL(req->outbuf,smb_vwv11,smb_action);
2071
2072 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2073 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2074 }
2075
2076 chain_reply(req);
2077 out:
2078 TALLOC_FREE(smb_fname);
2079 END_PROFILE(SMBopenX);
2080 return;
2081 }
2082
2083 /****************************************************************************
2084 Reply to a SMBulogoffX.
2085 ****************************************************************************/
2086
2087 void reply_ulogoffX(struct smb_request *req)
2088 {
2089 struct smbd_server_connection *sconn = req->sconn;
2090 user_struct *vuser;
2091
2092 START_PROFILE(SMBulogoffX);
2093
2094 vuser = get_valid_user_struct(sconn, req->vuid);
2095
2096 if(vuser == NULL) {
2097 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2098 req->vuid));
2099 }
2100
2101 /* in user level security we are supposed to close any files
2102 open by this user */
2103 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2104 file_close_user(sconn, req->vuid);
2105 }
2106
2107 invalidate_vuid(sconn, req->vuid);
2108
2109 reply_outbuf(req, 2, 0);
2110
2111 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2112
2113 END_PROFILE(SMBulogoffX);
2114 req->vuid = UID_FIELD_INVALID;
2115 chain_reply(req);
2116 }
2117
2118 /****************************************************************************
2119 Reply to a mknew or a create.
2120 ****************************************************************************/
2121
2122 void reply_mknew(struct smb_request *req)
2123 {
2124 connection_struct *conn = req->conn;
2125 struct smb_filename *smb_fname = NULL;
2126 char *fname = NULL;
2127 uint32 fattr = 0;
2128 struct smb_file_time ft;
2129 files_struct *fsp;
2130 int oplock_request = 0;
2131 NTSTATUS status;
2132 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2133 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2134 uint32 create_disposition;
2135 uint32 create_options = 0;
2136 TALLOC_CTX *ctx = talloc_tos();
2137
2138 START_PROFILE(SMBcreate);
2139 ZERO_STRUCT(ft);
2140
2141 if (req->wct < 3) {
2142 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2143 goto out;
2144 }
2145
2146 fattr = SVAL(req->vwv+0, 0);
2147 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2148
2149 /* mtime. */
2150 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2151
2152 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2153 STR_TERMINATE, &status);
2154 if (!NT_STATUS_IS_OK(status)) {
2155 reply_nterror(req, status);
2156 goto out;
2157 }
2158
2159 status = filename_convert(ctx,
2160 conn,
2161 req->flags2 & FLAGS2_DFS_PATHNAMES,
2162 fname,
2163 0,
2164 NULL,
2165 &smb_fname);
2166 if (!NT_STATUS_IS_OK(status)) {
2167 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2168 reply_botherror(req,
2169 NT_STATUS_PATH_NOT_COVERED,
2170 ERRSRV, ERRbadpath);
2171 goto out;
2172 }
2173 reply_nterror(req, status);
2174 goto out;
2175 }
2176
2177 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2178 DEBUG(0,("Attempt to create file (%s) with volid set - "
2179 "please report this\n",
2180 smb_fname_str_dbg(smb_fname)));
2181 }
2182
2183 if(req->cmd == SMBmknew) {
2184 /* We should fail if file exists. */
2185 create_disposition = FILE_CREATE;
2186 } else {
2187 /* Create if file doesn't exist, truncate if it does. */
2188 create_disposition = FILE_OVERWRITE_IF;
2189 }
2190
2191 status = SMB_VFS_CREATE_FILE(
2192 conn, /* conn */
2193 req, /* req */
2194 0, /* root_dir_fid */
2195 smb_fname, /* fname */
2196 access_mask, /* access_mask */
2197 share_mode, /* share_access */
2198 create_disposition, /* create_disposition*/
2199 create_options, /* create_options */
2200 fattr, /* file_attributes */
2201 oplock_request, /* oplock_request */
2202 0, /* allocation_size */
2203 0, /* private_flags */
2204 NULL, /* sd */
2205 NULL, /* ea_list */
2206 &fsp, /* result */
2207 NULL); /* pinfo */
2208
2209 if (!NT_STATUS_IS_OK(status)) {
2210 if (open_was_deferred(req->mid)) {
2211 /* We have re-scheduled this call. */
2212 goto out;
2213 }
2214 reply_openerror(req, status);
2215 goto out;
2216 }
2217
2218 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2219 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2220 if (!NT_STATUS_IS_OK(status)) {
2221 END_PROFILE(SMBcreate);
2222 goto out;
2223 }
2224
2225 reply_outbuf(req, 1, 0);
2226 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2227
2228 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2229 SCVAL(req->outbuf,smb_flg,
2230 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2231 }
2232
2233 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2234 SCVAL(req->outbuf,smb_flg,
2235 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2236 }
2237
2238 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2239 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2240 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2241 (unsigned int)fattr));
2242
2243 out:
2244 TALLOC_FREE(smb_fname);
2245 END_PROFILE(SMBcreate);
2246 return;
2247 }
2248
2249 /****************************************************************************
2250 Reply to a create temporary file.
2251 ****************************************************************************/
2252
2253 void reply_ctemp(struct smb_request *req)
2254 {
2255 connection_struct *conn = req->conn;
2256 struct smb_filename *smb_fname = NULL;
2257 char *fname = NULL;
2258 uint32 fattr;
2259 files_struct *fsp;
2260 int oplock_request;
2261 int tmpfd;
2262 char *s;
2263 NTSTATUS status;
2264 TALLOC_CTX *ctx = talloc_tos();
2265
2266 START_PROFILE(SMBctemp);
2267
2268 if (req->wct < 3) {
2269 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2270 goto out;
2271 }
2272
2273 fattr = SVAL(req->vwv+0, 0);
2274 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2275
2276 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2277 STR_TERMINATE, &status);
2278 if (!NT_STATUS_IS_OK(status)) {
2279 reply_nterror(req, status);
2280 goto out;
2281 }
2282 if (*fname) {
2283 fname = talloc_asprintf(ctx,
2284 "%s/TMXXXXXX",
2285 fname);
2286 } else {
2287 fname = talloc_strdup(ctx, "TMXXXXXX");
2288 }
2289
2290 if (!fname) {
2291 reply_nterror(req, NT_STATUS_NO_MEMORY);
2292 goto out;
2293 }
2294
2295 status = filename_convert(ctx, conn,
2296 req->flags2 & FLAGS2_DFS_PATHNAMES,
2297 fname,
2298 0,
2299 NULL,
2300 &smb_fname);
2301 if (!NT_STATUS_IS_OK(status)) {
2302 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2303 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2304 ERRSRV, ERRbadpath);
2305 goto out;
2306 }
2307 reply_nterror(req, status);
2308 goto out;
2309 }
2310
2311 tmpfd = mkstemp(smb_fname->base_name);
2312 if (tmpfd == -1) {
2313 reply_nterror(req, map_nt_error_from_unix(errno));
2314 goto out;
2315 }
2316
2317 SMB_VFS_STAT(conn, smb_fname);
2318
2319 /* We should fail if file does not exist. */
2320 status = SMB_VFS_CREATE_FILE(
2321 conn, /* conn */
2322 req, /* req */
2323 0, /* root_dir_fid */
2324 smb_fname, /* fname */
2325 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2326 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2327 FILE_OPEN, /* create_disposition*/
2328 0, /* create_options */
2329 fattr, /* file_attributes */
2330 oplock_request, /* oplock_request */
2331 0, /* allocation_size */
2332 0, /* private_flags */
2333 NULL, /* sd */
2334 NULL, /* ea_list */
2335 &fsp, /* result */
2336 NULL); /* pinfo */
2337
2338 /* close fd from mkstemp() */
2339 close(tmpfd);
2340
2341 if (!NT_STATUS_IS_OK(status)) {
2342 if (open_was_deferred(req->mid)) {
2343 /* We have re-scheduled this call. */
2344 goto out;
2345 }
2346 reply_openerror(req, status);
2347 goto out;
2348 }
2349
2350 reply_outbuf(req, 1, 0);
2351 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2352
2353 /* the returned filename is relative to the directory */
2354 s = strrchr_m(fsp->fsp_name->base_name, '/');
2355 if (!s) {
2356 s = fsp->fsp_name->base_name;
2357 } else {
2358 s++;
2359 }
2360
2361 #if 0
2362 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2363 thing in the byte section. JRA */
2364 SSVALS(p, 0, -1); /* what is this? not in spec */
2365 #endif
2366 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2367 == -1) {
2368 reply_nterror(req, NT_STATUS_NO_MEMORY);
2369 goto out;
2370 }
2371
2372 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2373 SCVAL(req->outbuf, smb_flg,
2374 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2375 }
2376
2377 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2378 SCVAL(req->outbuf, smb_flg,
2379 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2380 }
2381
2382 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2383 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2384 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2385 out:
2386 TALLOC_FREE(smb_fname);
2387 END_PROFILE(SMBctemp);
2388 return;
2389 }
2390
2391 /*******************************************************************
2392 Check if a user is allowed to rename a file.
2393 ********************************************************************/
2394
2395 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2396 uint16 dirtype)
2397 {
2398 if (!CAN_WRITE(conn)) {
2399 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2400 }
2401
2402 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2403 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2404 /* Only bother to read the DOS attribute if we might deny the
2405 rename on the grounds of attribute missmatch. */
2406 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2407 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2408 return NT_STATUS_NO_SUCH_FILE;
2409 }
2410 }
2411
2412 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2413 if (fsp->posix_open) {
2414 return NT_STATUS_OK;
2415 }
2416
2417 /* If no pathnames are open below this
2418 directory, allow the rename. */
2419
2420 if (file_find_subpath(fsp)) {
2421 return NT_STATUS_ACCESS_DENIED;
2422 }
2423 return NT_STATUS_OK;
2424 }
2425
2426 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2427 return NT_STATUS_OK;
2428 }
2429
2430 return NT_STATUS_ACCESS_DENIED;
2431 }
2432
2433 /*******************************************************************
2434 * unlink a file with all relevant access checks
2435 *******************************************************************/
2436
2437 static NTSTATUS do_unlink(connection_struct *conn,
2438 struct smb_request *req,
2439 struct smb_filename *smb_fname,
2440 uint32 dirtype)
2441 {
2442 uint32 fattr;
2443 files_struct *fsp;
2444 uint32 dirtype_orig = dirtype;
2445 NTSTATUS status;
2446 int ret;
2447 bool posix_paths = lp_posix_pathnames();
2448
2449 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2450 smb_fname_str_dbg(smb_fname),
2451 dirtype));
2452
2453 if (!CAN_WRITE(conn)) {
2454 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2455 }
2456
2457 if (posix_paths) {
2458 ret = SMB_VFS_LSTAT(conn, smb_fname);
2459 } else {
2460 ret = SMB_VFS_STAT(conn, smb_fname);
2461 }
2462 if (ret != 0) {
2463 return map_nt_error_from_unix(errno);
2464 }
2465
2466 fattr = dos_mode(conn, smb_fname);
2467
2468 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2469 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2470 }
2471
2472 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2473 if (!dirtype) {
2474 return NT_STATUS_NO_SUCH_FILE;
2475 }
2476
2477 if (!dir_check_ftype(conn, fattr, dirtype)) {
2478 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2479 return NT_STATUS_FILE_IS_A_DIRECTORY;
2480 }
2481 return NT_STATUS_NO_SUCH_FILE;
2482 }
2483
2484 if (dirtype_orig & 0x8000) {
2485 /* These will never be set for POSIX. */
2486 return NT_STATUS_NO_SUCH_FILE;
2487 }
2488
2489 #if 0
2490 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2491 return NT_STATUS_FILE_IS_A_DIRECTORY;
2492 }
2493
2494 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2495 return NT_STATUS_NO_SUCH_FILE;
2496 }
2497
2498 if (dirtype & 0xFF00) {
2499 /* These will never be set for POSIX. */
2500 return NT_STATUS_NO_SUCH_FILE;
2501 }
2502
2503 dirtype &= 0xFF;
2504 if (!dirtype) {
2505 return NT_STATUS_NO_SUCH_FILE;
2506 }
2507
2508 /* Can't delete a directory. */
2509 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2510 return NT_STATUS_FILE_IS_A_DIRECTORY;
2511 }
2512 #endif
2513
2514 #if 0 /* JRATEST */
2515 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2516 return NT_STATUS_OBJECT_NAME_INVALID;
2517 #endif /* JRATEST */
2518
2519 /* On open checks the open itself will check the share mode, so
2520 don't do it here as we'll get it wrong. */
2521
2522 status = SMB_VFS_CREATE_FILE
2523 (conn, /* conn */
2524 req, /* req */
2525 0, /* root_dir_fid */
2526 smb_fname, /* fname */
2527 DELETE_ACCESS, /* access_mask */
2528 FILE_SHARE_NONE, /* share_access */
2529 FILE_OPEN, /* create_disposition*/
2530 FILE_NON_DIRECTORY_FILE, /* create_options */
2531 /* file_attributes */
2532 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2533 FILE_ATTRIBUTE_NORMAL,
2534 0, /* oplock_request */
2535 0, /* allocation_size */
2536 0, /* private_flags */
2537 NULL, /* sd */
2538 NULL, /* ea_list */
2539 &fsp, /* result */
2540 NULL); /* pinfo */
2541
2542 if (!NT_STATUS_IS_OK(status)) {
2543 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2544 nt_errstr(status)));
2545 return status;
2546 }
2547
2548 status = can_set_delete_on_close(fsp, fattr);
2549 if (!NT_STATUS_IS_OK(status)) {
2550 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2551 "(%s)\n",
2552 smb_fname_str_dbg(smb_fname),
2553 nt_errstr(status)));
2554 close_file(req, fsp, NORMAL_CLOSE);
2555 return status;
2556 }
2557
2558 /* The set is across all open files on this dev/inode pair. */
2559 if (!set_delete_on_close(fsp, True, &conn->session_info->utok)) {
2560 close_file(req, fsp, NORMAL_CLOSE);
2561 return NT_STATUS_ACCESS_DENIED;
2562 }
2563
2564 return close_file(req, fsp, NORMAL_CLOSE);
2565 }
2566
2567 /****************************************************************************
2568 The guts of the unlink command, split out so it may be called by the NT SMB
2569 code.
2570 ****************************************************************************/
2571
2572 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2573 uint32 dirtype, struct smb_filename *smb_fname,
2574 bool has_wild)
2575 {
2576 char *fname_dir = NULL;
2577 char *fname_mask = NULL;
2578 int count=0;
2579 NTSTATUS status = NT_STATUS_OK;
2580 TALLOC_CTX *ctx = talloc_tos();
2581
2582 /* Split up the directory from the filename/mask. */
2583 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2584 &fname_dir, &fname_mask);
2585 if (!NT_STATUS_IS_OK(status)) {
2586 goto out;
2587 }
2588
2589 /*
2590 * We should only check the mangled cache
2591 * here if unix_convert failed. This means
2592 * that the path in 'mask' doesn't exist
2593 * on the file system and so we need to look
2594 * for a possible mangle. This patch from
2595 * Tine Smukavec <valentin.smukavec@hermes.si>.
2596 */
2597
2598 if (!VALID_STAT(smb_fname->st) &&
2599 mangle_is_mangled(fname_mask, conn->params)) {
2600 char *new_mask = NULL;
2601 mangle_lookup_name_from_8_3(ctx, fname_mask,
2602 &new_mask, conn->params);
2603 if (new_mask) {
2604 TALLOC_FREE(fname_mask);
2605 fname_mask = new_mask;
2606 }
2607 }
2608
2609 if (!has_wild) {
2610
2611 /*
2612 * Only one file needs to be unlinked. Append the mask back
2613 * onto the directory.
2614 */
2615 TALLOC_FREE(smb_fname->base_name);
2616 if (ISDOT(fname_dir)) {
2617 /* Ensure we use canonical names on open. */
2618 smb_fname->base_name = talloc_asprintf(smb_fname,
2619 "%s",
2620 fname_mask);
2621 } else {
2622 smb_fname->base_name = talloc_asprintf(smb_fname,
2623 "%s/%s",
2624 fname_dir,
2625 fname_mask);
2626 }
2627 if (!smb_fname->base_name) {
2628 status = NT_STATUS_NO_MEMORY;
2629 goto out;
2630 }
2631 if (dirtype == 0) {
2632 dirtype = FILE_ATTRIBUTE_NORMAL;
2633 }
2634
2635 status = check_name(conn, smb_fname->base_name);
2636 if (!NT_STATUS_IS_OK(status)) {
2637 goto out;
2638 }
2639
2640 status = do_unlink(conn, req, smb_fname, dirtype);
2641 if (!NT_STATUS_IS_OK(status)) {
2642 goto out;
2643 }
2644
2645 count++;
2646 } else {
2647 struct smb_Dir *dir_hnd = NULL;
2648 long offset = 0;
2649 const char *dname = NULL;
2650 char *talloced = NULL;
2651
2652 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2653 status = NT_STATUS_OBJECT_NAME_INVALID;
2654 goto out;
2655 }
2656
2657 if (strequal(fname_mask,"????????.???")) {
2658 TALLOC_FREE(fname_mask);
2659 fname_mask = talloc_strdup(ctx, "*");
2660 if (!fname_mask) {
2661 status = NT_STATUS_NO_MEMORY;
2662 goto out;
2663 }
2664 }
2665
2666 status = check_name(conn, fname_dir);
2667 if (!NT_STATUS_IS_OK(status)) {
2668 goto out;
2669 }
2670
2671 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2672 dirtype);
2673 if (dir_hnd == NULL) {
2674 status = map_nt_error_from_unix(errno);
2675 goto out;
2676 }
2677
2678 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2679 the pattern matches against the long name, otherwise the short name
2680 We don't implement this yet XXXX
2681 */
2682
2683 status = NT_STATUS_NO_SUCH_FILE;
2684
2685 while ((dname = ReadDirName(dir_hnd, &offset,
2686 &smb_fname->st, &talloced))) {
2687 TALLOC_CTX *frame = talloc_stackframe();
2688
2689 if (!is_visible_file(conn, fname_dir, dname,
2690 &smb_fname->st, true)) {
2691 TALLOC_FREE(frame);
2692 TALLOC_FREE(talloced);
2693 continue;
2694 }
2695
2696 /* Quick check for "." and ".." */
2697 if (ISDOT(dname) || ISDOTDOT(dname)) {
2698 TALLOC_FREE(frame);
2699 TALLOC_FREE(talloced);
2700 continue;
2701 }
2702
2703 if(!mask_match(dname, fname_mask,
2704 conn->case_sensitive)) {
2705 TALLOC_FREE(frame);
2706 TALLOC_FREE(talloced);
2707 continue;
2708 }
2709
2710 TALLOC_FREE(smb_fname->base_name);
2711 if (ISDOT(fname_dir)) {
2712 /* Ensure we use canonical names on open. */
2713 smb_fname->base_name =
2714 talloc_asprintf(smb_fname, "%s",
2715 dname);
2716 } else {
2717 smb_fname->base_name =
2718 talloc_asprintf(smb_fname, "%s/%s",
2719 fname_dir, dname);
2720 }
2721
2722 if (!smb_fname->base_name) {
2723 TALLOC_FREE(dir_hnd);
2724 status = NT_STATUS_NO_MEMORY;
2725 TALLOC_FREE(frame);
2726 TALLOC_FREE(talloced);
2727 goto out;
2728 }
2729
2730 status = check_name(conn, smb_fname->base_name);
2731 if (!NT_STATUS_IS_OK(status)) {
2732 TALLOC_FREE(dir_hnd);
2733 TALLOC_FREE(frame);
2734 TALLOC_FREE(talloced);
2735 goto out;
2736 }
2737
2738 status = do_unlink(conn, req, smb_fname, dirtype);
2739 if (!NT_STATUS_IS_OK(status)) {
2740 TALLOC_FREE(frame);
2741 TALLOC_FREE(talloced);
2742 continue;
2743 }
2744
2745 count++;
2746 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2747 smb_fname->base_name));
2748
2749 TALLOC_FREE(frame);
2750 TALLOC_FREE(talloced);
2751 }
2752 TALLOC_FREE(dir_hnd);
2753 }
2754
2755 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2756 status = map_nt_error_from_unix(errno);
2757 }
2758
2759 out:
2760 TALLOC_FREE(fname_dir);
2761 TALLOC_FREE(fname_mask);
2762 return status;
2763 }
2764
2765 /****************************************************************************
2766 Reply to a unlink
2767 ****************************************************************************/
2768
2769 void reply_unlink(struct smb_request *req)
2770 {
2771 connection_struct *conn = req->conn;
2772 char *name = NULL;
2773 struct smb_filename *smb_fname = NULL;
2774 uint32 dirtype;
2775 NTSTATUS status;
2776 bool path_contains_wcard = False;
2777 TALLOC_CTX *ctx = talloc_tos();
2778
2779 START_PROFILE(SMBunlink);
2780
2781 if (req->wct < 1) {
2782 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2783 goto out;
2784 }
2785
2786 dirtype = SVAL(req->vwv+0, 0);
2787
2788 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2789 STR_TERMINATE, &status,
2790 &path_contains_wcard);
2791 if (!NT_STATUS_IS_OK(status)) {
2792 reply_nterror(req, status);
2793 goto out;
2794 }
2795
2796 status = filename_convert(ctx, conn,
2797 req->flags2 & FLAGS2_DFS_PATHNAMES,
2798 name,
2799 UCF_COND_ALLOW_WCARD_LCOMP,
2800 &path_contains_wcard,
2801 &smb_fname);
2802 if (!NT_STATUS_IS_OK(status)) {
2803 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2804 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2805 ERRSRV, ERRbadpath);
2806 goto out;
2807 }
2808 reply_nterror(req, status);
2809 goto out;
2810 }
2811
2812 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2813
2814 status = unlink_internals(conn, req, dirtype, smb_fname,
2815 path_contains_wcard);
2816 if (!NT_STATUS_IS_OK(status)) {
2817 if (open_was_deferred(req->mid)) {
2818 /* We have re-scheduled this call. */
2819 goto out;
2820 }
2821 reply_nterror(req, status);
2822 goto out;
2823 }
2824
2825 reply_outbuf(req, 0, 0);
2826 out:
2827 TALLOC_FREE(smb_fname);
2828 END_PROFILE(SMBunlink);
2829 return;
2830 }
2831
2832 /****************************************************************************
2833 Fail for readbraw.
2834 ****************************************************************************/
2835
2836 static void fail_readraw(void)
2837 {
2838 const char *errstr = talloc_asprintf(talloc_tos(),
2839 "FAIL ! reply_readbraw: socket write fail (%s)",
2840 strerror(errno));
2841 if (!errstr) {
2842 errstr = "";
2843 }
2844 exit_server_cleanly(errstr);
2845 }
2846
2847 /****************************************************************************
2848 Fake (read/write) sendfile. Returns -1 on read or write fail.
2849 ****************************************************************************/
2850
2851 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2852 {
2853 size_t bufsize;
2854 size_t tosend = nread;
2855 char *buf;
2856
2857 if (nread == 0) {
2858 return 0;
2859 }
2860
2861 bufsize = MIN(nread, 65536);
2862
2863 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2864 return -1;
2865 }
2866
2867 while (tosend > 0) {
2868 ssize_t ret;
2869 size_t cur_read;
2870
2871 if (tosend > bufsize) {
2872 cur_read = bufsize;
2873 } else {
2874 cur_read = tosend;
2875 }
2876 ret = read_file(fsp,buf,startpos,cur_read);
2877 if (ret == -1) {
2878 SAFE_FREE(buf);
2879 return -1;
2880 }
2881
2882 /* If we had a short read, fill with zeros. */
2883 if (ret < cur_read) {
2884 memset(buf + ret, '\0', cur_read - ret);
2885 }
2886
2887 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2888 != cur_read) {
2889 char addr[INET6_ADDRSTRLEN];
2890 /*
2891 * Try and give an error message saying what
2892 * client failed.
2893 */
2894 DEBUG(0, ("write_data failed for client %s. "
2895 "Error %s\n",
2896 get_peer_addr(fsp->conn->sconn->sock, addr,
2897 sizeof(addr)),
2898 strerror(errno)));
2899 SAFE_FREE(buf);
2900 return -1;
2901 }
2902 tosend -= cur_read;
2903 startpos += cur_read;
2904 }
2905
2906 SAFE_FREE(buf);
2907 return (ssize_t)nread;
2908 }
2909
2910 /****************************************************************************
2911 Deal with the case of sendfile reading less bytes from the file than
2912 requested. Fill with zeros (all we can do).
2913 ****************************************************************************/
2914
2915 void sendfile_short_send(files_struct *fsp,
2916 ssize_t nread,
2917 size_t headersize,
2918 size_t smb_maxcnt)
2919 {
2920 #define SHORT_SEND_BUFSIZE 1024
2921 if (nread < headersize) {
2922 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2923 "header for file %s (%s). Terminating\n",
2924 fsp_str_dbg(fsp), strerror(errno)));
2925 exit_server_cleanly("sendfile_short_send failed");
2926 }
2927
2928 nread -= headersize;
2929
2930 if (nread < smb_maxcnt) {
2931 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2932 if (!buf) {
2933 exit_server_cleanly("sendfile_short_send: "
2934 "malloc failed");
2935 }
2936
2937 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2938 "with zeros !\n", fsp_str_dbg(fsp)));
2939
2940 while (nread < smb_maxcnt) {
2941 /*
2942 * We asked for the real file size and told sendfile
2943 * to not go beyond the end of the file. But it can
2944 * happen that in between our fstat call and the
2945 * sendfile call the file was truncated. This is very
2946 * bad because we have already announced the larger
2947 * number of bytes to the client.
2948 *
2949 * The best we can do now is to send 0-bytes, just as
2950 * a read from a hole in a sparse file would do.
2951 *
2952 * This should happen rarely enough that I don't care
2953 * about efficiency here :-)
2954 */
2955 size_t to_write;
2956
2957 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2958 if (write_data(fsp->conn->sconn->sock, buf, to_write)
2959 != to_write) {
2960 char addr[INET6_ADDRSTRLEN];
2961 /*
2962 * Try and give an error message saying what
2963 * client failed.
2964 */
2965 DEBUG(0, ("write_data failed for client %s. "
2966 "Error %s\n",
2967 get_peer_addr(
2968 fsp->conn->sconn->sock, addr,
2969 sizeof(addr)),
2970 strerror(errno)));
2971 exit_server_cleanly("sendfile_short_send: "
2972 "write_data failed");
2973 }
2974 nread += to_write;
2975 }
2976 SAFE_FREE(buf);
2977 }
2978 }
2979
2980 /****************************************************************************
2981 Return a readbraw error (4 bytes of zero).
2982 ****************************************************************************/
2983
2984 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2985 {
2986 char header[4];
2987
2988 SIVAL(header,0,0);
2989
2990 smbd_lock_socket(sconn);
2991 if (write_data(sconn->sock,header,4) != 4) {
2992 char addr[INET6_ADDRSTRLEN];
2993 /*
2994 * Try and give an error message saying what
2995 * client failed.
2996 */
2997 DEBUG(0, ("write_data failed for client %s. "
2998 "Error %s\n",
2999 get_peer_addr(sconn->sock, addr, sizeof(addr)),
3000 strerror(errno)));
3001
3002 fail_readraw();
3003 }
3004 smbd_unlock_socket(sconn);
3005 }
3006
3007 /****************************************************************************
3008 Use sendfile in readbraw.
3009 ****************************************************************************/
3010
3011 static void send_file_readbraw(connection_struct *conn,
3012 struct smb_request *req,
3013 files_struct *fsp,
3014 SMB_OFF_T startpos,
3015 size_t nread,
3016 ssize_t mincount)
3017 {
3018 struct smbd_server_connection *sconn = req->sconn;
3019 char *outbuf = NULL;
3020 ssize_t ret=0;
3021
3022 /*
3023 * We can only use sendfile on a non-chained packet
3024 * but we can use on a non-oplocked file. tridge proved this
3025 * on a train in Germany :-). JRA.
3026 * reply_readbraw has already checked the length.
3027 */
3028
3029 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3030 (fsp->wcp == NULL) &&
3031 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3032 ssize_t sendfile_read = -1;
3033 char header[4];
3034 DATA_BLOB header_blob;
3035
3036 _smb_setlen(header,nread);
3037 header_blob = data_blob_const(header, 4);
3038
3039 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3040 &header_blob, startpos,
3041 nread);
3042 if (sendfile_read == -1) {
3043 /* Returning ENOSYS means no data at all was sent.
3044 * Do this as a normal read. */
3045 if (errno == ENOSYS) {
3046 goto normal_readbraw;
3047 }
3048
3049 /*
3050 * Special hack for broken Linux with no working sendfile. If we
3051 * return EINTR we sent the header but not the rest of the data.
3052 * Fake this up by doing read/write calls.
3053 */
3054 if (errno == EINTR) {
3055 /* Ensure we don't do this again. */
3056 set_use_sendfile(SNUM(conn), False);
3057 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3058
3059 if (fake_sendfile(fsp, startpos, nread) == -1) {
3060 DEBUG(0,("send_file_readbraw: "
3061 "fake_sendfile failed for "
3062 "file %s (%s).\n",
3063 fsp_str_dbg(fsp),
3064 strerror(errno)));
3065 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3066 }
3067 return;
3068 }
3069
3070 DEBUG(0,("send_file_readbraw: sendfile failed for "
3071 "file %s (%s). Terminating\n",
3072 fsp_str_dbg(fsp), strerror(errno)));
3073 exit_server_cleanly("send_file_readbraw sendfile failed");
3074 } else if (sendfile_read == 0) {
3075 /*
3076 * Some sendfile implementations return 0 to indicate
3077 * that there was a short read, but nothing was
3078 * actually written to the socket. In this case,
3079 * fallback to the normal read path so the header gets
3080 * the correct byte count.
3081 */
3082 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3083 "bytes falling back to the normal read: "
3084 "%s\n", fsp_str_dbg(fsp)));
3085 goto normal_readbraw;
3086 }
3087
3088 /* Deal with possible short send. */
3089 if (sendfile_read != 4+nread) {
3090 sendfile_short_send(fsp, sendfile_read, 4, nread);
3091 }
3092 return;
3093 }
3094
3095 normal_readbraw:
3096
3097 outbuf = talloc_array(NULL, char, nread+4);
3098 if (!outbuf) {
3099 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3100 (unsigned)(nread+4)));
3101 reply_readbraw_error(sconn);
3102 return;
3103 }
3104
3105 if (nread > 0) {
3106 ret = read_file(fsp,outbuf+4,startpos,nread);
3107 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3108 if (ret < mincount)
3109 ret = 0;
3110 #else
3111 if (ret < nread)
3112 ret = 0;
3113 #endif
3114 }
3115
3116 _smb_setlen(outbuf,ret);
3117 if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3118 char addr[INET6_ADDRSTRLEN];
3119 /*
3120 * Try and give an error message saying what
3121 * client failed.
3122 */
3123 DEBUG(0, ("write_data failed for client %s. "
3124 "Error %s\n",
3125 get_peer_addr(fsp->conn->sconn->sock, addr,
3126 sizeof(addr)),
3127 strerror(errno)));
3128
3129 fail_readraw();
3130 }
3131
3132 TALLOC_FREE(outbuf);
3133 }
3134
3135 /****************************************************************************
3136 Reply to a readbraw (core+ protocol).
3137 ****************************************************************************/
3138
3139 void reply_readbraw(struct smb_request *req)
3140 {
3141 connection_struct *conn = req->conn;
3142 struct smbd_server_connection *sconn = req->sconn;
3143 ssize_t maxcount,mincount;
3144 size_t nread = 0;
3145 SMB_OFF_T startpos;
3146 files_struct *fsp;
3147 struct lock_struct lock;
3148 SMB_OFF_T size = 0;
3149
3150 START_PROFILE(SMBreadbraw);
3151
3152 if (srv_is_signing_active(sconn) ||
3153 is_encrypted_packet(req->inbuf)) {
3154 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3155 "raw reads/writes are disallowed.");
3156 }
3157
3158 if (req->wct < 8) {
3159 reply_readbraw_error(sconn);
3160 END_PROFILE(SMBreadbraw);
3161 return;
3162 }
3163
3164 if (sconn->smb1.echo_handler.trusted_fde) {
3165 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3166 "'async smb echo handler = yes'\n"));
3167 reply_readbraw_error(sconn);
3168 END_PROFILE(SMBreadbraw);
3169 return;
3170 }
3171
3172 /*
3173 * Special check if an oplock break has been issued
3174 * and the readraw request croses on the wire, we must
3175 * return a zero length response here.
3176 */
3177
3178 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3179
3180 /*
3181 * We have to do a check_fsp by hand here, as
3182 * we must always return 4 zero bytes on error,
3183 * not a NTSTATUS.
3184 */
3185
3186 if (!fsp || !conn || conn != fsp->conn ||
3187 req->vuid != fsp->vuid ||
3188 fsp->is_directory || fsp->fh->fd == -1) {
3189 /*
3190 * fsp could be NULL here so use the value from the packet. JRA.
3191 */
3192 DEBUG(3,("reply_readbraw: fnum %d not valid "
3193 "- cache prime?\n",
3194 (int)SVAL(req->vwv+0, 0)));
3195 reply_readbraw_error(sconn);
3196 END_PROFILE(SMBreadbraw);
3197 return;
3198 }
3199
3200 /* Do a "by hand" version of CHECK_READ. */
3201 if (!(fsp->can_read ||
3202 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3203 (fsp->access_mask & FILE_EXECUTE)))) {
3204 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3205 (int)SVAL(req->vwv+0, 0)));
3206 reply_readbraw_error(sconn);
3207 END_PROFILE(SMBreadbraw);
3208 return;
3209 }
3210
3211 flush_write_cache(fsp, READRAW_FLUSH);
3212
3213 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3214 if(req->wct == 10) {
3215 /*
3216 * This is a large offset (64 bit) read.
3217 */
3218 #ifdef LARGE_SMB_OFF_T
3219
3220 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3221
3222 #else /* !LARGE_SMB_OFF_T */
3223
3224 /*
3225 * Ensure we haven't been sent a >32 bit offset.
3226 */
3227
3228 if(IVAL(req->vwv+8, 0) != 0) {
3229 DEBUG(0,("reply_readbraw: large offset "
3230 "(%x << 32) used and we don't support "
3231 "64 bit offsets.\n",
3232 (unsigned int)IVAL(req->vwv+8, 0) ));
3233 reply_readbraw_error(sconn);
3234 END_PROFILE(SMBreadbraw);
3235 return;
3236 }
3237
3238 #endif /* LARGE_SMB_OFF_T */
3239
3240 if(startpos < 0) {
3241 DEBUG(0,("reply_readbraw: negative 64 bit "
3242 "readraw offset (%.0f) !\n",
3243 (double)startpos ));
3244 reply_readbraw_error(sconn);
3245 END_PROFILE(SMBreadbraw);
3246 return;
3247 }
3248 }
3249
3250 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3251 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3252
3253 /* ensure we don't overrun the packet size */
3254 maxcount = MIN(65535,maxcount);
3255
3256 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3257 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3258 &lock);
3259
3260 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3261 reply_readbraw_error(sconn);
3262 END_PROFILE(SMBreadbraw);
3263 return;
3264 }
3265
3266 if (fsp_stat(fsp) == 0) {
3267 size = fsp->fsp_name->st.st_ex_size;
3268 }
3269
3270 if (startpos >= size) {
3271 nread = 0;
3272 } else {
3273 nread = MIN(maxcount,(size - startpos));
3274 }
3275
3276 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3277 if (nread < mincount)
3278 nread = 0;
3279 #endif
3280
3281 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3282 "min=%lu nread=%lu\n",
3283 fsp->fnum, (double)startpos,
3284 (unsigned long)maxcount,
3285 (unsigned long)mincount,
3286 (unsigned long)nread ) );
3287
3288 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3289
3290 DEBUG(5,("reply_readbraw finished\n"));
3291
3292 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3293
3294 END_PROFILE(SMBreadbraw);
3295 return;
3296 }
3297
3298 #undef DBGC_CLASS
3299 #define DBGC_CLASS DBGC_LOCKING
3300
3301 /****************************************************************************
3302 Reply to a lockread (core+ protocol).
3303 ****************************************************************************/
3304
3305 void reply_lockread(struct smb_request *req)
3306 {
3307 connection_struct *conn = req->conn;
3308 ssize_t nread = -1;
3309 char *data;
3310 SMB_OFF_T startpos;
3311 size_t numtoread;
3312 NTSTATUS status;
3313 files_struct *fsp;
3314 struct byte_range_lock *br_lck = NULL;
3315 char *p = NULL;
3316 struct smbd_server_connection *sconn = req->sconn;
3317
3318 START_PROFILE(SMBlockread);
3319
3320 if (req->wct < 5) {
3321 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3322 END_PROFILE(SMBlockread);
3323 return;
3324 }
3325
3326 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3327
3328 if (!check_fsp(conn, req, fsp)) {
3329 END_PROFILE(SMBlockread);
3330 return;
3331 }
3332
3333 if (!CHECK_READ(fsp,req)) {
3334 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3335 END_PROFILE(SMBlockread);
3336 return;
3337 }
3338
3339 numtoread = SVAL(req->vwv+1, 0);
3340 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3341
3342 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3343
3344 reply_outbuf(req, 5, numtoread + 3);
3345
3346 data = smb_buf(req->outbuf) + 3;
3347
3348 /*
3349 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3350 * protocol request that predates the read/write lock concept.
3351 * Thus instead of asking for a read lock here we need to ask
3352 * for a write lock. JRA.
3353 * Note that the requested lock size is unaffected by max_recv.
3354 */
3355
3356 br_lck = do_lock(req->sconn->msg_ctx,
3357 fsp,
3358 (uint64_t)req->smbpid,
3359 (uint64_t)numtoread,
3360 (uint64_t)startpos,
3361 WRITE_LOCK,
3362 WINDOWS_LOCK,
3363 False, /* Non-blocking lock. */
3364 &status,
3365 NULL,
3366 NULL);
3367 TALLOC_FREE(br_lck);
3368
3369 if (NT_STATUS_V(status)) {
3370 reply_nterror(req, status);
3371 END_PROFILE(SMBlockread);
3372 return;
3373 }
3374
3375 /*
3376 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3377 */
3378
3379 if (numtoread > sconn->smb1.negprot.max_recv) {
3380 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3381 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3382 (unsigned int)numtoread,
3383 (unsigned int)sconn->smb1.negprot.max_recv));
3384 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3385 }
3386 nread = read_file(fsp,data,startpos,numtoread);
3387
3388 if (nread < 0) {
3389 reply_nterror(req, map_nt_error_from_unix(errno));
3390 END_PROFILE(SMBlockread);
3391 return;
3392 }
3393
3394 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3395
3396 SSVAL(req->outbuf,smb_vwv0,nread);
3397 SSVAL(req->outbuf,smb_vwv5,nread+3);
3398 p = smb_buf(req->outbuf);
3399 SCVAL(p,0,0); /* pad byte. */
3400 SSVAL(p,1,nread);
3401
3402 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3403 fsp->fnum, (int)numtoread, (int)nread));
3404
3405 END_PROFILE(SMBlockread);
3406 return;
3407 }
3408
3409 #undef DBGC_CLASS
3410 #define DBGC_CLASS DBGC_ALL
3411
3412 /****************************************************************************
3413 Reply to a read.
3414 ****************************************************************************/
3415
3416 void reply_read(struct smb_request *req)
3417 {
3418 connection_struct *conn = req->conn;
3419 size_t numtoread;
3420 ssize_t nread = 0;
3421 char *data;
3422 SMB_OFF_T startpos;
3423 int outsize = 0;
3424 files_struct *fsp;
3425 struct lock_struct lock;
3426 struct smbd_server_connection *sconn = req->sconn;
3427
3428 START_PROFILE(SMBread);
3429
3430 if (req->wct < 3) {
3431 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3432 END_PROFILE(SMBread);
3433 return;
3434 }
3435
3436 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3437
3438 if (!check_fsp(conn, req, fsp)) {
3439 END_PROFILE(SMBread);
3440 return;
3441 }
3442
3443 if (!CHECK_READ(fsp,req)) {
3444 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3445 END_PROFILE(SMBread);
3446 return;
3447 }
3448
3449 numtoread = SVAL(req->vwv+1, 0);
3450 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3451
3452 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3453
3454 /*
3455 * The requested read size cannot be greater than max_recv. JRA.
3456 */
3457 if (numtoread > sconn->smb1.negprot.max_recv) {
3458 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3459 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3460 (unsigned int)numtoread,
3461 (unsigned int)sconn->smb1.negprot.max_recv));
3462 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3463 }
3464
3465 reply_outbuf(req, 5, numtoread+3);
3466
3467 data = smb_buf(req->outbuf) + 3;
3468
3469 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3470 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3471 &lock);
3472
3473 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3474 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3475 END_PROFILE(SMBread);
3476 return;
3477 }
3478
3479 if (numtoread > 0)
3480 nread = read_file(fsp,data,startpos,numtoread);
3481
3482 if (nread < 0) {
3483 reply_nterror(req, map_nt_error_from_unix(errno));
3484 goto strict_unlock;
3485 }
3486
3487 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3488
3489 SSVAL(req->outbuf,smb_vwv0,nread);
3490 SSVAL(req->outbuf,smb_vwv5,nread+3);
3491 SCVAL(smb_buf(req->outbuf),0,1);
3492 SSVAL(smb_buf(req->outbuf),1,nread);
3493
3494 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3495 fsp->fnum, (int)numtoread, (int)nread ) );
3496
3497 strict_unlock:
3498 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3499
3500 END_PROFILE(SMBread);
3501 return;
3502 }
3503
3504 /****************************************************************************
3505 Setup readX header.
3506 ****************************************************************************/
3507
3508 static int setup_readX_header(struct smb_request *req, char *outbuf,
3509 size_t smb_maxcnt)
3510 {
3511 int outsize;
3512 char *data;
3513
3514 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3515 data = smb_buf(outbuf);
3516
3517 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3518
3519 SCVAL(outbuf,smb_vwv0,0xFF);
3520 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3521 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3522 SSVAL(outbuf,smb_vwv6,
3523 req_wct_ofs(req)
3524 + 1 /* the wct field */
3525 + 12 * sizeof(uint16_t) /* vwv */
3526 + 2); /* the buflen field */
3527 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3528 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3529 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3530 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3531 return outsize;
3532 }
3533
3534 /****************************************************************************
3535 Reply to a read and X - possibly using sendfile.
3536 ****************************************************************************/
3537
3538 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3539 files_struct *fsp, SMB_OFF_T startpos,
3540 size_t smb_maxcnt)
3541 {
3542 ssize_t nread = -1;
3543 struct lock_struct lock;
3544 int saved_errno = 0;
3545
3546 if(fsp_stat(fsp) == -1) {
3547 reply_nterror(req, map_nt_error_from_unix(errno));
3548 return;
3549 }
3550
3551 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3552 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3553 &lock);
3554
3555 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3556 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3557 return;
3558 }
3559
3560 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3561 (startpos > fsp->fsp_name->st.st_ex_size)
3562 || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3563 /*
3564 * We already know that we would do a short read, so don't
3565 * try the sendfile() path.
3566 */
3567 goto nosendfile_read;
3568 }
3569
3570 /*
3571 * We can only use sendfile on a non-chained packet
3572 * but we can use on a non-oplocked file. tridge proved this
3573 * on a train in Germany :-). JRA.
3574 */
3575
3576 if (!req_is_in_chain(req) &&
3577 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3578 (fsp->wcp == NULL) &&
3579 lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3580 uint8 headerbuf[smb_size + 12 * 2];
3581 DATA_BLOB header;
3582
3583 /*
3584 * Set up the packet header before send. We
3585 * assume here the sendfile will work (get the
3586 * correct amount of data).
3587 */
3588
3589 header = data_blob_const(headerbuf, sizeof(headerbuf));
3590
3591 construct_reply_common_req(req, (char *)headerbuf);
3592 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3593
3594 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3595 startpos, smb_maxcnt);
3596 if (nread == -1) {
3597 /* Returning ENOSYS means no data at all was sent.
3598 Do this as a normal read. */
3599 if (errno == ENOSYS) {
3600 goto normal_read;
3601 }
3602
3603 /*
3604 * Special hack for broken Linux with no working sendfile. If we
3605 * return EINTR we sent the header but not the rest of the data.
3606 * Fake this up by doing read/write calls.
3607 */
3608
3609 if (errno == EINTR) {
3610 /* Ensure we don't do this again. */
3611 set_use_sendfile(SNUM(conn), False);
3612 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3613 nread = fake_sendfile(fsp, startpos,
3614 smb_maxcnt);
3615 if (nread == -1) {
3616 DEBUG(0,("send_file_readX: "
3617 "fake_sendfile failed for "
3618 "file %s (%s).\n",
3619 fsp_str_dbg(fsp),
3620 strerror(errno)));
3621 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3622 }
3623 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3624 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3625 /* No outbuf here means successful sendfile. */
3626 goto strict_unlock;
3627 }
3628
3629 DEBUG(0,("send_file_readX: sendfile failed for file "
3630 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3631 strerror(errno)));
3632 exit_server_cleanly("send_file_readX sendfile failed");
3633 } else if (nread == 0) {
3634 /*
3635 * Some sendfile implementations return 0 to indicate
3636 * that there was a short read, but nothing was
3637 * actually written to the socket. In this case,
3638 * fallback to the normal read path so the header gets
3639 * the correct byte count.
3640 */
3641 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3642 "falling back to the normal read: %s\n",
3643 fsp_str_dbg(fsp)));
3644 goto normal_read;
3645 }
3646
3647 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3648 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3649
3650 /* Deal with possible short send. */
3651 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3652 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3653 }
3654 /* No outbuf here means successful sendfile. */
3655 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3656 SMB_PERFCOUNT_END(&req->pcd);
3657 goto strict_unlock;
3658 }
3659
3660 normal_read:
3661
3662 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3663 uint8 headerbuf[smb_size + 2*12];
3664
3665 construct_reply_common_req(req, (char *)headerbuf);
3666 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3667
3668 /* Send out the header. */
3669 if (write_data(req->sconn->sock, (char *)headerbuf,
3670 sizeof(headerbuf)) != sizeof(headerbuf)) {
3671
3672 char addr[INET6_ADDRSTRLEN];
3673 /*
3674 * Try and give an error message saying what
3675 * client failed.
3676 */
3677 DEBUG(0, ("write_data failed for client %s. "
3678 "Error %s\n",
3679 get_peer_addr(req->sconn->sock, addr,
3680 sizeof(addr)),
3681 strerror(errno)));
3682
3683 DEBUG(0,("send_file_readX: write_data failed for file "
3684 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3685 strerror(errno)));
3686 exit_server_cleanly("send_file_readX sendfile failed");
3687 }
3688 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3689 if (nread == -1) {
3690 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3691 "file %s (%s).\n", fsp_str_dbg(fsp),
3692 strerror(errno)));
3693 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3694 }
3695 goto strict_unlock;
3696 }
3697
3698 nosendfile_read:
3699
3700 reply_outbuf(req, 12, smb_maxcnt);
3701
3702 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3703 saved_errno = errno;
3704
3705 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3706
3707 if (nread < 0) {
3708 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3709 return;
3710 }
3711
3712 setup_readX_header(req, (char *)req->outbuf, nread);
3713
3714 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3715 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3716
3717 chain_reply(req);
3718 return;
3719
3720 strict_unlock:
3721 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3722 TALLOC_FREE(req->outbuf);
3723 return;
3724 }
3725
3726 /****************************************************************************
3727 Reply to a read and X.
3728 ****************************************************************************/
3729
3730 void reply_read_and_X(struct smb_request *req)
3731 {
3732 connection_struct *conn = req->conn;
3733 files_struct *fsp;
3734 SMB_OFF_T startpos;
3735 size_t smb_maxcnt;
3736 bool big_readX = False;
3737 #if 0
3738 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3739 #endif
3740
3741 START_PROFILE(SMBreadX);
3742
3743 if ((req->wct != 10) && (req->wct != 12)) {
3744 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3745 return;
3746 }
3747
3748 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3749 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3750 smb_maxcnt = SVAL(req->vwv+5, 0);
3751
3752 /* If it's an IPC, pass off the pipe handler. */
3753 if (IS_IPC(conn)) {
3754 reply_pipe_read_and_X(req);
3755 END_PROFILE(SMBreadX);
3756 return;
3757 }
3758
3759 if (!check_fsp(conn, req, fsp)) {
3760 END_PROFILE(SMBreadX);
3761 return;
3762 }
3763
3764 if (!CHECK_READ(fsp,req)) {
3765 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3766 END_PROFILE(SMBreadX);
3767 return;
3768 }
3769
3770 if (global_client_caps & CAP_LARGE_READX) {
3771 size_t upper_size = SVAL(req->vwv+7, 0);
3772 smb_maxcnt |= (upper_size<<16);
3773 if (upper_size > 1) {
3774 /* Can't do this on a chained packet. */
3775 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3776 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3777 END_PROFILE(SMBreadX);
3778 return;
3779 }
3780 /* We currently don't do this on signed or sealed data. */
3781 if (srv_is_signing_active(req->sconn) ||
3782 is_encrypted_packet(req->inbuf)) {
3783 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3784 END_PROFILE(SMBreadX);
3785 return;
3786 }
3787 /* Is there room in the reply for this data ? */
3788 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3789 reply_nterror(req,
3790 NT_STATUS_INVALID_PARAMETER);
3791 END_PROFILE(SMBreadX);
3792 return;
3793 }
3794 big_readX = True;
3795 }
3796 }
3797
3798 if (req->wct == 12) {
3799 #ifdef LARGE_SMB_OFF_T
3800 /*
3801 * This is a large offset (64 bit) read.
3802 */
3803 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3804
3805 #else /* !LARGE_SMB_OFF_T */
3806
3807 /*
3808 * Ensure we haven't been sent a >32 bit offset.
3809 */
3810
3811 if(IVAL(req->vwv+10, 0) != 0) {
3812 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3813 "used and we don't support 64 bit offsets.\n",
3814 (unsigned int)IVAL(req->vwv+10, 0) ));
3815 END_PROFILE(SMBreadX);
3816 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3817 return;
3818 }
3819
3820 #endif /* LARGE_SMB_OFF_T */
3821
3822 }
3823
3824 if (!big_readX) {
3825 NTSTATUS status = schedule_aio_read_and_X(conn,
3826 req,
3827 fsp,
3828 startpos,
3829 smb_maxcnt);
3830 if (NT_STATUS_IS_OK(status)) {
3831 /* Read scheduled - we're done. */
3832 goto out;
3833 }
3834 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3835 /* Real error - report to client. */
3836 END_PROFILE(SMBreadX);
3837 reply_nterror(req, status);
3838 return;
3839 }
3840 /* NT_STATUS_RETRY - fall back to sync read. */
3841 }
3842
3843 smbd_lock_socket(req->sconn);
3844 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3845 smbd_unlock_socket(req->sconn);
3846
3847 out:
3848 END_PROFILE(SMBreadX);
3849 return;
3850 }
3851
3852 /****************************************************************************
3853 Error replies to writebraw must have smb_wct == 1. Fix this up.
3854 ****************************************************************************/
3855
3856 void error_to_writebrawerr(struct smb_request *req)
3857 {
3858 uint8 *old_outbuf = req->outbuf;
3859
3860 reply_outbuf(req, 1, 0);
3861
3862 memcpy(req->outbuf, old_outbuf, smb_size);
3863 TALLOC_FREE(old_outbuf);
3864 }
3865
3866 /****************************************************************************
3867 Read 4 bytes of a smb packet and return the smb length of the packet.
3868 Store the result in the buffer. This version of the function will
3869 never return a session keepalive (length of zero).
3870 Timeout is in milliseconds.
3871 ****************************************************************************/
3872
3873 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3874 size_t *len)
3875 {
3876 uint8_t msgtype = SMBkeepalive;
3877
3878 while (msgtype == SMBkeepalive) {
3879 NTSTATUS status;
3880
3881 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3882 len);
3883 if (!NT_STATUS_IS_OK(status)) {
3884 char addr[INET6_ADDRSTRLEN];
3885 /* Try and give an error message
3886 * saying what client failed. */
3887 DEBUG(0, ("read_fd_with_timeout failed for "
3888 "client %s read error = %s.\n",
3889 get_peer_addr(fd,addr,sizeof(addr)),
3890 nt_errstr(status)));
3891 return status;
3892 }
3893
3894 msgtype = CVAL(inbuf, 0);
3895 }
3896
3897 DEBUG(10,("read_smb_length: got smb length of %lu\n",
3898 (unsigned long)len));
3899
3900 return NT_STATUS_OK;
3901 }
3902
3903 /****************************************************************************
3904 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3905 ****************************************************************************/
3906
3907 void reply_writebraw(struct smb_request *req)
3908 {
3909 connection_struct *conn = req->conn;
3910 char *buf = NULL;
3911 ssize_t nwritten=0;
3912 ssize_t total_written=0;
3913 size_t numtowrite=0;
3914 size_t tcount;
3915 SMB_OFF_T startpos;
3916 const char *data=NULL;
3917 bool write_through;
3918 files_struct *fsp;
3919 struct lock_struct lock;
3920 NTSTATUS status;
3921
3922 START_PROFILE(SMBwritebraw);
3923
3924 /*
3925 * If we ever reply with an error, it must have the SMB command
3926 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3927 * we're finished.
3928 */
3929 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3930
3931 if (srv_is_signing_active(req->sconn)) {
3932 END_PROFILE(SMBwritebraw);
3933 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3934 "raw reads/writes are disallowed.");
3935 }
3936
3937 if (req->wct < 12) {
3938 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3939 error_to_writebrawerr(req);
3940 END_PROFILE(SMBwritebraw);
3941 return;
3942 }
3943
3944 if (req->sconn->smb1.echo_handler.trusted_fde) {
3945 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3946 "'async smb echo handler = yes'\n"));
3947 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3948 error_to_writebrawerr(req);
3949 END_PROFILE(SMBwritebraw);
3950 return;
3951 }
3952
3953 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3954 if (!check_fsp(conn, req, fsp)) {
3955 error_to_writebrawerr(req);
3956 END_PROFILE(SMBwritebraw);
3957 return;
3958 }
3959
3960 if (!CHECK_WRITE(fsp)) {
3961 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3962 error_to_writebrawerr(req);
3963 END_PROFILE(SMBwritebraw);
3964 return;
3965 }
3966
3967 tcount = IVAL(req->vwv+1, 0);
3968 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3969 write_through = BITSETW(req->vwv+7,0);
3970
3971 /* We have to deal with slightly different formats depending
3972 on whether we are using the core+ or lanman1.0 protocol */
3973
3974 if(get_Protocol() <= PROTOCOL_COREPLUS) {
3975 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3976 data = smb_buf_const(req->inbuf);
3977 } else {
3978 numtowrite = SVAL(req->vwv+10, 0);
3979 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3980 }
3981
3982 /* Ensure we don't write bytes past the end of this packet. */
3983 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3984 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3985 error_to_writebrawerr(req);
3986 END_PROFILE(SMBwritebraw);
3987 return;
3988 }
3989
3990 if (!fsp->print_file) {
3991 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3992 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3993 &lock);
3994
3995 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3996 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3997 error_to_writebrawerr(req);
3998 END_PROFILE(SMBwritebraw);
3999 return;
4000 }
4001 }
4002
4003 if (numtowrite>0) {
4004 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4005 }
4006
4007 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4008 "wrote=%d sync=%d\n",
4009 fsp->fnum, (double)startpos, (int)numtowrite,
4010 (int)nwritten, (int)write_through));
4011
4012 if (nwritten < (ssize_t)numtowrite) {
4013 reply_nterror(req, NT_STATUS_DISK_FULL);
4014 error_to_writebrawerr(req);
4015 goto strict_unlock;
4016 }
4017
4018 total_written = nwritten;
4019
4020 /* Allocate a buffer of 64k + length. */
4021 buf = talloc_array(NULL, char, 65540);
4022 if (!buf) {
4023 reply_nterror(req, NT_STATUS_NO_MEMORY);
4024 error_to_writebrawerr(req);
4025 goto strict_unlock;
4026 }
4027
4028 /* Return a SMBwritebraw message to the redirector to tell
4029 * it to send more bytes */
4030
4031 memcpy(buf, req->inbuf, smb_size);
4032 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4033 SCVAL(buf,smb_com,SMBwritebraw);
4034 SSVALS(buf,smb_vwv0,0xFFFF);
4035 show_msg(buf);
4036 if (!srv_send_smb(req->sconn,
4037 buf,
4038 false, 0, /* no signing */
4039 IS_CONN_ENCRYPTED(conn),
4040 &req->pcd)) {
4041 exit_server_cleanly("reply_writebraw: srv_send_smb "
4042 "failed.");
4043 }
4044
4045 /* Now read the raw data into the buffer and write it */
4046 status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4047 &numtowrite);
4048 if (!NT_STATUS_IS_OK(status)) {
4049 exit_server_cleanly("secondary writebraw failed");
4050 }
4051
4052 /* Set up outbuf to return the correct size */
4053 reply_outbuf(req, 1, 0);
4054
4055 if (numtowrite != 0) {
4056
4057 if (numtowrite > 0xFFFF) {
4058 DEBUG(0,("reply_writebraw: Oversize secondary write "
4059 "raw requested (%u). Terminating\n",
4060 (unsigned int)numtowrite ));
4061 exit_server_cleanly("secondary writebraw failed");
4062 }
4063
4064 if (tcount > nwritten+numtowrite) {
4065 DEBUG(3,("reply_writebraw: Client overestimated the "
4066 "write %d %d %d\n",
4067 (int)tcount,(int)nwritten,(int)numtowrite));
4068 }
4069
4070 status = read_data(req->sconn->sock, buf+4, numtowrite);
4071
4072 if (!NT_STATUS_IS_OK(status)) {
4073 char addr[INET6_ADDRSTRLEN];
4074 /* Try and give an error message
4075 * saying what client failed. */
4076 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4077 "raw read failed (%s) for client %s. "
4078 "Terminating\n", nt_errstr(status),
4079 get_peer_addr(req->sconn->sock, addr,
4080 sizeof(addr))));
4081 exit_server_cleanly("secondary writebraw failed");
4082 }
4083
4084 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4085 if (nwritten == -1) {
4086 TALLOC_FREE(buf);
4087 reply_nterror(req, map_nt_error_from_unix(errno));
4088 error_to_writebrawerr(req);
4089 goto strict_unlock;
4090 }
4091
4092 if (nwritten < (ssize_t)numtowrite) {
4093 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4094 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4095 }
4096
4097 if (nwritten > 0) {
4098 total_written += nwritten;
4099 }
4100 }
4101
4102 TALLOC_FREE(buf);
4103 SSVAL(req->outbuf,smb_vwv0,total_written);
4104
4105 status = sync_file(conn, fsp, write_through);
4106 if (!NT_STATUS_IS_OK(status)) {
4107 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4108 fsp_str_dbg(fsp), nt_errstr(status)));
4109 reply_nterror(req, status);
4110 error_to_writebrawerr(req);
4111 goto strict_unlock;
4112 }
4113
4114 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4115 "wrote=%d\n",
4116 fsp->fnum, (double)startpos, (int)numtowrite,
4117 (int)total_written));
4118
4119 if (!fsp->print_file) {
4120 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4121 }
4122
4123 /* We won't return a status if write through is not selected - this
4124 * follows what WfWg does */
4125 END_PROFILE(SMBwritebraw);
4126
4127 if (!write_through && total_written==tcount) {
4128
4129 #if RABBIT_PELLET_FIX
4130 /*
4131 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4132 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4133 * JRA.
4134 */
4135 if (!send_keepalive(req->sconn->sock)) {
4136 exit_server_cleanly("reply_writebraw: send of "
4137 "keepalive failed");
4138 }
4139 #endif
4140 TALLOC_FREE(req->outbuf);
4141 }
4142 return;
4143
4144 strict_unlock:
4145 if (!fsp->print_file) {
4146 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4147 }
4148
4149 END_PROFILE(SMBwritebraw);
4150 return;
4151 }
4152
4153 #undef DBGC_CLASS
4154 #define DBGC_CLASS DBGC_LOCKING
4155
4156 /****************************************************************************
4157 Reply to a writeunlock (core+).
4158 ****************************************************************************/
4159
4160 void reply_writeunlock(struct smb_request *req)
4161 {
4162 connection_struct *conn = req->conn;
4163 ssize_t nwritten = -1;
4164 size_t numtowrite;
4165 SMB_OFF_T startpos;
4166 const char *data;
4167 NTSTATUS status = NT_STATUS_OK;
4168 files_struct *fsp;
4169 struct lock_struct lock;
4170 int saved_errno = 0;
4171
4172 START_PROFILE(SMBwriteunlock);
4173
4174 if (req->wct < 5) {
4175 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4176 END_PROFILE(SMBwriteunlock);
4177 return;
4178 }
4179
4180 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4181
4182 if (!check_fsp(conn, req, fsp)) {
4183 END_PROFILE(SMBwriteunlock);
4184 return;
4185 }
4186
4187 if (!CHECK_WRITE(fsp)) {
4188 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4189 END_PROFILE(SMBwriteunlock);
4190 return;
4191 }
4192
4193 numtowrite = SVAL(req->vwv+1, 0);
4194 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4195 data = (const char *)req->buf + 3;
4196
4197 if (!fsp->print_file && numtowrite > 0) {
4198 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4199 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4200 &lock);
4201
4202 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4203 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4204 END_PROFILE(SMBwriteunlock);
4205 return;
4206 }
4207 }
4208
4209 /* The special X/Open SMB protocol handling of
4210 zero length writes is *NOT* done for
4211 this call */
4212 if(numtowrite == 0) {
4213 nwritten = 0;
4214 } else {
4215 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4216 saved_errno = errno;
4217 }
4218
4219 status = sync_file(conn, fsp, False /* write through */);
4220 if (!NT_STATUS_IS_OK(status)) {
4221 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4222 fsp_str_dbg(fsp), nt_errstr(status)));
4223 reply_nterror(req, status);
4224 goto strict_unlock;
4225 }
4226
4227 if(nwritten < 0) {
4228 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4229 goto strict_unlock;
4230 }
4231
4232 if((nwritten < numtowrite) && (numtowrite != 0)) {
4233 reply_nterror(req, NT_STATUS_DISK_FULL);
4234 goto strict_unlock;
4235 }
4236
4237 if (numtowrite && !fsp->print_file) {
4238 status = do_unlock(req->sconn->msg_ctx,
4239 fsp,
4240 (uint64_t)req->smbpid,
4241 (uint64_t)numtowrite,
4242 (uint64_t)startpos,
4243 WINDOWS_LOCK);
4244
4245 if (NT_STATUS_V(status)) {
4246 reply_nterror(req, status);
4247 goto strict_unlock;
4248 }
4249 }
4250
4251 reply_outbuf(req, 1, 0);
4252
4253 SSVAL(req->outbuf,smb_vwv0,nwritten);
4254
4255 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4256 fsp->fnum, (int)numtowrite, (int)nwritten));
4257
4258 strict_unlock:
4259 if (numtowrite && !fsp->print_file) {
4260 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4261 }
4262
4263 END_PROFILE(SMBwriteunlock);
4264 return;
4265 }
4266
4267 #undef DBGC_CLASS
4268 #define DBGC_CLASS DBGC_ALL
4269
4270 /****************************************************************************
4271 Reply to a write.
4272 ****************************************************************************/
4273
4274 void reply_write(struct smb_request *req)
4275 {
4276 connection_struct *conn = req->conn;
4277 size_t numtowrite;
4278 ssize_t nwritten = -1;
4279 SMB_OFF_T startpos;
4280 const char *data;
4281 files_struct *fsp;
4282 struct lock_struct lock;
4283 NTSTATUS status;
4284 int saved_errno = 0;
4285
4286 START_PROFILE(SMBwrite);
4287
4288 if (req->wct < 5) {
4289 END_PROFILE(SMBwrite);
4290 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4291 return;
4292 }
4293
4294 /* If it's an IPC, pass off the pipe handler. */
4295 if (IS_IPC(conn)) {
4296 reply_pipe_write(req);
4297 END_PROFILE(SMBwrite);
4298 return;
4299 }
4300
4301 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4302
4303 if (!check_fsp(conn, req, fsp)) {
4304 END_PROFILE(SMBwrite);
4305 return;
4306 }
4307
4308 if (!CHECK_WRITE(fsp)) {
4309 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4310 END_PROFILE(SMBwrite);
4311 return;
4312 }
4313
4314 numtowrite = SVAL(req->vwv+1, 0);
4315 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4316 data = (const char *)req->buf + 3;
4317
4318 if (!fsp->print_file) {
4319 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4320 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4321 &lock);
4322
4323 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4324 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4325 END_PROFILE(SMBwrite);
4326 return;
4327 }
4328 }
4329
4330 /*
4331 * X/Open SMB protocol says that if smb_vwv1 is
4332 * zero then the file size should be extended or
4333 * truncated to the size given in smb_vwv[2-3].
4334 */
4335
4336 if(numtowrite == 0) {
4337 /*
4338 * This is actually an allocate call, and set EOF. JRA.
4339 */
4340 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4341 if (nwritten < 0) {
4342 reply_nterror(req, NT_STATUS_DISK_FULL);
4343 goto strict_unlock;
4344 }
4345 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4346 if (nwritten < 0) {
4347 reply_nterror(req, NT_STATUS_DISK_FULL);
4348 goto strict_unlock;
4349 }
4350 trigger_write_time_update_immediate(fsp);
4351 } else {
4352 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4353 }
4354
4355 status = sync_file(conn, fsp, False);
4356 if (!NT_STATUS_IS_OK(status)) {
4357 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4358 fsp_str_dbg(fsp), nt_errstr(status)));
4359 reply_nterror(req, status);
4360 goto strict_unlock;
4361 }
4362
4363 if(nwritten < 0) {
4364 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4365 goto strict_unlock;
4366 }
4367
4368 if((nwritten == 0) && (numtowrite != 0)) {
4369 reply_nterror(req, NT_STATUS_DISK_FULL);
4370 goto strict_unlock;
4371 }
4372
4373 reply_outbuf(req, 1, 0);
4374
4375 SSVAL(req->outbuf,smb_vwv0,nwritten);
4376
4377 if (nwritten < (ssize_t)numtowrite) {
4378 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4379 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4380 }
4381
4382 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4383
4384 strict_unlock:
4385 if (!fsp->print_file) {
4386 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4387 }
4388
4389 END_PROFILE(SMBwrite);
4390 return;
4391 }
4392
4393 /****************************************************************************
4394 Ensure a buffer is a valid writeX for recvfile purposes.
4395 ****************************************************************************/
4396
4397 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4398 (2*14) + /* word count (including bcc) */ \
4399 1 /* pad byte */)
4400
4401 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4402 const uint8_t *inbuf)
4403 {
4404 size_t numtowrite;
4405 connection_struct *conn = NULL;
4406 unsigned int doff = 0;
4407 size_t len = smb_len_large(inbuf);
4408
4409 if (is_encrypted_packet(inbuf)) {
4410 /* Can't do this on encrypted
4411 * connections. */
4412 return false;
4413 }
4414
4415 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4416 return false;
4417 }
4418
4419 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4420 CVAL(inbuf,smb_wct) != 14) {
4421 DEBUG(10,("is_valid_writeX_buffer: chained or "
4422 "invalid word length.\n"));
4423 return false;
4424 }
4425
4426 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4427 if (conn == NULL) {
4428 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4429 return false;
4430 }
4431 if (IS_IPC(conn)) {
4432 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4433 return false;
4434 }
4435 if (IS_PRINT(conn)) {
4436 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4437 return false;
4438 }
4439 doff = SVAL(inbuf,smb_vwv11);
4440
4441 numtowrite = SVAL(inbuf,smb_vwv10);
4442
4443 if (len > doff && len - doff > 0xFFFF) {
4444 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4445 }
4446
4447 if (numtowrite == 0) {
4448 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4449 return false;
4450 }
4451
4452 /* Ensure the sizes match up. */
4453 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4454 /* no pad byte...old smbclient :-( */
4455 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4456 (unsigned int)doff,
4457 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4458 return false;
4459 }
4460
4461 if (len - doff != numtowrite) {
4462 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4463 "len = %u, doff = %u, numtowrite = %u\n",
4464 (unsigned int)len,
4465 (unsigned int)doff,
4466 (unsigned int)numtowrite ));
4467 return false;
4468 }
4469
4470 DEBUG(10,("is_valid_writeX_buffer: true "
4471 "len = %u, doff = %u, numtowrite = %u\n",
4472 (unsigned int)len,
4473 (unsigned int)doff,
4474 (unsigned int)numtowrite ));
4475
4476 return true;
4477 }
4478
4479 /****************************************************************************
4480 Reply to a write and X.
4481 ****************************************************************************/
4482
4483 void reply_write_and_X(struct smb_request *req)
4484 {
4485 connection_struct *conn = req->conn;
4486 files_struct *fsp;
4487 struct lock_struct lock;
4488 SMB_OFF_T startpos;
4489 size_t numtowrite;
4490 bool write_through;
4491 ssize_t nwritten;
4492 unsigned int smb_doff;
4493 unsigned int smblen;
4494 const char *data;
4495 NTSTATUS status;
4496 int saved_errno = 0;
4497
4498 START_PROFILE(SMBwriteX);
4499
4500 if ((req->wct != 12) && (req->wct != 14)) {
4501 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4502 END_PROFILE(SMBwriteX);
4503 return;
4504 }
4505
4506 numtowrite = SVAL(req->vwv+10, 0);
4507 smb_doff = SVAL(req->vwv+11, 0);
4508 smblen = smb_len(req->inbuf);
4509
4510 if (req->unread_bytes > 0xFFFF ||
4511 (smblen > smb_doff &&
4512 smblen - smb_doff > 0xFFFF)) {
4513 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4514 }
4515
4516 if (req->unread_bytes) {
4517 /* Can't do a recvfile write on IPC$ */
4518 if (IS_IPC(conn)) {
4519 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4520 END_PROFILE(SMBwriteX);
4521 return;
4522 }
4523 if (numtowrite != req->unread_bytes) {
4524 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4525 END_PROFILE(SMBwriteX);
4526 return;
4527 }
4528 } else {
4529 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4530 smb_doff + numtowrite > smblen) {
4531 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532 END_PROFILE(SMBwriteX);
4533 return;
4534 }
4535 }
4536
4537 /* If it's an IPC, pass off the pipe handler. */
4538 if (IS_IPC(conn)) {
4539 if (req->unread_bytes) {
4540 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4541 END_PROFILE(SMBwriteX);
4542 return;
4543 }
4544 reply_pipe_write_and_X(req);
4545 END_PROFILE(SMBwriteX);
4546 return;
4547 }
4548
4549 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4550 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4551 write_through = BITSETW(req->vwv+7,0);
4552
4553 if (!check_fsp(conn, req, fsp)) {
4554 END_PROFILE(SMBwriteX);
4555 return;
4556 }
4557
4558 if (!CHECK_WRITE(fsp)) {
4559 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4560 END_PROFILE(SMBwriteX);
4561 return;
4562 }
4563
4564 data = smb_base(req->inbuf) + smb_doff;
4565
4566 if(req->wct == 14) {
4567 #ifdef LARGE_SMB_OFF_T
4568 /*
4569 * This is a large offset (64 bit) write.
4570 */
4571 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4572
4573 #else /* !LARGE_SMB_OFF_T */
4574
4575 /*
4576 * Ensure we haven't been sent a >32 bit offset.
4577 */
4578
4579 if(IVAL(req->vwv+12, 0) != 0) {
4580 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4581 "used and we don't support 64 bit offsets.\n",
4582 (unsigned int)IVAL(req->vwv+12, 0) ));
4583 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4584 END_PROFILE(SMBwriteX);
4585 return;
4586 }
4587
4588 #endif /* LARGE_SMB_OFF_T */
4589 }
4590
4591 /* X/Open SMB protocol says that, unlike SMBwrite
4592 if the length is zero then NO truncation is
4593 done, just a write of zero. To truncate a file,
4594 use SMBwrite. */
4595
4596 if(numtowrite == 0) {
4597 nwritten = 0;
4598 } else {
4599 if (req->unread_bytes == 0) {
4600 status = schedule_aio_write_and_X(conn,
4601 req,
4602 fsp,
4603 data,
4604 startpos,
4605 numtowrite);
4606
4607 if (NT_STATUS_IS_OK(status)) {
4608 /* write scheduled - we're done. */
4609 goto out;
4610 }
4611 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4612 /* Real error - report to client. */
4613 reply_nterror(req, status);
4614 goto out;
4615 }
4616 /* NT_STATUS_RETRY - fall through to sync write. */
4617 }
4618
4619 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4620 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4621 &lock);
4622
4623 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4624 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4625 goto out;
4626 }
4627
4628 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4629 saved_errno = errno;
4630
4631 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4632 }
4633
4634 if(nwritten < 0) {
4635 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4636 goto out;
4637 }
4638
4639 if((nwritten == 0) && (numtowrite != 0)) {
4640 reply_nterror(req, NT_STATUS_DISK_FULL);
4641 goto out;
4642 }
4643
4644 reply_outbuf(req, 6, 0);
4645 SSVAL(req->outbuf,smb_vwv2,nwritten);
4646 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4647
4648 if (nwritten < (ssize_t)numtowrite) {
4649 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4650 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4651 }
4652
4653 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4654 fsp->fnum, (int)numtowrite, (int)nwritten));
4655
4656 status = sync_file(conn, fsp, write_through);
4657 if (!NT_STATUS_IS_OK(status)) {
4658 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4659 fsp_str_dbg(fsp), nt_errstr(status)));
4660 reply_nterror(req, status);
4661 goto out;
4662 }
4663
4664 END_PROFILE(SMBwriteX);
4665 chain_reply(req);
4666 return;
4667
4668 out:
4669 END_PROFILE(SMBwriteX);
4670 return;
4671 }
4672
4673 /****************************************************************************
4674 Reply to a lseek.
4675 ****************************************************************************/
4676
4677 void reply_lseek(struct smb_request *req)
4678 {
4679 connection_struct *conn = req->conn;
4680 SMB_OFF_T startpos;
4681 SMB_OFF_T res= -1;
4682 int mode,umode;
4683 files_struct *fsp;
4684
4685 START_PROFILE(SMBlseek);
4686
4687 if (req->wct < 4) {
4688 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4689 END_PROFILE(SMBlseek);
4690 return;
4691 }
4692
4693 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4694
4695 if (!check_fsp(conn, req, fsp)) {
4696 return;
4697 }
4698
4699 flush_write_cache(fsp, SEEK_FLUSH);
4700
4701 mode = SVAL(req->vwv+1, 0) & 3;
4702 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4703 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4704
4705 switch (mode) {
4706 case 0:
4707 umode = SEEK_SET;
4708 res = startpos;
4709 break;
4710 case 1:
4711 umode = SEEK_CUR;
4712 res = fsp->fh->pos + startpos;
4713 break;
4714 case 2:
4715 umode = SEEK_END;
4716 break;
4717 default:
4718 umode = SEEK_SET;
4719 res = startpos;
4720 break;
4721 }
4722
4723 if (umode == SEEK_END) {
4724 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4725 if(errno == EINVAL) {
4726 SMB_OFF_T current_pos = startpos;
4727
4728 if(fsp_stat(fsp) == -1) {
4729 reply_nterror(req,
4730 map_nt_error_from_unix(errno));
4731 END_PROFILE(SMBlseek);
4732 return;
4733 }
4734
4735 current_pos += fsp->fsp_name->st.st_ex_size;
4736 if(current_pos < 0)
4737 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4738 }
4739 }
4740
4741 if(res == -1) {
4742 reply_nterror(req, map_nt_error_from_unix(errno));
4743 END_PROFILE(SMBlseek);
4744 return;
4745 }
4746 }
4747
4748 fsp->fh->pos = res;
4749
4750 reply_outbuf(req, 2, 0);
4751 SIVAL(req->outbuf,smb_vwv0,res);
4752
4753 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4754 fsp->fnum, (double)startpos, (double)res, mode));
4755
4756 END_PROFILE(SMBlseek);
4757 return;
4758 }
4759
4760 /****************************************************************************
4761 Reply to a flush.
4762 ****************************************************************************/
4763
4764 void reply_flush(struct smb_request *req)
4765 {
4766 connection_struct *conn = req->conn;
4767 uint16 fnum;
4768 files_struct *fsp;
4769
4770 START_PROFILE(SMBflush);
4771
4772 if (req->wct < 1) {
4773 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4774 return;
4775 }
4776
4777 fnum = SVAL(req->vwv+0, 0);
4778 fsp = file_fsp(req, fnum);
4779
4780 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4781 return;
4782 }
4783
4784 if (!fsp) {
4785 file_sync_all(conn);
4786 } else {
4787 NTSTATUS status = sync_file(conn, fsp, True);
4788 if (!NT_STATUS_IS_OK(status)) {
4789 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4790 fsp_str_dbg(fsp), nt_errstr(status)));
4791 reply_nterror(req, status);
4792 END_PROFILE(SMBflush);
4793 return;
4794 }
4795 }
4796
4797 reply_outbuf(req, 0, 0);
4798
4799 DEBUG(3,("flush\n"));
4800 END_PROFILE(SMBflush);
4801 return;
4802 }
4803
4804 /****************************************************************************
4805 Reply to a exit.
4806 conn POINTER CAN BE NULL HERE !
4807 ****************************************************************************/
4808
4809 void reply_exit(struct smb_request *req)
4810 {
4811 START_PROFILE(SMBexit);
4812
4813 file_close_pid(req->sconn, req->smbpid, req->vuid);
4814
4815 reply_outbuf(req, 0, 0);
4816
4817 DEBUG(3,("exit\n"));
4818
4819 END_PROFILE(SMBexit);
4820 return;
4821 }
4822
4823 /****************************************************************************
4824 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4825 ****************************************************************************/
4826
4827 void reply_close(struct smb_request *req)
4828 {
4829 connection_struct *conn = req->conn;
4830 NTSTATUS status = NT_STATUS_OK;
4831 files_struct *fsp = NULL;
4832 START_PROFILE(SMBclose);
4833
4834 if (req->wct < 3) {
4835 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4836 END_PROFILE(SMBclose);
4837 return;
4838 }
4839
4840 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4841
4842 /*
4843 * We can only use check_fsp if we know it's not a directory.
4844 */
4845
4846 if (!check_fsp_open(conn, req, fsp)) {
4847 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4848 END_PROFILE(SMBclose);
4849 return;
4850 }
4851
4852 if(fsp->is_directory) {
4853 /*
4854 * Special case - close NT SMB directory handle.
4855 */
4856 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4857 status = close_file(req, fsp, NORMAL_CLOSE);
4858 } else {
4859 time_t t;
4860 /*
4861 * Close ordinary file.
4862 */
4863
4864 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4865 fsp->fh->fd, fsp->fnum,
4866 conn->num_files_open));
4867
4868 /*
4869 * Take care of any time sent in the close.
4870 */
4871
4872 t = srv_make_unix_date3(req->vwv+1);
4873 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4874
4875 /*
4876 * close_file() returns the unix errno if an error
4877 * was detected on close - normally this is due to
4878 * a disk full error. If not then it was probably an I/O error.
4879 */
4880
4881 status = close_file(req, fsp, NORMAL_CLOSE);
4882 }
4883
4884 if (!NT_STATUS_IS_OK(status)) {
4885 reply_nterror(req, status);
4886 END_PROFILE(SMBclose);
4887 return;
4888 }
4889
4890 reply_outbuf(req, 0, 0);
4891 END_PROFILE(SMBclose);
4892 return;
4893 }
4894
4895 /****************************************************************************
4896 Reply to a writeclose (Core+ protocol).
4897 ****************************************************************************/
4898
4899 void reply_writeclose(struct smb_request *req)
4900 {
4901 connection_struct *conn = req->conn;
4902 size_t numtowrite;
4903 ssize_t nwritten = -1;
4904 NTSTATUS close_status = NT_STATUS_OK;
4905 SMB_OFF_T startpos;
4906 const char *data;
4907 struct timespec mtime;
4908 files_struct *fsp;
4909 struct lock_struct lock;
4910
4911 START_PROFILE(SMBwriteclose);
4912
4913 if (req->wct < 6) {
4914 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4915 END_PROFILE(SMBwriteclose);
4916 return;
4917 }
4918
4919 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4920
4921 if (!check_fsp(conn, req, fsp)) {
4922 END_PROFILE(SMBwriteclose);
4923 return;
4924 }
4925 if (!CHECK_WRITE(fsp)) {
4926 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4927 END_PROFILE(SMBwriteclose);
4928 return;
4929 }
4930
4931 numtowrite = SVAL(req->vwv+1, 0);
4932 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4933 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4934 data = (const char *)req->buf + 1;
4935
4936 if (!fsp->print_file) {
4937 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4938 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4939 &lock);
4940
4941 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4942 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4943 END_PROFILE(SMBwriteclose);
4944 return;
4945 }
4946 }
4947
4948 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4949
4950 set_close_write_time(fsp, mtime);
4951
4952 /*
4953 * More insanity. W2K only closes the file if writelen > 0.
4954 * JRA.
4955 */
4956
4957 if (numtowrite) {
4958 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4959 "file %s\n", fsp_str_dbg(fsp)));
4960 close_status = close_file(req, fsp, NORMAL_CLOSE);
4961 }
4962
4963 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4964 fsp->fnum, (int)numtowrite, (int)nwritten,
4965 conn->num_files_open));
4966
4967 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4968 reply_nterror(req, NT_STATUS_DISK_FULL);
4969 goto strict_unlock;
4970 }
4971
4972 if(!NT_STATUS_IS_OK(close_status)) {
4973 reply_nterror(req, close_status);
4974 goto strict_unlock;
4975 }
4976
4977 reply_outbuf(req, 1, 0);
4978
4979 SSVAL(req->outbuf,smb_vwv0,nwritten);
4980
4981 strict_unlock:
4982 if (numtowrite && !fsp->print_file) {
4983 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4984 }
4985
4986 END_PROFILE(SMBwriteclose);
4987 return;
4988 }
4989
4990 #undef DBGC_CLASS
4991 #define DBGC_CLASS DBGC_LOCKING
4992
4993 /****************************************************************************
4994 Reply to a lock.
4995 ****************************************************************************/
4996
4997 void reply_lock(struct smb_request *req)
4998 {
4999 connection_struct *conn = req->conn;
5000 uint64_t count,offset;
5001 NTSTATUS status;
5002 files_struct *fsp;
5003 struct byte_range_lock *br_lck = NULL;
5004
5005 START_PROFILE(SMBlock);
5006
5007 if (req->wct < 5) {
5008 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5009 END_PROFILE(SMBlock);
5010 return;
5011 }
5012
5013 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5014
5015 if (!check_fsp(conn, req, fsp)) {
5016 END_PROFILE(SMBlock);
5017 return;
5018 }
5019
5020 count = (uint64_t)IVAL(req->vwv+1, 0);
5021 offset = (uint64_t)IVAL(req->vwv+3, 0);
5022
5023 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5024 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5025
5026 br_lck = do_lock(req->sconn->msg_ctx,
5027 fsp,
5028 (uint64_t)req->smbpid,
5029 count,
5030 offset,
5031 WRITE_LOCK,
5032 WINDOWS_LOCK,
5033 False, /* Non-blocking lock. */
5034 &status,
5035 NULL,
5036 NULL);
5037
5038 TALLOC_FREE(br_lck);
5039
5040 if (NT_STATUS_V(status)) {
5041 reply_nterror(req, status);
5042 END_PROFILE(SMBlock);
5043 return;
5044 }
5045
5046 reply_outbuf(req, 0, 0);
5047
5048 END_PROFILE(SMBlock);
5049 return;
5050 }
5051
5052 /****************************************************************************
5053 Reply to a unlock.
5054 ****************************************************************************/
5055
5056 void reply_unlock(struct smb_request *req)
5057 {
5058 connection_struct *conn = req->conn;
5059 uint64_t count,offset;
5060 NTSTATUS status;
5061 files_struct *fsp;
5062
5063 START_PROFILE(SMBunlock);
5064
5065 if (req->wct < 5) {
5066 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5067 END_PROFILE(SMBunlock);
5068 return;
5069 }
5070
5071 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5072
5073 if (!check_fsp(conn, req, fsp)) {
5074 END_PROFILE(SMBunlock);
5075 return;
5076 }
5077
5078 count = (uint64_t)IVAL(req->vwv+1, 0);
5079 offset = (uint64_t)IVAL(req->vwv+3, 0);
5080
5081 status = do_unlock(req->sconn->msg_ctx,
5082 fsp,
5083 (uint64_t)req->smbpid,
5084 count,
5085 offset,
5086 WINDOWS_LOCK);
5087
5088 if (NT_STATUS_V(status)) {
5089 reply_nterror(req, status);
5090 END_PROFILE(SMBunlock);
5091 return;
5092 }
5093
5094 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5095 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5096
5097 reply_outbuf(req, 0, 0);
5098
5099 END_PROFILE(SMBunlock);
5100 return;
5101 }
5102
5103 #undef DBGC_CLASS
5104 #define DBGC_CLASS DBGC_ALL
5105
5106 /****************************************************************************
5107 Reply to a tdis.
5108 conn POINTER CAN BE NULL HERE !
5109 ****************************************************************************/
5110
5111 void reply_tdis(struct smb_request *req)
5112 {
5113 connection_struct *conn = req->conn;
5114 START_PROFILE(SMBtdis);
5115
5116 if (!conn) {
5117 DEBUG(4,("Invalid connection in tdis\n"));
5118 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5119 END_PROFILE(SMBtdis);
5120 return;
5121 }
5122
5123 conn->used = False;
5124
5125 close_cnum(conn,req->vuid);
5126 req->conn = NULL;
5127
5128 reply_outbuf(req, 0, 0);
5129 END_PROFILE(SMBtdis);
5130 return;
5131 }
5132
5133 /****************************************************************************
5134 Reply to a echo.
5135 conn POINTER CAN BE NULL HERE !
5136 ****************************************************************************/
5137
5138 void reply_echo(struct smb_request *req)
5139 {
5140 connection_struct *conn = req->conn;
5141 struct smb_perfcount_data local_pcd;
5142 struct smb_perfcount_data *cur_pcd;
5143 int smb_reverb;
5144 int seq_num;
5145
5146 START_PROFILE(SMBecho);
5147
5148 smb_init_perfcount_data(&local_pcd);
5149
5150 if (req->wct < 1) {
5151 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5152 END_PROFILE(SMBecho);
5153 return;
5154 }
5155
5156 smb_reverb = SVAL(req->vwv+0, 0);
5157
5158 reply_outbuf(req, 1, req->buflen);
5159
5160 /* copy any incoming data back out */
5161 if (req->buflen > 0) {
5162 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5163 }
5164
5165 if (smb_reverb > 100) {
5166 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5167 smb_reverb = 100;
5168 }
5169
5170 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5171
5172 /* this makes sure we catch the request pcd */
5173 if (seq_num == smb_reverb) {
5174 cur_pcd = &req->pcd;
5175 } else {
5176 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5177 cur_pcd = &local_pcd;
5178 }
5179
5180 SSVAL(req->outbuf,smb_vwv0,seq_num);
5181
5182 show_msg((char *)req->outbuf);
5183 if (!srv_send_smb(req->sconn,
5184 (char *)req->outbuf,
5185 true, req->seqnum+1,
5186 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5187 cur_pcd))
5188 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5189 }
5190
5191 DEBUG(3,("echo %d times\n", smb_reverb));
5192
5193 TALLOC_FREE(req->outbuf);
5194
5195 END_PROFILE(SMBecho);
5196 return;
5197 }
5198
5199 /****************************************************************************
5200 Reply to a printopen.
5201 ****************************************************************************/
5202
5203 void reply_printopen(struct smb_request *req)
5204 {
5205 connection_struct *conn = req->conn;
5206 files_struct *fsp;
5207 NTSTATUS status;
5208
5209 START_PROFILE(SMBsplopen);
5210
5211 if (req->wct < 2) {
5212 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5213 END_PROFILE(SMBsplopen);
5214 return;
5215 }
5216
5217 if (!CAN_PRINT(conn)) {
5218 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5219 END_PROFILE(SMBsplopen);
5220 return;
5221 }
5222
5223 status = file_new(req, conn, &fsp);
5224 if(!NT_STATUS_IS_OK(status)) {
5225 reply_nterror(req, status);
5226 END_PROFILE(SMBsplopen);
5227 return;
5228 }
5229
5230 /* Open for exclusive use, write only. */
5231 status = print_spool_open(fsp, NULL, req->vuid);
5232
5233 if (!NT_STATUS_IS_OK(status)) {
5234 file_free(req, fsp);
5235 reply_nterror(req, status);
5236 END_PROFILE(SMBsplopen);
5237 return;
5238 }
5239
5240 reply_outbuf(req, 1, 0);
5241 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5242
5243 DEBUG(3,("openprint fd=%d fnum=%d\n",
5244 fsp->fh->fd, fsp->fnum));
5245
5246 END_PROFILE(SMBsplopen);
5247 return;
5248 }
5249
5250 /****************************************************************************
5251 Reply to a printclose.
5252 ****************************************************************************/
5253
5254 void reply_printclose(struct smb_request *req)
5255 {
5256 connection_struct *conn = req->conn;
5257 files_struct *fsp;
5258 NTSTATUS status;
5259
5260 START_PROFILE(SMBsplclose);
5261
5262 if (req->wct < 1) {
5263 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5264 END_PROFILE(SMBsplclose);
5265 return;
5266 }
5267
5268 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5269
5270 if (!check_fsp(conn, req, fsp)) {
5271 END_PROFILE(SMBsplclose);
5272 return;
5273 }
5274
5275 if (!CAN_PRINT(conn)) {
5276 reply_force_doserror(req, ERRSRV, ERRerror);
5277 END_PROFILE(SMBsplclose);
5278 return;
5279 }
5280
5281 DEBUG(3,("printclose fd=%d fnum=%d\n",
5282 fsp->fh->fd,fsp->fnum));
5283
5284 status = close_file(req, fsp, NORMAL_CLOSE);
5285
5286 if(!NT_STATUS_IS_OK(status)) {
5287 reply_nterror(req, status);
5288 END_PROFILE(SMBsplclose);
5289 return;
5290 }
5291
5292 reply_outbuf(req, 0, 0);
5293
5294 END_PROFILE(SMBsplclose);
5295 return;
5296 }
5297
5298 /****************************************************************************
5299 Reply to a printqueue.
5300 ****************************************************************************/
5301
5302 void reply_printqueue(struct smb_request *req)
5303 {
5304 connection_struct *conn = req->conn;
5305 int max_count;
5306 int start_index;
5307
5308 START_PROFILE(SMBsplretq);
5309
5310 if (req->wct < 2) {
5311 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5312 END_PROFILE(SMBsplretq);
5313 return;
5314 }
5315
5316 max_count = SVAL(req->vwv+0, 0);
5317 start_index = SVAL(req->vwv+1, 0);
5318
5319 /* we used to allow the client to get the cnum wrong, but that
5320 is really quite gross and only worked when there was only
5321 one printer - I think we should now only accept it if they
5322 get it right (tridge) */
5323 if (!CAN_PRINT(conn)) {
5324 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5325 END_PROFILE(SMBsplretq);
5326 return;
5327 }
5328
5329 reply_outbuf(req, 2, 3);
5330 SSVAL(req->outbuf,smb_vwv0,0);
5331 SSVAL(req->outbuf,smb_vwv1,0);
5332 SCVAL(smb_buf(req->outbuf),0,1);
5333 SSVAL(smb_buf(req->outbuf),1,0);
5334
5335 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5336 start_index, max_count));
5337
5338 {
5339 TALLOC_CTX *mem_ctx = talloc_tos();
5340 NTSTATUS status;
5341 WERROR werr;
5342 const char *sharename = lp_servicename(SNUM(conn));
5343 struct rpc_pipe_client *cli = NULL;
5344 struct dcerpc_binding_handle *b = NULL;
5345 struct policy_handle handle;
5346 struct spoolss_DevmodeContainer devmode_ctr;
5347 union spoolss_JobInfo *info;
5348 uint32_t count;
5349 uint32_t num_to_get;
5350 uint32_t first;
5351 uint32_t i;
5352
5353 ZERO_STRUCT(handle);
5354
5355 status = rpc_pipe_open_interface(conn,
5356 &ndr_table_spoolss.syntax_id,
5357 conn->session_info,
5358 &conn->sconn->client_id,
5359 conn->sconn->msg_ctx,
5360 &cli);
5361 if (!NT_STATUS_IS_OK(status)) {
5362 DEBUG(0, ("reply_printqueue: "
5363 "could not connect to spoolss: %s\n",
5364 nt_errstr(status)));
5365 reply_nterror(req, status);
5366 goto out;
5367 }
5368 b = cli->binding_handle;
5369
5370 ZERO_STRUCT(devmode_ctr);
5371
5372 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5373 sharename,
5374 NULL, devmode_ctr,
5375 SEC_FLAG_MAXIMUM_ALLOWED,
5376 &handle,
5377 &werr);
5378 if (!NT_STATUS_IS_OK(status)) {
5379 reply_nterror(req, status);
5380 goto out;
5381 }
5382 if (!W_ERROR_IS_OK(werr)) {
5383 reply_nterror(req, werror_to_ntstatus(werr));
5384 goto out;
5385 }
5386
5387 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5388 &handle,
5389 0, /* firstjob */
5390 0xff, /* numjobs */
5391 2, /* level */
5392 0, /* offered */
5393 &count,
5394 &info);
5395 if (!W_ERROR_IS_OK(werr)) {
5396 reply_nterror(req, werror_to_ntstatus(werr));
5397 goto out;
5398 }
5399
5400 if (max_count > 0) {
5401 first = start_index;
5402 } else {
5403 first = start_index + max_count + 1;
5404 }
5405
5406 if (first >= count) {
5407 num_to_get = first;
5408 } else {
5409 num_to_get = first + MIN(ABS(max_count), count - first);
5410 }
5411
5412 for (i = first; i < num_to_get; i++) {
5413 char blob[28];
5414 char *p = blob;
5415 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5416 int qstatus;
5417 uint16_t qrapjobid = pjobid_to_rap(sharename,
5418 info[i].info2.job_id);
5419
5420 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5421 qstatus = 2;
5422 } else {
5423 qstatus = 3;
5424 }
5425
5426 srv_put_dos_date2(p, 0, qtime);
5427 SCVAL(p, 4, qstatus);
5428 SSVAL(p, 5, qrapjobid);
5429 SIVAL(p, 7, info[i].info2.size);
5430 SCVAL(p, 11, 0);
5431 srvstr_push(blob, req->flags2, p+12,
5432 info[i].info2.notify_name, 16, STR_ASCII);
5433
5434 if (message_push_blob(
5435 &req->outbuf,
5436 data_blob_const(
5437 blob, sizeof(blob))) == -1) {
5438 reply_nterror(req, NT_STATUS_NO_MEMORY);
5439 goto out;
5440 }
5441 }
5442
5443 if (count > 0) {
5444 SSVAL(req->outbuf,smb_vwv0,count);
5445 SSVAL(req->outbuf,smb_vwv1,
5446 (max_count>0?first+count:first-1));
5447 SCVAL(smb_buf(req->outbuf),0,1);
5448 SSVAL(smb_buf(req->outbuf),1,28*count);
5449 }
5450
5451
5452 DEBUG(3, ("%u entries returned in queue\n",
5453 (unsigned)count));
5454
5455 out:
5456 if (b && is_valid_policy_hnd(&handle)) {
5457 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5458 }
5459
5460 }
5461
5462 END_PROFILE(SMBsplretq);
5463 return;
5464 }
5465
5466 /****************************************************************************
5467 Reply to a printwrite.
5468 ****************************************************************************/
5469
5470 void reply_printwrite(struct smb_request *req)
5471 {
5472 connection_struct *conn = req->conn;
5473 int numtowrite;
5474 const char *data;
5475 files_struct *fsp;
5476
5477 START_PROFILE(SMBsplwr);
5478
5479 if (req->wct < 1) {
5480 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5481 END_PROFILE(SMBsplwr);
5482 return;
5483 }
5484
5485 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5486
5487 if (!check_fsp(conn, req, fsp)) {
5488 END_PROFILE(SMBsplwr);
5489 return;
5490 }
5491
5492 if (!fsp->print_file) {
5493 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5494 END_PROFILE(SMBsplwr);
5495 return;
5496 }
5497
5498 if (!CHECK_WRITE(fsp)) {
5499 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5500 END_PROFILE(SMBsplwr);
5501 return;
5502 }
5503
5504 numtowrite = SVAL(req->buf, 1);
5505
5506 if (req->buflen < numtowrite + 3) {
5507 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5508 END_PROFILE(SMBsplwr);
5509 return;
5510 }
5511
5512 data = (const char *)req->buf + 3;
5513
5514 if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5515 reply_nterror(req, map_nt_error_from_unix(errno));
5516 END_PROFILE(SMBsplwr);
5517 return;
5518 }
5519
5520 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5521
5522 END_PROFILE(SMBsplwr);
5523 return;
5524 }
5525
5526 /****************************************************************************
5527 Reply to a mkdir.
5528 ****************************************************************************/
5529
5530 void reply_mkdir(struct smb_request *req)
5531 {
5532 connection_struct *conn = req->conn;
5533 struct smb_filename *smb_dname = NULL;
5534 char *directory = NULL;
5535 NTSTATUS status;
5536 TALLOC_CTX *ctx = talloc_tos();
5537
5538 START_PROFILE(SMBmkdir);
5539
5540 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5541 STR_TERMINATE, &status);
5542 if (!NT_STATUS_IS_OK(status)) {
5543 reply_nterror(req, status);
5544 goto out;
5545 }
5546
5547 status = filename_convert(ctx, conn,
5548 req->flags2 & FLAGS2_DFS_PATHNAMES,
5549 directory,
5550 0,
5551 NULL,
5552 &smb_dname);
5553 if (!NT_STATUS_IS_OK(status)) {
5554 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5555 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5556 ERRSRV, ERRbadpath);
5557 goto out;
5558 }
5559 reply_nterror(req, status);
5560 goto out;
5561 }
5562
5563 status = create_directory(conn, req, smb_dname);
5564
5565 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5566
5567 if (!NT_STATUS_IS_OK(status)) {
5568
5569 if (!use_nt_status()
5570 && NT_STATUS_EQUAL(status,
5571 NT_STATUS_OBJECT_NAME_COLLISION)) {
5572 /*
5573 * Yes, in the DOS error code case we get a
5574 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5575 * samba4 torture test.
5576 */
5577 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5578 }
5579
5580 reply_nterror(req, status);
5581 goto out;
5582 }
5583
5584 reply_outbuf(req, 0, 0);
5585
5586 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5587 out:
5588 TALLOC_FREE(smb_dname);
5589 END_PROFILE(SMBmkdir);
5590 return;
5591 }
5592
5593 /****************************************************************************
5594 Reply to a rmdir.
5595 ****************************************************************************/
5596
5597 void reply_rmdir(struct smb_request *req)
5598 {
5599 connection_struct *conn = req->conn;
5600 struct smb_filename *smb_dname = NULL;
5601 char *directory = NULL;
5602 NTSTATUS status;
5603 TALLOC_CTX *ctx = talloc_tos();
5604 files_struct *fsp = NULL;
5605 int info = 0;
5606 struct smbd_server_connection *sconn = req->sconn;
5607
5608 START_PROFILE(SMBrmdir);
5609
5610 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5611 STR_TERMINATE, &status);
5612 if (!NT_STATUS_IS_OK(status)) {
5613 reply_nterror(req, status);
5614 goto out;
5615 }
5616
5617 status = filename_convert(ctx, conn,
5618 req->flags2 & FLAGS2_DFS_PATHNAMES,
5619 directory,
5620 0,
5621 NULL,
5622 &smb_dname);
5623 if (!NT_STATUS_IS_OK(status)) {
5624 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5625 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5626 ERRSRV, ERRbadpath);
5627 goto out;
5628 }
5629 reply_nterror(req, status);
5630 goto out;
5631 }
5632
5633 if (is_ntfs_stream_smb_fname(smb_dname)) {
5634 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5635 goto out;
5636 }
5637
5638 status = SMB_VFS_CREATE_FILE(
5639 conn, /* conn */
5640 req, /* req */
5641 0, /* root_dir_fid */
5642 smb_dname, /* fname */
5643 DELETE_ACCESS, /* access_mask */
5644 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
5645 FILE_SHARE_DELETE),
5646 FILE_OPEN, /* create_disposition*/
5647 FILE_DIRECTORY_FILE, /* create_options */
5648 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5649 0, /* oplock_request */
5650 0, /* allocation_size */
5651 0, /* private_flags */
5652 NULL, /* sd */
5653 NULL, /* ea_list */
5654 &fsp, /* result */
5655 &info); /* pinfo */
5656
5657 if (!NT_STATUS_IS_OK(status)) {
5658 if (open_was_deferred(req->mid)) {
5659 /* We have re-scheduled this call. */
5660 goto out;
5661 }
5662 reply_nterror(req, status);
5663 goto out;
5664 }
5665
5666 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5667 if (!NT_STATUS_IS_OK(status)) {
5668 close_file(req, fsp, ERROR_CLOSE);
5669 reply_nterror(req, status);
5670 goto out;
5671 }
5672
5673 if (!set_delete_on_close(fsp, true, &conn->session_info->utok)) {
5674 close_file(req, fsp, ERROR_CLOSE);
5675 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5676 goto out;
5677 }
5678
5679 status = close_file(req, fsp, NORMAL_CLOSE);
5680 if (!NT_STATUS_IS_OK(status)) {
5681 reply_nterror(req, status);
5682 } else {
5683 reply_outbuf(req, 0, 0);
5684 }
5685
5686 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5687
5688 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5689 out:
5690 TALLOC_FREE(smb_dname);
5691 END_PROFILE(SMBrmdir);
5692 return;
5693 }
5694
5695 /*******************************************************************
5696 Resolve wildcards in a filename rename.
5697 ********************************************************************/
5698
5699 static bool resolve_wildcards(TALLOC_CTX *ctx,
5700 const char *name1,
5701 const char *name2,
5702 char **pp_newname)
5703 {
5704 char *name2_copy = NULL;
5705 char *root1 = NULL;
5706 char *root2 = NULL;
5707 char *ext1 = NULL;
5708 char *ext2 = NULL;
5709 char *p,*p2, *pname1, *pname2;
5710
5711 name2_copy = talloc_strdup(ctx, name2);
5712 if (!name2_copy) {
5713 return False;
5714 }
5715
5716 pname1 = strrchr_m(name1,'/');
5717 pname2 = strrchr_m(name2_copy,'/');
5718
5719 if (!pname1 || !pname2) {
5720 return False;
5721 }
5722
5723 /* Truncate the copy of name2 at the last '/' */
5724 *pname2 = '\0';
5725
5726 /* Now go past the '/' */
5727 pname1++;
5728 pname2++;
5729
5730 root1 = talloc_strdup(ctx, pname1);
5731 root2 = talloc_strdup(ctx, pname2);
5732
5733 if (!root1 || !root2) {
5734 return False;
5735 }
5736
5737 p = strrchr_m(root1,'.');
5738 if (p) {
5739 *p = 0;
5740 ext1 = talloc_strdup(ctx, p+1);
5741 } else {
5742 ext1 = talloc_strdup(ctx, "");
5743 }
5744 p = strrchr_m(root2,'.');
5745 if (p) {
5746 *p = 0;
5747 ext2 = talloc_strdup(ctx, p+1);
5748 } else {
5749 ext2 = talloc_strdup(ctx, "");
5750 }
5751
5752 if (!ext1 || !ext2) {
5753 return False;
5754 }
5755
5756 p = root1;
5757 p2 = root2;
5758 while (*p2) {
5759 if (*p2 == '?') {
5760 /* Hmmm. Should this be mb-aware ? */
5761 *p2 = *p;
5762 p2++;
5763 } else if (*p2 == '*') {
5764 *p2 = '\0';
5765 root2 = talloc_asprintf(ctx, "%s%s",
5766 root2,
5767 p);
5768 if (!root2) {
5769 return False;
5770 }
5771 break;
5772 } else {
5773 p2++;
5774 }
5775 if (*p) {
5776 p++;
5777 }
5778 }
5779
5780 p = ext1;
5781 p2 = ext2;
5782 while (*p2) {
5783 if (*p2 == '?') {
5784 /* Hmmm. Should this be mb-aware ? */
5785 *p2 = *p;
5786 p2++;
5787 } else if (*p2 == '*') {
5788 *p2 = '\0';
5789 ext2 = talloc_asprintf(ctx, "%s%s",
5790 ext2,
5791 p);
5792 if (!ext2) {
5793 return False;
5794 }
5795 break;
5796 } else {
5797 p2++;
5798 }
5799 if (*p) {
5800 p++;
5801 }
5802 }
5803
5804 if (*ext2) {
5805 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5806 name2_copy,
5807 root2,
5808 ext2);
5809 } else {
5810 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5811 name2_copy,
5812 root2);
5813 }
5814
5815 if (!*pp_newname) {
5816 return False;
5817 }
5818
5819 return True;
5820 }
5821
5822 /****************************************************************************
5823 Ensure open files have their names updated. Updated to notify other smbd's
5824 asynchronously.
5825 ****************************************************************************/
5826
5827 static void rename_open_files(connection_struct *conn,
5828 struct share_mode_lock *lck,
5829 uint32_t orig_name_hash,
5830 const struct smb_filename *smb_fname_dst)
5831 {
5832 files_struct *fsp;
5833 bool did_rename = False;
5834 NTSTATUS status;
5835 uint32_t new_name_hash = 0;
5836
5837 for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5838 fsp = file_find_di_next(fsp)) {
5839 /* fsp_name is a relative path under the fsp. To change this for other
5840 sharepaths we need to manipulate relative paths. */
5841 /* TODO - create the absolute path and manipulate the newname
5842 relative to the sharepath. */
5843 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5844 continue;
5845 }
5846 if (fsp->name_hash != orig_name_hash) {
5847 continue;
5848 }
5849 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5850 "(file_id %s) from %s -> %s\n", fsp->fnum,
5851 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5852 smb_fname_str_dbg(smb_fname_dst)));
5853
5854 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5855 if (NT_STATUS_IS_OK(status)) {
5856 did_rename = True;
5857 new_name_hash = fsp->name_hash;
5858 }
5859 }
5860
5861 if (!did_rename) {
5862 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5863 "for %s\n", file_id_string_tos(&lck->id),
5864 smb_fname_str_dbg(smb_fname_dst)));
5865 }
5866
5867 /* Send messages to all smbd's (not ourself) that the name has changed. */
5868 rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5869 orig_name_hash, new_name_hash,
5870 smb_fname_dst);
5871
5872 }
5873
5874 /****************************************************************************
5875 We need to check if the source path is a parent directory of the destination
5876 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5877 refuse the rename with a sharing violation. Under UNIX the above call can
5878 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5879 probably need to check that the client is a Windows one before disallowing
5880 this as a UNIX client (one with UNIX extensions) can know the source is a
5881 symlink and make this decision intelligently. Found by an excellent bug
5882 report from <AndyLiebman@aol.com>.
5883 ****************************************************************************/
5884
5885 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5886 const struct smb_filename *smb_fname_dst)
5887 {
5888 const char *psrc = smb_fname_src->base_name;
5889 const char *pdst = smb_fname_dst->base_name;
5890 size_t slen;
5891
5892 if (psrc[0] == '.' && psrc[1] == '/') {
5893 psrc += 2;
5894 }
5895 if (pdst[0] == '.' && pdst[1] == '/') {
5896 pdst += 2;
5897 }
5898 if ((slen = strlen(psrc)) > strlen(pdst)) {
5899 return False;
5900 }
5901 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5902 }
5903
5904 /*
5905 * Do the notify calls from a rename
5906 */
5907
5908 static void notify_rename(connection_struct *conn, bool is_dir,
5909 const struct smb_filename *smb_fname_src,
5910 const struct smb_filename *smb_fname_dst)
5911 {
5912 char *parent_dir_src = NULL;
5913 char *parent_dir_dst = NULL;
5914 uint32 mask;
5915
5916 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5917 : FILE_NOTIFY_CHANGE_FILE_NAME;
5918
5919 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5920 &parent_dir_src, NULL) ||
5921 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5922 &parent_dir_dst, NULL)) {
5923 goto out;
5924 }
5925
5926 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5927 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5928 smb_fname_src->base_name);
5929 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5930 smb_fname_dst->base_name);
5931 }
5932 else {
5933 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5934 smb_fname_src->base_name);
5935 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5936 smb_fname_dst->base_name);
5937 }
5938
5939 /* this is a strange one. w2k3 gives an additional event for
5940 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5941 files, but not directories */
5942 if (!is_dir) {
5943 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5944 FILE_NOTIFY_CHANGE_ATTRIBUTES
5945 |FILE_NOTIFY_CHANGE_CREATION,
5946 smb_fname_dst->base_name);
5947 }
5948 out:
5949 TALLOC_FREE(parent_dir_src);
5950 TALLOC_FREE(parent_dir_dst);
5951 }
5952
5953 /****************************************************************************
5954 Rename an open file - given an fsp.
5955 ****************************************************************************/
5956
5957 NTSTATUS rename_internals_fsp(connection_struct *conn,
5958 files_struct *fsp,
5959 const struct smb_filename *smb_fname_dst_in,
5960 uint32 attrs,
5961 bool replace_if_exists)
5962 {
5963 TALLOC_CTX *ctx = talloc_tos();
5964 struct smb_filename *smb_fname_dst = NULL;
5965 NTSTATUS status = NT_STATUS_OK;
5966 struct share_mode_lock *lck = NULL;
5967 bool dst_exists, old_is_stream, new_is_stream;
5968
5969 status = check_name(conn, smb_fname_dst_in->base_name);
5970 if (!NT_STATUS_IS_OK(status)) {
5971 return status;
5972 }
5973
5974 /* Make a copy of the dst smb_fname structs */
5975
5976 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5977 if (!NT_STATUS_IS_OK(status)) {
5978 goto out;
5979 }
5980
5981 /*
5982 * Check for special case with case preserving and not
5983 * case sensitive. If the old last component differs from the original
5984 * last component only by case, then we should allow
5985 * the rename (user is trying to change the case of the
5986 * filename).
5987 */
5988 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5989 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5990 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5991 char *last_slash;
5992 char *fname_dst_lcomp_base_mod = NULL;
5993 struct smb_filename *smb_fname_orig_lcomp = NULL;
5994
5995 /*
5996 * Get the last component of the destination name.
5997 */
5998 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5999 if (last_slash) {
6000 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6001 } else {
6002 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6003 }
6004 if (!fname_dst_lcomp_base_mod) {
6005 status = NT_STATUS_NO_MEMORY;
6006 goto out;
6007 }
6008
6009 /*
6010 * Create an smb_filename struct using the original last
6011 * component of the destination.
6012 */
6013 status = create_synthetic_smb_fname_split(ctx,
6014 smb_fname_dst->original_lcomp, NULL,
6015 &smb_fname_orig_lcomp);
6016 if (!NT_STATUS_IS_OK(status)) {
6017 TALLOC_FREE(fname_dst_lcomp_base_mod);
6018 goto out;
6019 }
6020
6021 /* If the base names only differ by case, use original. */
6022 if(!strcsequal(fname_dst_lcomp_base_mod,
6023 smb_fname_orig_lcomp->base_name)) {
6024 char *tmp;
6025 /*
6026 * Replace the modified last component with the
6027 * original.
6028 */
6029 if (last_slash) {
6030 *last_slash = '\0'; /* Truncate at the '/' */
6031 tmp = talloc_asprintf(smb_fname_dst,
6032 "%s/%s",
6033 smb_fname_dst->base_name,
6034 smb_fname_orig_lcomp->base_name);
6035 } else {
6036 tmp = talloc_asprintf(smb_fname_dst,
6037 "%s",
6038 smb_fname_orig_lcomp->base_name);
6039 }
6040 if (tmp == NULL) {
6041 status = NT_STATUS_NO_MEMORY;
6042 TALLOC_FREE(fname_dst_lcomp_base_mod);
6043 TALLOC_FREE(smb_fname_orig_lcomp);
6044 goto out;
6045 }
6046 TALLOC_FREE(smb_fname_dst->base_name);
6047 smb_fname_dst->base_name = tmp;
6048 }
6049
6050 /* If the stream_names only differ by case, use original. */
6051 if(!strcsequal(smb_fname_dst->stream_name,
6052 smb_fname_orig_lcomp->stream_name)) {
6053 char *tmp = NULL;
6054 /* Use the original stream. */
6055 tmp = talloc_strdup(smb_fname_dst,
6056 smb_fname_orig_lcomp->stream_name);
6057 if (tmp == NULL) {
6058 status = NT_STATUS_NO_MEMORY;
6059 TALLOC_FREE(fname_dst_lcomp_base_mod);
6060 TALLOC_FREE(smb_fname_orig_lcomp);
6061 goto out;
6062 }
6063 TALLOC_FREE(smb_fname_dst->stream_name);
6064 smb_fname_dst->stream_name = tmp;
6065 }
6066 TALLOC_FREE(fname_dst_lcomp_base_mod);
6067 TALLOC_FREE(smb_fname_orig_lcomp);
6068 }
6069
6070 /*
6071 * If the src and dest names are identical - including case,
6072 * don't do the rename, just return success.
6073 */
6074
6075 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6076 strcsequal(fsp->fsp_name->stream_name,
6077 smb_fname_dst->stream_name)) {
6078 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6079 "- returning success\n",
6080 smb_fname_str_dbg(smb_fname_dst)));
6081 status = NT_STATUS_OK;
6082 goto out;
6083 }
6084
6085 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6086 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6087
6088 /* Return the correct error code if both names aren't streams. */
6089 if (!old_is_stream && new_is_stream) {
6090 status = NT_STATUS_OBJECT_NAME_INVALID;
6091 goto out;
6092 }
6093
6094 if (old_is_stream && !new_is_stream) {
6095 status = NT_STATUS_INVALID_PARAMETER;
6096 goto out;
6097 }
6098
6099 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6100
6101 if(!replace_if_exists && dst_exists) {
6102 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6103 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6104 smb_fname_str_dbg(smb_fname_dst)));
6105 status = NT_STATUS_OBJECT_NAME_COLLISION;
6106 goto out;
6107 }
6108
6109 if (dst_exists) {
6110 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6111 &smb_fname_dst->st);
6112 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6113 fileid);
6114 /* The file can be open when renaming a stream */
6115 if (dst_fsp && !new_is_stream) {
6116 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6117 status = NT_STATUS_ACCESS_DENIED;
6118 goto out;
6119 }
6120 }
6121
6122 /* Ensure we have a valid stat struct for the source. */
6123 status = vfs_stat_fsp(fsp);
6124 if (!NT_STATUS_IS_OK(status)) {
6125 goto out;
6126 }
6127
6128 status = can_rename(conn, fsp, attrs);
6129
6130 if (!NT_STATUS_IS_OK(status)) {
6131 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6132 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6133 smb_fname_str_dbg(smb_fname_dst)));
6134 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6135 status = NT_STATUS_ACCESS_DENIED;
6136 goto out;
6137 }
6138
6139 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6140 status = NT_STATUS_ACCESS_DENIED;
6141 }
6142
6143 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6144 NULL);
6145
6146 /*
6147 * We have the file open ourselves, so not being able to get the
6148 * corresponding share mode lock is a fatal error.
6149 */
6150
6151 SMB_ASSERT(lck != NULL);
6152
6153 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6154 uint32 create_options = fsp->fh->private_options;
6155
6156 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6157 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6158 smb_fname_str_dbg(smb_fname_dst)));
6159
6160 if (!lp_posix_pathnames() &&
6161 (lp_map_archive(SNUM(conn)) ||
6162 lp_store_dos_attributes(SNUM(conn)))) {
6163 /* We must set the archive bit on the newly
6164 renamed file. */
6165 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6166 uint32_t old_dosmode = dos_mode(conn,
6167 smb_fname_dst);
6168 file_set_dosmode(conn,
6169 smb_fname_dst,
6170 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6171 NULL,
6172 true);
6173 }
6174 }
6175
6176 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6177 smb_fname_dst);
6178
6179 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6180
6181 /*
6182 * A rename acts as a new file create w.r.t. allowing an initial delete
6183 * on close, probably because in Windows there is a new handle to the
6184 * new file. If initial delete on close was requested but not
6185 * originally set, we need to set it here. This is probably not 100% correct,
6186 * but will work for the CIFSFS client which in non-posix mode
6187 * depends on these semantics. JRA.
6188 */
6189
6190 if (create_options & FILE_DELETE_ON_CLOSE) {
6191 status = can_set_delete_on_close(fsp, 0);
6192
6193 if (NT_STATUS_IS_OK(status)) {
6194 /* Note that here we set the *inital* delete on close flag,
6195 * not the regular one. The magic gets handled in close. */
6196 fsp->initial_delete_on_close = True;
6197 }
6198 }
6199 TALLOC_FREE(lck);
6200 status = NT_STATUS_OK;
6201 goto out;
6202 }
6203
6204 TALLOC_FREE(lck);
6205
6206 if (errno == ENOTDIR || errno == EISDIR) {
6207 status = NT_STATUS_OBJECT_NAME_COLLISION;
6208 } else {
6209 status = map_nt_error_from_unix(errno);
6210 }
6211
6212 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6213 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6214 smb_fname_str_dbg(smb_fname_dst)));
6215
6216 out:
6217 TALLOC_FREE(smb_fname_dst);
6218
6219 return status;
6220 }
6221
6222 /****************************************************************************
6223 The guts of the rename command, split out so it may be called by the NT SMB
6224 code.
6225 ****************************************************************************/
6226
6227 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6228 connection_struct *conn,
6229 struct smb_request *req,
6230 struct smb_filename *smb_fname_src,
6231 struct smb_filename *smb_fname_dst,
6232 uint32 attrs,
6233 bool replace_if_exists,
6234 bool src_has_wild,
6235 bool dest_has_wild,
6236 uint32_t access_mask)
6237 {
6238 char *fname_src_dir = NULL;
6239 char *fname_src_mask = NULL;
6240 int count=0;
6241 NTSTATUS status = NT_STATUS_OK;
6242 struct smb_Dir *dir_hnd = NULL;
6243 const char *dname = NULL;
6244 char *talloced = NULL;
6245 long offset = 0;
6246 int create_options = 0;
6247 bool posix_pathnames = lp_posix_pathnames();
6248
6249 /*
6250 * Split the old name into directory and last component
6251 * strings. Note that unix_convert may have stripped off a
6252 * leading ./ from both name and newname if the rename is
6253 * at the root of the share. We need to make sure either both
6254 * name and newname contain a / character or neither of them do
6255 * as this is checked in resolve_wildcards().
6256 */
6257
6258 /* Split up the directory from the filename/mask. */
6259 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6260 &fname_src_dir, &fname_src_mask);
6261 if (!NT_STATUS_IS_OK(status)) {
6262 status = NT_STATUS_NO_MEMORY;
6263 goto out;
6264 }
6265
6266 /*
6267 * We should only check the mangled cache
6268 * here if unix_convert failed. This means
6269 * that the path in 'mask' doesn't exist
6270 * on the file system and so we need to look
6271 * for a possible mangle. This patch from
6272 * Tine Smukavec <valentin.smukavec@hermes.si>.
6273 */
6274
6275 if (!VALID_STAT(smb_fname_src->st) &&
6276 mangle_is_mangled(fname_src_mask, conn->params)) {
6277 char *new_mask = NULL;
6278 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6279 conn->params);
6280 if (new_mask) {
6281 TALLOC_FREE(fname_src_mask);
6282 fname_src_mask = new_mask;
6283 }
6284 }
6285
6286 if (!src_has_wild) {
6287 files_struct *fsp;
6288
6289 /*
6290 * Only one file needs to be renamed. Append the mask back
6291 * onto the directory.
6292 */
6293 TALLOC_FREE(smb_fname_src->base_name);
6294 if (ISDOT(fname_src_dir)) {
6295 /* Ensure we use canonical names on open. */
6296 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6297 "%s",
6298 fname_src_mask);
6299 } else {
6300 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6301 "%s/%s",
6302 fname_src_dir,
6303 fname_src_mask);
6304 }
6305 if (!smb_fname_src->base_name) {
6306 status = NT_STATUS_NO_MEMORY;
6307 goto out;
6308 }
6309
6310 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6311 "case_preserve = %d, short case preserve = %d, "
6312 "directory = %s, newname = %s, "
6313 "last_component_dest = %s\n",
6314 conn->case_sensitive, conn->case_preserve,
6315 conn->short_case_preserve,
6316 smb_fname_str_dbg(smb_fname_src),
6317 smb_fname_str_dbg(smb_fname_dst),
6318 smb_fname_dst->original_lcomp));
6319
6320 /* The dest name still may have wildcards. */
6321 if (dest_has_wild) {
6322 char *fname_dst_mod = NULL;
6323 if (!resolve_wildcards(smb_fname_dst,
6324 smb_fname_src->base_name,
6325 smb_fname_dst->base_name,
6326 &fname_dst_mod)) {
6327 DEBUG(6, ("rename_internals: resolve_wildcards "
6328 "%s %s failed\n",
6329 smb_fname_src->base_name,
6330 smb_fname_dst->base_name));
6331 status = NT_STATUS_NO_MEMORY;
6332 goto out;
6333 }
6334 TALLOC_FREE(smb_fname_dst->base_name);
6335 smb_fname_dst->base_name = fname_dst_mod;
6336 }
6337
6338 ZERO_STRUCT(smb_fname_src->st);
6339 if (posix_pathnames) {
6340 SMB_VFS_LSTAT(conn, smb_fname_src);
6341 } else {
6342 SMB_VFS_STAT(conn, smb_fname_src);
6343 }
6344
6345 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6346 create_options |= FILE_DIRECTORY_FILE;
6347 }
6348
6349 status = SMB_VFS_CREATE_FILE(
6350 conn, /* conn */
6351 req, /* req */
6352 0, /* root_dir_fid */
6353 smb_fname_src, /* fname */
6354 access_mask, /* access_mask */
6355 (FILE_SHARE_READ | /* share_access */
6356 FILE_SHARE_WRITE),
6357 FILE_OPEN, /* create_disposition*/
6358 create_options, /* create_options */
6359 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6360 0, /* oplock_request */
6361 0, /* allocation_size */
6362 0, /* private_flags */
6363 NULL, /* sd */
6364 NULL, /* ea_list */
6365 &fsp, /* result */
6366 NULL); /* pinfo */
6367
6368 if (!NT_STATUS_IS_OK(status)) {
6369 DEBUG(3, ("Could not open rename source %s: %s\n",
6370 smb_fname_str_dbg(smb_fname_src),
6371 nt_errstr(status)));
6372 goto out;
6373 }
6374
6375 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6376 attrs, replace_if_exists);
6377
6378 close_file(req, fsp, NORMAL_CLOSE);
6379
6380 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6381 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6382 smb_fname_str_dbg(smb_fname_dst)));
6383
6384 goto out;
6385 }
6386
6387 /*
6388 * Wildcards - process each file that matches.
6389 */
6390 if (strequal(fname_src_mask, "????????.???")) {
6391 TALLOC_FREE(fname_src_mask);
6392 fname_src_mask = talloc_strdup(ctx, "*");
6393 if (!fname_src_mask) {
6394 status = NT_STATUS_NO_MEMORY;
6395 goto out;
6396 }
6397 }
6398
6399 status = check_name(conn, fname_src_dir);
6400 if (!NT_STATUS_IS_OK(status)) {
6401 goto out;
6402 }
6403
6404 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6405 attrs);
6406 if (dir_hnd == NULL) {
6407 status = map_nt_error_from_unix(errno);
6408 goto out;
6409 }
6410
6411 status = NT_STATUS_NO_SUCH_FILE;
6412 /*
6413 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6414 * - gentest fix. JRA
6415 */
6416
6417 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6418 &talloced))) {
6419 files_struct *fsp = NULL;
6420 char *destname = NULL;
6421 bool sysdir_entry = False;
6422
6423 /* Quick check for "." and ".." */
6424 if (ISDOT(dname) || ISDOTDOT(dname)) {
6425 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6426 sysdir_entry = True;
6427 } else {
6428 TALLOC_FREE(talloced);
6429 continue;
6430 }
6431 }
6432
6433 if (!is_visible_file(conn, fname_src_dir, dname,
6434 &smb_fname_src->st, false)) {
6435 TALLOC_FREE(talloced);
6436 continue;
6437 }
6438
6439 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6440 TALLOC_FREE(talloced);
6441 continue;
6442 }
6443
6444 if (sysdir_entry) {
6445 status = NT_STATUS_OBJECT_NAME_INVALID;
6446 break;
6447 }
6448
6449 TALLOC_FREE(smb_fname_src->base_name);
6450 if (ISDOT(fname_src_dir)) {
6451 /* Ensure we use canonical names on open. */
6452 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6453 "%s",
6454 dname);
6455 } else {
6456 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6457 "%s/%s",
6458 fname_src_dir,
6459 dname);
6460 }
6461 if (!smb_fname_src->base_name) {
6462 status = NT_STATUS_NO_MEMORY;
6463 goto out;
6464 }
6465
6466 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6467 smb_fname_dst->base_name,
6468 &destname)) {
6469 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6470 smb_fname_src->base_name, destname));
6471 TALLOC_FREE(talloced);
6472 continue;
6473 }
6474 if (!destname) {
6475 status = NT_STATUS_NO_MEMORY;
6476 goto out;
6477 }
6478
6479 TALLOC_FREE(smb_fname_dst->base_name);
6480 smb_fname_dst->base_name = destname;
6481
6482 ZERO_STRUCT(smb_fname_src->st);
6483 if (posix_pathnames) {
6484 SMB_VFS_LSTAT(conn, smb_fname_src);
6485 } else {
6486 SMB_VFS_STAT(conn, smb_fname_src);
6487 }
6488
6489 create_options = 0;
6490
6491 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6492 create_options |= FILE_DIRECTORY_FILE;
6493 }
6494
6495 status = SMB_VFS_CREATE_FILE(
6496 conn, /* conn */
6497 req, /* req */
6498 0, /* root_dir_fid */
6499 smb_fname_src, /* fname */
6500 access_mask, /* access_mask */
6501 (FILE_SHARE_READ | /* share_access */
6502 FILE_SHARE_WRITE),
6503 FILE_OPEN, /* create_disposition*/
6504 create_options, /* create_options */
6505 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6506 0, /* oplock_request */
6507 0, /* allocation_size */
6508 0, /* private_flags */
6509 NULL, /* sd */
6510 NULL, /* ea_list */
6511 &fsp, /* result */
6512 NULL); /* pinfo */
6513
6514 if (!NT_STATUS_IS_OK(status)) {
6515 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6516 "returned %s rename %s -> %s\n",
6517 nt_errstr(status),
6518 smb_fname_str_dbg(smb_fname_src),
6519 smb_fname_str_dbg(smb_fname_dst)));
6520 break;
6521 }
6522
6523 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6524 dname);
6525 if (!smb_fname_dst->original_lcomp) {
6526 status = NT_STATUS_NO_MEMORY;
6527 goto out;
6528 }
6529
6530 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6531 attrs, replace_if_exists);
6532
6533 close_file(req, fsp, NORMAL_CLOSE);
6534
6535 if (!NT_STATUS_IS_OK(status)) {
6536 DEBUG(3, ("rename_internals_fsp returned %s for "
6537 "rename %s -> %s\n", nt_errstr(status),
6538 smb_fname_str_dbg(smb_fname_src),
6539 smb_fname_str_dbg(smb_fname_dst)));
6540 break;
6541 }
6542
6543 count++;
6544
6545 DEBUG(3,("rename_internals: doing rename on %s -> "
6546 "%s\n", smb_fname_str_dbg(smb_fname_src),
6547 smb_fname_str_dbg(smb_fname_src)));
6548 TALLOC_FREE(talloced);
6549 }
6550 TALLOC_FREE(dir_hnd);
6551
6552 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6553 status = map_nt_error_from_unix(errno);
6554 }
6555
6556 out:
6557 TALLOC_FREE(talloced);
6558 TALLOC_FREE(fname_src_dir);
6559 TALLOC_FREE(fname_src_mask);
6560 return status;
6561 }
6562
6563 /****************************************************************************
6564 Reply to a mv.
6565 ****************************************************************************/
6566
6567 void reply_mv(struct smb_request *req)
6568 {
6569 connection_struct *conn = req->conn;
6570 char *name = NULL;
6571 char *newname = NULL;
6572 const char *p;
6573 uint32 attrs;
6574 NTSTATUS status;
6575 bool src_has_wcard = False;
6576 bool dest_has_wcard = False;
6577 TALLOC_CTX *ctx = talloc_tos();
6578 struct smb_filename *smb_fname_src = NULL;
6579 struct smb_filename *smb_fname_dst = NULL;
6580 bool stream_rename = false;
6581
6582 START_PROFILE(SMBmv);
6583
6584 if (req->wct < 1) {
6585 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6586 goto out;
6587 }
6588
6589 attrs = SVAL(req->vwv+0, 0);
6590
6591 p = (const char *)req->buf + 1;
6592 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6593 &status, &src_has_wcard);
6594 if (!NT_STATUS_IS_OK(status)) {
6595 reply_nterror(req, status);
6596 goto out;
6597 }
6598 p++;
6599 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6600 &status, &dest_has_wcard);
6601 if (!NT_STATUS_IS_OK(status)) {
6602 reply_nterror(req, status);
6603 goto out;
6604 }
6605
6606 if (!lp_posix_pathnames()) {
6607 /* The newname must begin with a ':' if the
6608 name contains a ':'. */
6609 if (strchr_m(name, ':')) {
6610 if (newname[0] != ':') {
6611 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6612 goto out;
6613 }
6614 stream_rename = true;
6615 }
6616 }
6617
6618 status = filename_convert(ctx,
6619 conn,
6620 req->flags2 & FLAGS2_DFS_PATHNAMES,
6621 name,
6622 UCF_COND_ALLOW_WCARD_LCOMP,
6623 &src_has_wcard,
6624 &smb_fname_src);
6625
6626 if (!NT_STATUS_IS_OK(status)) {
6627 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6628 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6629 ERRSRV, ERRbadpath);
6630 goto out;
6631 }
6632 reply_nterror(req, status);
6633 goto out;
6634 }
6635
6636 status = filename_convert(ctx,
6637 conn,
6638 req->flags2 & FLAGS2_DFS_PATHNAMES,
6639 newname,
6640 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6641 &dest_has_wcard,
6642 &smb_fname_dst);
6643
6644 if (!NT_STATUS_IS_OK(status)) {
6645 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6646 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6647 ERRSRV, ERRbadpath);
6648 goto out;
6649 }
6650 reply_nterror(req, status);
6651 goto out;
6652 }
6653
6654 if (stream_rename) {
6655 /* smb_fname_dst->base_name must be the same as
6656 smb_fname_src->base_name. */
6657 TALLOC_FREE(smb_fname_dst->base_name);
6658 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6659 smb_fname_src->base_name);
6660 if (!smb_fname_dst->base_name) {
6661 reply_nterror(req, NT_STATUS_NO_MEMORY);
6662 goto out;
6663 }
6664 }
6665
6666 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6667 smb_fname_str_dbg(smb_fname_dst)));
6668
6669 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6670 attrs, False, src_has_wcard, dest_has_wcard,
6671 DELETE_ACCESS);
6672 if (!NT_STATUS_IS_OK(status)) {
6673 if (open_was_deferred(req->mid)) {
6674 /* We have re-scheduled this call. */
6675 goto out;
6676 }
6677 reply_nterror(req, status);
6678 goto out;
6679 }
6680
6681 reply_outbuf(req, 0, 0);
6682 out:
6683 TALLOC_FREE(smb_fname_src);
6684 TALLOC_FREE(smb_fname_dst);
6685 END_PROFILE(SMBmv);
6686 return;
6687 }
6688
6689 /*******************************************************************
6690 Copy a file as part of a reply_copy.
6691 ******************************************************************/
6692
6693 /*
6694 * TODO: check error codes on all callers
6695 */
6696
6697 NTSTATUS copy_file(TALLOC_CTX *ctx,
6698 connection_struct *conn,
6699 struct smb_filename *smb_fname_src,
6700 struct smb_filename *smb_fname_dst,
6701 int ofun,
6702 int count,
6703 bool target_is_directory)
6704 {
6705 struct smb_filename *smb_fname_dst_tmp = NULL;
6706 SMB_OFF_T ret=-1;
6707 files_struct *fsp1,*fsp2;
6708 uint32 dosattrs;
6709 uint32 new_create_disposition;
6710 NTSTATUS status;
6711
6712
6713 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6714 if (!NT_STATUS_IS_OK(status)) {
6715 return status;
6716 }
6717
6718 /*
6719 * If the target is a directory, extract the last component from the
6720 * src filename and append it to the dst filename
6721 */
6722 if (target_is_directory) {
6723 const char *p;
6724
6725 /* dest/target can't be a stream if it's a directory. */
6726 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6727
6728 p = strrchr_m(smb_fname_src->base_name,'/');
6729 if (p) {
6730 p++;
6731 } else {
6732 p = smb_fname_src->base_name;
6733 }
6734 smb_fname_dst_tmp->base_name =
6735 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6736 p);
6737 if (!smb_fname_dst_tmp->base_name) {
6738 status = NT_STATUS_NO_MEMORY;
6739 goto out;
6740 }
6741 }
6742
6743 status = vfs_file_exist(conn, smb_fname_src);
6744 if (!NT_STATUS_IS_OK(status)) {
6745 goto out;
6746 }
6747
6748 if (!target_is_directory && count) {
6749 new_create_disposition = FILE_OPEN;
6750 } else {
6751 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6752 NULL, NULL,
6753 &new_create_disposition,
6754 NULL,
6755 NULL)) {
6756 status = NT_STATUS_INVALID_PARAMETER;
6757 goto out;
6758 }
6759 }
6760
6761 /* Open the src file for reading. */
6762 status = SMB_VFS_CREATE_FILE(
6763 conn, /* conn */
6764 NULL, /* req */
6765 0, /* root_dir_fid */
6766 smb_fname_src, /* fname */
6767 FILE_GENERIC_READ, /* access_mask */
6768 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6769 FILE_OPEN, /* create_disposition*/
6770 0, /* create_options */
6771 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6772 INTERNAL_OPEN_ONLY, /* oplock_request */
6773 0, /* allocation_size */
6774 0, /* private_flags */
6775 NULL, /* sd */
6776 NULL, /* ea_list */
6777 &fsp1, /* result */
6778 NULL); /* psbuf */
6779
6780 if (!NT_STATUS_IS_OK(status)) {
6781 goto out;
6782 }
6783
6784 dosattrs = dos_mode(conn, smb_fname_src);
6785
6786 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6787 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6788 }
6789
6790 /* Open the dst file for writing. */
6791 status = SMB_VFS_CREATE_FILE(
6792 conn, /* conn */
6793 NULL, /* req */
6794 0, /* root_dir_fid */
6795 smb_fname_dst, /* fname */
6796 FILE_GENERIC_WRITE, /* access_mask */
6797 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6798 new_create_disposition, /* create_disposition*/
6799 0, /* create_options */
6800 dosattrs, /* file_attributes */
6801 INTERNAL_OPEN_ONLY, /* oplock_request */
6802 0, /* allocation_size */
6803 0, /* private_flags */
6804 NULL, /* sd */
6805 NULL, /* ea_list */
6806 &fsp2, /* result */
6807 NULL); /* psbuf */
6808
6809 if (!NT_STATUS_IS_OK(status)) {
6810 close_file(NULL, fsp1, ERROR_CLOSE);
6811 goto out;
6812 }
6813
6814 if (ofun & OPENX_FILE_EXISTS_OPEN) {
6815 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6816 if (ret == -1) {
6817 DEBUG(0, ("error - vfs lseek returned error %s\n",
6818 strerror(errno)));
6819 status = map_nt_error_from_unix(errno);
6820 close_file(NULL, fsp1, ERROR_CLOSE);
6821 close_file(NULL, fsp2, ERROR_CLOSE);
6822 goto out;
6823 }
6824 }
6825
6826 /* Do the actual copy. */
6827 if (smb_fname_src->st.st_ex_size) {
6828 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6829 } else {
6830 ret = 0;
6831 }
6832
6833 close_file(NULL, fsp1, NORMAL_CLOSE);
6834
6835 /* Ensure the modtime is set correctly on the destination file. */
6836 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6837
6838 /*
6839 * As we are opening fsp1 read-only we only expect
6840 * an error on close on fsp2 if we are out of space.
6841 * Thus we don't look at the error return from the
6842 * close of fsp1.
6843 */
6844 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6845
6846 if (!NT_STATUS_IS_OK(status)) {
6847 goto out;
6848 }
6849
6850 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6851 status = NT_STATUS_DISK_FULL;
6852 goto out;
6853 }
6854
6855 status = NT_STATUS_OK;
6856
6857 out:
6858 TALLOC_FREE(smb_fname_dst_tmp);
6859 return status;
6860 }
6861
6862 /****************************************************************************
6863 Reply to a file copy.
6864 ****************************************************************************/
6865
6866 void reply_copy(struct smb_request *req)
6867 {
6868 connection_struct *conn = req->conn;
6869 struct smb_filename *smb_fname_src = NULL;
6870 struct smb_filename *smb_fname_dst = NULL;
6871 char *fname_src = NULL;
6872 char *fname_dst = NULL;
6873 char *fname_src_mask = NULL;
6874 char *fname_src_dir = NULL;
6875 const char *p;
6876 int count=0;
6877 int error = ERRnoaccess;
6878 int tid2;
6879 int ofun;
6880 int flags;
6881 bool target_is_directory=False;
6882 bool source_has_wild = False;
6883 bool dest_has_wild = False;
6884 NTSTATUS status;
6885 TALLOC_CTX *ctx = talloc_tos();
6886
6887 START_PROFILE(SMBcopy);
6888
6889 if (req->wct < 3) {
6890 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6891 goto out;
6892 }
6893
6894 tid2 = SVAL(req->vwv+0, 0);
6895 ofun = SVAL(req->vwv+1, 0);
6896 flags = SVAL(req->vwv+2, 0);
6897
6898 p = (const char *)req->buf;
6899 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6900 &status, &source_has_wild);
6901 if (!NT_STATUS_IS_OK(status)) {
6902 reply_nterror(req, status);
6903 goto out;
6904 }
6905 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6906 &status, &dest_has_wild);
6907 if (!NT_STATUS_IS_OK(status)) {
6908 reply_nterror(req, status);
6909 goto out;
6910 }
6911
6912 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6913
6914 if (tid2 != conn->cnum) {
6915 /* can't currently handle inter share copies XXXX */
6916 DEBUG(3,("Rejecting inter-share copy\n"));
6917 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6918 goto out;
6919 }
6920
6921 status = filename_convert(ctx, conn,
6922 req->flags2 & FLAGS2_DFS_PATHNAMES,
6923 fname_src,
6924 UCF_COND_ALLOW_WCARD_LCOMP,
6925 &source_has_wild,
6926 &smb_fname_src);
6927 if (!NT_STATUS_IS_OK(status)) {
6928 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6929 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6930 ERRSRV, ERRbadpath);
6931 goto out;
6932 }
6933 reply_nterror(req, status);
6934 goto out;
6935 }
6936
6937 status = filename_convert(ctx, conn,
6938 req->flags2 & FLAGS2_DFS_PATHNAMES,
6939 fname_dst,
6940 UCF_COND_ALLOW_WCARD_LCOMP,
6941 &dest_has_wild,
6942 &smb_fname_dst);
6943 if (!NT_STATUS_IS_OK(status)) {
6944 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6945 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6946 ERRSRV, ERRbadpath);
6947 goto out;
6948 }
6949 reply_nterror(req, status);
6950 goto out;
6951 }
6952
6953 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6954
6955 if ((flags&1) && target_is_directory) {
6956 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6957 goto out;
6958 }
6959
6960 if ((flags&2) && !target_is_directory) {
6961 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6962 goto out;
6963 }
6964
6965 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6966 /* wants a tree copy! XXXX */
6967 DEBUG(3,("Rejecting tree copy\n"));
6968 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6969 goto out;
6970 }
6971
6972 /* Split up the directory from the filename/mask. */
6973 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6974 &fname_src_dir, &fname_src_mask);
6975 if (!NT_STATUS_IS_OK(status)) {
6976 reply_nterror(req, NT_STATUS_NO_MEMORY);
6977 goto out;
6978 }
6979
6980 /*
6981 * We should only check the mangled cache
6982 * here if unix_convert failed. This means
6983 * that the path in 'mask' doesn't exist
6984 * on the file system and so we need to look
6985 * for a possible mangle. This patch from
6986 * Tine Smukavec <valentin.smukavec@hermes.si>.
6987 */
6988 if (!VALID_STAT(smb_fname_src->st) &&
6989 mangle_is_mangled(fname_src_mask, conn->params)) {
6990 char *new_mask = NULL;
6991 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6992 &new_mask, conn->params);
6993
6994 /* Use demangled name if one was successfully found. */
6995 if (new_mask) {
6996 TALLOC_FREE(fname_src_mask);
6997 fname_src_mask = new_mask;
6998 }
6999 }
7000
7001 if (!source_has_wild) {
7002
7003 /*
7004 * Only one file needs to be copied. Append the mask back onto
7005 * the directory.
7006 */
7007 TALLOC_FREE(smb_fname_src->base_name);
7008 if (ISDOT(fname_src_dir)) {
7009 /* Ensure we use canonical names on open. */
7010 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7011 "%s",
7012 fname_src_mask);
7013 } else {
7014 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7015 "%s/%s",
7016 fname_src_dir,
7017 fname_src_mask);
7018 }
7019 if (!smb_fname_src->base_name) {
7020 reply_nterror(req, NT_STATUS_NO_MEMORY);
7021 goto out;
7022 }
7023
7024 if (dest_has_wild) {
7025 char *fname_dst_mod = NULL;
7026 if (!resolve_wildcards(smb_fname_dst,
7027 smb_fname_src->base_name,
7028 smb_fname_dst->base_name,
7029 &fname_dst_mod)) {
7030 reply_nterror(req, NT_STATUS_NO_MEMORY);
7031 goto out;
7032 }
7033 TALLOC_FREE(smb_fname_dst->base_name);
7034 smb_fname_dst->base_name = fname_dst_mod;
7035 }
7036
7037 status = check_name(conn, smb_fname_src->base_name);
7038 if (!NT_STATUS_IS_OK(status)) {
7039 reply_nterror(req, status);
7040 goto out;
7041 }
7042
7043 status = check_name(conn, smb_fname_dst->base_name);
7044 if (!NT_STATUS_IS_OK(status)) {
7045 reply_nterror(req, status);
7046 goto out;
7047 }
7048
7049 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7050 ofun, count, target_is_directory);
7051
7052 if(!NT_STATUS_IS_OK(status)) {
7053 reply_nterror(req, status);
7054 goto out;
7055 } else {
7056 count++;
7057 }
7058 } else {
7059 struct smb_Dir *dir_hnd = NULL;
7060 const char *dname = NULL;
7061 char *talloced = NULL;
7062 long offset = 0;
7063
7064 /*
7065 * There is a wildcard that requires us to actually read the
7066 * src dir and copy each file matching the mask to the dst.
7067 * Right now streams won't be copied, but this could
7068 * presumably be added with a nested loop for reach dir entry.
7069 */
7070 SMB_ASSERT(!smb_fname_src->stream_name);
7071 SMB_ASSERT(!smb_fname_dst->stream_name);
7072
7073 smb_fname_src->stream_name = NULL;
7074 smb_fname_dst->stream_name = NULL;
7075
7076 if (strequal(fname_src_mask,"????????.???")) {
7077 TALLOC_FREE(fname_src_mask);
7078 fname_src_mask = talloc_strdup(ctx, "*");
7079 if (!fname_src_mask) {
7080 reply_nterror(req, NT_STATUS_NO_MEMORY);
7081 goto out;
7082 }
7083 }
7084
7085 status = check_name(conn, fname_src_dir);
7086 if (!NT_STATUS_IS_OK(status)) {
7087 reply_nterror(req, status);
7088 goto out;
7089 }
7090
7091 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7092 if (dir_hnd == NULL) {
7093 status = map_nt_error_from_unix(errno);
7094 reply_nterror(req, status);
7095 goto out;
7096 }
7097
7098 error = ERRbadfile;
7099
7100 /* Iterate over the src dir copying each entry to the dst. */
7101 while ((dname = ReadDirName(dir_hnd, &offset,
7102 &smb_fname_src->st, &talloced))) {
7103 char *destname = NULL;
7104
7105 if (ISDOT(dname) || ISDOTDOT(dname)) {
7106 TALLOC_FREE(talloced);
7107 continue;
7108 }
7109
7110 if (!is_visible_file(conn, fname_src_dir, dname,
7111 &smb_fname_src->st, false)) {
7112 TALLOC_FREE(talloced);
7113 continue;
7114 }
7115
7116 if(!mask_match(dname, fname_src_mask,
7117 conn->case_sensitive)) {
7118 TALLOC_FREE(talloced);
7119 continue;
7120 }
7121
7122 error = ERRnoaccess;
7123
7124 /* Get the src smb_fname struct setup. */
7125 TALLOC_FREE(smb_fname_src->base_name);
7126 if (ISDOT(fname_src_dir)) {
7127 /* Ensure we use canonical names on open. */
7128 smb_fname_src->base_name =
7129 talloc_asprintf(smb_fname_src, "%s",
7130 dname);
7131 } else {
7132 smb_fname_src->base_name =
7133 talloc_asprintf(smb_fname_src, "%s/%s",
7134 fname_src_dir, dname);
7135 }
7136
7137 if (!smb_fname_src->base_name) {
7138 TALLOC_FREE(dir_hnd);
7139 TALLOC_FREE(talloced);
7140 reply_nterror(req, NT_STATUS_NO_MEMORY);
7141 goto out;
7142 }
7143
7144 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7145 smb_fname_dst->base_name,
7146 &destname)) {
7147 TALLOC_FREE(talloced);
7148 continue;
7149 }
7150 if (!destname) {
7151 TALLOC_FREE(dir_hnd);
7152 TALLOC_FREE(talloced);
7153 reply_nterror(req, NT_STATUS_NO_MEMORY);
7154 goto out;
7155 }
7156
7157 TALLOC_FREE(smb_fname_dst->base_name);
7158 smb_fname_dst->base_name = destname;
7159
7160 status = check_name(conn, smb_fname_src->base_name);
7161 if (!NT_STATUS_IS_OK(status)) {
7162 TALLOC_FREE(dir_hnd);
7163 TALLOC_FREE(talloced);
7164 reply_nterror(req, status);
7165 goto out;
7166 }
7167
7168 status = check_name(conn, smb_fname_dst->base_name);
7169 if (!NT_STATUS_IS_OK(status)) {
7170 TALLOC_FREE(dir_hnd);
7171 TALLOC_FREE(talloced);
7172 reply_nterror(req, status);
7173 goto out;
7174 }
7175
7176 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7177 smb_fname_src->base_name,
7178 smb_fname_dst->base_name));
7179
7180 status = copy_file(ctx, conn, smb_fname_src,
7181 smb_fname_dst, ofun, count,
7182 target_is_directory);
7183 if (NT_STATUS_IS_OK(status)) {
7184 count++;
7185 }
7186
7187 TALLOC_FREE(talloced);
7188 }
7189 TALLOC_FREE(dir_hnd);
7190 }
7191
7192 if (count == 0) {
7193 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7194 goto out;
7195 }
7196
7197 reply_outbuf(req, 1, 0);
7198 SSVAL(req->outbuf,smb_vwv0,count);
7199 out:
7200 TALLOC_FREE(smb_fname_src);
7201 TALLOC_FREE(smb_fname_dst);
7202 TALLOC_FREE(fname_src);
7203 TALLOC_FREE(fname_dst);
7204 TALLOC_FREE(fname_src_mask);
7205 TALLOC_FREE(fname_src_dir);
7206
7207 END_PROFILE(SMBcopy);
7208 return;
7209 }
7210
7211 #undef DBGC_CLASS
7212 #define DBGC_CLASS DBGC_LOCKING
7213
7214 /****************************************************************************
7215 Get a lock pid, dealing with large count requests.
7216 ****************************************************************************/
7217
7218 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7219 bool large_file_format)
7220 {
7221 if(!large_file_format)
7222 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7223 else
7224 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7225 }
7226
7227 /****************************************************************************
7228 Get a lock count, dealing with large count requests.
7229 ****************************************************************************/
7230
7231 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7232 bool large_file_format)
7233 {
7234 uint64_t count = 0;
7235
7236 if(!large_file_format) {
7237 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7238 } else {
7239
7240 #if defined(HAVE_LONGLONG)
7241 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7242 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7243 #else /* HAVE_LONGLONG */
7244
7245 /*
7246 * NT4.x seems to be broken in that it sends large file (64 bit)
7247 * lockingX calls even if the CAP_LARGE_FILES was *not*
7248 * negotiated. For boxes without large unsigned ints truncate the
7249 * lock count by dropping the top 32 bits.
7250 */
7251
7252 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7253 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7254 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7255 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7256 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7257 }
7258
7259 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7260 #endif /* HAVE_LONGLONG */
7261 }
7262
7263 return count;
7264 }
7265
7266 #if !defined(HAVE_LONGLONG)
7267 /****************************************************************************
7268 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7269 ****************************************************************************/
7270
7271 static uint32 map_lock_offset(uint32 high, uint32 low)
7272 {
7273 unsigned int i;
7274 uint32 mask = 0;
7275 uint32 highcopy = high;
7276
7277 /*
7278 * Try and find out how many significant bits there are in high.
7279 */
7280
7281 for(i = 0; highcopy; i++)
7282 highcopy >>= 1;
7283
7284 /*
7285 * We use 31 bits not 32 here as POSIX
7286 * lock offsets may not be negative.
7287 */
7288
7289 mask = (~0) << (31 - i);
7290
7291 if(low & mask)
7292 return 0; /* Fail. */
7293
7294 high <<= (31 - i);
7295
7296 return (high|low);
7297 }
7298 #endif /* !defined(HAVE_LONGLONG) */
7299
7300 /****************************************************************************
7301 Get a lock offset, dealing with large offset requests.
7302 ****************************************************************************/
7303
7304 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7305 bool large_file_format, bool *err)
7306 {
7307 uint64_t offset = 0;
7308
7309 *err = False;
7310
7311 if(!large_file_format) {
7312 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7313 } else {
7314
7315 #if defined(HAVE_LONGLONG)
7316 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7317 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7318 #else /* HAVE_LONGLONG */
7319
7320 /*
7321 * NT4.x seems to be broken in that it sends large file (64 bit)
7322 * lockingX calls even if the CAP_LARGE_FILES was *not*
7323 * negotiated. For boxes without large unsigned ints mangle the
7324 * lock offset by mapping the top 32 bits onto the lower 32.
7325 */
7326
7327 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7328 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7329 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7330 uint32 new_low = 0;
7331
7332 if((new_low = map_lock_offset(high, low)) == 0) {
7333 *err = True;
7334 return (uint64_t)-1;
7335 }
7336
7337 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7338 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7339 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7340 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7341 }
7342
7343 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7344 #endif /* HAVE_LONGLONG */
7345 }
7346
7347 return offset;
7348 }
7349
7350 NTSTATUS smbd_do_locking(struct smb_request *req,
7351 files_struct *fsp,
7352 uint8_t type,
7353 int32_t timeout,
7354 uint16_t num_ulocks,
7355 struct smbd_lock_element *ulocks,
7356 uint16_t num_locks,
7357 struct smbd_lock_element *locks,
7358 bool *async)
7359 {
7360 connection_struct *conn = req->conn;
7361 int i;
7362 NTSTATUS status = NT_STATUS_OK;
7363
7364 *async = false;
7365
7366 /* Data now points at the beginning of the list
7367 of smb_unlkrng structs */
7368 for(i = 0; i < (int)num_ulocks; i++) {
7369 struct smbd_lock_element *e = &ulocks[i];
7370
7371 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7372 "pid %u, file %s\n",
7373 (double)e->offset,
7374 (double)e->count,
7375 (unsigned int)e->smblctx,
7376 fsp_str_dbg(fsp)));
7377
7378 if (e->brltype != UNLOCK_LOCK) {
7379 /* this can only happen with SMB2 */
7380 return NT_STATUS_INVALID_PARAMETER;
7381 }
7382
7383 status = do_unlock(req->sconn->msg_ctx,
7384 fsp,
7385 e->smblctx,
7386 e->count,
7387 e->offset,
7388 WINDOWS_LOCK);
7389
7390 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7391 nt_errstr(status)));
7392
7393 if (!NT_STATUS_IS_OK(status)) {
7394 return status;
7395 }
7396 }
7397
7398 /* Setup the timeout in seconds. */
7399
7400 if (!lp_blocking_locks(SNUM(conn))) {
7401 timeout = 0;
7402 }
7403
7404 /* Data now points at the beginning of the list
7405 of smb_lkrng structs */
7406
7407 for(i = 0; i < (int)num_locks; i++) {
7408 struct smbd_lock_element *e = &locks[i];
7409
7410 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7411 "%llu, file %s timeout = %d\n",
7412 (double)e->offset,
7413 (double)e->count,
7414 (unsigned long long)e->smblctx,
7415 fsp_str_dbg(fsp),
7416 (int)timeout));
7417
7418 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7419 struct blocking_lock_record *blr = NULL;
7420
7421 if (num_locks > 1) {
7422 /*
7423 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7424 * if the lock vector contains one entry. When given mutliple cancel
7425 * requests in a single PDU we expect the server to return an
7426 * error. Windows servers seem to accept the request but only
7427 * cancel the first lock.
7428 * JRA - Do what Windows does (tm) :-).
7429 */
7430
7431 #if 0
7432 /* MS-CIFS (2.2.4.32.1) behavior. */
7433 return NT_STATUS_DOS(ERRDOS,
7434 ERRcancelviolation);
7435 #else
7436 /* Windows behavior. */
7437 if (i != 0) {
7438 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7439 "cancel request\n"));
7440 continue;
7441 }
7442 #endif
7443 }
7444
7445 if (lp_blocking_locks(SNUM(conn))) {
7446
7447 /* Schedule a message to ourselves to
7448 remove the blocking lock record and
7449 return the right error. */
7450
7451 blr = blocking_lock_cancel_smb1(fsp,
7452 e->smblctx,
7453 e->offset,
7454 e->count,
7455 WINDOWS_LOCK,
7456 type,
7457 NT_STATUS_FILE_LOCK_CONFLICT);
7458 if (blr == NULL) {
7459 return NT_STATUS_DOS(
7460 ERRDOS,
7461 ERRcancelviolation);
7462 }
7463 }
7464 /* Remove a matching pending lock. */
7465 status = do_lock_cancel(fsp,
7466 e->smblctx,
7467 e->count,
7468 e->offset,
7469 WINDOWS_LOCK,
7470 blr);
7471 } else {
7472 bool blocking_lock = timeout ? true : false;
7473 bool defer_lock = false;
7474 struct byte_range_lock *br_lck;
7475 uint64_t block_smblctx;
7476
7477 br_lck = do_lock(req->sconn->msg_ctx,
7478 fsp,
7479 e->smblctx,
7480 e->count,
7481 e->offset,
7482 e->brltype,
7483 WINDOWS_LOCK,
7484 blocking_lock,
7485 &status,
7486 &block_smblctx,
7487 NULL);
7488
7489 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7490 /* Windows internal resolution for blocking locks seems
7491 to be about 200ms... Don't wait for less than that. JRA. */
7492 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7493 timeout = lp_lock_spin_time();
7494 }
7495 defer_lock = true;
7496 }
7497
7498 /* If a lock sent with timeout of zero would fail, and
7499 * this lock has been requested multiple times,
7500 * according to brl_lock_failed() we convert this
7501 * request to a blocking lock with a timeout of between
7502 * 150 - 300 milliseconds.
7503 *
7504 * If lp_lock_spin_time() has been set to 0, we skip
7505 * this blocking retry and fail immediately.
7506 *
7507 * Replacement for do_lock_spin(). JRA. */
7508
7509 if (!req->sconn->using_smb2 &&
7510 br_lck && lp_blocking_locks(SNUM(conn)) &&
7511 lp_lock_spin_time() && !blocking_lock &&
7512 NT_STATUS_EQUAL((status),
7513 NT_STATUS_FILE_LOCK_CONFLICT))
7514 {
7515 defer_lock = true;
7516 timeout = lp_lock_spin_time();
7517 }
7518
7519 if (br_lck && defer_lock) {
7520 /*
7521 * A blocking lock was requested. Package up
7522 * this smb into a queued request and push it
7523 * onto the blocking lock queue.
7524 */
7525 if(push_blocking_lock_request(br_lck,
7526 req,
7527 fsp,
7528 timeout,
7529 i,
7530 e->smblctx,
7531 e->brltype,
7532 WINDOWS_LOCK,
7533 e->offset,
7534 e->count,
7535 block_smblctx)) {
7536 TALLOC_FREE(br_lck);
7537 *async = true;
7538 return NT_STATUS_OK;
7539 }
7540 }
7541
7542 TALLOC_FREE(br_lck);
7543 }
7544
7545 if (!NT_STATUS_IS_OK(status)) {
7546 break;
7547 }
7548 }
7549
7550 /* If any of the above locks failed, then we must unlock
7551 all of the previous locks (X/Open spec). */
7552
7553 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7554
7555 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7556 i = -1; /* we want to skip the for loop */
7557 }
7558
7559 /*
7560 * Ensure we don't do a remove on the lock that just failed,
7561 * as under POSIX rules, if we have a lock already there, we
7562 * will delete it (and we shouldn't) .....
7563 */
7564 for(i--; i >= 0; i--) {
7565 struct smbd_lock_element *e = &locks[i];
7566
7567 do_unlock(req->sconn->msg_ctx,
7568 fsp,
7569 e->smblctx,
7570 e->count,
7571 e->offset,
7572 WINDOWS_LOCK);
7573 }
7574 return status;
7575 }
7576
7577 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7578 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7579
7580 return NT_STATUS_OK;
7581 }
7582
7583 /****************************************************************************
7584 Reply to a lockingX request.
7585 ****************************************************************************/
7586
7587 void reply_lockingX(struct smb_request *req)
7588 {
7589 connection_struct *conn = req->conn;
7590 files_struct *fsp;
7591 unsigned char locktype;
7592 unsigned char oplocklevel;
7593 uint16 num_ulocks;
7594 uint16 num_locks;
7595 int32 lock_timeout;
7596 int i;
7597 const uint8_t *data;
7598 bool large_file_format;
7599 bool err;
7600 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7601 struct smbd_lock_element *ulocks;
7602 struct smbd_lock_element *locks;
7603 bool async = false;
7604
7605 START_PROFILE(SMBlockingX);
7606
7607 if (req->wct < 8) {
7608 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7609 END_PROFILE(SMBlockingX);
7610 return;
7611 }
7612
7613 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7614 locktype = CVAL(req->vwv+3, 0);
7615 oplocklevel = CVAL(req->vwv+3, 1);
7616 num_ulocks = SVAL(req->vwv+6, 0);
7617 num_locks = SVAL(req->vwv+7, 0);
7618 lock_timeout = IVAL(req->vwv+4, 0);
7619 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7620
7621 if (!check_fsp(conn, req, fsp)) {
7622 END_PROFILE(SMBlockingX);
7623 return;
7624 }
7625
7626 data = req->buf;
7627
7628 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7629 /* we don't support these - and CANCEL_LOCK makes w2k
7630 and XP reboot so I don't really want to be
7631 compatible! (tridge) */
7632 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7633 END_PROFILE(SMBlockingX);
7634 return;
7635 }
7636
7637 /* Check if this is an oplock break on a file
7638 we have granted an oplock on.
7639 */
7640 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7641 /* Client can insist on breaking to none. */
7642 bool break_to_none = (oplocklevel == 0);
7643 bool result;
7644
7645 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7646 "for fnum = %d\n", (unsigned int)oplocklevel,
7647 fsp->fnum ));
7648
7649 /*
7650 * Make sure we have granted an exclusive or batch oplock on
7651 * this file.
7652 */
7653
7654 if (fsp->oplock_type == 0) {
7655
7656 /* The Samba4 nbench simulator doesn't understand
7657 the difference between break to level2 and break
7658 to none from level2 - it sends oplock break
7659 replies in both cases. Don't keep logging an error
7660 message here - just ignore it. JRA. */
7661
7662 DEBUG(5,("reply_lockingX: Error : oplock break from "
7663 "client for fnum = %d (oplock=%d) and no "
7664 "oplock granted on this file (%s).\n",
7665 fsp->fnum, fsp->oplock_type,
7666 fsp_str_dbg(fsp)));
7667
7668 /* if this is a pure oplock break request then don't
7669 * send a reply */
7670 if (num_locks == 0 && num_ulocks == 0) {
7671 END_PROFILE(SMBlockingX);
7672 return;
7673 } else {
7674 END_PROFILE(SMBlockingX);
7675 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7676 return;
7677 }
7678 }
7679
7680 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7681 (break_to_none)) {
7682 result = remove_oplock(fsp);
7683 } else {
7684 result = downgrade_oplock(fsp);
7685 }
7686
7687 if (!result) {
7688 DEBUG(0, ("reply_lockingX: error in removing "
7689 "oplock on file %s\n", fsp_str_dbg(fsp)));
7690 /* Hmmm. Is this panic justified? */
7691 smb_panic("internal tdb error");
7692 }
7693
7694 reply_to_oplock_break_requests(fsp);
7695
7696 /* if this is a pure oplock break request then don't send a
7697 * reply */
7698 if (num_locks == 0 && num_ulocks == 0) {
7699 /* Sanity check - ensure a pure oplock break is not a
7700 chained request. */
7701 if(CVAL(req->vwv+0, 0) != 0xff)
7702 DEBUG(0,("reply_lockingX: Error : pure oplock "
7703 "break is a chained %d request !\n",
7704 (unsigned int)CVAL(req->vwv+0, 0)));
7705 END_PROFILE(SMBlockingX);
7706 return;
7707 }
7708 }
7709
7710 if (req->buflen <
7711 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7712 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7713 END_PROFILE(SMBlockingX);
7714 return;
7715 }
7716
7717 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7718 if (ulocks == NULL) {
7719 reply_nterror(req, NT_STATUS_NO_MEMORY);
7720 END_PROFILE(SMBlockingX);
7721 return;
7722 }
7723
7724 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7725 if (locks == NULL) {
7726 reply_nterror(req, NT_STATUS_NO_MEMORY);
7727 END_PROFILE(SMBlockingX);
7728 return;
7729 }
7730
7731 /* Data now points at the beginning of the list
7732 of smb_unlkrng structs */
7733 for(i = 0; i < (int)num_ulocks; i++) {
7734 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7735 ulocks[i].count = get_lock_count(data, i, large_file_format);
7736 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7737 ulocks[i].brltype = UNLOCK_LOCK;
7738
7739 /*
7740 * There is no error code marked "stupid client bug".... :-).
7741 */
7742 if(err) {
7743 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7744 END_PROFILE(SMBlockingX);
7745 return;
7746 }
7747 }
7748
7749 /* Now do any requested locks */
7750 data += ((large_file_format ? 20 : 10)*num_ulocks);
7751
7752 /* Data now points at the beginning of the list
7753 of smb_lkrng structs */
7754
7755 for(i = 0; i < (int)num_locks; i++) {
7756 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7757 locks[i].count = get_lock_count(data, i, large_file_format);
7758 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7759
7760 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7761 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7762 locks[i].brltype = PENDING_READ_LOCK;
7763 } else {
7764 locks[i].brltype = READ_LOCK;
7765 }
7766 } else {
7767 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7768 locks[i].brltype = PENDING_WRITE_LOCK;
7769 } else {
7770 locks[i].brltype = WRITE_LOCK;
7771 }
7772 }
7773
7774 /*
7775 * There is no error code marked "stupid client bug".... :-).
7776 */
7777 if(err) {
7778 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7779 END_PROFILE(SMBlockingX);
7780 return;
7781 }
7782 }
7783
7784 status = smbd_do_locking(req, fsp,
7785 locktype, lock_timeout,
7786 num_ulocks, ulocks,
7787 num_locks, locks,
7788 &async);
7789 if (!NT_STATUS_IS_OK(status)) {
7790 END_PROFILE(SMBlockingX);
7791 reply_nterror(req, status);
7792 return;
7793 }
7794 if (async) {
7795 END_PROFILE(SMBlockingX);
7796 return;
7797 }
7798
7799 reply_outbuf(req, 2, 0);
7800
7801 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7802 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7803
7804 END_PROFILE(SMBlockingX);
7805 chain_reply(req);
7806 }
7807
7808 #undef DBGC_CLASS
7809 #define DBGC_CLASS DBGC_ALL
7810
7811 /****************************************************************************
7812 Reply to a SMBreadbmpx (read block multiplex) request.
7813 Always reply with an error, if someone has a platform really needs this,
7814 please contact vl@samba.org
7815 ****************************************************************************/
7816
7817 void reply_readbmpx(struct smb_request *req)
7818 {
7819 START_PROFILE(SMBreadBmpx);
7820 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7821 END_PROFILE(SMBreadBmpx);
7822 return;
7823 }
7824
7825 /****************************************************************************
7826 Reply to a SMBreadbs (read block multiplex secondary) request.
7827 Always reply with an error, if someone has a platform really needs this,
7828 please contact vl@samba.org
7829 ****************************************************************************/
7830
7831 void reply_readbs(struct smb_request *req)
7832 {
7833 START_PROFILE(SMBreadBs);
7834 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7835 END_PROFILE(SMBreadBs);
7836 return;
7837 }
7838
7839 /****************************************************************************
7840 Reply to a SMBsetattrE.
7841 ****************************************************************************/
7842
7843 void reply_setattrE(struct smb_request *req)
7844 {
7845 connection_struct *conn = req->conn;
7846 struct smb_file_time ft;
7847 files_struct *fsp;
7848 NTSTATUS status;
7849
7850 START_PROFILE(SMBsetattrE);
7851 ZERO_STRUCT(ft);
7852
7853 if (req->wct < 7) {
7854 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7855 goto out;
7856 }
7857
7858 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7859
7860 if(!fsp || (fsp->conn != conn)) {
7861 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7862 goto out;
7863 }
7864
7865 /*
7866 * Convert the DOS times into unix times.
7867 */
7868
7869 ft.atime = convert_time_t_to_timespec(
7870 srv_make_unix_date2(req->vwv+3));
7871 ft.mtime = convert_time_t_to_timespec(
7872 srv_make_unix_date2(req->vwv+5));
7873 ft.create_time = convert_time_t_to_timespec(
7874 srv_make_unix_date2(req->vwv+1));
7875
7876 reply_outbuf(req, 0, 0);
7877
7878 /*
7879 * Patch from Ray Frush <frush@engr.colostate.edu>
7880 * Sometimes times are sent as zero - ignore them.
7881 */
7882
7883 /* Ensure we have a valid stat struct for the source. */
7884 status = vfs_stat_fsp(fsp);
7885 if (!NT_STATUS_IS_OK(status)) {
7886 reply_nterror(req, status);
7887 goto out;
7888 }
7889
7890 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7891 if (!NT_STATUS_IS_OK(status)) {
7892 reply_nterror(req, status);
7893 goto out;
7894 }
7895
7896 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7897 " createtime=%u\n",
7898 fsp->fnum,
7899 (unsigned int)ft.atime.tv_sec,
7900 (unsigned int)ft.mtime.tv_sec,
7901 (unsigned int)ft.create_time.tv_sec
7902 ));
7903 out:
7904 END_PROFILE(SMBsetattrE);
7905 return;
7906 }
7907
7908
7909 /* Back from the dead for OS/2..... JRA. */
7910
7911 /****************************************************************************
7912 Reply to a SMBwritebmpx (write block multiplex primary) request.
7913 Always reply with an error, if someone has a platform really needs this,
7914 please contact vl@samba.org
7915 ****************************************************************************/
7916
7917 void reply_writebmpx(struct smb_request *req)
7918 {
7919 START_PROFILE(SMBwriteBmpx);
7920 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7921 END_PROFILE(SMBwriteBmpx);
7922 return;
7923 }
7924
7925 /****************************************************************************
7926 Reply to a SMBwritebs (write block multiplex secondary) request.
7927 Always reply with an error, if someone has a platform really needs this,
7928 please contact vl@samba.org
7929 ****************************************************************************/
7930
7931 void reply_writebs(struct smb_request *req)
7932 {
7933 START_PROFILE(SMBwriteBs);
7934 reply_force_doserror(req, ERRSRV, ERRuseSTD);
7935 END_PROFILE(SMBwriteBs);
7936 return;
7937 }
7938
7939 /****************************************************************************
7940 Reply to a SMBgetattrE.
7941 ****************************************************************************/
7942
7943 void reply_getattrE(struct smb_request *req)
7944 {
7945 connection_struct *conn = req->conn;
7946 int mode;
7947 files_struct *fsp;
7948 struct timespec create_ts;
7949
7950 START_PROFILE(SMBgetattrE);
7951
7952 if (req->wct < 1) {
7953 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7954 END_PROFILE(SMBgetattrE);
7955 return;
7956 }
7957
7958 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7959
7960 if(!fsp || (fsp->conn != conn)) {
7961 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7962 END_PROFILE(SMBgetattrE);
7963 return;
7964 }
7965
7966 /* Do an fstat on this file */
7967 if(fsp_stat(fsp)) {
7968 reply_nterror(req, map_nt_error_from_unix(errno));
7969 END_PROFILE(SMBgetattrE);
7970 return;
7971 }
7972
7973 mode = dos_mode(conn, fsp->fsp_name);
7974
7975 /*
7976 * Convert the times into dos times. Set create
7977 * date to be last modify date as UNIX doesn't save
7978 * this.
7979 */
7980
7981 reply_outbuf(req, 11, 0);
7982
7983 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7984 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7985 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7986 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7987 /* Should we check pending modtime here ? JRA */
7988 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7989 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7990
7991 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
7992 SIVAL(req->outbuf, smb_vwv6, 0);
7993 SIVAL(req->outbuf, smb_vwv8, 0);
7994 } else {
7995 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7996 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7997 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7998 }
7999 SSVAL(req->outbuf,smb_vwv10, mode);
8000
8001 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8002
8003 END_PROFILE(SMBgetattrE);
8004 return;
8005 }
Samba GIT mirror