?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Simplify an if-condition
[Samba.git] / source3 / smbd / smb1_trans2.c
blobe31bdf02fe8297bc6ba09174d47620ec006df32d
1 /*
2 Unix SMB/CIFS implementation.
3 SMB transaction2 handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6 Copyright (C) Volker Lendecke 2005-2007
7 Copyright (C) Steve French 2005
8 Copyright (C) James Peach 2006-2007
9
10 Extensively modified by Andrew Tridgell, 1995
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "ntioctl.h"
28 #include "system/filesys.h"
29 #include "lib/util/time_basic.h"
30 #include "version.h"
31 #include "smbd/smbd.h"
32 #include "smbd/globals.h"
33 #include "../libcli/auth/libcli_auth.h"
34 #include "../librpc/gen_ndr/xattr.h"
35 #include "../librpc/gen_ndr/ndr_security.h"
36 #include "libcli/security/security.h"
37 #include "trans2.h"
38 #include "auth.h"
39 #include "smbprofile.h"
40 #include "rpc_server/srv_pipe_hnd.h"
41 #include "printing.h"
42 #include "lib/util_ea.h"
43 #include "lib/readdir_attr.h"
44 #include "messages.h"
45 #include "libcli/smb/smb2_posix.h"
46 #include "lib/util/string_wrappers.h"
47 #include "source3/lib/substitute.h"
48 #include "source3/lib/adouble.h"
49 #include "source3/smbd/dir.h"
50
51 #define DIR_ENTRY_SAFETY_MARGIN 4096
52
53 /****************************************************************************
54 Send the required number of replies back.
55 We assume all fields other than the data fields are
56 set correctly for the type of call.
57 HACK ! Always assumes smb_setup field is zero.
58 ****************************************************************************/
59
60 static void send_trans2_replies(connection_struct *conn,
61 struct smb_request *req,
62 NTSTATUS status,
63 const char *params,
64 int paramsize,
65 const char *pdata,
66 int datasize,
67 int max_data_bytes)
68 {
69 /* As we are using a protocol > LANMAN1 then the max_send
70 variable must have been set in the sessetupX call.
71 This takes precedence over the max_xmit field in the
72 global struct. These different max_xmit variables should
73 be merged as this is now too confusing */
74
75 int data_to_send = datasize;
76 int params_to_send = paramsize;
77 int useable_space;
78 const char *pp = params;
79 const char *pd = pdata;
80 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
81 int alignment_offset = 1; /* JRA. This used to be 3. Set to 1 to make netmon parse ok. */
82 int data_alignment_offset = 0;
83 bool overflow = False;
84 struct smbXsrv_connection *xconn = req->xconn;
85 int max_send = xconn->smb1.sessions.max_send;
86
87 /* Modify the data_to_send and datasize and set the error if
88 we're trying to send more than max_data_bytes. We still send
89 the part of the packet(s) that fit. Strange, but needed
90 for OS/2. */
91
92 if (max_data_bytes > 0 && datasize > max_data_bytes) {
93 DEBUG(5,("send_trans2_replies: max_data_bytes %d exceeded by data %d\n",
94 max_data_bytes, datasize ));
95 datasize = data_to_send = max_data_bytes;
96 overflow = True;
97 }
98
99 /* If there genuinely are no parameters or data to send just send the empty packet */
100
101 if(params_to_send == 0 && data_to_send == 0) {
102 reply_smb1_outbuf(req, 10, 0);
103 if (NT_STATUS_V(status)) {
104 uint8_t eclass;
105 uint32_t ecode;
106 ntstatus_to_dos(status, &eclass, &ecode);
107 error_packet_set((char *)req->outbuf,
108 eclass, ecode, status,
109 __LINE__,__FILE__);
110 }
111 show_msg((char *)req->outbuf);
112 if (!smb1_srv_send(xconn,
113 (char *)req->outbuf,
114 true,
115 req->seqnum + 1,
116 IS_CONN_ENCRYPTED(conn))) {
117 exit_server_cleanly("send_trans2_replies: smb1_srv_send failed.");
118 }
119 TALLOC_FREE(req->outbuf);
120 return;
121 }
122
123 /* When sending params and data ensure that both are nicely aligned */
124 /* Only do this alignment when there is also data to send - else
125 can cause NT redirector problems. */
126
127 if (((params_to_send % 4) != 0) && (data_to_send != 0))
128 data_alignment_offset = 4 - (params_to_send % 4);
129
130 /* Space is bufsize minus Netbios over TCP header minus SMB header */
131 /* The alignment_offset is to align the param bytes on an even byte
132 boundary. NT 4.0 Beta needs this to work correctly. */
133
134 useable_space = max_send - (smb_size
135 + 2 * 10 /* wct */
136 + alignment_offset
137 + data_alignment_offset);
138
139 if (useable_space < 0) {
140 DEBUG(0, ("send_trans2_replies failed sanity useable_space "
141 "= %d!!!\n", useable_space));
142 exit_server_cleanly("send_trans2_replies: Not enough space");
143 }
144
145 while (params_to_send || data_to_send) {
146 /* Calculate whether we will totally or partially fill this packet */
147
148 total_sent_thistime = params_to_send + data_to_send;
149
150 /* We can never send more than useable_space */
151 /*
152 * Note that 'useable_space' does not include the alignment offsets,
153 * but we must include the alignment offsets in the calculation of
154 * the length of the data we send over the wire, as the alignment offsets
155 * are sent here. Fix from Marc_Jacobsen@hp.com.
156 */
157
158 total_sent_thistime = MIN(total_sent_thistime, useable_space);
159
160 reply_smb1_outbuf(req, 10, total_sent_thistime + alignment_offset
161 + data_alignment_offset);
162
163 /* Set total params and data to be sent */
164 SSVAL(req->outbuf,smb_tprcnt,paramsize);
165 SSVAL(req->outbuf,smb_tdrcnt,datasize);
166
167 /* Calculate how many parameters and data we can fit into
168 * this packet. Parameters get precedence
169 */
170
171 params_sent_thistime = MIN(params_to_send,useable_space);
172 data_sent_thistime = useable_space - params_sent_thistime;
173 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
174
175 SSVAL(req->outbuf,smb_prcnt, params_sent_thistime);
176
177 /* smb_proff is the offset from the start of the SMB header to the
178 parameter bytes, however the first 4 bytes of outbuf are
179 the Netbios over TCP header. Thus use smb_base() to subtract
180 them from the calculation */
181
182 SSVAL(req->outbuf,smb_proff,
183 ((smb_buf(req->outbuf)+alignment_offset)
184 - smb_base(req->outbuf)));
185
186 if(params_sent_thistime == 0)
187 SSVAL(req->outbuf,smb_prdisp,0);
188 else
189 /* Absolute displacement of param bytes sent in this packet */
190 SSVAL(req->outbuf,smb_prdisp,pp - params);
191
192 SSVAL(req->outbuf,smb_drcnt, data_sent_thistime);
193 if(data_sent_thistime == 0) {
194 SSVAL(req->outbuf,smb_droff,0);
195 SSVAL(req->outbuf,smb_drdisp, 0);
196 } else {
197 /* The offset of the data bytes is the offset of the
198 parameter bytes plus the number of parameters being sent this time */
199 SSVAL(req->outbuf, smb_droff,
200 ((smb_buf(req->outbuf)+alignment_offset)
201 - smb_base(req->outbuf))
202 + params_sent_thistime + data_alignment_offset);
203 SSVAL(req->outbuf,smb_drdisp, pd - pdata);
204 }
205
206 /* Initialize the padding for alignment */
207
208 if (alignment_offset != 0) {
209 memset(smb_buf(req->outbuf), 0, alignment_offset);
210 }
211
212 /* Copy the param bytes into the packet */
213
214 if(params_sent_thistime) {
215 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
216 params_sent_thistime);
217 }
218
219 /* Copy in the data bytes */
220 if(data_sent_thistime) {
221 if (data_alignment_offset != 0) {
222 memset((smb_buf(req->outbuf)+alignment_offset+
223 params_sent_thistime), 0,
224 data_alignment_offset);
225 }
226 memcpy(smb_buf(req->outbuf)+alignment_offset
227 +params_sent_thistime+data_alignment_offset,
228 pd,data_sent_thistime);
229 }
230
231 DEBUG(9,("t2_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
232 params_sent_thistime, data_sent_thistime, useable_space));
233 DEBUG(9,("t2_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
234 params_to_send, data_to_send, paramsize, datasize));
235
236 if (overflow) {
237 error_packet_set((char *)req->outbuf,
238 ERRDOS,ERRbufferoverflow,
239 STATUS_BUFFER_OVERFLOW,
240 __LINE__,__FILE__);
241 } else if (NT_STATUS_V(status)) {
242 uint8_t eclass;
243 uint32_t ecode;
244 ntstatus_to_dos(status, &eclass, &ecode);
245 error_packet_set((char *)req->outbuf,
246 eclass, ecode, status,
247 __LINE__,__FILE__);
248 }
249
250 /* Send the packet */
251 show_msg((char *)req->outbuf);
252 if (!smb1_srv_send(xconn,
253 (char *)req->outbuf,
254 true,
255 req->seqnum + 1,
256 IS_CONN_ENCRYPTED(conn))) {
257 exit_server_cleanly("send_trans2_replies: smb1_srv_send failed.");
258 }
259
260 TALLOC_FREE(req->outbuf);
261
262 pp += params_sent_thistime;
263 pd += data_sent_thistime;
264
265 params_to_send -= params_sent_thistime;
266 data_to_send -= data_sent_thistime;
267
268 /* Sanity check */
269 if(params_to_send < 0 || data_to_send < 0) {
270 DEBUG(0,("send_trans2_replies failed sanity check pts = %d, dts = %d\n!!!",
271 params_to_send, data_to_send));
272 return;
273 }
274 }
275
276 return;
277 }
278
279 /****************************************************************************
280 Deal with SMB_SET_POSIX_LOCK.
281 ****************************************************************************/
282
283 static void smb_set_posix_lock_done(struct tevent_req *subreq);
284
285 static NTSTATUS smb_set_posix_lock(connection_struct *conn,
286 struct smb_request *req,
287 const char *pdata,
288 int total_data,
289 files_struct *fsp)
290 {
291 struct tevent_req *subreq = NULL;
292 struct smbd_lock_element *lck = NULL;
293 uint64_t count;
294 uint64_t offset;
295 uint64_t smblctx;
296 bool blocking_lock = False;
297 enum brl_type lock_type;
298
299 NTSTATUS status = NT_STATUS_OK;
300
301 if (!CAN_WRITE(conn)) {
302 return NT_STATUS_DOS(ERRSRV, ERRaccess);
303 }
304
305 if (fsp == NULL ||
306 fsp->fsp_flags.is_pathref ||
307 fsp_get_io_fd(fsp) == -1)
308 {
309 return NT_STATUS_INVALID_HANDLE;
310 }
311
312 if (total_data != POSIX_LOCK_DATA_SIZE) {
313 return NT_STATUS_INVALID_PARAMETER;
314 }
315
316 switch (SVAL(pdata, POSIX_LOCK_TYPE_OFFSET)) {
317 case POSIX_LOCK_TYPE_READ:
318 lock_type = READ_LOCK;
319 break;
320 case POSIX_LOCK_TYPE_WRITE:
321 /* Return the right POSIX-mappable error code for files opened read-only. */
322 if (!fsp->fsp_flags.can_write) {
323 return NT_STATUS_INVALID_HANDLE;
324 }
325 lock_type = WRITE_LOCK;
326 break;
327 case POSIX_LOCK_TYPE_UNLOCK:
328 lock_type = UNLOCK_LOCK;
329 break;
330 default:
331 return NT_STATUS_INVALID_PARAMETER;
332 }
333
334 switch (SVAL(pdata, POSIX_LOCK_FLAGS_OFFSET)) {
335 case POSIX_LOCK_FLAG_NOWAIT:
336 blocking_lock = false;
337 break;
338 case POSIX_LOCK_FLAG_WAIT:
339 blocking_lock = true;
340 break;
341 default:
342 return NT_STATUS_INVALID_PARAMETER;
343 }
344
345 if (!lp_blocking_locks(SNUM(conn))) {
346 blocking_lock = False;
347 }
348
349 smblctx = (uint64_t)IVAL(pdata, POSIX_LOCK_PID_OFFSET);
350 offset = (((uint64_t) IVAL(pdata,(POSIX_LOCK_START_OFFSET+4))) << 32) |
351 ((uint64_t) IVAL(pdata,POSIX_LOCK_START_OFFSET));
352 count = (((uint64_t) IVAL(pdata,(POSIX_LOCK_LEN_OFFSET+4))) << 32) |
353 ((uint64_t) IVAL(pdata,POSIX_LOCK_LEN_OFFSET));
354
355 DBG_DEBUG("file %s, lock_type = %u, smblctx = %"PRIu64", "
356 "count = %"PRIu64", offset = %"PRIu64"\n",
357 fsp_str_dbg(fsp),
358 (unsigned int)lock_type,
359 smblctx,
360 count,
361 offset);
362
363 if (lock_type == UNLOCK_LOCK) {
364 struct smbd_lock_element l = {
365 .req_guid = smbd_request_guid(req, 0),
366 .smblctx = smblctx,
367 .brltype = UNLOCK_LOCK,
368 .lock_flav = POSIX_LOCK,
369 .offset = offset,
370 .count = count,
371 };
372 status = smbd_do_unlocking(req, fsp, 1, &l);
373 return status;
374 }
375
376 lck = talloc(req, struct smbd_lock_element);
377 if (lck == NULL) {
378 return NT_STATUS_NO_MEMORY;
379 }
380
381 *lck = (struct smbd_lock_element) {
382 .req_guid = smbd_request_guid(req, 0),
383 .smblctx = smblctx,
384 .brltype = lock_type,
385 .lock_flav = POSIX_LOCK,
386 .count = count,
387 .offset = offset,
388 };
389
390 subreq = smbd_smb1_do_locks_send(
391 fsp,
392 req->sconn->ev_ctx,
393 &req,
394 fsp,
395 blocking_lock ? UINT32_MAX : 0,
396 true, /* large_offset */
397 1,
398 lck);
399 if (subreq == NULL) {
400 TALLOC_FREE(lck);
401 return NT_STATUS_NO_MEMORY;
402 }
403 tevent_req_set_callback(subreq, smb_set_posix_lock_done, req);
404 return NT_STATUS_EVENT_PENDING;
405 }
406
407 static void smb_set_posix_lock_done(struct tevent_req *subreq)
408 {
409 struct smb_request *req = NULL;
410 NTSTATUS status;
411 bool ok;
412
413 ok = smbd_smb1_do_locks_extract_smbreq(subreq, talloc_tos(), &req);
414 SMB_ASSERT(ok);
415
416 status = smbd_smb1_do_locks_recv(subreq);
417 TALLOC_FREE(subreq);
418
419 if (NT_STATUS_IS_OK(status)) {
420 char params[2] = {0};
421 /* Fake up max_data_bytes here - we know it fits. */
422 send_trans2_replies(
423 req->conn,
424 req,
425 NT_STATUS_OK,
426 params,
427 2,
428 NULL,
429 0,
430 0xffff);
431 } else {
432 reply_nterror(req, status);
433 ok = smb1_srv_send(req->xconn,
434 (char *)req->outbuf,
435 true,
436 req->seqnum + 1,
437 IS_CONN_ENCRYPTED(req->conn));
438 if (!ok) {
439 exit_server_cleanly("smb_set_posix_lock_done: "
440 "smb1_srv_send failed.");
441 }
442 }
443
444 TALLOC_FREE(req);
445 return;
446 }
447
448 /****************************************************************************
449 Read a list of EA names from an incoming data buffer. Create an ea_list with them.
450 ****************************************************************************/
451
452 static struct ea_list *read_ea_name_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
453 {
454 struct ea_list *ea_list_head = NULL;
455 size_t converted_size, offset = 0;
456
457 while (offset + 2 < data_size) {
458 struct ea_list *eal = talloc_zero(ctx, struct ea_list);
459 unsigned int namelen = CVAL(pdata,offset);
460
461 offset++; /* Go past the namelen byte. */
462
463 /* integer wrap paranioa. */
464 if ((offset + namelen < offset) || (offset + namelen < namelen) ||
465 (offset > data_size) || (namelen > data_size) ||
466 (offset + namelen >= data_size)) {
467 break;
468 }
469 /* Ensure the name is null terminated. */
470 if (pdata[offset + namelen] != '\0') {
471 return NULL;
472 }
473 if (!pull_ascii_talloc(ctx, &eal->ea.name, &pdata[offset],
474 &converted_size)) {
475 DEBUG(0,("read_ea_name_list: pull_ascii_talloc "
476 "failed: %s\n", strerror(errno)));
477 }
478 if (!eal->ea.name) {
479 return NULL;
480 }
481
482 offset += (namelen + 1); /* Go past the name + terminating zero. */
483 DLIST_ADD_END(ea_list_head, eal);
484 DEBUG(10,("read_ea_name_list: read ea name %s\n", eal->ea.name));
485 }
486
487 return ea_list_head;
488 }
489
490 /****************************************************************************
491 Reply to a TRANSACT2_OPEN.
492 ****************************************************************************/
493
494 static void call_trans2open(connection_struct *conn,
495 struct smb_request *req,
496 char **pparams, int total_params,
497 char **ppdata, int total_data,
498 unsigned int max_data_bytes)
499 {
500 struct smb_filename *smb_fname = NULL;
501 char *params = *pparams;
502 char *pdata = *ppdata;
503 int deny_mode;
504 int32_t open_attr;
505 bool oplock_request;
506 #if 0
507 bool return_additional_info;
508 int16 open_sattr;
509 time_t open_time;
510 #endif
511 int open_ofun;
512 uint32_t open_size;
513 char *pname;
514 char *fname = NULL;
515 off_t size=0;
516 int fattr = 0;
517 SMB_INO_T inode = 0;
518 int smb_action = 0;
519 struct files_struct *dirfsp = NULL;
520 files_struct *fsp;
521 struct ea_list *ea_list = NULL;
522 uint16_t flags = 0;
523 NTSTATUS status;
524 uint32_t access_mask;
525 uint32_t share_mode;
526 uint32_t create_disposition;
527 uint32_t create_options = 0;
528 uint32_t private_flags = 0;
529 NTTIME twrp = 0;
530 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
531 TALLOC_CTX *ctx = talloc_tos();
532
533 /*
534 * Ensure we have enough parameters to perform the operation.
535 */
536
537 if (total_params < 29) {
538 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
539 goto out;
540 }
541
542 flags = SVAL(params, 0);
543 deny_mode = SVAL(params, 2);
544 open_attr = SVAL(params,6);
545 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
546 if (oplock_request) {
547 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
548 }
549
550 #if 0
551 return_additional_info = BITSETW(params,0);
552 open_sattr = SVAL(params, 4);
553 open_time = make_unix_date3(params+8);
554 #endif
555 open_ofun = SVAL(params,12);
556 open_size = IVAL(params,14);
557 pname = &params[28];
558
559 if (IS_IPC(conn)) {
560 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
561 goto out;
562 }
563
564 if (req->posix_pathnames) {
565 srvstr_get_path_posix(ctx,
566 params,
567 req->flags2,
568 &fname,
569 pname,
570 total_params - 28,
571 STR_TERMINATE,
572 &status);
573 } else {
574 srvstr_get_path(ctx,
575 params,
576 req->flags2,
577 &fname,
578 pname,
579 total_params - 28,
580 STR_TERMINATE,
581 &status);
582 }
583 if (!NT_STATUS_IS_OK(status)) {
584 reply_nterror(req, status);
585 goto out;
586 }
587
588 DEBUG(3,("call_trans2open %s deny_mode=0x%x attr=%d ofun=0x%x size=%d\n",
589 fname, (unsigned int)deny_mode, (unsigned int)open_attr,
590 (unsigned int)open_ofun, open_size));
591
592 if (ucf_flags & UCF_GMT_PATHNAME) {
593 extract_snapshot_token(fname, &twrp);
594 }
595 status = smb1_strip_dfs_path(ctx, &ucf_flags, &fname);
596 if (!NT_STATUS_IS_OK(status)) {
597 reply_nterror(req, status);
598 goto out;
599 }
600 status = filename_convert_dirfsp(ctx,
601 conn,
602 fname,
603 ucf_flags,
604 twrp,
605 &dirfsp,
606 &smb_fname);
607 if (!NT_STATUS_IS_OK(status)) {
608 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
609 reply_botherror(req,
610 NT_STATUS_PATH_NOT_COVERED,
611 ERRSRV, ERRbadpath);
612 goto out;
613 }
614 reply_nterror(req, status);
615 goto out;
616 }
617
618 if (open_ofun == 0) {
619 reply_nterror(req, NT_STATUS_OBJECT_NAME_COLLISION);
620 goto out;
621 }
622
623 if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
624 open_ofun,
625 &access_mask, &share_mode,
626 &create_disposition,
627 &create_options,
628 &private_flags)) {
629 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
630 goto out;
631 }
632
633 /* Any data in this call is an EA list. */
634 if (total_data && (total_data != 4)) {
635 if (total_data < 10) {
636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
637 goto out;
638 }
639
640 if (IVAL(pdata,0) > total_data) {
641 DEBUG(10,("call_trans2open: bad total data size (%u) > %u\n",
642 IVAL(pdata,0), (unsigned int)total_data));
643 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
644 goto out;
645 }
646
647 ea_list = read_ea_list(talloc_tos(), pdata + 4,
648 total_data - 4);
649 if (!ea_list) {
650 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
651 goto out;
652 }
653
654 if (!lp_ea_support(SNUM(conn))) {
655 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
656 goto out;
657 }
658
659 if (!req->posix_pathnames &&
660 ea_list_has_invalid_name(ea_list)) {
661 int param_len = 30;
662 *pparams = (char *)SMB_REALLOC(*pparams, param_len);
663 if(*pparams == NULL ) {
664 reply_nterror(req, NT_STATUS_NO_MEMORY);
665 goto out;
666 }
667 params = *pparams;
668 memset(params, '\0', param_len);
669 send_trans2_replies(conn, req, STATUS_INVALID_EA_NAME,
670 params, param_len, NULL, 0, max_data_bytes);
671 goto out;
672 }
673 }
674
675 status = SMB_VFS_CREATE_FILE(
676 conn, /* conn */
677 req, /* req */
678 dirfsp, /* dirfsp */
679 smb_fname, /* fname */
680 access_mask, /* access_mask */
681 share_mode, /* share_access */
682 create_disposition, /* create_disposition*/
683 create_options, /* create_options */
684 open_attr, /* file_attributes */
685 oplock_request, /* oplock_request */
686 NULL, /* lease */
687 open_size, /* allocation_size */
688 private_flags,
689 NULL, /* sd */
690 ea_list, /* ea_list */
691 &fsp, /* result */
692 &smb_action, /* psbuf */
693 NULL, NULL); /* create context */
694
695 if (!NT_STATUS_IS_OK(status)) {
696 if (open_was_deferred(req->xconn, req->mid)) {
697 /* We have re-scheduled this call. */
698 goto out;
699 }
700
701 if (!NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
702 reply_openerror(req, status);
703 goto out;
704 }
705
706 fsp = fcb_or_dos_open(
707 req,
708 smb_fname,
709 access_mask,
710 create_options,
711 private_flags);
712 if (fsp == NULL) {
713 bool ok = defer_smb1_sharing_violation(req);
714 if (ok) {
715 goto out;
716 }
717 reply_openerror(req, status);
718 goto out;
719 }
720
721 smb_action = FILE_WAS_OPENED;
722 }
723
724 size = get_file_size_stat(&smb_fname->st);
725 fattr = fdos_mode(fsp);
726 inode = smb_fname->st.st_ex_ino;
727 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
728 close_file_free(req, &fsp, ERROR_CLOSE);
729 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
730 goto out;
731 }
732
733 /* Realloc the size of parameters and data we will return */
734 *pparams = (char *)SMB_REALLOC(*pparams, 30);
735 if(*pparams == NULL ) {
736 reply_nterror(req, NT_STATUS_NO_MEMORY);
737 goto out;
738 }
739 params = *pparams;
740
741 SSVAL(params,0,fsp->fnum);
742 SSVAL(params,2,fattr);
743 srv_put_dos_date2_ts(params, 4, smb_fname->st.st_ex_mtime);
744 SIVAL(params,8, (uint32_t)size);
745 SSVAL(params,12,deny_mode);
746 SSVAL(params,14,0); /* open_type - file or directory. */
747 SSVAL(params,16,0); /* open_state - only valid for IPC device. */
748
749 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
750 smb_action |= EXTENDED_OPLOCK_GRANTED;
751 }
752
753 SSVAL(params,18,smb_action);
754
755 /*
756 * WARNING - this may need to be changed if SMB_INO_T <> 4 bytes.
757 */
758 SIVAL(params,20,inode);
759 SSVAL(params,24,0); /* Padding. */
760 if (flags & 8) {
761 uint32_t ea_size = estimate_ea_size(smb_fname->fsp);
762 SIVAL(params, 26, ea_size);
763 } else {
764 SIVAL(params, 26, 0);
765 }
766
767 /* Send the required number of replies */
768 send_trans2_replies(conn, req, NT_STATUS_OK, params, 30, *ppdata, 0, max_data_bytes);
769 out:
770 TALLOC_FREE(smb_fname);
771 }
772
773 static NTSTATUS get_lanman2_dir_entry(TALLOC_CTX *ctx,
774 connection_struct *conn,
775 struct dptr_struct *dirptr,
776 uint16_t flags2,
777 const char *path_mask,
778 uint32_t dirtype,
779 int info_level,
780 bool requires_resume_key,
781 bool dont_descend,
782 bool ask_sharemode,
783 char **ppdata,
784 char *base_data,
785 char *end_data,
786 int space_remaining,
787 int *last_entry_off,
788 struct ea_list *name_list)
789 {
790 uint8_t align = 4;
791 const bool do_pad = true;
792
793 if (info_level >= 1 && info_level <= 3) {
794 /* No alignment on earlier info levels. */
795 align = 1;
796 }
797
798 return smbd_dirptr_lanman2_entry(ctx, conn, dirptr, flags2,
799 path_mask, dirtype, info_level,
800 requires_resume_key, dont_descend, ask_sharemode,
801 true, align, do_pad,
802 ppdata, base_data, end_data,
803 space_remaining,
804 NULL,
805 last_entry_off, name_list, NULL);
806 }
807
808 /****************************************************************************
809 Reply to a TRANS2_FINDFIRST.
810 ****************************************************************************/
811
812 static void call_trans2findfirst(connection_struct *conn,
813 struct smb_request *req,
814 char **pparams, int total_params,
815 char **ppdata, int total_data,
816 unsigned int max_data_bytes)
817 {
818 /* We must be careful here that we don't return more than the
819 allowed number of data bytes. If this means returning fewer than
820 maxentries then so be it. We assume that the redirector has
821 enough room for the fixed number of parameter bytes it has
822 requested. */
823 struct smb_filename *smb_dname = NULL;
824 char *params = *pparams;
825 char *pdata = *ppdata;
826 char *data_end;
827 uint32_t dirtype;
828 int maxentries;
829 uint16_t findfirst_flags;
830 bool close_after_first;
831 bool close_if_end;
832 bool requires_resume_key;
833 int info_level;
834 char *directory = NULL;
835 char *mask = NULL;
836 char *p;
837 int last_entry_off=0;
838 int dptr_num = -1;
839 int numentries = 0;
840 int i;
841 bool finished = False;
842 bool dont_descend = False;
843 bool out_of_space = False;
844 int space_remaining;
845 struct ea_list *ea_list = NULL;
846 NTSTATUS ntstatus = NT_STATUS_OK;
847 bool ask_sharemode;
848 struct smbXsrv_connection *xconn = req->xconn;
849 struct smbd_server_connection *sconn = req->sconn;
850 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
851 bool backup_priv = false;
852 bool as_root = false;
853 files_struct *fsp = NULL;
854 struct files_struct *dirfsp = NULL;
855 const struct loadparm_substitution *lp_sub =
856 loadparm_s3_global_substitution();
857
858 if (total_params < 13) {
859 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
860 goto out;
861 }
862
863 dirtype = SVAL(params,0);
864 maxentries = SVAL(params,2);
865 findfirst_flags = SVAL(params,4);
866 close_after_first = (findfirst_flags & FLAG_TRANS2_FIND_CLOSE);
867 close_if_end = (findfirst_flags & FLAG_TRANS2_FIND_CLOSE_IF_END);
868 requires_resume_key = (findfirst_flags & FLAG_TRANS2_FIND_REQUIRE_RESUME);
869 backup_priv = ((findfirst_flags & FLAG_TRANS2_FIND_BACKUP_INTENT) &&
870 security_token_has_privilege(get_current_nttok(conn),
871 SEC_PRIV_BACKUP));
872
873 info_level = SVAL(params,6);
874
875 DBG_NOTICE("dirtype = %"PRIx32", maxentries = %d, "
876 "close_after_first=%d, close_if_end = %d "
877 "requires_resume_key = %d backup_priv = %d level = 0x%x, "
878 "max_data_bytes = %d\n",
879 dirtype,
880 maxentries,
881 close_after_first,
882 close_if_end,
883 requires_resume_key,
884 backup_priv,
885 info_level,
886 max_data_bytes);
887
888 if (!maxentries) {
889 /* W2K3 seems to treat zero as 1. */
890 maxentries = 1;
891 }
892
893 switch (info_level) {
894 case SMB_FIND_INFO_STANDARD:
895 case SMB_FIND_EA_SIZE:
896 case SMB_FIND_EA_LIST:
897 case SMB_FIND_FILE_DIRECTORY_INFO:
898 case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
899 case SMB_FIND_FILE_NAMES_INFO:
900 case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
901 case SMB_FIND_ID_FULL_DIRECTORY_INFO:
902 case SMB_FIND_ID_BOTH_DIRECTORY_INFO:
903 break;
904 case SMB_FIND_FILE_UNIX:
905 case SMB_FIND_FILE_UNIX_INFO2:
906 if (!lp_smb1_unix_extensions()) {
907 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
908 goto out;
909 }
910 if (!req->posix_pathnames) {
911 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
912 goto out;
913 }
914 break;
915 default:
916 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
917 goto out;
918 }
919
920 if (req->posix_pathnames) {
921 srvstr_get_path_posix(talloc_tos(),
922 params,
923 req->flags2,
924 &directory,
925 params+12,
926 total_params - 12,
927 STR_TERMINATE,
928 &ntstatus);
929 } else {
930 srvstr_get_path(talloc_tos(),
931 params,
932 req->flags2,
933 &directory,
934 params+12,
935 total_params - 12,
936 STR_TERMINATE,
937 &ntstatus);
938 }
939 if (!NT_STATUS_IS_OK(ntstatus)) {
940 reply_nterror(req, ntstatus);
941 goto out;
942 }
943
944 if (backup_priv) {
945 become_root();
946 as_root = true;
947 }
948 ntstatus = smb1_strip_dfs_path(talloc_tos(), &ucf_flags, &directory);
949 if (!NT_STATUS_IS_OK(ntstatus)) {
950 reply_nterror(req, ntstatus);
951 goto out;
952 }
953
954 ntstatus = filename_convert_smb1_search_path(talloc_tos(),
955 conn,
956 directory,
957 ucf_flags,
958 &dirfsp,
959 &smb_dname,
960 &mask);
961
962 if (!NT_STATUS_IS_OK(ntstatus)) {
963 if (NT_STATUS_EQUAL(ntstatus,NT_STATUS_PATH_NOT_COVERED)) {
964 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
965 ERRSRV, ERRbadpath);
966 goto out;
967 }
968 reply_nterror(req, ntstatus);
969 goto out;
970 }
971
972 TALLOC_FREE(directory);
973 directory = smb_dname->base_name;
974
975 DEBUG(5,("dir=%s, mask = %s\n",directory, mask));
976
977 if (info_level == SMB_FIND_EA_LIST) {
978 uint32_t ea_size;
979
980 if (total_data < 4) {
981 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
982 goto out;
983 }
984
985 ea_size = IVAL(pdata,0);
986 if (ea_size != total_data) {
987 DBG_NOTICE("Rejecting EA request with incorrect "
988 "total_data=%d (should be %" PRIu32 ")\n",
989 total_data,
990 ea_size);
991 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
992 goto out;
993 }
994
995 if (!lp_ea_support(SNUM(conn))) {
996 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
997 goto out;
998 }
999
1000 /* Pull out the list of names. */
1001 ea_list = read_ea_name_list(talloc_tos(), pdata + 4, ea_size - 4);
1002 if (!ea_list) {
1003 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1004 goto out;
1005 }
1006 }
1007
1008 if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
1009 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1010 goto out;
1011 }
1012
1013 *ppdata = (char *)SMB_REALLOC(
1014 *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
1015 if(*ppdata == NULL ) {
1016 reply_nterror(req, NT_STATUS_NO_MEMORY);
1017 goto out;
1018 }
1019 pdata = *ppdata;
1020 data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
1021 /*
1022 * squash valgrind "writev(vector[...]) points to uninitialised byte(s)"
1023 * error.
1024 */
1025 memset(pdata + total_data, 0, ((max_data_bytes + DIR_ENTRY_SAFETY_MARGIN) - total_data));
1026 /* Realloc the params space */
1027 *pparams = (char *)SMB_REALLOC(*pparams, 10);
1028 if (*pparams == NULL) {
1029 reply_nterror(req, NT_STATUS_NO_MEMORY);
1030 goto out;
1031 }
1032 params = *pparams;
1033
1034 /*
1035 * Open an fsp on this directory for the dptr.
1036 */
1037 ntstatus = SMB_VFS_CREATE_FILE(
1038 conn, /* conn */
1039 req, /* req */
1040 dirfsp, /* dirfsp */
1041 smb_dname, /* dname */
1042 FILE_LIST_DIRECTORY, /* access_mask */
1043 FILE_SHARE_READ|
1044 FILE_SHARE_WRITE, /* share_access */
1045 FILE_OPEN, /* create_disposition*/
1046 FILE_DIRECTORY_FILE, /* create_options */
1047 FILE_ATTRIBUTE_DIRECTORY,/* file_attributes */
1048 NO_OPLOCK, /* oplock_request */
1049 NULL, /* lease */
1050 0, /* allocation_size */
1051 0, /* private_flags */
1052 NULL, /* sd */
1053 NULL, /* ea_list */
1054 &fsp, /* result */
1055 NULL, /* pinfo */
1056 NULL, /* in_context */
1057 NULL);/* out_context */
1058
1059 if (!NT_STATUS_IS_OK(ntstatus)) {
1060 DBG_ERR("failed to open directory %s\n",
1061 smb_fname_str_dbg(smb_dname));
1062 reply_nterror(req, ntstatus);
1063 goto out;
1064 }
1065
1066 /* Save the wildcard match and attribs we are using on this directory -
1067 needed as lanman2 assumes these are being saved between calls */
1068
1069 ntstatus = dptr_create(conn,
1070 req,
1071 fsp, /* fsp */
1072 False,
1073 mask,
1074 dirtype,
1075 &fsp->dptr);
1076
1077 if (!NT_STATUS_IS_OK(ntstatus)) {
1078 /*
1079 * Use NULL here for the first parameter (req)
1080 * as this is not a client visible handle so
1081 * can't be part of an SMB1 chain.
1082 */
1083 close_file_free(NULL, &fsp, NORMAL_CLOSE);
1084 reply_nterror(req, ntstatus);
1085 goto out;
1086 }
1087
1088 if (backup_priv) {
1089 /* Remember this in case we have
1090 to do a findnext. */
1091 dptr_set_priv(fsp->dptr);
1092 }
1093
1094 dptr_num = dptr_dnum(fsp->dptr);
1095 DEBUG(4,("dptr_num is %d, wcard = %s, attr = %d\n", dptr_num, mask, dirtype));
1096
1097 /* We don't need to check for VOL here as this is returned by
1098 a different TRANS2 call. */
1099
1100 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1101 directory,lp_dont_descend(talloc_tos(), lp_sub, SNUM(conn))));
1102 if (in_list(directory,
1103 lp_dont_descend(talloc_tos(), lp_sub, SNUM(conn)),
1104 dptr_case_sensitive(fsp->dptr))) {
1105 dont_descend = True;
1106 }
1107
1108 p = pdata;
1109 space_remaining = max_data_bytes;
1110 out_of_space = False;
1111
1112 ask_sharemode = fsp_search_ask_sharemode(fsp);
1113
1114 for (i=0;(i<maxentries) && !finished && !out_of_space;i++) {
1115
1116 ntstatus = get_lanman2_dir_entry(talloc_tos(),
1117 conn,
1118 fsp->dptr,
1119 req->flags2,
1120 mask,
1121 dirtype,
1122 info_level,
1123 requires_resume_key,
1124 dont_descend,
1125 ask_sharemode,
1126 &p,
1127 pdata,
1128 data_end,
1129 space_remaining,
1130 &last_entry_off,
1131 ea_list);
1132 if (NT_STATUS_EQUAL(ntstatus, NT_STATUS_ILLEGAL_CHARACTER)) {
1133 /*
1134 * Bad character conversion on name. Ignore
1135 * this entry.
1136 */
1137 continue;
1138 }
1139 if (NT_STATUS_EQUAL(ntstatus, STATUS_MORE_ENTRIES)) {
1140 out_of_space = true;
1141 } else {
1142 finished = !NT_STATUS_IS_OK(ntstatus);
1143 }
1144
1145 if (!finished && !out_of_space) {
1146 numentries++;
1147 }
1148
1149 /* Ensure space_remaining never goes -ve. */
1150 if (PTR_DIFF(p,pdata) > max_data_bytes) {
1151 space_remaining = 0;
1152 out_of_space = true;
1153 } else {
1154 space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
1155 }
1156 }
1157
1158 /* Check if we can close the dirptr */
1159 if(close_after_first || (finished && close_if_end)) {
1160 DEBUG(5,("call_trans2findfirst - (2) closing dptr_num %d\n", dptr_num));
1161 dptr_num = -1;
1162 close_file_free(NULL, &fsp, NORMAL_CLOSE);
1163 }
1164
1165 /*
1166 * If there are no matching entries we must return ERRDOS/ERRbadfile -
1167 * from observation of NT. NB. This changes to ERRDOS,ERRnofiles if
1168 * the protocol level is less than NT1. Tested with smbclient. JRA.
1169 * This should fix the OS/2 client bug #2335.
1170 */
1171
1172 if(numentries == 0) {
1173 dptr_num = -1;
1174 /*
1175 * We may have already closed the file in the
1176 * close_after_first or finished case above.
1177 */
1178 if (fsp != NULL) {
1179 close_file_free(NULL, &fsp, NORMAL_CLOSE);
1180 }
1181 if (xconn->protocol < PROTOCOL_NT1) {
1182 reply_force_doserror(req, ERRDOS, ERRnofiles);
1183 goto out;
1184 } else {
1185 reply_botherror(req, NT_STATUS_NO_SUCH_FILE,
1186 ERRDOS, ERRbadfile);
1187 goto out;
1188 }
1189 }
1190
1191 /* At this point pdata points to numentries directory entries. */
1192
1193 /* Set up the return parameter block */
1194 SSVAL(params,0,dptr_num);
1195 SSVAL(params,2,numentries);
1196 SSVAL(params,4,finished);
1197 SSVAL(params,6,0); /* Never an EA error */
1198 SSVAL(params,8,last_entry_off);
1199
1200 send_trans2_replies(conn, req, NT_STATUS_OK, params, 10, pdata, PTR_DIFF(p,pdata),
1201 max_data_bytes);
1202
1203 if ((! *directory) && dptr_path(sconn, dptr_num)) {
1204 directory = talloc_strdup(talloc_tos(),dptr_path(sconn, dptr_num));
1205 if (!directory) {
1206 reply_nterror(req, NT_STATUS_NO_MEMORY);
1207 }
1208 }
1209
1210 DEBUG( 4, ( "%s mask=%s directory=%s dirtype=%d numentries=%d\n",
1211 smb_fn_name(req->cmd),
1212 mask, directory, dirtype, numentries ) );
1213
1214 /*
1215 * Force a name mangle here to ensure that the
1216 * mask as an 8.3 name is top of the mangled cache.
1217 * The reasons for this are subtle. Don't remove
1218 * this code unless you know what you are doing
1219 * (see PR#13758). JRA.
1220 */
1221
1222 if(!mangle_is_8_3_wildcards( mask, False, conn->params)) {
1223 char mangled_name[13];
1224 name_to_8_3(mask, mangled_name, True, conn->params);
1225 }
1226 out:
1227
1228 if (as_root) {
1229 unbecome_root();
1230 }
1231
1232 TALLOC_FREE(smb_dname);
1233 return;
1234 }
1235
1236 static bool smbd_dptr_name_equal(struct dptr_struct *dptr,
1237 const char *name1,
1238 const char *name2)
1239 {
1240 bool equal;
1241
1242 if (dptr_case_sensitive(dptr)) {
1243 equal = (strcmp(name1, name2) == 0);
1244 } else {
1245 equal = strequal(name1, name2);
1246 }
1247
1248 return equal;
1249 }
1250
1251 /****************************************************************************
1252 Reply to a TRANS2_FINDNEXT.
1253 ****************************************************************************/
1254
1255 static void call_trans2findnext(connection_struct *conn,
1256 struct smb_request *req,
1257 char **pparams, int total_params,
1258 char **ppdata, int total_data,
1259 unsigned int max_data_bytes)
1260 {
1261 /* We must be careful here that we don't return more than the
1262 allowed number of data bytes. If this means returning fewer than
1263 maxentries then so be it. We assume that the redirector has
1264 enough room for the fixed number of parameter bytes it has
1265 requested. */
1266 char *params = *pparams;
1267 char *pdata = *ppdata;
1268 char *data_end;
1269 int dptr_num;
1270 int maxentries;
1271 uint16_t info_level;
1272 uint32_t resume_key;
1273 uint16_t findnext_flags;
1274 bool close_after_request;
1275 bool close_if_end;
1276 bool requires_resume_key;
1277 bool continue_bit;
1278 char *resume_name = NULL;
1279 const char *mask = NULL;
1280 const char *directory = NULL;
1281 char *p = NULL;
1282 uint16_t dirtype;
1283 int numentries = 0;
1284 int i, last_entry_off=0;
1285 bool finished = False;
1286 bool dont_descend = False;
1287 bool out_of_space = False;
1288 int space_remaining;
1289 struct ea_list *ea_list = NULL;
1290 NTSTATUS ntstatus = NT_STATUS_OK;
1291 bool ask_sharemode;
1292 TALLOC_CTX *ctx = talloc_tos();
1293 struct smbd_server_connection *sconn = req->sconn;
1294 bool backup_priv = false;
1295 bool as_root = false;
1296 files_struct *fsp = NULL;
1297 const struct loadparm_substitution *lp_sub =
1298 loadparm_s3_global_substitution();
1299
1300 if (total_params < 13) {
1301 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1302 return;
1303 }
1304
1305 dptr_num = SVAL(params,0);
1306 maxentries = SVAL(params,2);
1307 info_level = SVAL(params,4);
1308 resume_key = IVAL(params,6);
1309 findnext_flags = SVAL(params,10);
1310 close_after_request = (findnext_flags & FLAG_TRANS2_FIND_CLOSE);
1311 close_if_end = (findnext_flags & FLAG_TRANS2_FIND_CLOSE_IF_END);
1312 requires_resume_key = (findnext_flags & FLAG_TRANS2_FIND_REQUIRE_RESUME);
1313 continue_bit = (findnext_flags & FLAG_TRANS2_FIND_CONTINUE);
1314
1315 if (!continue_bit) {
1316 /* We only need resume_name if continue_bit is zero. */
1317 if (req->posix_pathnames) {
1318 srvstr_get_path_posix(ctx,
1319 params,
1320 req->flags2,
1321 &resume_name,
1322 params+12,
1323 total_params - 12,
1324 STR_TERMINATE,
1325 &ntstatus);
1326 } else {
1327 srvstr_get_path(ctx,
1328 params,
1329 req->flags2,
1330 &resume_name,
1331 params+12,
1332 total_params - 12,
1333 STR_TERMINATE,
1334 &ntstatus);
1335 }
1336 if (!NT_STATUS_IS_OK(ntstatus)) {
1337 /* Win9x or OS/2 can send a resume name of ".." or ".". This will cause the parser to
1338 complain (it thinks we're asking for the directory above the shared
1339 path or an invalid name). Catch this as the resume name is only compared, never used in
1340 a file access. JRA. */
1341 srvstr_pull_talloc(ctx, params, req->flags2,
1342 &resume_name, params+12,
1343 total_params - 12,
1344 STR_TERMINATE);
1345
1346 if (!resume_name || !(ISDOT(resume_name) || ISDOTDOT(resume_name))) {
1347 reply_nterror(req, ntstatus);
1348 return;
1349 }
1350 }
1351 }
1352
1353 DBG_NOTICE("dirhandle = %d, max_data_bytes = %u, maxentries = %d, "
1354 "close_after_request=%d, close_if_end = %d "
1355 "requires_resume_key = %d resume_key = %d "
1356 "resume name = %s continue=%d level = %d\n",
1357 dptr_num,
1358 max_data_bytes,
1359 maxentries,
1360 close_after_request,
1361 close_if_end,
1362 requires_resume_key,
1363 resume_key,
1364 resume_name ? resume_name : "(NULL)",
1365 continue_bit,
1366 info_level);
1367
1368 if (!maxentries) {
1369 /* W2K3 seems to treat zero as 1. */
1370 maxentries = 1;
1371 }
1372
1373 switch (info_level) {
1374 case SMB_FIND_INFO_STANDARD:
1375 case SMB_FIND_EA_SIZE:
1376 case SMB_FIND_EA_LIST:
1377 case SMB_FIND_FILE_DIRECTORY_INFO:
1378 case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
1379 case SMB_FIND_FILE_NAMES_INFO:
1380 case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
1381 case SMB_FIND_ID_FULL_DIRECTORY_INFO:
1382 case SMB_FIND_ID_BOTH_DIRECTORY_INFO:
1383 break;
1384 case SMB_FIND_FILE_UNIX:
1385 case SMB_FIND_FILE_UNIX_INFO2:
1386 if (!lp_smb1_unix_extensions()) {
1387 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
1388 return;
1389 }
1390 if (!req->posix_pathnames) {
1391 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
1392 return;
1393 }
1394 break;
1395 default:
1396 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
1397 return;
1398 }
1399
1400 if (info_level == SMB_FIND_EA_LIST) {
1401 uint32_t ea_size;
1402
1403 if (total_data < 4) {
1404 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1405 return;
1406 }
1407
1408 ea_size = IVAL(pdata,0);
1409 if (ea_size != total_data) {
1410 DBG_NOTICE("Rejecting EA request with incorrect "
1411 "total_data=%d (should be %" PRIu32 ")\n",
1412 total_data,
1413 ea_size);
1414 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1415 return;
1416 }
1417
1418 if (!lp_ea_support(SNUM(conn))) {
1419 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1420 return;
1421 }
1422
1423 /* Pull out the list of names. */
1424 ea_list = read_ea_name_list(ctx, pdata + 4, ea_size - 4);
1425 if (!ea_list) {
1426 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1427 return;
1428 }
1429 }
1430
1431 if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
1432 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1433 return;
1434 }
1435
1436 *ppdata = (char *)SMB_REALLOC(
1437 *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
1438 if(*ppdata == NULL) {
1439 reply_nterror(req, NT_STATUS_NO_MEMORY);
1440 return;
1441 }
1442
1443 pdata = *ppdata;
1444 data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
1445
1446 /*
1447 * squash valgrind "writev(vector[...]) points to uninitialised byte(s)"
1448 * error.
1449 */
1450 memset(pdata + total_data, 0, (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN) - total_data);
1451 /* Realloc the params space */
1452 *pparams = (char *)SMB_REALLOC(*pparams, 6*SIZEOFWORD);
1453 if(*pparams == NULL ) {
1454 reply_nterror(req, NT_STATUS_NO_MEMORY);
1455 return;
1456 }
1457
1458 params = *pparams;
1459
1460 /* Check that the dptr is valid */
1461 fsp = dptr_fetch_lanman2_fsp(sconn, dptr_num);
1462 if (fsp == NULL) {
1463 reply_nterror(req, STATUS_NO_MORE_FILES);
1464 return;
1465 }
1466
1467 directory = dptr_path(sconn, dptr_num);
1468
1469 /* Get the wildcard mask from the dptr */
1470 if((mask = dptr_wcard(sconn, dptr_num))== NULL) {
1471 DEBUG(2,("dptr_num %d has no wildcard\n", dptr_num));
1472 reply_nterror(req, STATUS_NO_MORE_FILES);
1473 return;
1474 }
1475
1476 /* Get the attr mask from the dptr */
1477 dirtype = dptr_attr(sconn, dptr_num);
1478
1479 backup_priv = dptr_get_priv(fsp->dptr);
1480
1481 DEBUG(3,("dptr_num is %d, mask = %s, attr = %x, dirptr=(0x%lX) "
1482 "backup_priv = %d\n",
1483 dptr_num, mask, dirtype,
1484 (long)fsp->dptr,
1485 (int)backup_priv));
1486
1487 /* We don't need to check for VOL here as this is returned by
1488 a different TRANS2 call. */
1489
1490 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1491 directory,lp_dont_descend(ctx, lp_sub, SNUM(conn))));
1492 if (in_list(directory,lp_dont_descend(ctx, lp_sub, SNUM(conn)),
1493 dptr_case_sensitive(fsp->dptr)))
1494 dont_descend = True;
1495
1496 p = pdata;
1497 space_remaining = max_data_bytes;
1498 out_of_space = False;
1499
1500 if (backup_priv) {
1501 become_root();
1502 as_root = true;
1503 }
1504
1505 /*
1506 * Seek to the correct position. We no longer use the resume key but
1507 * depend on the last file name instead.
1508 */
1509
1510 if(!continue_bit && resume_name && *resume_name) {
1511 bool posix_open = (fsp->posix_flags & FSP_POSIX_FLAGS_OPEN);
1512 char *last_name_sent = NULL;
1513 bool sequential;
1514
1515 /*
1516 * Remember, name_to_8_3 is called by
1517 * get_lanman2_dir_entry(), so the resume name
1518 * could be mangled. Ensure we check the unmangled name.
1519 */
1520
1521 if (!posix_open &&
1522 mangle_is_mangled(resume_name, conn->params)) {
1523 char *new_resume_name = NULL;
1524 mangle_lookup_name_from_8_3(ctx,
1525 resume_name,
1526 &new_resume_name,
1527 conn->params);
1528 if (new_resume_name) {
1529 resume_name = new_resume_name;
1530 }
1531 }
1532
1533 /*
1534 * Fix for NT redirector problem triggered by resume key indexes
1535 * changing between directory scans. We now return a resume key of 0
1536 * and instead look for the filename to continue from (also given
1537 * to us by NT/95/smbfs/smbclient). If no other scans have been done between the
1538 * findfirst/findnext (as is usual) then the directory pointer
1539 * should already be at the correct place.
1540 */
1541
1542 last_name_sent = smbd_dirptr_get_last_name_sent(fsp->dptr);
1543 sequential = smbd_dptr_name_equal(fsp->dptr,
1544 resume_name,
1545 last_name_sent);
1546 if (!sequential) {
1547 char *name = NULL;
1548 bool found = false;
1549
1550 dptr_RewindDir(fsp->dptr);
1551
1552 while ((name = dptr_ReadDirName(talloc_tos(),
1553 fsp->dptr)) != NULL) {
1554 found = smbd_dptr_name_equal(fsp->dptr,
1555 resume_name,
1556 name);
1557 TALLOC_FREE(name);
1558 if (found) {
1559 break;
1560 }
1561 }
1562
1563 if (!found) {
1564 /*
1565 * We got a name that used to exist
1566 * but does not anymore. Just start
1567 * from the beginning. Shown by the
1568 * "raw.search.os2 delete" smbtorture
1569 * test.
1570 */
1571 dptr_RewindDir(fsp->dptr);
1572 }
1573 }
1574 } /* end if resume_name && !continue_bit */
1575
1576 ask_sharemode = fsp_search_ask_sharemode(fsp);
1577
1578 for (i=0;(i<(int)maxentries) && !finished && !out_of_space ;i++) {
1579
1580 ntstatus = get_lanman2_dir_entry(ctx,
1581 conn,
1582 fsp->dptr,
1583 req->flags2,
1584 mask,
1585 dirtype,
1586 info_level,
1587 requires_resume_key,
1588 dont_descend,
1589 ask_sharemode,
1590 &p,
1591 pdata,
1592 data_end,
1593 space_remaining,
1594 &last_entry_off,
1595 ea_list);
1596 if (NT_STATUS_EQUAL(ntstatus, NT_STATUS_ILLEGAL_CHARACTER)) {
1597 /*
1598 * Bad character conversion on name. Ignore
1599 * this entry.
1600 */
1601 continue;
1602 }
1603 if (NT_STATUS_EQUAL(ntstatus, STATUS_MORE_ENTRIES)) {
1604 out_of_space = true;
1605 } else {
1606 finished = !NT_STATUS_IS_OK(ntstatus);
1607 }
1608
1609 if (!finished && !out_of_space) {
1610 numentries++;
1611 }
1612
1613 space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
1614 }
1615
1616 DEBUG( 3, ( "%s mask=%s directory=%s dirtype=%d numentries=%d\n",
1617 smb_fn_name(req->cmd),
1618 mask, directory, dirtype, numentries ) );
1619
1620 /* Check if we can close the fsp->dptr */
1621 if(close_after_request || (finished && close_if_end)) {
1622 DBG_INFO("closing dptr_num = %d\n", dptr_num);
1623 dptr_num = -1;
1624 close_file_free(NULL, &fsp, NORMAL_CLOSE);
1625 }
1626
1627 if (as_root) {
1628 unbecome_root();
1629 }
1630
1631 /* Set up the return parameter block */
1632 SSVAL(params,0,numentries);
1633 SSVAL(params,2,finished);
1634 SSVAL(params,4,0); /* Never an EA error */
1635 SSVAL(params,6,last_entry_off);
1636
1637 send_trans2_replies(conn, req, NT_STATUS_OK, params, 8, pdata, PTR_DIFF(p,pdata),
1638 max_data_bytes);
1639
1640 return;
1641 }
1642
1643 /****************************************************************************
1644 Reply to a TRANS2_QFSINFO (query filesystem info).
1645 ****************************************************************************/
1646
1647 static void call_trans2qfsinfo(connection_struct *conn,
1648 struct smb_request *req,
1649 char **pparams, int total_params,
1650 char **ppdata, int total_data,
1651 unsigned int max_data_bytes)
1652 {
1653 char *params = *pparams;
1654 uint16_t info_level;
1655 int data_len = 0;
1656 size_t fixed_portion;
1657 NTSTATUS status;
1658
1659 if (total_params < 2) {
1660 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1661 return;
1662 }
1663
1664 info_level = SVAL(params,0);
1665
1666 if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
1667 if (info_level != SMB_QUERY_CIFS_UNIX_INFO) {
1668 DEBUG(0,("call_trans2qfsinfo: encryption required "
1669 "and info level 0x%x sent.\n",
1670 (unsigned int)info_level));
1671 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1672 return;
1673 }
1674 }
1675
1676 DEBUG(3,("call_trans2qfsinfo: level = %d\n", info_level));
1677
1678 status = smbd_do_qfsinfo(req->xconn, conn, req,
1679 info_level,
1680 req->flags2,
1681 max_data_bytes,
1682 &fixed_portion,
1683 NULL,
1684 NULL,
1685 ppdata, &data_len);
1686 if (!NT_STATUS_IS_OK(status)) {
1687 reply_nterror(req, status);
1688 return;
1689 }
1690
1691 send_trans2_replies(conn, req, NT_STATUS_OK, params, 0, *ppdata, data_len,
1692 max_data_bytes);
1693
1694 DEBUG( 4, ( "%s info_level = %d\n",
1695 smb_fn_name(req->cmd), info_level) );
1696
1697 return;
1698 }
1699
1700 /****************************************************************************
1701 Reply to a TRANS2_SETFSINFO (set filesystem info).
1702 ****************************************************************************/
1703
1704 static void call_trans2setfsinfo(connection_struct *conn,
1705 struct smb_request *req,
1706 char **pparams, int total_params,
1707 char **ppdata, int total_data,
1708 unsigned int max_data_bytes)
1709 {
1710 const struct loadparm_substitution *lp_sub =
1711 loadparm_s3_global_substitution();
1712 struct smbXsrv_connection *xconn = req->xconn;
1713 char *pdata = *ppdata;
1714 char *params = *pparams;
1715 uint16_t info_level;
1716
1717 DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",
1718 lp_servicename(talloc_tos(), lp_sub, SNUM(conn))));
1719
1720 /* */
1721 if (total_params < 4) {
1722 DEBUG(0,("call_trans2setfsinfo: requires total_params(%d) >= 4 bytes!\n",
1723 total_params));
1724 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1725 return;
1726 }
1727
1728 info_level = SVAL(params,2);
1729
1730 if (IS_IPC(conn)) {
1731 if (info_level != SMB_REQUEST_TRANSPORT_ENCRYPTION &&
1732 info_level != SMB_SET_CIFS_UNIX_INFO) {
1733 DEBUG(0,("call_trans2setfsinfo: not an allowed "
1734 "info level (0x%x) on IPC$.\n",
1735 (unsigned int)info_level));
1736 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1737 return;
1738 }
1739 }
1740
1741 if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
1742 if (info_level != SMB_REQUEST_TRANSPORT_ENCRYPTION) {
1743 DEBUG(0,("call_trans2setfsinfo: encryption required "
1744 "and info level 0x%x sent.\n",
1745 (unsigned int)info_level));
1746 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1747 return;
1748 }
1749 }
1750
1751 switch(info_level) {
1752 case SMB_SET_CIFS_UNIX_INFO:
1753 if (!lp_smb1_unix_extensions()) {
1754 DEBUG(2,("call_trans2setfsinfo: "
1755 "SMB_SET_CIFS_UNIX_INFO is invalid with "
1756 "unix extensions off\n"));
1757 reply_nterror(req,
1758 NT_STATUS_INVALID_LEVEL);
1759 return;
1760 }
1761
1762 /* There should be 12 bytes of capabilities set. */
1763 if (total_data < 12) {
1764 reply_nterror(
1765 req,
1766 NT_STATUS_INVALID_PARAMETER);
1767 return;
1768 }
1769 xconn->smb1.unix_info.client_major = SVAL(pdata,0);
1770 xconn->smb1.unix_info.client_minor = SVAL(pdata,2);
1771 xconn->smb1.unix_info.client_cap_low = IVAL(pdata,4);
1772 xconn->smb1.unix_info.client_cap_high = IVAL(pdata,8);
1773
1774 /* Just print these values for now. */
1775 DBG_DEBUG("set unix_info info. "
1776 "major = %"PRIu16", minor = %"PRIu16
1777 "cap_low = 0x%"PRIx32", "
1778 "cap_high = 0x%"PRIx32"\n",
1779 xconn->smb1.unix_info.client_major,
1780 xconn->smb1.unix_info.client_minor,
1781 xconn->smb1.unix_info.client_cap_low,
1782 xconn->smb1.unix_info.client_cap_high);
1783
1784 /*
1785 * Here is where we must switch to posix
1786 * pathname processing...
1787 */
1788 if (xconn->smb1.unix_info.client_cap_low &
1789 CIFS_UNIX_POSIX_PATHNAMES_CAP)
1790 {
1791 lp_set_posix_pathnames();
1792 mangle_change_to_posix();
1793 }
1794
1795 if ((xconn->smb1.unix_info.client_cap_low &
1796 CIFS_UNIX_FCNTL_LOCKS_CAP) &&
1797 !(xconn->smb1.unix_info.client_cap_low &
1798 CIFS_UNIX_POSIX_PATH_OPERATIONS_CAP))
1799 {
1800 /* Client that knows how to do posix locks,
1801 * but not posix open/mkdir operations. Set a
1802 * default type for read/write checks. */
1803
1804 lp_set_posix_default_cifsx_readwrite_locktype(
1805 POSIX_LOCK);
1806
1807 }
1808 break;
1809
1810 case SMB_REQUEST_TRANSPORT_ENCRYPTION:
1811 {
1812 NTSTATUS status;
1813 size_t param_len = 0;
1814 size_t data_len = total_data;
1815
1816 if (!lp_smb1_unix_extensions()) {
1817 reply_nterror(
1818 req,
1819 NT_STATUS_INVALID_LEVEL);
1820 return;
1821 }
1822
1823 if (lp_server_smb_encrypt(SNUM(conn)) ==
1824 SMB_ENCRYPTION_OFF) {
1825 reply_nterror(
1826 req,
1827 NT_STATUS_NOT_SUPPORTED);
1828 return;
1829 }
1830
1831 if (xconn->smb1.echo_handler.trusted_fde) {
1832 DEBUG( 2,("call_trans2setfsinfo: "
1833 "request transport encryption disabled"
1834 "with 'fork echo handler = yes'\n"));
1835 reply_nterror(
1836 req,
1837 NT_STATUS_NOT_SUPPORTED);
1838 return;
1839 }
1840
1841 DEBUG( 4,("call_trans2setfsinfo: "
1842 "request transport encryption.\n"));
1843
1844 status = srv_request_encryption_setup(conn,
1845 (unsigned char **)ppdata,
1846 &data_len,
1847 (unsigned char **)pparams,
1848 &param_len);
1849
1850 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
1851 !NT_STATUS_IS_OK(status)) {
1852 reply_nterror(req, status);
1853 return;
1854 }
1855
1856 send_trans2_replies(conn, req,
1857 NT_STATUS_OK,
1858 *pparams,
1859 param_len,
1860 *ppdata,
1861 data_len,
1862 max_data_bytes);
1863
1864 if (NT_STATUS_IS_OK(status)) {
1865 /* Server-side transport
1866 * encryption is now *on*. */
1867 status = srv_encryption_start(conn);
1868 if (!NT_STATUS_IS_OK(status)) {
1869 char *reason = talloc_asprintf(talloc_tos(),
1870 "Failure in setting "
1871 "up encrypted transport: %s",
1872 nt_errstr(status));
1873 exit_server_cleanly(reason);
1874 }
1875 }
1876 return;
1877 }
1878
1879 case SMB_FS_QUOTA_INFORMATION:
1880 {
1881 NTSTATUS status;
1882 DATA_BLOB qdata = {
1883 .data = (uint8_t *)pdata,
1884 .length = total_data
1885 };
1886 files_struct *fsp = NULL;
1887 fsp = file_fsp(req, SVAL(params,0));
1888
1889 status = smb_set_fsquota(conn,
1890 req,
1891 fsp,
1892 &qdata);
1893 if (!NT_STATUS_IS_OK(status)) {
1894 reply_nterror(req, status);
1895 return;
1896 }
1897 break;
1898 }
1899 default:
1900 DEBUG(3,("call_trans2setfsinfo: unknown level (0x%X) not implemented yet.\n",
1901 info_level));
1902 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
1903 return;
1904 break;
1905 }
1906
1907 /*
1908 * sending this reply works fine,
1909 * but I'm not sure it's the same
1910 * like windows do...
1911 * --metze
1912 */
1913 reply_smb1_outbuf(req, 10, 0);
1914 }
1915
1916 /****************************************************************************
1917 Reply to a TRANSACT2_QFILEINFO on a PIPE !
1918 ****************************************************************************/
1919
1920 static void call_trans2qpipeinfo(connection_struct *conn,
1921 struct smb_request *req,
1922 files_struct *fsp,
1923 uint16_t info_level,
1924 unsigned int tran_call,
1925 char **pparams, int total_params,
1926 char **ppdata, int total_data,
1927 unsigned int max_data_bytes)
1928 {
1929 char *params = *pparams;
1930 char *pdata = *ppdata;
1931 unsigned int data_size = 0;
1932 unsigned int param_size = 2;
1933
1934 if (!fsp_is_np(fsp)) {
1935 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1936 return;
1937 }
1938
1939 *pparams = (char *)SMB_REALLOC(*pparams,2);
1940 if (*pparams == NULL) {
1941 reply_nterror(req, NT_STATUS_NO_MEMORY);
1942 return;
1943 }
1944 params = *pparams;
1945 SSVAL(params,0,0);
1946 if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
1947 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1948 return;
1949 }
1950 data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
1951 *ppdata = (char *)SMB_REALLOC(*ppdata, data_size);
1952 if (*ppdata == NULL ) {
1953 reply_nterror(req, NT_STATUS_NO_MEMORY);
1954 return;
1955 }
1956 pdata = *ppdata;
1957
1958 switch (info_level) {
1959 case SMB_FILE_STANDARD_INFORMATION:
1960 memset(pdata,0,24);
1961 SOFF_T(pdata,0,4096LL);
1962 SIVAL(pdata,16,1);
1963 SIVAL(pdata,20,1);
1964 data_size = 24;
1965 break;
1966
1967 default:
1968 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
1969 return;
1970 }
1971
1972 send_trans2_replies(conn, req, NT_STATUS_OK, params, param_size, *ppdata, data_size,
1973 max_data_bytes);
1974 }
1975
1976 static void handle_trans2qfilepathinfo_result(
1977 connection_struct *conn,
1978 struct smb_request *req,
1979 uint16_t info_level,
1980 NTSTATUS status,
1981 char *pdata,
1982 int data_return_size,
1983 size_t fixed_portion,
1984 unsigned int max_data_bytes)
1985 {
1986 char params[2] = { 0, 0, };
1987 int param_size = 2;
1988
1989 /*
1990 * draft-leach-cifs-v1-spec-02.txt
1991 * 4.2.14 TRANS2_QUERY_PATH_INFORMATION: Get File Attributes given Path
1992 * says:
1993 *
1994 * The requested information is placed in the Data portion of the
1995 * transaction response. For the information levels greater than 0x100,
1996 * the transaction response has 1 parameter word which should be
1997 * ignored by the client.
1998 *
1999 * However Windows only follows this rule for the IS_NAME_VALID call.
2000 */
2001 switch (info_level) {
2002 case SMB_INFO_IS_NAME_VALID:
2003 param_size = 0;
2004 break;
2005 }
2006
2007 if (!NT_STATUS_IS_OK(status)) {
2008 if (open_was_deferred(req->xconn, req->mid)) {
2009 /* We have re-scheduled this call. */
2010 return;
2011 }
2012 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
2013 bool ok = defer_smb1_sharing_violation(req);
2014 if (ok) {
2015 return;
2016 }
2017 }
2018 reply_nterror(req, status);
2019 return;
2020 }
2021
2022 if (fixed_portion > max_data_bytes) {
2023 reply_nterror(req, NT_STATUS_INFO_LENGTH_MISMATCH);
2024 return;
2025 }
2026
2027 send_trans2_replies(
2028 conn,
2029 req,
2030 NT_STATUS_OK,
2031 params,
2032 param_size,
2033 pdata,
2034 data_return_size,
2035 max_data_bytes);
2036 }
2037
2038 /****************************************************************************
2039 Reply to a TRANS2_QFILEPATHINFO or TRANSACT2_QFILEINFO (query file info by
2040 file name or file id).
2041 ****************************************************************************/
2042
2043 static void call_trans2qfilepathinfo(connection_struct *conn,
2044 struct smb_request *req,
2045 unsigned int tran_call,
2046 uint16_t info_level,
2047 struct smb_filename *smb_fname,
2048 struct files_struct *fsp,
2049 bool delete_pending,
2050 struct timespec write_time_ts,
2051 char **pparams, int total_params,
2052 char **ppdata, int total_data,
2053 unsigned int max_data_bytes)
2054 {
2055 char *params = *pparams;
2056 char *pdata = *ppdata;
2057 unsigned int data_size = 0;
2058 struct ea_list *ea_list = NULL;
2059 size_t fixed_portion;
2060 NTSTATUS status = NT_STATUS_OK;
2061
2062 DEBUG(3,("call_trans2qfilepathinfo %s (%s) level=%d call=%d "
2063 "total_data=%d\n", smb_fname_str_dbg(smb_fname),
2064 fsp_fnum_dbg(fsp),
2065 info_level,tran_call,total_data));
2066
2067 /* Pull out any data sent here before we realloc. */
2068 switch (info_level) {
2069 case SMB_INFO_QUERY_EAS_FROM_LIST:
2070 {
2071 /* Pull any EA list from the data portion. */
2072 uint32_t ea_size;
2073
2074 if (total_data < 4) {
2075 reply_nterror(
2076 req, NT_STATUS_INVALID_PARAMETER);
2077 return;
2078 }
2079 ea_size = IVAL(pdata,0);
2080
2081 if (total_data > 0 && ea_size != total_data) {
2082 DEBUG(4,("call_trans2qfilepathinfo: Rejecting EA request with incorrect \
2083 total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pdata,0) ));
2084 reply_nterror(
2085 req, NT_STATUS_INVALID_PARAMETER);
2086 return;
2087 }
2088
2089 if (!lp_ea_support(SNUM(conn))) {
2090 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
2091 return;
2092 }
2093
2094 /* Pull out the list of names. */
2095 ea_list = read_ea_name_list(req, pdata + 4, ea_size - 4);
2096 if (!ea_list) {
2097 reply_nterror(
2098 req, NT_STATUS_INVALID_PARAMETER);
2099 return;
2100 }
2101 break;
2102 }
2103
2104 default:
2105 break;
2106 }
2107
2108 *pparams = (char *)SMB_REALLOC(*pparams,2);
2109 if (*pparams == NULL) {
2110 reply_nterror(req, NT_STATUS_NO_MEMORY);
2111 return;
2112 }
2113 params = *pparams;
2114 SSVAL(params,0,0);
2115
2116 if ((info_level & SMB2_INFO_SPECIAL) == SMB2_INFO_SPECIAL) {
2117 /*
2118 * We use levels that start with 0xFF00
2119 * internally to represent SMB2 specific levels
2120 */
2121 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2122 return;
2123 }
2124
2125 status = smbd_do_qfilepathinfo(conn, req, req, info_level,
2126 fsp, smb_fname,
2127 delete_pending, write_time_ts,
2128 ea_list,
2129 req->flags2, max_data_bytes,
2130 &fixed_portion,
2131 ppdata, &data_size);
2132
2133 handle_trans2qfilepathinfo_result(
2134 conn,
2135 req,
2136 info_level,
2137 status,
2138 *ppdata,
2139 data_size,
2140 fixed_portion,
2141 max_data_bytes);
2142 }
2143
2144 static NTSTATUS smb_q_unix_basic(
2145 struct connection_struct *conn,
2146 struct smb_request *req,
2147 struct smb_filename *smb_fname,
2148 struct files_struct *fsp,
2149 char **ppdata,
2150 int *ptotal_data)
2151 {
2152 const int total_data = 100;
2153
2154 *ppdata = SMB_REALLOC(*ppdata, total_data);
2155 if (*ppdata == NULL) {
2156 return NT_STATUS_NO_MEMORY;
2157 }
2158 store_file_unix_basic(conn, *ppdata, fsp, &smb_fname->st);
2159
2160 *ptotal_data = total_data;
2161
2162 return NT_STATUS_OK;
2163 }
2164
2165 static NTSTATUS smb_q_unix_info2(
2166 struct connection_struct *conn,
2167 struct smb_request *req,
2168 struct smb_filename *smb_fname,
2169 struct files_struct *fsp,
2170 char **ppdata,
2171 int *ptotal_data)
2172 {
2173 const int total_data = 116;
2174
2175 *ppdata = SMB_REALLOC(*ppdata, total_data);
2176 if (*ppdata == NULL) {
2177 return NT_STATUS_NO_MEMORY;
2178 }
2179 store_file_unix_basic_info2(conn, *ppdata, fsp, &smb_fname->st);
2180
2181 *ptotal_data = total_data;
2182
2183 return NT_STATUS_OK;
2184 }
2185
2186 #if defined(HAVE_POSIX_ACLS)
2187 /****************************************************************************
2188 Utility function to open a fsp for a POSIX handle operation.
2189 ****************************************************************************/
2190
2191 static NTSTATUS get_posix_fsp(connection_struct *conn,
2192 struct smb_request *req,
2193 struct smb_filename *smb_fname,
2194 uint32_t access_mask,
2195 files_struct **ret_fsp)
2196 {
2197 NTSTATUS status;
2198 uint32_t create_disposition = FILE_OPEN;
2199 uint32_t share_access = FILE_SHARE_READ|
2200 FILE_SHARE_WRITE|
2201 FILE_SHARE_DELETE;
2202 struct smb2_create_blobs *posx = NULL;
2203
2204 /*
2205 * Only FILE_FLAG_POSIX_SEMANTICS matters on existing files,
2206 * but set reasonable defaults.
2207 */
2208 uint32_t file_attributes = 0664;
2209 uint32_t oplock = NO_OPLOCK;
2210 uint32_t create_options = FILE_NON_DIRECTORY_FILE;
2211
2212 /* File or directory must exist. */
2213 if (!VALID_STAT(smb_fname->st)) {
2214 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2215 }
2216 /* Cannot be a symlink. */
2217 if (S_ISLNK(smb_fname->st.st_ex_mode)) {
2218 return NT_STATUS_ACCESS_DENIED;
2219 }
2220 /* Set options correctly for directory open. */
2221 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
2222 /*
2223 * Only FILE_FLAG_POSIX_SEMANTICS matters on existing
2224 * directories, but set reasonable defaults.
2225 */
2226 file_attributes = 0775;
2227 create_options = FILE_DIRECTORY_FILE;
2228 }
2229
2230 status = make_smb2_posix_create_ctx(
2231 talloc_tos(), &posx, file_attributes);
2232 if (!NT_STATUS_IS_OK(status)) {
2233 DBG_WARNING("make_smb2_posix_create_ctx failed: %s\n",
2234 nt_errstr(status));
2235 goto done;
2236 }
2237
2238 status = SMB_VFS_CREATE_FILE(
2239 conn, /* conn */
2240 req, /* req */
2241 NULL, /* dirfsp */
2242 smb_fname, /* fname */
2243 access_mask, /* access_mask */
2244 share_access, /* share_access */
2245 create_disposition,/* create_disposition*/
2246 create_options, /* create_options */
2247 file_attributes,/* file_attributes */
2248 oplock, /* oplock_request */
2249 NULL, /* lease */
2250 0, /* allocation_size */
2251 0, /* private_flags */
2252 NULL, /* sd */
2253 NULL, /* ea_list */
2254 ret_fsp, /* result */
2255 NULL, /* pinfo */
2256 posx, /* in_context */
2257 NULL); /* out_context */
2258
2259 done:
2260 TALLOC_FREE(posx);
2261 return status;
2262 }
2263
2264 /****************************************************************************
2265 Utility function to count the number of entries in a POSIX acl.
2266 ****************************************************************************/
2267
2268 static unsigned int count_acl_entries(connection_struct *conn, SMB_ACL_T posix_acl)
2269 {
2270 unsigned int ace_count = 0;
2271 int entry_id = SMB_ACL_FIRST_ENTRY;
2272 SMB_ACL_ENTRY_T entry;
2273
2274 while ( posix_acl && (sys_acl_get_entry(posix_acl, entry_id, &entry) == 1)) {
2275 entry_id = SMB_ACL_NEXT_ENTRY;
2276 ace_count++;
2277 }
2278 return ace_count;
2279 }
2280
2281 /****************************************************************************
2282 Utility function to marshall a POSIX acl into wire format.
2283 ****************************************************************************/
2284
2285 static bool marshall_posix_acl(connection_struct *conn, char *pdata, SMB_STRUCT_STAT *pst, SMB_ACL_T posix_acl)
2286 {
2287 int entry_id = SMB_ACL_FIRST_ENTRY;
2288 SMB_ACL_ENTRY_T entry;
2289
2290 while ( posix_acl && (sys_acl_get_entry(posix_acl, entry_id, &entry) == 1)) {
2291 SMB_ACL_TAG_T tagtype;
2292 SMB_ACL_PERMSET_T permset;
2293 unsigned char perms = 0;
2294 unsigned int own_grp;
2295
2296 entry_id = SMB_ACL_NEXT_ENTRY;
2297
2298 if (sys_acl_get_tag_type(entry, &tagtype) == -1) {
2299 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_TAG_TYPE failed.\n"));
2300 return False;
2301 }
2302
2303 if (sys_acl_get_permset(entry, &permset) == -1) {
2304 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_PERMSET failed.\n"));
2305 return False;
2306 }
2307
2308 perms |= (sys_acl_get_perm(permset, SMB_ACL_READ) ? SMB_POSIX_ACL_READ : 0);
2309 perms |= (sys_acl_get_perm(permset, SMB_ACL_WRITE) ? SMB_POSIX_ACL_WRITE : 0);
2310 perms |= (sys_acl_get_perm(permset, SMB_ACL_EXECUTE) ? SMB_POSIX_ACL_EXECUTE : 0);
2311
2312 SCVAL(pdata,1,perms);
2313
2314 switch (tagtype) {
2315 case SMB_ACL_USER_OBJ:
2316 SCVAL(pdata,0,SMB_POSIX_ACL_USER_OBJ);
2317 own_grp = (unsigned int)pst->st_ex_uid;
2318 SIVAL(pdata,2,own_grp);
2319 SIVAL(pdata,6,0);
2320 break;
2321 case SMB_ACL_USER:
2322 {
2323 uid_t *puid = (uid_t *)sys_acl_get_qualifier(entry);
2324 if (!puid) {
2325 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_QUALIFIER failed.\n"));
2326 return False;
2327 }
2328 own_grp = (unsigned int)*puid;
2329 SCVAL(pdata,0,SMB_POSIX_ACL_USER);
2330 SIVAL(pdata,2,own_grp);
2331 SIVAL(pdata,6,0);
2332 break;
2333 }
2334 case SMB_ACL_GROUP_OBJ:
2335 SCVAL(pdata,0,SMB_POSIX_ACL_GROUP_OBJ);
2336 own_grp = (unsigned int)pst->st_ex_gid;
2337 SIVAL(pdata,2,own_grp);
2338 SIVAL(pdata,6,0);
2339 break;
2340 case SMB_ACL_GROUP:
2341 {
2342 gid_t *pgid= (gid_t *)sys_acl_get_qualifier(entry);
2343 if (!pgid) {
2344 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_QUALIFIER failed.\n"));
2345 return False;
2346 }
2347 own_grp = (unsigned int)*pgid;
2348 SCVAL(pdata,0,SMB_POSIX_ACL_GROUP);
2349 SIVAL(pdata,2,own_grp);
2350 SIVAL(pdata,6,0);
2351 break;
2352 }
2353 case SMB_ACL_MASK:
2354 SCVAL(pdata,0,SMB_POSIX_ACL_MASK);
2355 SIVAL(pdata,2,0xFFFFFFFF);
2356 SIVAL(pdata,6,0xFFFFFFFF);
2357 break;
2358 case SMB_ACL_OTHER:
2359 SCVAL(pdata,0,SMB_POSIX_ACL_OTHER);
2360 SIVAL(pdata,2,0xFFFFFFFF);
2361 SIVAL(pdata,6,0xFFFFFFFF);
2362 break;
2363 default:
2364 DEBUG(0,("marshall_posix_acl: unknown tagtype.\n"));
2365 return False;
2366 }
2367 pdata += SMB_POSIX_ACL_ENTRY_SIZE;
2368 }
2369
2370 return True;
2371 }
2372 #endif
2373
2374 static NTSTATUS smb_q_posix_acl(
2375 struct connection_struct *conn,
2376 struct smb_request *req,
2377 struct smb_filename *smb_fname,
2378 struct files_struct *fsp,
2379 char **ppdata,
2380 int *ptotal_data)
2381 {
2382 #if !defined(HAVE_POSIX_ACLS)
2383 return NT_STATUS_INVALID_LEVEL;
2384 #else
2385 char *pdata = NULL;
2386 SMB_ACL_T file_acl = NULL;
2387 SMB_ACL_T def_acl = NULL;
2388 uint16_t num_file_acls = 0;
2389 uint16_t num_def_acls = 0;
2390 unsigned int size_needed = 0;
2391 NTSTATUS status;
2392 bool ok;
2393 bool close_fsp = false;
2394
2395 /*
2396 * Ensure we always operate on a file descriptor, not just
2397 * the filename.
2398 */
2399 if (fsp == NULL || !fsp->fsp_flags.is_fsa) {
2400 uint32_t access_mask = SEC_STD_READ_CONTROL|
2401 FILE_READ_ATTRIBUTES|
2402 FILE_WRITE_ATTRIBUTES;
2403
2404 status = get_posix_fsp(conn,
2405 req,
2406 smb_fname,
2407 access_mask,
2408 &fsp);
2409
2410 if (!NT_STATUS_IS_OK(status)) {
2411 goto out;
2412 }
2413 close_fsp = true;
2414 }
2415
2416 SMB_ASSERT(fsp != NULL);
2417
2418 status = refuse_symlink_fsp(fsp);
2419 if (!NT_STATUS_IS_OK(status)) {
2420 goto out;
2421 }
2422
2423 file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, SMB_ACL_TYPE_ACCESS,
2424 talloc_tos());
2425
2426 if (file_acl == NULL && no_acl_syscall_error(errno)) {
2427 DBG_INFO("ACLs not implemented on "
2428 "filesystem containing %s\n",
2429 fsp_str_dbg(fsp));
2430 status = NT_STATUS_NOT_IMPLEMENTED;
2431 goto out;
2432 }
2433
2434 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2435 /*
2436 * We can only have default POSIX ACLs on
2437 * directories.
2438 */
2439 if (!fsp->fsp_flags.is_directory) {
2440 DBG_INFO("Non-directory open %s\n",
2441 fsp_str_dbg(fsp));
2442 status = NT_STATUS_INVALID_HANDLE;
2443 goto out;
2444 }
2445 def_acl = SMB_VFS_SYS_ACL_GET_FD(fsp,
2446 SMB_ACL_TYPE_DEFAULT,
2447 talloc_tos());
2448 def_acl = free_empty_sys_acl(conn, def_acl);
2449 }
2450
2451 num_file_acls = count_acl_entries(conn, file_acl);
2452 num_def_acls = count_acl_entries(conn, def_acl);
2453
2454 /* Wrap checks. */
2455 if (num_file_acls + num_def_acls < num_file_acls) {
2456 status = NT_STATUS_INVALID_PARAMETER;
2457 goto out;
2458 }
2459
2460 size_needed = num_file_acls + num_def_acls;
2461
2462 /*
2463 * (size_needed * SMB_POSIX_ACL_ENTRY_SIZE) must be less
2464 * than UINT_MAX, so check by division.
2465 */
2466 if (size_needed > (UINT_MAX/SMB_POSIX_ACL_ENTRY_SIZE)) {
2467 status = NT_STATUS_INVALID_PARAMETER;
2468 goto out;
2469 }
2470
2471 size_needed = size_needed*SMB_POSIX_ACL_ENTRY_SIZE;
2472 if (size_needed + SMB_POSIX_ACL_HEADER_SIZE < size_needed) {
2473 status = NT_STATUS_INVALID_PARAMETER;
2474 goto out;
2475 }
2476 size_needed += SMB_POSIX_ACL_HEADER_SIZE;
2477
2478 *ppdata = SMB_REALLOC(*ppdata, size_needed);
2479 if (*ppdata == NULL) {
2480 status = NT_STATUS_NO_MEMORY;
2481 goto out;
2482 }
2483 pdata = *ppdata;
2484
2485 SSVAL(pdata,0,SMB_POSIX_ACL_VERSION);
2486 SSVAL(pdata,2,num_file_acls);
2487 SSVAL(pdata,4,num_def_acls);
2488 pdata += SMB_POSIX_ACL_HEADER_SIZE;
2489
2490 ok = marshall_posix_acl(conn,
2491 pdata,
2492 &fsp->fsp_name->st,
2493 file_acl);
2494 if (!ok) {
2495 status = NT_STATUS_INTERNAL_ERROR;
2496 goto out;
2497 }
2498 pdata += (num_file_acls*SMB_POSIX_ACL_ENTRY_SIZE);
2499
2500 ok = marshall_posix_acl(conn,
2501 pdata,
2502 &fsp->fsp_name->st,
2503 def_acl);
2504 if (!ok) {
2505 status = NT_STATUS_INTERNAL_ERROR;
2506 goto out;
2507 }
2508
2509 *ptotal_data = size_needed;
2510 status = NT_STATUS_OK;
2511
2512 out:
2513
2514 if (close_fsp) {
2515 /*
2516 * Ensure the stat struct in smb_fname is up to
2517 * date. Structure copy.
2518 */
2519 smb_fname->st = fsp->fsp_name->st;
2520 (void)close_file_free(req, &fsp, NORMAL_CLOSE);
2521 }
2522
2523 TALLOC_FREE(file_acl);
2524 TALLOC_FREE(def_acl);
2525 return status;
2526 #endif
2527 }
2528
2529 static NTSTATUS smb_q_posix_symlink(
2530 struct connection_struct *conn,
2531 struct smb_request *req,
2532 struct files_struct *dirfsp,
2533 struct smb_filename *smb_fname,
2534 char **ppdata,
2535 int *ptotal_data)
2536 {
2537 char *target = NULL;
2538 size_t needed, len;
2539 char *pdata = NULL;
2540 NTSTATUS status;
2541
2542 DBG_DEBUG("SMB_QUERY_FILE_UNIX_LINK for file %s\n",
2543 smb_fname_str_dbg(smb_fname));
2544
2545 if (!S_ISLNK(smb_fname->st.st_ex_mode)) {
2546 return NT_STATUS_DOS(ERRSRV, ERRbadlink);
2547 }
2548
2549 if (fsp_get_pathref_fd(smb_fname->fsp) != -1) {
2550 /*
2551 * fsp is an O_PATH open, Linux does a "freadlink"
2552 * with an empty name argument to readlinkat
2553 */
2554 status = readlink_talloc(talloc_tos(),
2555 smb_fname->fsp,
2556 NULL,
2557 &target);
2558 } else {
2559 struct smb_filename smb_fname_rel = *smb_fname;
2560 char *slash = NULL;
2561
2562 slash = strrchr_m(smb_fname->base_name, '/');
2563 if (slash != NULL) {
2564 smb_fname_rel.base_name = slash + 1;
2565 }
2566 status = readlink_talloc(talloc_tos(),
2567 dirfsp,
2568 &smb_fname_rel,
2569 &target);
2570 }
2571
2572 if (!NT_STATUS_IS_OK(status)) {
2573 DBG_DEBUG("readlink_talloc() failed: %s\n", nt_errstr(status));
2574 return status;
2575 }
2576
2577 needed = talloc_get_size(target) * 2;
2578
2579 *ppdata = SMB_REALLOC(*ppdata, needed);
2580 if (*ppdata == NULL) {
2581 TALLOC_FREE(target);
2582 return NT_STATUS_NO_MEMORY;
2583 }
2584 pdata = *ppdata;
2585
2586 status = srvstr_push(
2587 pdata,
2588 req->flags2,
2589 pdata,
2590 target,
2591 needed,
2592 STR_TERMINATE,
2593 &len);
2594 TALLOC_FREE(target);
2595 if (!NT_STATUS_IS_OK(status)) {
2596 return status;
2597 }
2598 *ptotal_data = len;
2599
2600 return NT_STATUS_OK;
2601 }
2602
2603 static void call_trans2qpathinfo(
2604 connection_struct *conn,
2605 struct smb_request *req,
2606 char **pparams,
2607 int total_params,
2608 char **ppdata,
2609 int total_data,
2610 unsigned int max_data_bytes)
2611 {
2612 char *params = *pparams;
2613 uint16_t info_level;
2614 struct smb_filename *smb_fname = NULL;
2615 bool delete_pending = False;
2616 struct timespec write_time_ts = { .tv_sec = 0, };
2617 struct files_struct *dirfsp = NULL;
2618 files_struct *fsp = NULL;
2619 char *fname = NULL;
2620 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
2621 NTTIME twrp = 0;
2622 bool info_level_handled;
2623 NTSTATUS status = NT_STATUS_OK;
2624
2625 if (!params) {
2626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2627 return;
2628 }
2629
2630
2631 /* qpathinfo */
2632 if (total_params < 7) {
2633 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2634 return;
2635 }
2636
2637 info_level = SVAL(params,0);
2638
2639 DBG_NOTICE("TRANSACT2_QPATHINFO: level = %d\n", info_level);
2640
2641 if (INFO_LEVEL_IS_UNIX(info_level)) {
2642 if (!lp_smb1_unix_extensions()) {
2643 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2644 return;
2645 }
2646 if (!req->posix_pathnames) {
2647 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2648 return;
2649 }
2650 }
2651
2652 if (req->posix_pathnames) {
2653 srvstr_get_path_posix(req,
2654 params,
2655 req->flags2,
2656 &fname,
2657 &params[6],
2658 total_params - 6,
2659 STR_TERMINATE,
2660 &status);
2661 } else {
2662 srvstr_get_path(req,
2663 params,
2664 req->flags2,
2665 &fname,
2666 &params[6],
2667 total_params - 6,
2668 STR_TERMINATE,
2669 &status);
2670 }
2671 if (!NT_STATUS_IS_OK(status)) {
2672 reply_nterror(req, status);
2673 return;
2674 }
2675
2676 if (ucf_flags & UCF_GMT_PATHNAME) {
2677 extract_snapshot_token(fname, &twrp);
2678 }
2679 status = smb1_strip_dfs_path(req, &ucf_flags, &fname);
2680 if (!NT_STATUS_IS_OK(status)) {
2681 reply_nterror(req, status);
2682 return;
2683 }
2684 status = filename_convert_dirfsp(req,
2685 conn,
2686 fname,
2687 ucf_flags,
2688 twrp,
2689 &dirfsp,
2690 &smb_fname);
2691 if (!NT_STATUS_IS_OK(status)) {
2692 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2693 reply_botherror(req,
2694 NT_STATUS_PATH_NOT_COVERED,
2695 ERRSRV, ERRbadpath);
2696 return;
2697 }
2698 reply_nterror(req, status);
2699 return;
2700 }
2701
2702 /*
2703 * qpathinfo must operate on an existing file, so we
2704 * can exit early if filename_convert_dirfsp() returned the
2705 * "new file" NT_STATUS_OK, !VALID_STAT case.
2706 */
2707
2708 if (!VALID_STAT(smb_fname->st)) {
2709 reply_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
2710 return;
2711 }
2712
2713 fsp = smb_fname->fsp;
2714
2715 /* If this is a stream, check if there is a delete_pending. */
2716 if (fsp_is_alternate_stream(fsp)) {
2717
2718 struct files_struct *base_fsp = fsp->base_fsp;
2719
2720 get_file_infos(base_fsp->file_id,
2721 base_fsp->name_hash,
2722 &delete_pending,
2723 NULL);
2724 if (delete_pending) {
2725 reply_nterror(req, NT_STATUS_DELETE_PENDING);
2726 return;
2727 }
2728 }
2729
2730 if (fsp_getinfo_ask_sharemode(fsp)) {
2731 get_file_infos(fsp->file_id,
2732 fsp->name_hash,
2733 &delete_pending,
2734 &write_time_ts);
2735 }
2736
2737 if (delete_pending) {
2738 reply_nterror(req, NT_STATUS_DELETE_PENDING);
2739 return;
2740 }
2741
2742 info_level_handled = true; /* Untouched in switch cases below */
2743
2744 switch (info_level) {
2745
2746 default:
2747 info_level_handled = false;
2748 break;
2749
2750 case SMB_QUERY_FILE_UNIX_BASIC:
2751 status = smb_q_unix_basic(
2752 conn,
2753 req,
2754 smb_fname,
2755 smb_fname->fsp,
2756 ppdata,
2757 &total_data);
2758 break;
2759
2760 case SMB_QUERY_FILE_UNIX_INFO2:
2761 status = smb_q_unix_info2(
2762 conn,
2763 req,
2764 smb_fname,
2765 smb_fname->fsp,
2766 ppdata,
2767 &total_data);
2768 break;
2769
2770 case SMB_QUERY_POSIX_ACL:
2771 status = smb_q_posix_acl(
2772 conn,
2773 req,
2774 smb_fname,
2775 smb_fname->fsp,
2776 ppdata,
2777 &total_data);
2778 break;
2779
2780 case SMB_QUERY_FILE_UNIX_LINK:
2781 status = smb_q_posix_symlink(
2782 conn,
2783 req,
2784 dirfsp,
2785 smb_fname,
2786 ppdata,
2787 &total_data);
2788 break;
2789 }
2790
2791 if (info_level_handled) {
2792 handle_trans2qfilepathinfo_result(
2793 conn,
2794 req,
2795 info_level,
2796 status,
2797 *ppdata,
2798 total_data,
2799 total_data,
2800 max_data_bytes);
2801 return;
2802 }
2803
2804 call_trans2qfilepathinfo(
2805 conn,
2806 req,
2807 TRANSACT2_QPATHINFO,
2808 info_level,
2809 smb_fname,
2810 fsp,
2811 false,
2812 write_time_ts,
2813 pparams,
2814 total_params,
2815 ppdata,
2816 total_data,
2817 max_data_bytes);
2818 }
2819
2820 static NTSTATUS smb_q_posix_lock(
2821 struct connection_struct *conn,
2822 struct smb_request *req,
2823 struct files_struct *fsp,
2824 char **ppdata,
2825 int *ptotal_data)
2826 {
2827 char *pdata = *ppdata;
2828 int total_data = *ptotal_data;
2829 uint64_t count;
2830 uint64_t offset;
2831 uint64_t smblctx;
2832 enum brl_type lock_type;
2833 NTSTATUS status;
2834
2835 if (fsp->fsp_flags.is_pathref || (fsp_get_io_fd(fsp) == -1)) {
2836 return NT_STATUS_INVALID_HANDLE;
2837 }
2838
2839 if (total_data != POSIX_LOCK_DATA_SIZE) {
2840 return NT_STATUS_INVALID_PARAMETER;
2841 }
2842
2843 switch (SVAL(pdata, POSIX_LOCK_TYPE_OFFSET)) {
2844 case POSIX_LOCK_TYPE_READ:
2845 lock_type = READ_LOCK;
2846 break;
2847 case POSIX_LOCK_TYPE_WRITE:
2848 lock_type = WRITE_LOCK;
2849 break;
2850 case POSIX_LOCK_TYPE_UNLOCK:
2851 default:
2852 /* There's no point in asking for an unlock... */
2853 return NT_STATUS_INVALID_PARAMETER;
2854 }
2855
2856 smblctx = (uint64_t)IVAL(pdata, POSIX_LOCK_PID_OFFSET);
2857 offset = BVAL(pdata,POSIX_LOCK_START_OFFSET);
2858 count = BVAL(pdata,POSIX_LOCK_LEN_OFFSET);
2859
2860 status = query_lock(
2861 fsp,
2862 &smblctx,
2863 &count,
2864 &offset,
2865 &lock_type,
2866 POSIX_LOCK);
2867
2868 if (NT_STATUS_IS_OK(status)) {
2869 /*
2870 * For success we just return a copy of what we sent
2871 * with the lock type set to POSIX_LOCK_TYPE_UNLOCK.
2872 */
2873 SSVAL(pdata, POSIX_LOCK_TYPE_OFFSET, POSIX_LOCK_TYPE_UNLOCK);
2874 return NT_STATUS_OK;
2875 }
2876
2877 if (!ERROR_WAS_LOCK_DENIED(status)) {
2878 DBG_DEBUG("query_lock() failed: %s\n", nt_errstr(status));
2879 return status;
2880 }
2881
2882 /*
2883 * Here we need to report who has it locked.
2884 */
2885
2886 SSVAL(pdata, POSIX_LOCK_TYPE_OFFSET, lock_type);
2887 SSVAL(pdata, POSIX_LOCK_FLAGS_OFFSET, 0);
2888 SIVAL(pdata, POSIX_LOCK_PID_OFFSET, (uint32_t)smblctx);
2889 SBVAL(pdata, POSIX_LOCK_START_OFFSET, offset);
2890 SBVAL(pdata, POSIX_LOCK_LEN_OFFSET, count);
2891
2892 return NT_STATUS_OK;
2893 }
2894
2895 static void call_trans2qfileinfo(
2896 connection_struct *conn,
2897 struct smb_request *req,
2898 char **pparams,
2899 int total_params,
2900 char **ppdata,
2901 int total_data,
2902 unsigned int max_data_bytes)
2903 {
2904 char *params = *pparams;
2905 uint16_t info_level;
2906 struct smb_filename *smb_fname = NULL;
2907 bool delete_pending = False;
2908 struct timespec write_time_ts = { .tv_sec = 0, };
2909 files_struct *fsp = NULL;
2910 struct file_id fileid;
2911 bool info_level_handled;
2912 NTSTATUS status = NT_STATUS_OK;
2913 int ret;
2914
2915 if (params == NULL) {
2916 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2917 return;
2918 }
2919
2920 if (total_params < 4) {
2921 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2922 return;
2923 }
2924
2925 fsp = file_fsp(req, SVAL(params,0));
2926 info_level = SVAL(params,2);
2927
2928 if (IS_IPC(conn)) {
2929 call_trans2qpipeinfo(
2930 conn,
2931 req,
2932 fsp,
2933 info_level,
2934 TRANSACT2_QFILEINFO,
2935 pparams,
2936 total_params,
2937 ppdata,
2938 total_data,
2939 max_data_bytes);
2940 return;
2941 }
2942
2943 DBG_NOTICE("TRANSACT2_QFILEINFO: level = %d\n", info_level);
2944
2945 if (INFO_LEVEL_IS_UNIX(info_level)) {
2946 if (!lp_smb1_unix_extensions()) {
2947 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2948 return;
2949 }
2950 if (!req->posix_pathnames) {
2951 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2952 return;
2953 }
2954 }
2955
2956 /* Initial check for valid fsp ptr. */
2957 if (!check_fsp_open(conn, req, fsp)) {
2958 return;
2959 }
2960
2961 smb_fname = fsp->fsp_name;
2962
2963 if(fsp->fake_file_handle) {
2964 /*
2965 * This is actually for the QUOTA_FAKE_FILE --metze
2966 */
2967
2968 /* We know this name is ok, it's already passed the checks. */
2969
2970 } else if(fsp_get_pathref_fd(fsp) == -1) {
2971 /*
2972 * This is actually a QFILEINFO on a directory
2973 * handle (returned from an NT SMB). NT5.0 seems
2974 * to do this call. JRA.
2975 */
2976 ret = vfs_stat(conn, smb_fname);
2977 if (ret != 0) {
2978 DBG_NOTICE("vfs_stat of %s failed (%s)\n",
2979 smb_fname_str_dbg(smb_fname),
2980 strerror(errno));
2981 reply_nterror(req,
2982 map_nt_error_from_unix(errno));
2983 return;
2984 }
2985
2986 if (fsp_getinfo_ask_sharemode(fsp)) {
2987 fileid = vfs_file_id_from_sbuf(
2988 conn, &smb_fname->st);
2989 get_file_infos(fileid, fsp->name_hash,
2990 &delete_pending,
2991 &write_time_ts);
2992 }
2993 } else {
2994 /*
2995 * Original code - this is an open file.
2996 */
2997 status = vfs_stat_fsp(fsp);
2998 if (!NT_STATUS_IS_OK(status)) {
2999 DEBUG(3, ("fstat of %s failed (%s)\n",
3000 fsp_fnum_dbg(fsp), nt_errstr(status)));
3001 reply_nterror(req, status);
3002 return;
3003 }
3004 if (fsp_getinfo_ask_sharemode(fsp)) {
3005 fileid = vfs_file_id_from_sbuf(
3006 conn, &smb_fname->st);
3007 get_file_infos(fileid, fsp->name_hash,
3008 &delete_pending,
3009 &write_time_ts);
3010 }
3011 }
3012
3013 info_level_handled = true; /* Untouched in switch cases below */
3014
3015 switch (info_level) {
3016
3017 default:
3018 info_level_handled = false;
3019 break;
3020
3021 case SMB_QUERY_POSIX_LOCK:
3022 status = smb_q_posix_lock(conn, req, fsp, ppdata, &total_data);
3023 break;
3024
3025 case SMB_QUERY_FILE_UNIX_BASIC:
3026 status = smb_q_unix_basic(
3027 conn, req, fsp->fsp_name, fsp, ppdata, &total_data);
3028 break;
3029
3030 case SMB_QUERY_FILE_UNIX_INFO2:
3031 status = smb_q_unix_info2(
3032 conn, req, fsp->fsp_name, fsp, ppdata, &total_data);
3033 break;
3034
3035 case SMB_QUERY_POSIX_ACL:
3036 status = smb_q_posix_acl(
3037 conn, req, fsp->fsp_name, fsp, ppdata, &total_data);
3038 break;
3039 }
3040
3041 if (info_level_handled) {
3042 handle_trans2qfilepathinfo_result(
3043 conn,
3044 req,
3045 info_level,
3046 status,
3047 *ppdata,
3048 total_data,
3049 total_data,
3050 max_data_bytes);
3051 return;
3052 }
3053
3054 call_trans2qfilepathinfo(
3055 conn,
3056 req,
3057 TRANSACT2_QFILEINFO,
3058 info_level,
3059 smb_fname,
3060 fsp,
3061 delete_pending,
3062 write_time_ts,
3063 pparams,
3064 total_params,
3065 ppdata,
3066 total_data,
3067 max_data_bytes);
3068 }
3069
3070 static void handle_trans2setfilepathinfo_result(
3071 connection_struct *conn,
3072 struct smb_request *req,
3073 uint16_t info_level,
3074 NTSTATUS status,
3075 char *pdata,
3076 int data_return_size,
3077 unsigned int max_data_bytes)
3078 {
3079 char params[2] = { 0, 0, };
3080
3081 if (NT_STATUS_IS_OK(status)) {
3082 send_trans2_replies(
3083 conn,
3084 req,
3085 NT_STATUS_OK,
3086 params,
3087 2,
3088 pdata,
3089 data_return_size,
3090 max_data_bytes);
3091 return;
3092 }
3093
3094 if (open_was_deferred(req->xconn, req->mid)) {
3095 /* We have re-scheduled this call. */
3096 return;
3097 }
3098
3099 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
3100 bool ok = defer_smb1_sharing_violation(req);
3101 if (ok) {
3102 return;
3103 }
3104 }
3105
3106 if (NT_STATUS_EQUAL(status, NT_STATUS_EVENT_PENDING)) {
3107 /* We have re-scheduled this call. */
3108 return;
3109 }
3110
3111 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3112 reply_botherror(
3113 req,
3114 NT_STATUS_PATH_NOT_COVERED,
3115 ERRSRV,
3116 ERRbadpath);
3117 return;
3118 }
3119
3120 if (info_level == SMB_POSIX_PATH_OPEN) {
3121 reply_openerror(req, status);
3122 return;
3123 }
3124
3125 if (NT_STATUS_EQUAL(status, STATUS_INVALID_EA_NAME)) {
3126 /*
3127 * Invalid EA name needs to return 2 param bytes,
3128 * not a zero-length error packet.
3129 */
3130
3131 send_trans2_replies(
3132 conn,
3133 req,
3134 status,
3135 params,
3136 2,
3137 NULL,
3138 0,
3139 max_data_bytes);
3140 return;
3141 }
3142
3143 reply_nterror(req, status);
3144 }
3145
3146 /****************************************************************************
3147 Create a directory with POSIX semantics.
3148 ****************************************************************************/
3149
3150 static NTSTATUS smb_posix_mkdir(connection_struct *conn,
3151 struct smb_request *req,
3152 char **ppdata,
3153 int total_data,
3154 struct smb_filename *smb_fname,
3155 int *pdata_return_size)
3156 {
3157 NTSTATUS status = NT_STATUS_OK;
3158 uint32_t raw_unixmode = 0;
3159 mode_t unixmode = (mode_t)0;
3160 files_struct *fsp = NULL;
3161 uint16_t info_level_return = 0;
3162 int info;
3163 char *pdata = *ppdata;
3164 struct smb2_create_blobs *posx = NULL;
3165
3166 if (total_data < 18) {
3167 return NT_STATUS_INVALID_PARAMETER;
3168 }
3169
3170 raw_unixmode = IVAL(pdata,8);
3171 /* Next 4 bytes are not yet defined. */
3172
3173 status = unix_perms_from_wire(conn, &smb_fname->st, raw_unixmode,
3174 PERM_NEW_DIR, &unixmode);
3175 if (!NT_STATUS_IS_OK(status)) {
3176 return status;
3177 }
3178
3179 status = make_smb2_posix_create_ctx(talloc_tos(), &posx, unixmode);
3180 if (!NT_STATUS_IS_OK(status)) {
3181 DBG_WARNING("make_smb2_posix_create_ctx failed: %s\n",
3182 nt_errstr(status));
3183 return status;
3184 }
3185
3186 DEBUG(10,("smb_posix_mkdir: file %s, mode 0%o\n",
3187 smb_fname_str_dbg(smb_fname), (unsigned int)unixmode));
3188
3189 status = SMB_VFS_CREATE_FILE(
3190 conn, /* conn */
3191 req, /* req */
3192 NULL, /* dirfsp */
3193 smb_fname, /* fname */
3194 FILE_READ_ATTRIBUTES, /* access_mask */
3195 FILE_SHARE_NONE, /* share_access */
3196 FILE_CREATE, /* create_disposition*/
3197 FILE_DIRECTORY_FILE, /* create_options */
3198 0, /* file_attributes */
3199 0, /* oplock_request */
3200 NULL, /* lease */
3201 0, /* allocation_size */
3202 0, /* private_flags */
3203 NULL, /* sd */
3204 NULL, /* ea_list */
3205 &fsp, /* result */
3206 &info, /* pinfo */
3207 posx, /* in_context_blobs */
3208 NULL); /* out_context_blobs */
3209
3210 TALLOC_FREE(posx);
3211
3212 if (NT_STATUS_IS_OK(status)) {
3213 close_file_free(req, &fsp, NORMAL_CLOSE);
3214 }
3215
3216 info_level_return = SVAL(pdata,16);
3217
3218 if (info_level_return == SMB_QUERY_FILE_UNIX_BASIC) {
3219 *pdata_return_size = 12 + SMB_FILE_UNIX_BASIC_SIZE;
3220 } else if (info_level_return == SMB_QUERY_FILE_UNIX_INFO2) {
3221 *pdata_return_size = 12 + SMB_FILE_UNIX_INFO2_SIZE;
3222 } else {
3223 *pdata_return_size = 12;
3224 }
3225
3226 /* Realloc the data size */
3227 *ppdata = (char *)SMB_REALLOC(*ppdata,*pdata_return_size);
3228 if (*ppdata == NULL) {
3229 *pdata_return_size = 0;
3230 return NT_STATUS_NO_MEMORY;
3231 }
3232 pdata = *ppdata;
3233
3234 SSVAL(pdata,0,NO_OPLOCK_RETURN);
3235 SSVAL(pdata,2,0); /* No fnum. */
3236 SIVAL(pdata,4,info); /* Was directory created. */
3237
3238 switch (info_level_return) {
3239 case SMB_QUERY_FILE_UNIX_BASIC:
3240 SSVAL(pdata,8,SMB_QUERY_FILE_UNIX_BASIC);
3241 SSVAL(pdata,10,0); /* Padding. */
3242 store_file_unix_basic(conn, pdata + 12, fsp,
3243 &smb_fname->st);
3244 break;
3245 case SMB_QUERY_FILE_UNIX_INFO2:
3246 SSVAL(pdata,8,SMB_QUERY_FILE_UNIX_INFO2);
3247 SSVAL(pdata,10,0); /* Padding. */
3248 store_file_unix_basic_info2(conn, pdata + 12, fsp,
3249 &smb_fname->st);
3250 break;
3251 default:
3252 SSVAL(pdata,8,SMB_NO_INFO_LEVEL_RETURNED);
3253 SSVAL(pdata,10,0); /* Padding. */
3254 break;
3255 }
3256
3257 return status;
3258 }
3259
3260 /****************************************************************************
3261 Open/Create a file with POSIX semantics.
3262 ****************************************************************************/
3263
3264 #define SMB_O_RDONLY_MAPPING (FILE_READ_DATA|FILE_READ_ATTRIBUTES|FILE_READ_EA)
3265 #define SMB_O_WRONLY_MAPPING (FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|FILE_WRITE_EA)
3266
3267 static NTSTATUS smb_posix_open(connection_struct *conn,
3268 struct smb_request *req,
3269 char **ppdata,
3270 int total_data,
3271 struct files_struct *dirfsp,
3272 struct smb_filename *smb_fname,
3273 int *pdata_return_size)
3274 {
3275 bool extended_oplock_granted = False;
3276 char *pdata = *ppdata;
3277 uint32_t flags = 0;
3278 uint32_t wire_open_mode = 0;
3279 uint32_t raw_unixmode = 0;
3280 uint32_t attributes = 0;
3281 uint32_t create_disp = 0;
3282 uint32_t access_mask = 0;
3283 uint32_t create_options = FILE_NON_DIRECTORY_FILE;
3284 NTSTATUS status = NT_STATUS_OK;
3285 mode_t unixmode = (mode_t)0;
3286 files_struct *fsp = NULL;
3287 int oplock_request = 0;
3288 int info = 0;
3289 uint16_t info_level_return = 0;
3290 struct smb2_create_blobs *posx = NULL;
3291
3292 if (total_data < 18) {
3293 return NT_STATUS_INVALID_PARAMETER;
3294 }
3295
3296 flags = IVAL(pdata,0);
3297 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
3298 if (oplock_request) {
3299 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
3300 }
3301
3302 wire_open_mode = IVAL(pdata,4);
3303
3304 if (wire_open_mode == (SMB_O_CREAT|SMB_O_DIRECTORY)) {
3305 return smb_posix_mkdir(conn, req,
3306 ppdata,
3307 total_data,
3308 smb_fname,
3309 pdata_return_size);
3310 }
3311
3312 switch (wire_open_mode & SMB_ACCMODE) {
3313 case SMB_O_RDONLY:
3314 access_mask = SMB_O_RDONLY_MAPPING;
3315 break;
3316 case SMB_O_WRONLY:
3317 access_mask = SMB_O_WRONLY_MAPPING;
3318 break;
3319 case SMB_O_RDWR:
3320 access_mask = (SMB_O_RDONLY_MAPPING|
3321 SMB_O_WRONLY_MAPPING);
3322 break;
3323 default:
3324 DEBUG(5,("smb_posix_open: invalid open mode 0x%x\n",
3325 (unsigned int)wire_open_mode ));
3326 return NT_STATUS_INVALID_PARAMETER;
3327 }
3328
3329 wire_open_mode &= ~SMB_ACCMODE;
3330
3331 /* First take care of O_CREAT|O_EXCL interactions. */
3332 switch (wire_open_mode & (SMB_O_CREAT | SMB_O_EXCL)) {
3333 case (SMB_O_CREAT | SMB_O_EXCL):
3334 /* File exists fail. File not exist create. */
3335 create_disp = FILE_CREATE;
3336 break;
3337 case SMB_O_CREAT:
3338 /* File exists open. File not exist create. */
3339 create_disp = FILE_OPEN_IF;
3340 break;
3341 case SMB_O_EXCL:
3342 /* O_EXCL on its own without O_CREAT is undefined.
3343 We deliberately ignore it as some versions of
3344 Linux CIFSFS can send a bare O_EXCL on the
3345 wire which other filesystems in the kernel
3346 ignore. See bug 9519 for details. */
3347
3348 /* Fallthrough. */
3349
3350 case 0:
3351 /* File exists open. File not exist fail. */
3352 create_disp = FILE_OPEN;
3353 break;
3354 default:
3355 DEBUG(5,("smb_posix_open: invalid create mode 0x%x\n",
3356 (unsigned int)wire_open_mode ));
3357 return NT_STATUS_INVALID_PARAMETER;
3358 }
3359
3360 /* Next factor in the effects of O_TRUNC. */
3361 wire_open_mode &= ~(SMB_O_CREAT | SMB_O_EXCL);
3362
3363 if (wire_open_mode & SMB_O_TRUNC) {
3364 switch (create_disp) {
3365 case FILE_CREATE:
3366 /* (SMB_O_CREAT | SMB_O_EXCL | O_TRUNC) */
3367 /* Leave create_disp alone as
3368 (O_CREAT|O_EXCL|O_TRUNC) == (O_CREAT|O_EXCL)
3369 */
3370 /* File exists fail. File not exist create. */
3371 break;
3372 case FILE_OPEN_IF:
3373 /* SMB_O_CREAT | SMB_O_TRUNC */
3374 /* File exists overwrite. File not exist create. */
3375 create_disp = FILE_OVERWRITE_IF;
3376 break;
3377 case FILE_OPEN:
3378 /* SMB_O_TRUNC */
3379 /* File exists overwrite. File not exist fail. */
3380 create_disp = FILE_OVERWRITE;
3381 break;
3382 default:
3383 /* Cannot get here. */
3384 smb_panic("smb_posix_open: logic error");
3385 return NT_STATUS_INVALID_PARAMETER;
3386 }
3387 }
3388
3389 raw_unixmode = IVAL(pdata,8);
3390 /* Next 4 bytes are not yet defined. */
3391
3392 status = unix_perms_from_wire(conn, &smb_fname->st, raw_unixmode,
3393 (VALID_STAT(smb_fname->st) ?
3394 PERM_EXISTING_FILE : PERM_NEW_FILE),
3395 &unixmode);
3396
3397 if (!NT_STATUS_IS_OK(status)) {
3398 return status;
3399 }
3400
3401 status = make_smb2_posix_create_ctx(talloc_tos(), &posx, unixmode);
3402 if (!NT_STATUS_IS_OK(status)) {
3403 DBG_WARNING("make_smb2_posix_create_ctx failed: %s\n",
3404 nt_errstr(status));
3405 return status;
3406 }
3407
3408 if (wire_open_mode & SMB_O_SYNC) {
3409 create_options |= FILE_WRITE_THROUGH;
3410 }
3411 if (wire_open_mode & SMB_O_APPEND) {
3412 access_mask |= FILE_APPEND_DATA;
3413 }
3414 if (wire_open_mode & SMB_O_DIRECT) {
3415 /*
3416 * BUG: this doesn't work anymore since
3417 * e0814dc5082dd4ecca8a155e0ce24b073158fd92. But since
3418 * FILE_FLAG_NO_BUFFERING isn't used at all in the IO codepath,
3419 * it doesn't really matter.
3420 */
3421 attributes |= FILE_FLAG_NO_BUFFERING;
3422 }
3423
3424 if ((wire_open_mode & SMB_O_DIRECTORY) ||
3425 VALID_STAT_OF_DIR(smb_fname->st)) {
3426 if (access_mask != SMB_O_RDONLY_MAPPING) {
3427 return NT_STATUS_FILE_IS_A_DIRECTORY;
3428 }
3429 create_options &= ~FILE_NON_DIRECTORY_FILE;
3430 create_options |= FILE_DIRECTORY_FILE;
3431 }
3432
3433 DEBUG(10,("smb_posix_open: file %s, smb_posix_flags = %u, mode 0%o\n",
3434 smb_fname_str_dbg(smb_fname),
3435 (unsigned int)wire_open_mode,
3436 (unsigned int)unixmode ));
3437
3438 status = SMB_VFS_CREATE_FILE(
3439 conn, /* conn */
3440 req, /* req */
3441 dirfsp, /* dirfsp */
3442 smb_fname, /* fname */
3443 access_mask, /* access_mask */
3444 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
3445 FILE_SHARE_DELETE),
3446 create_disp, /* create_disposition*/
3447 create_options, /* create_options */
3448 attributes, /* file_attributes */
3449 oplock_request, /* oplock_request */
3450 NULL, /* lease */
3451 0, /* allocation_size */
3452 0, /* private_flags */
3453 NULL, /* sd */
3454 NULL, /* ea_list */
3455 &fsp, /* result */
3456 &info, /* pinfo */
3457 posx, /* in_context_blobs */
3458 NULL); /* out_context_blobs */
3459
3460 TALLOC_FREE(posx);
3461
3462 if (!NT_STATUS_IS_OK(status)) {
3463 return status;
3464 }
3465
3466 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
3467 extended_oplock_granted = True;
3468 }
3469
3470 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
3471 extended_oplock_granted = True;
3472 }
3473
3474 info_level_return = SVAL(pdata,16);
3475
3476 /* Allocate the correct return size. */
3477
3478 if (info_level_return == SMB_QUERY_FILE_UNIX_BASIC) {
3479 *pdata_return_size = 12 + SMB_FILE_UNIX_BASIC_SIZE;
3480 } else if (info_level_return == SMB_QUERY_FILE_UNIX_INFO2) {
3481 *pdata_return_size = 12 + SMB_FILE_UNIX_INFO2_SIZE;
3482 } else {
3483 *pdata_return_size = 12;
3484 }
3485
3486 /* Realloc the data size */
3487 *ppdata = (char *)SMB_REALLOC(*ppdata,*pdata_return_size);
3488 if (*ppdata == NULL) {
3489 close_file_free(req, &fsp, ERROR_CLOSE);
3490 *pdata_return_size = 0;
3491 return NT_STATUS_NO_MEMORY;
3492 }
3493 pdata = *ppdata;
3494
3495 if (extended_oplock_granted) {
3496 if (flags & REQUEST_BATCH_OPLOCK) {
3497 SSVAL(pdata,0, BATCH_OPLOCK_RETURN);
3498 } else {
3499 SSVAL(pdata,0, EXCLUSIVE_OPLOCK_RETURN);
3500 }
3501 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
3502 SSVAL(pdata,0, LEVEL_II_OPLOCK_RETURN);
3503 } else {
3504 SSVAL(pdata,0,NO_OPLOCK_RETURN);
3505 }
3506
3507 SSVAL(pdata,2,fsp->fnum);
3508 SIVAL(pdata,4,info); /* Was file created etc. */
3509
3510 switch (info_level_return) {
3511 case SMB_QUERY_FILE_UNIX_BASIC:
3512 SSVAL(pdata,8,SMB_QUERY_FILE_UNIX_BASIC);
3513 SSVAL(pdata,10,0); /* padding. */
3514 store_file_unix_basic(conn, pdata + 12, fsp,
3515 &smb_fname->st);
3516 break;
3517 case SMB_QUERY_FILE_UNIX_INFO2:
3518 SSVAL(pdata,8,SMB_QUERY_FILE_UNIX_INFO2);
3519 SSVAL(pdata,10,0); /* padding. */
3520 store_file_unix_basic_info2(conn, pdata + 12, fsp,
3521 &smb_fname->st);
3522 break;
3523 default:
3524 SSVAL(pdata,8,SMB_NO_INFO_LEVEL_RETURNED);
3525 SSVAL(pdata,10,0); /* padding. */
3526 break;
3527 }
3528 return NT_STATUS_OK;
3529 }
3530
3531 /****************************************************************************
3532 Delete a file with POSIX semantics.
3533 ****************************************************************************/
3534
3535 struct smb_posix_unlink_state {
3536 struct smb_filename *smb_fname;
3537 struct files_struct *fsp;
3538 NTSTATUS status;
3539 };
3540
3541 static void smb_posix_unlink_locked(struct share_mode_lock *lck,
3542 void *private_data)
3543 {
3544 struct smb_posix_unlink_state *state = private_data;
3545 char del = 1;
3546 bool other_nonposix_opens;
3547
3548 other_nonposix_opens = has_other_nonposix_opens(lck, state->fsp);
3549 if (other_nonposix_opens) {
3550 /* Fail with sharing violation. */
3551 state->status = NT_STATUS_SHARING_VIOLATION;
3552 return;
3553 }
3554
3555 /*
3556 * Set the delete on close.
3557 */
3558 state->status = smb_set_file_disposition_info(state->fsp->conn,
3559 &del,
3560 1,
3561 state->fsp,
3562 state->smb_fname);
3563 }
3564
3565 static NTSTATUS smb_posix_unlink(connection_struct *conn,
3566 struct smb_request *req,
3567 const char *pdata,
3568 int total_data,
3569 struct files_struct *dirfsp,
3570 struct smb_filename *smb_fname)
3571 {
3572 struct smb_posix_unlink_state state = {};
3573 NTSTATUS status = NT_STATUS_OK;
3574 files_struct *fsp = NULL;
3575 uint16_t flags = 0;
3576 int info = 0;
3577 int create_options = FILE_OPEN_REPARSE_POINT;
3578 struct smb2_create_blobs *posx = NULL;
3579
3580 if (!CAN_WRITE(conn)) {
3581 return NT_STATUS_DOS(ERRSRV, ERRaccess);
3582 }
3583
3584 if (total_data < 2) {
3585 return NT_STATUS_INVALID_PARAMETER;
3586 }
3587
3588 flags = SVAL(pdata,0);
3589
3590 if (!VALID_STAT(smb_fname->st)) {
3591 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3592 }
3593
3594 if ((flags == SMB_POSIX_UNLINK_DIRECTORY_TARGET) &&
3595 !VALID_STAT_OF_DIR(smb_fname->st)) {
3596 return NT_STATUS_NOT_A_DIRECTORY;
3597 }
3598
3599 DEBUG(10,("smb_posix_unlink: %s %s\n",
3600 (flags == SMB_POSIX_UNLINK_DIRECTORY_TARGET) ? "directory" : "file",
3601 smb_fname_str_dbg(smb_fname)));
3602
3603 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
3604 create_options |= FILE_DIRECTORY_FILE;
3605 }
3606
3607 status = make_smb2_posix_create_ctx(talloc_tos(), &posx, 0777);
3608 if (!NT_STATUS_IS_OK(status)) {
3609 DBG_WARNING("make_smb2_posix_create_ctx failed: %s\n",
3610 nt_errstr(status));
3611 return status;
3612 }
3613
3614 status = SMB_VFS_CREATE_FILE(
3615 conn, /* conn */
3616 req, /* req */
3617 dirfsp, /* dirfsp */
3618 smb_fname, /* fname */
3619 DELETE_ACCESS, /* access_mask */
3620 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
3621 FILE_SHARE_DELETE),
3622 FILE_OPEN, /* create_disposition*/
3623 create_options, /* create_options */
3624 0, /* file_attributes */
3625 0, /* oplock_request */
3626 NULL, /* lease */
3627 0, /* allocation_size */
3628 0, /* private_flags */
3629 NULL, /* sd */
3630 NULL, /* ea_list */
3631 &fsp, /* result */
3632 &info, /* pinfo */
3633 posx, /* in_context_blobs */
3634 NULL); /* out_context_blobs */
3635
3636 TALLOC_FREE(posx);
3637
3638 if (!NT_STATUS_IS_OK(status)) {
3639 return status;
3640 }
3641
3642 /*
3643 * Don't lie to client. If we can't really delete due to
3644 * non-POSIX opens return SHARING_VIOLATION.
3645 */
3646
3647 state = (struct smb_posix_unlink_state) {
3648 .smb_fname = smb_fname,
3649 .fsp = fsp,
3650 };
3651
3652 status = share_mode_do_locked_vfs_allowed(fsp->file_id,
3653 smb_posix_unlink_locked,
3654 &state);
3655 if (!NT_STATUS_IS_OK(status)) {
3656 DBG_ERR("share_mode_do_locked_vfs_allowed(%s) failed - %s\n",
3657 fsp_str_dbg(fsp), nt_errstr(status));
3658 close_file_free(req, &fsp, NORMAL_CLOSE);
3659 return NT_STATUS_INVALID_PARAMETER;
3660 }
3661
3662 status = state.status;
3663 if (!NT_STATUS_IS_OK(status)) {
3664 close_file_free(req, &fsp, NORMAL_CLOSE);
3665 return status;
3666 }
3667 return close_file_free(req, &fsp, NORMAL_CLOSE);
3668 }
3669
3670 /****************************************************************************
3671 Deal with SMB_SET_FILE_UNIX_LINK (create a UNIX symlink).
3672 ****************************************************************************/
3673
3674 static NTSTATUS smb_set_file_unix_link(connection_struct *conn,
3675 struct smb_request *req,
3676 const char *pdata,
3677 int total_data,
3678 struct files_struct *dirfsp,
3679 struct smb_filename *new_smb_fname)
3680 {
3681 char *link_target = NULL;
3682 struct smb_filename target_fname;
3683 TALLOC_CTX *ctx = talloc_tos();
3684 struct smb_filename new_smb_fname_rel = {};
3685 char *slash = NULL;
3686 NTSTATUS status;
3687 int ret;
3688
3689 if (!CAN_WRITE(conn)) {
3690 return NT_STATUS_DOS(ERRSRV, ERRaccess);
3691 }
3692
3693 /* Set a symbolic link. */
3694 /* Don't allow this if follow links is false. */
3695
3696 if (total_data == 0) {
3697 return NT_STATUS_INVALID_PARAMETER;
3698 }
3699
3700 if (!lp_follow_symlinks(SNUM(conn))) {
3701 return NT_STATUS_ACCESS_DENIED;
3702 }
3703
3704 srvstr_pull_talloc(ctx, pdata, req->flags2, &link_target, pdata,
3705 total_data, STR_TERMINATE);
3706
3707 if (!link_target) {
3708 return NT_STATUS_INVALID_PARAMETER;
3709 }
3710
3711 target_fname = (struct smb_filename) {
3712 .base_name = link_target,
3713 };
3714
3715 /* Removes @GMT tokens if any */
3716 status = canonicalize_snapshot_path(&target_fname, UCF_GMT_PATHNAME, 0);
3717 if (!NT_STATUS_IS_OK(status)) {
3718 return status;
3719 }
3720
3721 DBG_DEBUG("SMB_SET_FILE_UNIX_LINK doing symlink %s -> %s\n",
3722 new_smb_fname->base_name, link_target);
3723
3724 new_smb_fname_rel = *new_smb_fname;
3725 slash = strrchr_m(new_smb_fname_rel.base_name, '/');
3726 if (slash != NULL) {
3727 new_smb_fname_rel.base_name = slash + 1;
3728 }
3729
3730 ret = SMB_VFS_SYMLINKAT(conn,
3731 &target_fname,
3732 dirfsp,
3733 &new_smb_fname_rel);
3734 if (ret != 0) {
3735 return map_nt_error_from_unix(errno);
3736 }
3737
3738 return NT_STATUS_OK;
3739 }
3740
3741 /****************************************************************************
3742 Deal with SMB_SET_FILE_UNIX_HLINK (create a UNIX hard link).
3743 ****************************************************************************/
3744
3745 static NTSTATUS smb_set_file_unix_hlink(connection_struct *conn,
3746 struct smb_request *req,
3747 const char *pdata, int total_data,
3748 struct smb_filename *smb_fname_new)
3749 {
3750 char *oldname = NULL;
3751 struct files_struct *src_dirfsp = NULL;
3752 struct smb_filename *smb_fname_old = NULL;
3753 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
3754 NTTIME old_twrp = 0;
3755 TALLOC_CTX *ctx = talloc_tos();
3756 NTSTATUS status = NT_STATUS_OK;
3757
3758 if (!CAN_WRITE(conn)) {
3759 return NT_STATUS_DOS(ERRSRV, ERRaccess);
3760 }
3761
3762 /* Set a hard link. */
3763 if (total_data == 0) {
3764 return NT_STATUS_INVALID_PARAMETER;
3765 }
3766
3767 if (req->posix_pathnames) {
3768 srvstr_get_path_posix(ctx,
3769 pdata,
3770 req->flags2,
3771 &oldname,
3772 pdata,
3773 total_data,
3774 STR_TERMINATE,
3775 &status);
3776 } else {
3777 srvstr_get_path(ctx,
3778 pdata,
3779 req->flags2,
3780 &oldname,
3781 pdata,
3782 total_data,
3783 STR_TERMINATE,
3784 &status);
3785 }
3786 if (!NT_STATUS_IS_OK(status)) {
3787 return status;
3788 }
3789
3790 DEBUG(10,("smb_set_file_unix_hlink: SMB_SET_FILE_UNIX_LINK doing hard link %s -> %s\n",
3791 smb_fname_str_dbg(smb_fname_new), oldname));
3792
3793 if (ucf_flags & UCF_GMT_PATHNAME) {
3794 extract_snapshot_token(oldname, &old_twrp);
3795 }
3796 status = smb1_strip_dfs_path(ctx, &ucf_flags, &oldname);
3797 if (!NT_STATUS_IS_OK(status)) {
3798 return status;
3799 }
3800 status = filename_convert_dirfsp(ctx,
3801 conn,
3802 oldname,
3803 ucf_flags,
3804 old_twrp,
3805 &src_dirfsp,
3806 &smb_fname_old);
3807 if (!NT_STATUS_IS_OK(status)) {
3808 return status;
3809 }
3810
3811 return hardlink_internals(ctx,
3812 conn,
3813 req,
3814 false,
3815 smb_fname_old,
3816 smb_fname_new);
3817 }
3818
3819 /****************************************************************************
3820 Allow a UNIX info mknod.
3821 ****************************************************************************/
3822
3823 static NTSTATUS smb_unix_mknod(connection_struct *conn,
3824 const char *pdata,
3825 int total_data,
3826 struct files_struct *dirfsp,
3827 const struct smb_filename *smb_fname)
3828 {
3829 uint32_t file_type = IVAL(pdata,56);
3830 #if defined(HAVE_MAKEDEV)
3831 uint32_t dev_major = IVAL(pdata,60);
3832 uint32_t dev_minor = IVAL(pdata,68);
3833 #endif
3834 SMB_DEV_T dev = (SMB_DEV_T)0;
3835 uint32_t raw_unixmode = IVAL(pdata,84);
3836 NTSTATUS status;
3837 mode_t unixmode;
3838 int ret;
3839 struct smb_filename *parent_fname = NULL;
3840 struct smb_filename *atname = NULL;
3841
3842 if (total_data < 100) {
3843 return NT_STATUS_INVALID_PARAMETER;
3844 }
3845
3846 status = unix_perms_from_wire(conn, &smb_fname->st, raw_unixmode,
3847 PERM_NEW_FILE, &unixmode);
3848 if (!NT_STATUS_IS_OK(status)) {
3849 return status;
3850 }
3851
3852 #if defined(HAVE_MAKEDEV)
3853 dev = makedev(dev_major, dev_minor);
3854 #endif
3855
3856 switch (file_type) {
3857 /* We can't create other objects here. */
3858 case UNIX_TYPE_FILE:
3859 case UNIX_TYPE_DIR:
3860 case UNIX_TYPE_SYMLINK:
3861 return NT_STATUS_ACCESS_DENIED;
3862 #if defined(S_IFIFO)
3863 case UNIX_TYPE_FIFO:
3864 unixmode |= S_IFIFO;
3865 break;
3866 #endif
3867 #if defined(S_IFSOCK)
3868 case UNIX_TYPE_SOCKET:
3869 unixmode |= S_IFSOCK;
3870 break;
3871 #endif
3872 #if defined(S_IFCHR)
3873 case UNIX_TYPE_CHARDEV:
3874 /* This is only allowed for root. */
3875 if (get_current_uid(conn) != sec_initial_uid()) {
3876 return NT_STATUS_ACCESS_DENIED;
3877 }
3878 unixmode |= S_IFCHR;
3879 break;
3880 #endif
3881 #if defined(S_IFBLK)
3882 case UNIX_TYPE_BLKDEV:
3883 if (get_current_uid(conn) != sec_initial_uid()) {
3884 return NT_STATUS_ACCESS_DENIED;
3885 }
3886 unixmode |= S_IFBLK;
3887 break;
3888 #endif
3889 default:
3890 return NT_STATUS_INVALID_PARAMETER;
3891 }
3892
3893 DEBUG(10,("smb_unix_mknod: SMB_SET_FILE_UNIX_BASIC doing mknod dev "
3894 "%.0f mode 0%o for file %s\n", (double)dev,
3895 (unsigned int)unixmode, smb_fname_str_dbg(smb_fname)));
3896
3897 status = SMB_VFS_PARENT_PATHNAME(dirfsp->conn,
3898 talloc_tos(),
3899 smb_fname,
3900 &parent_fname,
3901 &atname);
3902 if (!NT_STATUS_IS_OK(status)) {
3903 return status;
3904 }
3905
3906 /* Ok - do the mknod. */
3907 ret = SMB_VFS_MKNODAT(conn,
3908 dirfsp,
3909 atname,
3910 unixmode,
3911 dev);
3912
3913 if (ret != 0) {
3914 TALLOC_FREE(parent_fname);
3915 return map_nt_error_from_unix(errno);
3916 }
3917
3918 /* If any of the other "set" calls fail we
3919 * don't want to end up with a half-constructed mknod.
3920 */
3921
3922 if (lp_inherit_permissions(SNUM(conn))) {
3923 inherit_access_posix_acl(conn,
3924 dirfsp,
3925 smb_fname,
3926 unixmode);
3927 }
3928 TALLOC_FREE(parent_fname);
3929
3930 return NT_STATUS_OK;
3931 }
3932
3933 /****************************************************************************
3934 Deal with SMB_SET_FILE_UNIX_BASIC.
3935 ****************************************************************************/
3936
3937 static NTSTATUS smb_set_file_unix_basic(connection_struct *conn,
3938 struct smb_request *req,
3939 const char *pdata,
3940 int total_data,
3941 struct files_struct *dirfsp,
3942 files_struct *fsp,
3943 struct smb_filename *smb_fname)
3944 {
3945 struct smb_file_time ft;
3946 uint32_t raw_unixmode;
3947 mode_t unixmode;
3948 off_t size = 0;
3949 uid_t set_owner = (uid_t)SMB_UID_NO_CHANGE;
3950 gid_t set_grp = (uid_t)SMB_GID_NO_CHANGE;
3951 NTSTATUS status = NT_STATUS_OK;
3952 enum perm_type ptype;
3953 files_struct *all_fsps = NULL;
3954 bool modify_mtime = true;
3955 struct file_id id;
3956 SMB_STRUCT_STAT sbuf;
3957
3958 if (!CAN_WRITE(conn)) {
3959 return NT_STATUS_DOS(ERRSRV, ERRaccess);
3960 }
3961
3962 init_smb_file_time(&ft);
3963
3964 if (total_data < 100) {
3965 return NT_STATUS_INVALID_PARAMETER;
3966 }
3967
3968 if(IVAL(pdata, 0) != SMB_SIZE_NO_CHANGE_LO &&
3969 IVAL(pdata, 4) != SMB_SIZE_NO_CHANGE_HI) {
3970 size=IVAL(pdata,0); /* first 8 Bytes are size */
3971 size |= (((off_t)IVAL(pdata,4)) << 32);
3972 }
3973
3974 ft.atime = pull_long_date_full_timespec(pdata+24); /* access_time */
3975 ft.mtime = pull_long_date_full_timespec(pdata+32); /* modification_time */
3976 set_owner = (uid_t)IVAL(pdata,40);
3977 set_grp = (gid_t)IVAL(pdata,48);
3978 raw_unixmode = IVAL(pdata,84);
3979
3980 if (VALID_STAT(smb_fname->st)) {
3981 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
3982 ptype = PERM_EXISTING_DIR;
3983 } else {
3984 ptype = PERM_EXISTING_FILE;
3985 }
3986 } else {
3987 ptype = PERM_NEW_FILE;
3988 }
3989
3990 status = unix_perms_from_wire(conn, &smb_fname->st, raw_unixmode,
3991 ptype, &unixmode);
3992 if (!NT_STATUS_IS_OK(status)) {
3993 return status;
3994 }
3995
3996 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC: name = "
3997 "%s size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
3998 smb_fname_str_dbg(smb_fname), (double)size,
3999 (unsigned int)set_owner, (unsigned int)set_grp,
4000 (int)raw_unixmode));
4001
4002 sbuf = smb_fname->st;
4003
4004 if (!VALID_STAT(sbuf)) {
4005 /*
4006 * The only valid use of this is to create character and block
4007 * devices, and named pipes. This is deprecated (IMHO) and
4008 * a new info level should be used for mknod. JRA.
4009 */
4010
4011 if (dirfsp == NULL) {
4012 return NT_STATUS_INVALID_PARAMETER;
4013 }
4014
4015 return smb_unix_mknod(conn,
4016 pdata,
4017 total_data,
4018 dirfsp,
4019 smb_fname);
4020 }
4021
4022 #if 1
4023 /* Horrible backwards compatibility hack as an old server bug
4024 * allowed a CIFS client bug to remain unnoticed :-(. JRA.
4025 * */
4026
4027 if (!size) {
4028 size = get_file_size_stat(&sbuf);
4029 }
4030 #endif
4031
4032 /*
4033 * Deal with the UNIX specific mode set.
4034 */
4035
4036 if (raw_unixmode != SMB_MODE_NO_CHANGE) {
4037 int ret;
4038
4039 if (fsp == NULL || S_ISLNK(smb_fname->st.st_ex_mode)) {
4040 DBG_WARNING("Can't set mode on symlink %s\n",
4041 smb_fname_str_dbg(smb_fname));
4042 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4043 }
4044
4045 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC "
4046 "setting mode 0%o for file %s\n",
4047 (unsigned int)unixmode,
4048 smb_fname_str_dbg(smb_fname)));
4049 ret = SMB_VFS_FCHMOD(fsp, unixmode);
4050 if (ret != 0) {
4051 return map_nt_error_from_unix(errno);
4052 }
4053 }
4054
4055 /*
4056 * Deal with the UNIX specific uid set.
4057 */
4058
4059 if ((set_owner != (uid_t)SMB_UID_NO_CHANGE) &&
4060 (sbuf.st_ex_uid != set_owner)) {
4061 int ret;
4062
4063 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC "
4064 "changing owner %u for path %s\n",
4065 (unsigned int)set_owner,
4066 smb_fname_str_dbg(smb_fname)));
4067
4068 if (fsp &&
4069 !fsp->fsp_flags.is_pathref &&
4070 fsp_get_io_fd(fsp) != -1)
4071 {
4072 ret = SMB_VFS_FCHOWN(fsp, set_owner, (gid_t)-1);
4073 } else {
4074 /*
4075 * UNIX extensions calls must always operate
4076 * on symlinks.
4077 */
4078 ret = SMB_VFS_LCHOWN(conn, smb_fname,
4079 set_owner, (gid_t)-1);
4080 }
4081
4082 if (ret != 0) {
4083 status = map_nt_error_from_unix(errno);
4084 return status;
4085 }
4086 }
4087
4088 /*
4089 * Deal with the UNIX specific gid set.
4090 */
4091
4092 if ((set_grp != (uid_t)SMB_GID_NO_CHANGE) &&
4093 (sbuf.st_ex_gid != set_grp)) {
4094 int ret;
4095
4096 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC "
4097 "changing group %u for file %s\n",
4098 (unsigned int)set_grp,
4099 smb_fname_str_dbg(smb_fname)));
4100 if (fsp &&
4101 !fsp->fsp_flags.is_pathref &&
4102 fsp_get_io_fd(fsp) != -1)
4103 {
4104 ret = SMB_VFS_FCHOWN(fsp, (uid_t)-1, set_grp);
4105 } else {
4106 /*
4107 * UNIX extensions calls must always operate
4108 * on symlinks.
4109 */
4110 ret = SMB_VFS_LCHOWN(conn, smb_fname, (uid_t)-1,
4111 set_grp);
4112 }
4113 if (ret != 0) {
4114 status = map_nt_error_from_unix(errno);
4115 return status;
4116 }
4117 }
4118
4119 /* Deal with any size changes. */
4120
4121 if (S_ISREG(sbuf.st_ex_mode)) {
4122 status = smb_set_file_size(conn, req,
4123 fsp,
4124 smb_fname,
4125 &sbuf,
4126 size,
4127 false);
4128 if (!NT_STATUS_IS_OK(status)) {
4129 return status;
4130 }
4131 }
4132
4133 /* Deal with any time changes. */
4134 if (is_omit_timespec(&ft.mtime) && is_omit_timespec(&ft.atime)) {
4135 /* No change, don't cancel anything. */
4136 return status;
4137 }
4138
4139 id = vfs_file_id_from_sbuf(conn, &sbuf);
4140 for(all_fsps = file_find_di_first(conn->sconn, id, true); all_fsps;
4141 all_fsps = file_find_di_next(all_fsps, true)) {
4142 /*
4143 * We're setting the time explicitly for UNIX.
4144 * Cancel any pending changes over all handles.
4145 */
4146 all_fsps->fsp_flags.update_write_time_on_close = false;
4147 TALLOC_FREE(all_fsps->update_write_time_event);
4148 }
4149
4150 /*
4151 * Override the "setting_write_time"
4152 * parameter here as it almost does what
4153 * we need. Just remember if we modified
4154 * mtime and send the notify ourselves.
4155 */
4156 if (is_omit_timespec(&ft.mtime)) {
4157 modify_mtime = false;
4158 }
4159
4160 status = smb_set_file_time(conn,
4161 fsp,
4162 smb_fname,
4163 &ft,
4164 false);
4165 if (modify_mtime) {
4166 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
4167 FILE_NOTIFY_CHANGE_LAST_WRITE, smb_fname->base_name);
4168 }
4169 return status;
4170 }
4171
4172 /****************************************************************************
4173 Deal with SMB_SET_FILE_UNIX_INFO2.
4174 ****************************************************************************/
4175
4176 static NTSTATUS smb_set_file_unix_info2(connection_struct *conn,
4177 struct smb_request *req,
4178 const char *pdata,
4179 int total_data,
4180 struct files_struct *dirfsp,
4181 files_struct *fsp,
4182 struct smb_filename *smb_fname)
4183 {
4184 NTSTATUS status;
4185 uint32_t smb_fflags;
4186 uint32_t smb_fmask;
4187
4188 if (!CAN_WRITE(conn)) {
4189 return NT_STATUS_DOS(ERRSRV, ERRaccess);
4190 }
4191
4192 if (total_data < 116) {
4193 return NT_STATUS_INVALID_PARAMETER;
4194 }
4195
4196 /* Start by setting all the fields that are common between UNIX_BASIC
4197 * and UNIX_INFO2.
4198 */
4199 status = smb_set_file_unix_basic(conn,
4200 req,
4201 pdata,
4202 total_data,
4203 dirfsp,
4204 fsp,
4205 smb_fname);
4206 if (!NT_STATUS_IS_OK(status)) {
4207 return status;
4208 }
4209
4210 smb_fflags = IVAL(pdata, 108);
4211 smb_fmask = IVAL(pdata, 112);
4212
4213 /* NB: We should only attempt to alter the file flags if the client
4214 * sends a non-zero mask.
4215 */
4216 if (smb_fmask != 0) {
4217 int stat_fflags = 0;
4218
4219 if (!map_info2_flags_to_sbuf(&smb_fname->st, smb_fflags,
4220 smb_fmask, &stat_fflags)) {
4221 /* Client asked to alter a flag we don't understand. */
4222 return NT_STATUS_INVALID_PARAMETER;
4223 }
4224
4225 if (fsp == NULL || S_ISLNK(smb_fname->st.st_ex_mode)) {
4226 DBG_WARNING("Can't change flags on symlink %s\n",
4227 smb_fname_str_dbg(smb_fname));
4228 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4229 }
4230 if (SMB_VFS_FCHFLAGS(fsp, stat_fflags) != 0) {
4231 return map_nt_error_from_unix(errno);
4232 }
4233 }
4234
4235 /* XXX: need to add support for changing the create_time here. You
4236 * can do this for paths on Darwin with setattrlist(2). The right way
4237 * to hook this up is probably by extending the VFS utimes interface.
4238 */
4239
4240 return NT_STATUS_OK;
4241 }
4242
4243 /****************************************************************************
4244 Deal with SMB_SET_POSIX_ACL.
4245 ****************************************************************************/
4246
4247 static NTSTATUS smb_set_posix_acl(connection_struct *conn,
4248 struct smb_request *req,
4249 const char *pdata,
4250 int total_data_in,
4251 files_struct *fsp,
4252 struct smb_filename *smb_fname)
4253 {
4254 #if !defined(HAVE_POSIX_ACLS)
4255 return NT_STATUS_INVALID_LEVEL;
4256 #else
4257 uint16_t posix_acl_version;
4258 uint16_t num_file_acls;
4259 uint16_t num_def_acls;
4260 bool valid_file_acls = true;
4261 bool valid_def_acls = true;
4262 NTSTATUS status;
4263 unsigned int size_needed;
4264 unsigned int total_data;
4265 bool close_fsp = false;
4266
4267 if (total_data_in < 0) {
4268 status = NT_STATUS_INVALID_PARAMETER;
4269 goto out;
4270 }
4271
4272 total_data = total_data_in;
4273
4274 if (total_data < SMB_POSIX_ACL_HEADER_SIZE) {
4275 status = NT_STATUS_INVALID_PARAMETER;
4276 goto out;
4277 }
4278 posix_acl_version = SVAL(pdata,0);
4279 num_file_acls = SVAL(pdata,2);
4280 num_def_acls = SVAL(pdata,4);
4281
4282 if (num_file_acls == SMB_POSIX_IGNORE_ACE_ENTRIES) {
4283 valid_file_acls = false;
4284 num_file_acls = 0;
4285 }
4286
4287 if (num_def_acls == SMB_POSIX_IGNORE_ACE_ENTRIES) {
4288 valid_def_acls = false;
4289 num_def_acls = 0;
4290 }
4291
4292 if (posix_acl_version != SMB_POSIX_ACL_VERSION) {
4293 status = NT_STATUS_INVALID_PARAMETER;
4294 goto out;
4295 }
4296
4297 /* Wrap checks. */
4298 if (num_file_acls + num_def_acls < num_file_acls) {
4299 status = NT_STATUS_INVALID_PARAMETER;
4300 goto out;
4301 }
4302
4303 size_needed = num_file_acls + num_def_acls;
4304
4305 /*
4306 * (size_needed * SMB_POSIX_ACL_ENTRY_SIZE) must be less
4307 * than UINT_MAX, so check by division.
4308 */
4309 if (size_needed > (UINT_MAX/SMB_POSIX_ACL_ENTRY_SIZE)) {
4310 status = NT_STATUS_INVALID_PARAMETER;
4311 goto out;
4312 }
4313
4314 size_needed = size_needed*SMB_POSIX_ACL_ENTRY_SIZE;
4315 if (size_needed + SMB_POSIX_ACL_HEADER_SIZE < size_needed) {
4316 status = NT_STATUS_INVALID_PARAMETER;
4317 goto out;
4318 }
4319 size_needed += SMB_POSIX_ACL_HEADER_SIZE;
4320
4321 if (total_data < size_needed) {
4322 status = NT_STATUS_INVALID_PARAMETER;
4323 goto out;
4324 }
4325
4326 /*
4327 * Ensure we always operate on a file descriptor, not just
4328 * the filename.
4329 */
4330 if (fsp == NULL || !fsp->fsp_flags.is_fsa) {
4331 uint32_t access_mask = SEC_STD_WRITE_OWNER|
4332 SEC_STD_WRITE_DAC|
4333 SEC_STD_READ_CONTROL|
4334 FILE_READ_ATTRIBUTES|
4335 FILE_WRITE_ATTRIBUTES;
4336
4337 status = get_posix_fsp(conn,
4338 req,
4339 smb_fname,
4340 access_mask,
4341 &fsp);
4342
4343 if (!NT_STATUS_IS_OK(status)) {
4344 goto out;
4345 }
4346 close_fsp = true;
4347 }
4348
4349 /* Here we know fsp != NULL */
4350 SMB_ASSERT(fsp != NULL);
4351
4352 status = refuse_symlink_fsp(fsp);
4353 if (!NT_STATUS_IS_OK(status)) {
4354 goto out;
4355 }
4356
4357 /* If we have a default acl, this *must* be a directory. */
4358 if (valid_def_acls && !fsp->fsp_flags.is_directory) {
4359 DBG_INFO("Can't set default acls on "
4360 "non-directory %s\n",
4361 fsp_str_dbg(fsp));
4362 return NT_STATUS_INVALID_HANDLE;
4363 }
4364
4365 DBG_DEBUG("file %s num_file_acls = %"PRIu16", "
4366 "num_def_acls = %"PRIu16"\n",
4367 fsp_str_dbg(fsp),
4368 num_file_acls,
4369 num_def_acls);
4370
4371 /* Move pdata to the start of the file ACL entries. */
4372 pdata += SMB_POSIX_ACL_HEADER_SIZE;
4373
4374 if (valid_file_acls) {
4375 status = set_unix_posix_acl(conn,
4376 fsp,
4377 num_file_acls,
4378 pdata);
4379 if (!NT_STATUS_IS_OK(status)) {
4380 goto out;
4381 }
4382 }
4383
4384 /* Move pdata to the start of the default ACL entries. */
4385 pdata += (num_file_acls*SMB_POSIX_ACL_ENTRY_SIZE);
4386
4387 if (valid_def_acls) {
4388 status = set_unix_posix_default_acl(conn,
4389 fsp,
4390 num_def_acls,
4391 pdata);
4392 if (!NT_STATUS_IS_OK(status)) {
4393 goto out;
4394 }
4395 }
4396
4397 status = NT_STATUS_OK;
4398
4399 out:
4400
4401 if (close_fsp) {
4402 (void)close_file_free(req, &fsp, NORMAL_CLOSE);
4403 }
4404 return status;
4405 #endif
4406 }
4407
4408 static void call_trans2setpathinfo(
4409 connection_struct *conn,
4410 struct smb_request *req,
4411 char **pparams,
4412 int total_params,
4413 char **ppdata,
4414 int total_data,
4415 unsigned int max_data_bytes)
4416 {
4417 uint16_t info_level;
4418 struct smb_filename *smb_fname = NULL;
4419 struct files_struct *dirfsp = NULL;
4420 struct files_struct *fsp = NULL;
4421 char *params = *pparams;
4422 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
4423 NTTIME twrp = 0;
4424 char *fname = NULL;
4425 bool info_level_handled;
4426 int data_return_size = 0;
4427 NTSTATUS status;
4428
4429 if (params == NULL) {
4430 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4431 return;
4432 }
4433
4434 /* set path info */
4435 if (total_params < 7) {
4436 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4437 return;
4438 }
4439
4440 info_level = SVAL(params,0);
4441
4442 if (INFO_LEVEL_IS_UNIX(info_level)) {
4443 if (!lp_smb1_unix_extensions()) {
4444 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
4445 return;
4446 }
4447 if (!req->posix_pathnames) {
4448 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
4449 return;
4450 }
4451 }
4452
4453 if (req->posix_pathnames) {
4454 srvstr_get_path_posix(req,
4455 params,
4456 req->flags2,
4457 &fname,
4458 &params[6],
4459 total_params - 6,
4460 STR_TERMINATE,
4461 &status);
4462 } else {
4463 srvstr_get_path(req,
4464 params,
4465 req->flags2,
4466 &fname,
4467 &params[6],
4468 total_params - 6,
4469 STR_TERMINATE,
4470 &status);
4471 }
4472 if (!NT_STATUS_IS_OK(status)) {
4473 reply_nterror(req, status);
4474 return;
4475 }
4476
4477 DBG_NOTICE("fname=%s info_level=%d totdata=%d\n",
4478 fname,
4479 info_level,
4480 total_data);
4481
4482 if (ucf_flags & UCF_GMT_PATHNAME) {
4483 extract_snapshot_token(fname, &twrp);
4484 }
4485 status = smb1_strip_dfs_path(req, &ucf_flags, &fname);
4486 if (!NT_STATUS_IS_OK(status)) {
4487 reply_nterror(req, status);
4488 return;
4489 }
4490 status = filename_convert_dirfsp(req,
4491 conn,
4492 fname,
4493 ucf_flags,
4494 twrp,
4495 &dirfsp,
4496 &smb_fname);
4497 if (!NT_STATUS_IS_OK(status)) {
4498 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4499 reply_botherror(req,
4500 NT_STATUS_PATH_NOT_COVERED,
4501 ERRSRV, ERRbadpath);
4502 return;
4503 }
4504 reply_nterror(req, status);
4505 return;
4506 }
4507
4508 info_level_handled = true; /* Untouched in switch cases below */
4509
4510 switch (info_level) {
4511
4512 default:
4513 info_level_handled = false;
4514 break;
4515
4516 case SMB_POSIX_PATH_OPEN:
4517 status = smb_posix_open(conn,
4518 req,
4519 ppdata,
4520 total_data,
4521 dirfsp,
4522 smb_fname,
4523 &data_return_size);
4524 break;
4525
4526 case SMB_POSIX_PATH_UNLINK:
4527 status = smb_posix_unlink(conn,
4528 req,
4529 *ppdata,
4530 total_data,
4531 dirfsp,
4532 smb_fname);
4533 break;
4534
4535 case SMB_SET_FILE_UNIX_LINK:
4536 status = smb_set_file_unix_link(
4537 conn, req, *ppdata, total_data, dirfsp, smb_fname);
4538 break;
4539
4540 case SMB_SET_FILE_UNIX_HLINK:
4541 status = smb_set_file_unix_hlink(
4542 conn, req, *ppdata, total_data, smb_fname);
4543 break;
4544
4545 case SMB_SET_FILE_UNIX_BASIC:
4546 status = smb_set_file_unix_basic(conn,
4547 req,
4548 *ppdata,
4549 total_data,
4550 dirfsp,
4551 smb_fname->fsp,
4552 smb_fname);
4553 break;
4554
4555 case SMB_SET_FILE_UNIX_INFO2:
4556 status = smb_set_file_unix_info2(conn,
4557 req,
4558 *ppdata,
4559 total_data,
4560 dirfsp,
4561 smb_fname->fsp,
4562 smb_fname);
4563 break;
4564 case SMB_SET_POSIX_ACL:
4565 status = smb_set_posix_acl(
4566 conn, req, *ppdata, total_data, NULL, smb_fname);
4567 break;
4568 }
4569
4570 if (info_level_handled) {
4571 handle_trans2setfilepathinfo_result(
4572 conn,
4573 req,
4574 info_level,
4575 status,
4576 *ppdata,
4577 data_return_size,
4578 max_data_bytes);
4579 return;
4580 }
4581
4582 /*
4583 * smb_fname->fsp may be NULL if smb_fname points at a symlink
4584 * and we're in POSIX context, so be careful when using fsp
4585 * below, it can still be NULL.
4586 */
4587 fsp = smb_fname->fsp;
4588
4589 status = smbd_do_setfilepathinfo(
4590 conn,
4591 req,
4592 req,
4593 info_level,
4594 fsp,
4595 smb_fname,
4596 ppdata,
4597 total_data,
4598 &data_return_size);
4599
4600 handle_trans2setfilepathinfo_result(
4601 conn,
4602 req,
4603 info_level,
4604 status,
4605 *ppdata,
4606 data_return_size,
4607 max_data_bytes);
4608 }
4609
4610 static void call_trans2setfileinfo(
4611 connection_struct *conn,
4612 struct smb_request *req,
4613 char **pparams,
4614 int total_params,
4615 char **ppdata,
4616 int total_data,
4617 unsigned int max_data_bytes)
4618 {
4619 char *pdata = *ppdata;
4620 uint16_t info_level;
4621 struct smb_filename *smb_fname = NULL;
4622 struct files_struct *fsp = NULL;
4623 char *params = *pparams;
4624 int data_return_size = 0;
4625 bool info_level_handled;
4626 NTSTATUS status;
4627 int ret;
4628
4629 if (params == NULL) {
4630 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4631 return;
4632 }
4633 if (total_params < 4) {
4634 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4635 return;
4636 }
4637
4638 fsp = file_fsp(req, SVAL(params,0));
4639 /* Basic check for non-null fsp. */
4640 if (!check_fsp_open(conn, req, fsp)) {
4641 return;
4642 }
4643 info_level = SVAL(params,2);
4644
4645 if (INFO_LEVEL_IS_UNIX(info_level)) {
4646 if (!lp_smb1_unix_extensions()) {
4647 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
4648 return;
4649 }
4650 if (!req->posix_pathnames) {
4651 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
4652 return;
4653 }
4654 }
4655
4656 smb_fname = fsp->fsp_name;
4657
4658 DBG_NOTICE("fnum=%s fname=%s info_level=%d totdata=%d\n",
4659 fsp_fnum_dbg(fsp),
4660 fsp_str_dbg(fsp),
4661 info_level,
4662 total_data);
4663
4664 if (fsp_get_pathref_fd(fsp) == -1) {
4665 /*
4666 * This is actually a SETFILEINFO on a directory
4667 * handle (returned from an NT SMB). NT5.0 seems
4668 * to do this call. JRA.
4669 */
4670 ret = vfs_stat(conn, smb_fname);
4671 if (ret != 0) {
4672 DBG_NOTICE("vfs_stat of %s failed (%s)\n",
4673 smb_fname_str_dbg(smb_fname),
4674 strerror(errno));
4675 reply_nterror(req, map_nt_error_from_unix(errno));
4676 return;
4677 }
4678 } else if (fsp->print_file) {
4679 /*
4680 * Doing a DELETE_ON_CLOSE should cancel a print job.
4681 */
4682 if ((info_level == SMB_SET_FILE_DISPOSITION_INFO) &&
4683 CVAL(pdata,0)) {
4684
4685 fsp->fsp_flags.delete_on_close = true;
4686
4687 DBG_NOTICE("Cancelling print job (%s)\n",
4688 fsp_str_dbg(fsp));
4689
4690 SSVAL(params,0,0);
4691 send_trans2_replies(
4692 conn,
4693 req,
4694 NT_STATUS_OK,
4695 params,
4696 2,
4697 *ppdata, 0,
4698 max_data_bytes);
4699 return;
4700 } else {
4701 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
4702 return;
4703 }
4704 } else {
4705 /*
4706 * Original code - this is an open file.
4707 */
4708 status = vfs_stat_fsp(fsp);
4709 if (!NT_STATUS_IS_OK(status)) {
4710 DBG_NOTICE("fstat of %s failed (%s)\n",
4711 fsp_fnum_dbg(fsp),
4712 nt_errstr(status));
4713 reply_nterror(req, status);
4714 return;
4715 }
4716 }
4717
4718 info_level_handled = true; /* Untouched in switch cases below */
4719
4720 switch (info_level) {
4721
4722 default:
4723 info_level_handled = false;
4724 break;
4725
4726 case SMB_SET_FILE_UNIX_BASIC:
4727 status = smb_set_file_unix_basic(conn,
4728 req,
4729 pdata,
4730 total_data,
4731 NULL,
4732 fsp,
4733 smb_fname);
4734 break;
4735
4736 case SMB_SET_FILE_UNIX_INFO2:
4737 status = smb_set_file_unix_info2(conn,
4738 req,
4739 pdata,
4740 total_data,
4741 NULL,
4742 fsp,
4743 smb_fname);
4744 break;
4745
4746 case SMB_SET_POSIX_LOCK:
4747 status = smb_set_posix_lock(
4748 conn, req, *ppdata, total_data, fsp);
4749 break;
4750 }
4751
4752 if (info_level_handled) {
4753 handle_trans2setfilepathinfo_result(
4754 conn,
4755 req,
4756 info_level,
4757 status,
4758 *ppdata,
4759 data_return_size,
4760 max_data_bytes);
4761 return;
4762 }
4763
4764 status = smbd_do_setfilepathinfo(
4765 conn,
4766 req,
4767 req,
4768 info_level,
4769 fsp,
4770 smb_fname,
4771 ppdata,
4772 total_data,
4773 &data_return_size);
4774
4775 handle_trans2setfilepathinfo_result(
4776 conn,
4777 req,
4778 info_level,
4779 status,
4780 *ppdata,
4781 data_return_size,
4782 max_data_bytes);
4783 }
4784
4785 /****************************************************************************
4786 Reply to a TRANS2_MKDIR (make directory with extended attributes).
4787 ****************************************************************************/
4788
4789 static void call_trans2mkdir(connection_struct *conn, struct smb_request *req,
4790 char **pparams, int total_params,
4791 char **ppdata, int total_data,
4792 unsigned int max_data_bytes)
4793 {
4794 struct files_struct *dirfsp = NULL;
4795 struct files_struct *fsp = NULL;
4796 struct smb_filename *smb_dname = NULL;
4797 char *params = *pparams;
4798 char *pdata = *ppdata;
4799 char *directory = NULL;
4800 NTSTATUS status = NT_STATUS_OK;
4801 struct ea_list *ea_list = NULL;
4802 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
4803 NTTIME twrp = 0;
4804 TALLOC_CTX *ctx = talloc_tos();
4805
4806 if (!CAN_WRITE(conn)) {
4807 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4808 return;
4809 }
4810
4811 if (total_params < 5) {
4812 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4813 return;
4814 }
4815
4816 if (req->posix_pathnames) {
4817 srvstr_get_path_posix(ctx,
4818 params,
4819 req->flags2,
4820 &directory,
4821 &params[4],
4822 total_params - 4,
4823 STR_TERMINATE,
4824 &status);
4825 } else {
4826 srvstr_get_path(ctx,
4827 params,
4828 req->flags2,
4829 &directory,
4830 &params[4],
4831 total_params - 4,
4832 STR_TERMINATE,
4833 &status);
4834 }
4835 if (!NT_STATUS_IS_OK(status)) {
4836 reply_nterror(req, status);
4837 return;
4838 }
4839
4840 DEBUG(3,("call_trans2mkdir : name = %s\n", directory));
4841
4842 if (ucf_flags & UCF_GMT_PATHNAME) {
4843 extract_snapshot_token(directory, &twrp);
4844 }
4845 status = smb1_strip_dfs_path(ctx, &ucf_flags, &directory);
4846 if (!NT_STATUS_IS_OK(status)) {
4847 reply_nterror(req, status);
4848 goto out;
4849 }
4850 status = filename_convert_dirfsp(ctx,
4851 conn,
4852 directory,
4853 ucf_flags,
4854 twrp,
4855 &dirfsp,
4856 &smb_dname);
4857 if (!NT_STATUS_IS_OK(status)) {
4858 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4859 reply_botherror(req,
4860 NT_STATUS_PATH_NOT_COVERED,
4861 ERRSRV, ERRbadpath);
4862 return;
4863 }
4864 reply_nterror(req, status);
4865 return;
4866 }
4867
4868 /*
4869 * OS/2 workplace shell seems to send SET_EA requests of "null"
4870 * length (4 bytes containing IVAL 4).
4871 * They seem to have no effect. Bug #3212. JRA.
4872 */
4873
4874 if (total_data && (total_data != 4)) {
4875 /* Any data in this call is an EA list. */
4876 if (total_data < 10) {
4877 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4878 goto out;
4879 }
4880
4881 if (IVAL(pdata,0) > total_data) {
4882 DEBUG(10,("call_trans2mkdir: bad total data size (%u) > %u\n",
4883 IVAL(pdata,0), (unsigned int)total_data));
4884 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4885 goto out;
4886 }
4887
4888 ea_list = read_ea_list(talloc_tos(), pdata + 4,
4889 total_data - 4);
4890 if (!ea_list) {
4891 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4892 goto out;
4893 }
4894
4895 if (!lp_ea_support(SNUM(conn))) {
4896 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
4897 goto out;
4898 }
4899 }
4900 /* If total_data == 4 Windows doesn't care what values
4901 * are placed in that field, it just ignores them.
4902 * The System i QNTC IBM SMB client puts bad values here,
4903 * so ignore them. */
4904
4905 status = SMB_VFS_CREATE_FILE(
4906 conn, /* conn */
4907 req, /* req */
4908 dirfsp, /* dirfsp */
4909 smb_dname, /* fname */
4910 MAXIMUM_ALLOWED_ACCESS, /* access_mask */
4911 FILE_SHARE_NONE, /* share_access */
4912 FILE_CREATE, /* create_disposition*/
4913 FILE_DIRECTORY_FILE, /* create_options */
4914 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
4915 0, /* oplock_request */
4916 NULL, /* lease */
4917 0, /* allocation_size */
4918 0, /* private_flags */
4919 NULL, /* sd */
4920 NULL, /* ea_list */
4921 &fsp, /* result */
4922 NULL, /* pinfo */
4923 NULL, NULL); /* create context */
4924 if (!NT_STATUS_IS_OK(status)) {
4925 reply_nterror(req, status);
4926 goto out;
4927 }
4928
4929 /* Try and set any given EA. */
4930 if (ea_list) {
4931 status = set_ea(conn, fsp, ea_list);
4932 if (!NT_STATUS_IS_OK(status)) {
4933 reply_nterror(req, status);
4934 goto out;
4935 }
4936 }
4937
4938 /* Realloc the parameter and data sizes */
4939 *pparams = (char *)SMB_REALLOC(*pparams,2);
4940 if(*pparams == NULL) {
4941 reply_nterror(req, NT_STATUS_NO_MEMORY);
4942 goto out;
4943 }
4944 params = *pparams;
4945
4946 SSVAL(params,0,0);
4947
4948 send_trans2_replies(conn, req, NT_STATUS_OK, params, 2, *ppdata, 0, max_data_bytes);
4949
4950 out:
4951 if (fsp != NULL) {
4952 close_file_free(NULL, &fsp, NORMAL_CLOSE);
4953 }
4954 TALLOC_FREE(smb_dname);
4955 }
4956
4957 /****************************************************************************
4958 Reply to a TRANS2_FINDNOTIFYFIRST (start monitoring a directory for changes).
4959 We don't actually do this - we just send a null response.
4960 ****************************************************************************/
4961
4962 static void call_trans2findnotifyfirst(connection_struct *conn,
4963 struct smb_request *req,
4964 char **pparams, int total_params,
4965 char **ppdata, int total_data,
4966 unsigned int max_data_bytes)
4967 {
4968 char *params = *pparams;
4969 uint16_t info_level;
4970
4971 if (total_params < 6) {
4972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4973 return;
4974 }
4975
4976 info_level = SVAL(params,4);
4977 DEBUG(3,("call_trans2findnotifyfirst - info_level %d\n", info_level));
4978
4979 switch (info_level) {
4980 case 1:
4981 case 2:
4982 break;
4983 default:
4984 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
4985 return;
4986 }
4987
4988 /* Realloc the parameter and data sizes */
4989 *pparams = (char *)SMB_REALLOC(*pparams,6);
4990 if (*pparams == NULL) {
4991 reply_nterror(req, NT_STATUS_NO_MEMORY);
4992 return;
4993 }
4994 params = *pparams;
4995
4996 SSVAL(params,0,fnf_handle);
4997 SSVAL(params,2,0); /* No changes */
4998 SSVAL(params,4,0); /* No EA errors */
4999
5000 fnf_handle++;
5001
5002 if(fnf_handle == 0)
5003 fnf_handle = 257;
5004
5005 send_trans2_replies(conn, req, NT_STATUS_OK, params, 6, *ppdata, 0, max_data_bytes);
5006 }
5007
5008 /****************************************************************************
5009 Reply to a TRANS2_FINDNOTIFYNEXT (continue monitoring a directory for
5010 changes). Currently this does nothing.
5011 ****************************************************************************/
5012
5013 static void call_trans2findnotifynext(connection_struct *conn,
5014 struct smb_request *req,
5015 char **pparams, int total_params,
5016 char **ppdata, int total_data,
5017 unsigned int max_data_bytes)
5018 {
5019 char *params = *pparams;
5020
5021 DEBUG(3,("call_trans2findnotifynext\n"));
5022
5023 /* Realloc the parameter and data sizes */
5024 *pparams = (char *)SMB_REALLOC(*pparams,4);
5025 if (*pparams == NULL) {
5026 reply_nterror(req, NT_STATUS_NO_MEMORY);
5027 return;
5028 }
5029 params = *pparams;
5030
5031 SSVAL(params,0,0); /* No changes */
5032 SSVAL(params,2,0); /* No EA errors */
5033
5034 send_trans2_replies(conn, req, NT_STATUS_OK, params, 4, *ppdata, 0, max_data_bytes);
5035 }
5036
5037 /****************************************************************************
5038 Reply to a TRANS2_GET_DFS_REFERRAL - Shirish Kalele <kalele@veritas.com>.
5039 ****************************************************************************/
5040
5041 static void call_trans2getdfsreferral(connection_struct *conn,
5042 struct smb_request *req,
5043 char **pparams, int total_params,
5044 char **ppdata, int total_data,
5045 unsigned int max_data_bytes)
5046 {
5047 char *params = *pparams;
5048 char *pathname = NULL;
5049 int reply_size = 0;
5050 int max_referral_level;
5051 NTSTATUS status = NT_STATUS_OK;
5052 TALLOC_CTX *ctx = talloc_tos();
5053
5054 DEBUG(10,("call_trans2getdfsreferral\n"));
5055
5056 if (!IS_IPC(conn)) {
5057 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5058 return;
5059 }
5060
5061 if (total_params < 3) {
5062 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5063 return;
5064 }
5065
5066 max_referral_level = SVAL(params,0);
5067
5068 if(!lp_host_msdfs()) {
5069 reply_nterror(req, NT_STATUS_NOT_IMPLEMENTED);
5070 return;
5071 }
5072
5073 srvstr_pull_talloc(ctx, params, req->flags2, &pathname, &params[2],
5074 total_params - 2, STR_TERMINATE);
5075 if (!pathname) {
5076 reply_nterror(req, NT_STATUS_NOT_FOUND);
5077 return;
5078 }
5079 reply_size = setup_dfs_referral(
5080 conn, pathname, max_referral_level, ppdata, &status);
5081 if (reply_size < 0) {
5082 reply_nterror(req, status);
5083 return;
5084 }
5085
5086 SSVAL((discard_const_p(uint8_t, req->inbuf)), smb_flg2,
5087 SVAL(req->inbuf,smb_flg2) | FLAGS2_DFS_PATHNAMES);
5088 send_trans2_replies(conn, req, NT_STATUS_OK, 0,0,*ppdata,reply_size, max_data_bytes);
5089 }
5090
5091 #define LMCAT_SPL 0x53
5092 #define LMFUNC_GETJOBID 0x60
5093
5094 /****************************************************************************
5095 Reply to a TRANS2_IOCTL - used for OS/2 printing.
5096 ****************************************************************************/
5097
5098 static void call_trans2ioctl(connection_struct *conn,
5099 struct smb_request *req,
5100 char **pparams, int total_params,
5101 char **ppdata, int total_data,
5102 unsigned int max_data_bytes)
5103 {
5104 const struct loadparm_substitution *lp_sub =
5105 loadparm_s3_global_substitution();
5106 char *pdata = *ppdata;
5107 files_struct *fsp = file_fsp(req, SVAL(req->vwv+15, 0));
5108 NTSTATUS status;
5109 size_t len = 0;
5110
5111 /* check for an invalid fid before proceeding */
5112
5113 if (!fsp) {
5114 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5115 return;
5116 }
5117
5118 if ((SVAL(req->vwv+16, 0) == LMCAT_SPL)
5119 && (SVAL(req->vwv+17, 0) == LMFUNC_GETJOBID)) {
5120 *ppdata = (char *)SMB_REALLOC(*ppdata, 32);
5121 if (*ppdata == NULL) {
5122 reply_nterror(req, NT_STATUS_NO_MEMORY);
5123 return;
5124 }
5125 pdata = *ppdata;
5126
5127 /* NOTE - THIS IS ASCII ONLY AT THE MOMENT - NOT SURE IF OS/2
5128 CAN ACCEPT THIS IN UNICODE. JRA. */
5129
5130 /* Job number */
5131 SSVAL(pdata, 0, print_spool_rap_jobid(fsp->print_file));
5132
5133 status = srvstr_push(pdata, req->flags2, pdata + 2,
5134 lp_netbios_name(), 15,
5135 STR_ASCII|STR_TERMINATE, &len); /* Our NetBIOS name */
5136 if (!NT_STATUS_IS_OK(status)) {
5137 reply_nterror(req, status);
5138 return;
5139 }
5140 status = srvstr_push(pdata, req->flags2, pdata+18,
5141 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)), 13,
5142 STR_ASCII|STR_TERMINATE, &len); /* Service name */
5143 if (!NT_STATUS_IS_OK(status)) {
5144 reply_nterror(req, status);
5145 return;
5146 }
5147 send_trans2_replies(conn, req, NT_STATUS_OK, *pparams, 0, *ppdata, 32,
5148 max_data_bytes);
5149 return;
5150 }
5151
5152 DEBUG(2,("Unknown TRANS2_IOCTL\n"));
5153 reply_nterror(req, NT_STATUS_NOT_IMPLEMENTED);
5154 }
5155
5156 static void handle_trans2(connection_struct *conn, struct smb_request *req,
5157 struct trans_state *state)
5158 {
5159 struct smbXsrv_connection *xconn = req->xconn;
5160
5161 if (xconn->protocol >= PROTOCOL_NT1) {
5162 req->flags2 |= 0x40; /* IS_LONG_NAME */
5163 SSVAL((discard_const_p(uint8_t, req->inbuf)),smb_flg2,req->flags2);
5164 }
5165
5166 if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
5167 if (state->call != TRANSACT2_QFSINFO &&
5168 state->call != TRANSACT2_SETFSINFO) {
5169 DEBUG(0,("handle_trans2: encryption required "
5170 "with call 0x%x\n",
5171 (unsigned int)state->call));
5172 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5173 return;
5174 }
5175 }
5176
5177 /* Now we must call the relevant TRANS2 function */
5178 switch(state->call) {
5179 case TRANSACT2_OPEN:
5180 {
5181 START_PROFILE(Trans2_open);
5182 call_trans2open(conn, req,
5183 &state->param, state->total_param,
5184 &state->data, state->total_data,
5185 state->max_data_return);
5186 END_PROFILE(Trans2_open);
5187 break;
5188 }
5189
5190 case TRANSACT2_FINDFIRST:
5191 {
5192 START_PROFILE(Trans2_findfirst);
5193 call_trans2findfirst(conn, req,
5194 &state->param, state->total_param,
5195 &state->data, state->total_data,
5196 state->max_data_return);
5197 END_PROFILE(Trans2_findfirst);
5198 break;
5199 }
5200
5201 case TRANSACT2_FINDNEXT:
5202 {
5203 START_PROFILE(Trans2_findnext);
5204 call_trans2findnext(conn, req,
5205 &state->param, state->total_param,
5206 &state->data, state->total_data,
5207 state->max_data_return);
5208 END_PROFILE(Trans2_findnext);
5209 break;
5210 }
5211
5212 case TRANSACT2_QFSINFO:
5213 {
5214 START_PROFILE(Trans2_qfsinfo);
5215 call_trans2qfsinfo(conn, req,
5216 &state->param, state->total_param,
5217 &state->data, state->total_data,
5218 state->max_data_return);
5219 END_PROFILE(Trans2_qfsinfo);
5220 break;
5221 }
5222
5223 case TRANSACT2_SETFSINFO:
5224 {
5225 START_PROFILE(Trans2_setfsinfo);
5226 call_trans2setfsinfo(conn, req,
5227 &state->param, state->total_param,
5228 &state->data, state->total_data,
5229 state->max_data_return);
5230 END_PROFILE(Trans2_setfsinfo);
5231 break;
5232 }
5233
5234 case TRANSACT2_QPATHINFO:
5235 {
5236 START_PROFILE(Trans2_qpathinfo);
5237 call_trans2qpathinfo(
5238 conn,
5239 req,
5240 &state->param,
5241 state->total_param,
5242 &state->data,
5243 state->total_data,
5244 state->max_data_return);
5245 END_PROFILE(Trans2_qpathinfo);
5246 break;
5247 }
5248
5249 case TRANSACT2_QFILEINFO:
5250 {
5251 START_PROFILE(Trans2_qfileinfo);
5252 call_trans2qfileinfo(
5253 conn,
5254 req,
5255 &state->param,
5256 state->total_param,
5257 &state->data,
5258 state->total_data,
5259 state->max_data_return);
5260 END_PROFILE(Trans2_qfileinfo);
5261 break;
5262 }
5263
5264 case TRANSACT2_SETPATHINFO:
5265 {
5266 START_PROFILE(Trans2_setpathinfo);
5267 call_trans2setpathinfo(
5268 conn,
5269 req,
5270 &state->param,
5271 state->total_param,
5272 &state->data,
5273 state->total_data,
5274 state->max_data_return);
5275 END_PROFILE(Trans2_setpathinfo);
5276 break;
5277 }
5278
5279 case TRANSACT2_SETFILEINFO:
5280 {
5281 START_PROFILE(Trans2_setfileinfo);
5282 call_trans2setfileinfo(
5283 conn,
5284 req,
5285 &state->param,
5286 state->total_param,
5287 &state->data,
5288 state->total_data,
5289 state->max_data_return);
5290 END_PROFILE(Trans2_setfileinfo);
5291 break;
5292 }
5293
5294 case TRANSACT2_FINDNOTIFYFIRST:
5295 {
5296 START_PROFILE(Trans2_findnotifyfirst);
5297 call_trans2findnotifyfirst(conn, req,
5298 &state->param, state->total_param,
5299 &state->data, state->total_data,
5300 state->max_data_return);
5301 END_PROFILE(Trans2_findnotifyfirst);
5302 break;
5303 }
5304
5305 case TRANSACT2_FINDNOTIFYNEXT:
5306 {
5307 START_PROFILE(Trans2_findnotifynext);
5308 call_trans2findnotifynext(conn, req,
5309 &state->param, state->total_param,
5310 &state->data, state->total_data,
5311 state->max_data_return);
5312 END_PROFILE(Trans2_findnotifynext);
5313 break;
5314 }
5315
5316 case TRANSACT2_MKDIR:
5317 {
5318 START_PROFILE(Trans2_mkdir);
5319 call_trans2mkdir(conn, req,
5320 &state->param, state->total_param,
5321 &state->data, state->total_data,
5322 state->max_data_return);
5323 END_PROFILE(Trans2_mkdir);
5324 break;
5325 }
5326
5327 case TRANSACT2_GET_DFS_REFERRAL:
5328 {
5329 START_PROFILE(Trans2_get_dfs_referral);
5330 call_trans2getdfsreferral(conn, req,
5331 &state->param, state->total_param,
5332 &state->data, state->total_data,
5333 state->max_data_return);
5334 END_PROFILE(Trans2_get_dfs_referral);
5335 break;
5336 }
5337
5338 case TRANSACT2_IOCTL:
5339 {
5340 START_PROFILE(Trans2_ioctl);
5341 call_trans2ioctl(conn, req,
5342 &state->param, state->total_param,
5343 &state->data, state->total_data,
5344 state->max_data_return);
5345 END_PROFILE(Trans2_ioctl);
5346 break;
5347 }
5348
5349 default:
5350 /* Error in request */
5351 DEBUG(2,("Unknown request %d in trans2 call\n", state->call));
5352 reply_nterror(req, NT_STATUS_NOT_IMPLEMENTED);
5353 }
5354 }
5355
5356 /****************************************************************************
5357 Reply to a SMBtrans2.
5358 ****************************************************************************/
5359
5360 void reply_trans2(struct smb_request *req)
5361 {
5362 connection_struct *conn = req->conn;
5363 unsigned int dsoff;
5364 unsigned int dscnt;
5365 unsigned int psoff;
5366 unsigned int pscnt;
5367 unsigned int tran_call;
5368 struct trans_state *state;
5369 NTSTATUS result;
5370
5371 START_PROFILE(SMBtrans2);
5372
5373 if (req->wct < 14) {
5374 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5375 END_PROFILE(SMBtrans2);
5376 return;
5377 }
5378
5379 dsoff = SVAL(req->vwv+12, 0);
5380 dscnt = SVAL(req->vwv+11, 0);
5381 psoff = SVAL(req->vwv+10, 0);
5382 pscnt = SVAL(req->vwv+9, 0);
5383 tran_call = SVAL(req->vwv+14, 0);
5384
5385 result = allow_new_trans(conn->pending_trans, req->mid);
5386 if (!NT_STATUS_IS_OK(result)) {
5387 DEBUG(2, ("Got invalid trans2 request: %s\n",
5388 nt_errstr(result)));
5389 reply_nterror(req, result);
5390 END_PROFILE(SMBtrans2);
5391 return;
5392 }
5393
5394 if (IS_IPC(conn)) {
5395 switch (tran_call) {
5396 /* List the allowed trans2 calls on IPC$ */
5397 case TRANSACT2_OPEN:
5398 case TRANSACT2_GET_DFS_REFERRAL:
5399 case TRANSACT2_QFILEINFO:
5400 case TRANSACT2_QFSINFO:
5401 case TRANSACT2_SETFSINFO:
5402 break;
5403 default:
5404 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5405 END_PROFILE(SMBtrans2);
5406 return;
5407 }
5408 }
5409
5410 if ((state = talloc(conn, struct trans_state)) == NULL) {
5411 DEBUG(0, ("talloc failed\n"));
5412 reply_nterror(req, NT_STATUS_NO_MEMORY);
5413 END_PROFILE(SMBtrans2);
5414 return;
5415 }
5416
5417 state->cmd = SMBtrans2;
5418
5419 state->mid = req->mid;
5420 state->vuid = req->vuid;
5421 state->setup_count = SVAL(req->vwv+13, 0);
5422 state->setup = NULL;
5423 state->total_param = SVAL(req->vwv+0, 0);
5424 state->param = NULL;
5425 state->total_data = SVAL(req->vwv+1, 0);
5426 state->data = NULL;
5427 state->max_param_return = SVAL(req->vwv+2, 0);
5428 state->max_data_return = SVAL(req->vwv+3, 0);
5429 state->max_setup_return = SVAL(req->vwv+4, 0);
5430 state->close_on_completion = BITSETW(req->vwv+5, 0);
5431 state->one_way = BITSETW(req->vwv+5, 1);
5432
5433 state->call = tran_call;
5434
5435 /* All trans2 messages we handle have smb_sucnt == 1 - ensure this
5436 is so as a sanity check */
5437 if (state->setup_count != 1) {
5438 /*
5439 * Need to have rc=0 for ioctl to get job id for OS/2.
5440 * Network printing will fail if function is not successful.
5441 * Similar function in reply.c will be used if protocol
5442 * is LANMAN1.0 instead of LM1.2X002.
5443 * Until DosPrintSetJobInfo with PRJINFO3 is supported,
5444 * outbuf doesn't have to be set(only job id is used).
5445 */
5446 if ( (state->setup_count == 4)
5447 && (tran_call == TRANSACT2_IOCTL)
5448 && (SVAL(req->vwv+16, 0) == LMCAT_SPL)
5449 && (SVAL(req->vwv+17, 0) == LMFUNC_GETJOBID)) {
5450 DEBUG(2,("Got Trans2 DevIOctl jobid\n"));
5451 } else {
5452 DEBUG(2,("Invalid smb_sucnt in trans2 call(%u)\n",state->setup_count));
5453 DEBUG(2,("Transaction is %d\n",tran_call));
5454 TALLOC_FREE(state);
5455 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5456 END_PROFILE(SMBtrans2);
5457 return;
5458 }
5459 }
5460
5461 if ((dscnt > state->total_data) || (pscnt > state->total_param))
5462 goto bad_param;
5463
5464 if (state->total_data) {
5465
5466 if (smb_buffer_oob(state->total_data, 0, dscnt)
5467 || smb_buffer_oob(smb_len(req->inbuf), dsoff, dscnt)) {
5468 goto bad_param;
5469 }
5470
5471 /* Can't use talloc here, the core routines do realloc on the
5472 * params and data. */
5473 state->data = (char *)SMB_MALLOC(state->total_data);
5474 if (state->data == NULL) {
5475 DEBUG(0,("reply_trans2: data malloc fail for %u "
5476 "bytes !\n", (unsigned int)state->total_data));
5477 TALLOC_FREE(state);
5478 reply_nterror(req, NT_STATUS_NO_MEMORY);
5479 END_PROFILE(SMBtrans2);
5480 return;
5481 }
5482
5483 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
5484 }
5485
5486 if (state->total_param) {
5487
5488 if (smb_buffer_oob(state->total_param, 0, pscnt)
5489 || smb_buffer_oob(smb_len(req->inbuf), psoff, pscnt)) {
5490 goto bad_param;
5491 }
5492
5493 /* Can't use talloc here, the core routines do realloc on the
5494 * params and data. */
5495 state->param = (char *)SMB_MALLOC(state->total_param);
5496 if (state->param == NULL) {
5497 DEBUG(0,("reply_trans: param malloc fail for %u "
5498 "bytes !\n", (unsigned int)state->total_param));
5499 SAFE_FREE(state->data);
5500 TALLOC_FREE(state);
5501 reply_nterror(req, NT_STATUS_NO_MEMORY);
5502 END_PROFILE(SMBtrans2);
5503 return;
5504 }
5505
5506 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
5507 }
5508
5509 state->received_data = dscnt;
5510 state->received_param = pscnt;
5511
5512 if ((state->received_param == state->total_param) &&
5513 (state->received_data == state->total_data)) {
5514
5515 handle_trans2(conn, req, state);
5516
5517 SAFE_FREE(state->data);
5518 SAFE_FREE(state->param);
5519 TALLOC_FREE(state);
5520 END_PROFILE(SMBtrans2);
5521 return;
5522 }
5523
5524 DLIST_ADD(conn->pending_trans, state);
5525
5526 /* We need to send an interim response then receive the rest
5527 of the parameter/data bytes */
5528 reply_smb1_outbuf(req, 0, 0);
5529 show_msg((char *)req->outbuf);
5530 END_PROFILE(SMBtrans2);
5531 return;
5532
5533 bad_param:
5534
5535 DEBUG(0,("reply_trans2: invalid trans parameters\n"));
5536 SAFE_FREE(state->data);
5537 SAFE_FREE(state->param);
5538 TALLOC_FREE(state);
5539 END_PROFILE(SMBtrans2);
5540 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5541 }
5542
5543 /****************************************************************************
5544 Reply to a SMBtranss2
5545 ****************************************************************************/
5546
5547 void reply_transs2(struct smb_request *req)
5548 {
5549 connection_struct *conn = req->conn;
5550 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
5551 struct trans_state *state;
5552
5553 START_PROFILE(SMBtranss2);
5554
5555 show_msg((const char *)req->inbuf);
5556
5557 /* Windows clients expect all replies to
5558 a transact secondary (SMBtranss2 0x33)
5559 to have a command code of transact
5560 (SMBtrans2 0x32). See bug #8989
5561 and also [MS-CIFS] section 2.2.4.47.2
5562 for details.
5563 */
5564 req->cmd = SMBtrans2;
5565
5566 if (req->wct < 8) {
5567 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5568 END_PROFILE(SMBtranss2);
5569 return;
5570 }
5571
5572 for (state = conn->pending_trans; state != NULL;
5573 state = state->next) {
5574 if (state->mid == req->mid) {
5575 break;
5576 }
5577 }
5578
5579 if ((state == NULL) || (state->cmd != SMBtrans2)) {
5580 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5581 END_PROFILE(SMBtranss2);
5582 return;
5583 }
5584
5585 /* Revise state->total_param and state->total_data in case they have
5586 changed downwards */
5587
5588 if (SVAL(req->vwv+0, 0) < state->total_param)
5589 state->total_param = SVAL(req->vwv+0, 0);
5590 if (SVAL(req->vwv+1, 0) < state->total_data)
5591 state->total_data = SVAL(req->vwv+1, 0);
5592
5593 pcnt = SVAL(req->vwv+2, 0);
5594 poff = SVAL(req->vwv+3, 0);
5595 pdisp = SVAL(req->vwv+4, 0);
5596
5597 dcnt = SVAL(req->vwv+5, 0);
5598 doff = SVAL(req->vwv+6, 0);
5599 ddisp = SVAL(req->vwv+7, 0);
5600
5601 state->received_param += pcnt;
5602 state->received_data += dcnt;
5603
5604 if ((state->received_data > state->total_data) ||
5605 (state->received_param > state->total_param))
5606 goto bad_param;
5607
5608 if (pcnt) {
5609 if (smb_buffer_oob(state->total_param, pdisp, pcnt)
5610 || smb_buffer_oob(smb_len(req->inbuf), poff, pcnt)) {
5611 goto bad_param;
5612 }
5613 memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
5614 }
5615
5616 if (dcnt) {
5617 if (smb_buffer_oob(state->total_data, ddisp, dcnt)
5618 || smb_buffer_oob(smb_len(req->inbuf), doff, dcnt)) {
5619 goto bad_param;
5620 }
5621 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
5622 }
5623
5624 if ((state->received_param < state->total_param) ||
5625 (state->received_data < state->total_data)) {
5626 END_PROFILE(SMBtranss2);
5627 return;
5628 }
5629
5630 handle_trans2(conn, req, state);
5631
5632 DLIST_REMOVE(conn->pending_trans, state);
5633 SAFE_FREE(state->data);
5634 SAFE_FREE(state->param);
5635 TALLOC_FREE(state);
5636
5637 END_PROFILE(SMBtranss2);
5638 return;
5639
5640 bad_param:
5641
5642 DEBUG(0,("reply_transs2: invalid trans parameters\n"));
5643 DLIST_REMOVE(conn->pending_trans, state);
5644 SAFE_FREE(state->data);
5645 SAFE_FREE(state->param);
5646 TALLOC_FREE(state);
5647 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5648 END_PROFILE(SMBtranss2);
5649 }
Samba GIT mirror