?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Remove the "current_user" arg from fsp_belongs_conn
[Samba.git] / source / smbd / reply.c
blobf36c5c4d312b697d84938d1b5aa0ad95416da0b5
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28
29 /* look in server.c for some explanation of these variables */
30 extern enum protocol_types Protocol;
31 extern int max_recv;
32 unsigned int smb_echo_count = 0;
33 extern uint32 global_client_caps;
34
35 extern struct current_user current_user;
36 extern bool global_encrypted_passwords_negotiated;
37
38 /****************************************************************************
39 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
40 path or anything including wildcards.
41 We're assuming here that '/' is not the second byte in any multibyte char
42 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
43 set.
44 ****************************************************************************/
45
46 /* Custom version for processing POSIX paths. */
47 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
48
49 static NTSTATUS check_path_syntax_internal(char *path,
50 bool posix_path,
51 bool *p_last_component_contains_wcard)
52 {
53 char *d = path;
54 const char *s = path;
55 NTSTATUS ret = NT_STATUS_OK;
56 bool start_of_name_component = True;
57
58 *p_last_component_contains_wcard = False;
59
60 while (*s) {
61 if (IS_PATH_SEP(*s,posix_path)) {
62 /*
63 * Safe to assume is not the second part of a mb char
64 * as this is handled below.
65 */
66 /* Eat multiple '/' or '\\' */
67 while (IS_PATH_SEP(*s,posix_path)) {
68 s++;
69 }
70 if ((d != path) && (*s != '\0')) {
71 /* We only care about non-leading or trailing '/' or '\\' */
72 *d++ = '/';
73 }
74
75 start_of_name_component = True;
76 /* New component. */
77 *p_last_component_contains_wcard = False;
78 continue;
79 }
80
81 if (start_of_name_component) {
82 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
83 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
84
85 /*
86 * No mb char starts with '.' so we're safe checking the directory separator here.
87 */
88
89 /* If we just added a '/' - delete it */
90 if ((d > path) && (*(d-1) == '/')) {
91 *(d-1) = '\0';
92 d--;
93 }
94
95 /* Are we at the start ? Can't go back further if so. */
96 if (d <= path) {
97 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
98 break;
99 }
100 /* Go back one level... */
101 /* We know this is safe as '/' cannot be part of a mb sequence. */
102 /* NOTE - if this assumption is invalid we are not in good shape... */
103 /* Decrement d first as d points to the *next* char to write into. */
104 for (d--; d > path; d--) {
105 if (*d == '/')
106 break;
107 }
108 s += 2; /* Else go past the .. */
109 /* We're still at the start of a name component, just the previous one. */
110 continue;
111
112 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
113 if (posix_path) {
114 /* Eat the '.' */
115 s++;
116 continue;
117 }
118 }
119
120 }
121
122 if (!(*s & 0x80)) {
123 if (!posix_path) {
124 if (*s <= 0x1f) {
125 return NT_STATUS_OBJECT_NAME_INVALID;
126 }
127 switch (*s) {
128 case '*':
129 case '?':
130 case '<':
131 case '>':
132 case '"':
133 *p_last_component_contains_wcard = True;
134 break;
135 default:
136 break;
137 }
138 }
139 *d++ = *s++;
140 } else {
141 size_t siz;
142 /* Get the size of the next MB character. */
143 next_codepoint(s,&siz);
144 switch(siz) {
145 case 5:
146 *d++ = *s++;
147 /*fall through*/
148 case 4:
149 *d++ = *s++;
150 /*fall through*/
151 case 3:
152 *d++ = *s++;
153 /*fall through*/
154 case 2:
155 *d++ = *s++;
156 /*fall through*/
157 case 1:
158 *d++ = *s++;
159 break;
160 default:
161 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
162 *d = '\0';
163 return NT_STATUS_INVALID_PARAMETER;
164 }
165 }
166 start_of_name_component = False;
167 }
168
169 *d = '\0';
170
171 return ret;
172 }
173
174 /****************************************************************************
175 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
176 No wildcards allowed.
177 ****************************************************************************/
178
179 NTSTATUS check_path_syntax(char *path)
180 {
181 bool ignore;
182 return check_path_syntax_internal(path, False, &ignore);
183 }
184
185 /****************************************************************************
186 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
187 Wildcards allowed - p_contains_wcard returns true if the last component contained
188 a wildcard.
189 ****************************************************************************/
190
191 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
192 {
193 return check_path_syntax_internal(path, False, p_contains_wcard);
194 }
195
196 /****************************************************************************
197 Check the path for a POSIX client.
198 We're assuming here that '/' is not the second byte in any multibyte char
199 set (a safe assumption).
200 ****************************************************************************/
201
202 NTSTATUS check_path_syntax_posix(char *path)
203 {
204 bool ignore;
205 return check_path_syntax_internal(path, True, &ignore);
206 }
207
208 /****************************************************************************
209 Pull a string and check the path allowing a wilcard - provide for error return.
210 ****************************************************************************/
211
212 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
213 const char *inbuf,
214 uint16 smb_flags2,
215 char **pp_dest,
216 const char *src,
217 size_t src_len,
218 int flags,
219 NTSTATUS *err,
220 bool *contains_wcard)
221 {
222 size_t ret;
223
224 *pp_dest = NULL;
225
226 if (src_len == 0) {
227 ret = srvstr_pull_buf_talloc(ctx,
228 inbuf,
229 smb_flags2,
230 pp_dest,
231 src,
232 flags);
233 } else {
234 ret = srvstr_pull_talloc(ctx,
235 inbuf,
236 smb_flags2,
237 pp_dest,
238 src,
239 src_len,
240 flags);
241 }
242
243 if (!*pp_dest) {
244 *err = NT_STATUS_INVALID_PARAMETER;
245 return ret;
246 }
247
248 *contains_wcard = False;
249
250 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
251 /*
252 * For a DFS path the function parse_dfs_path()
253 * will do the path processing, just make a copy.
254 */
255 *err = NT_STATUS_OK;
256 return ret;
257 }
258
259 if (lp_posix_pathnames()) {
260 *err = check_path_syntax_posix(*pp_dest);
261 } else {
262 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
263 }
264
265 return ret;
266 }
267
268 /****************************************************************************
269 Pull a string and check the path - provide for error return.
270 ****************************************************************************/
271
272 size_t srvstr_get_path(TALLOC_CTX *ctx,
273 const char *inbuf,
274 uint16 smb_flags2,
275 char **pp_dest,
276 const char *src,
277 size_t src_len,
278 int flags,
279 NTSTATUS *err)
280 {
281 size_t ret;
282
283 *pp_dest = NULL;
284
285 if (src_len == 0) {
286 ret = srvstr_pull_buf_talloc(ctx,
287 inbuf,
288 smb_flags2,
289 pp_dest,
290 src,
291 flags);
292 } else {
293 ret = srvstr_pull_talloc(ctx,
294 inbuf,
295 smb_flags2,
296 pp_dest,
297 src,
298 src_len,
299 flags);
300 }
301
302 if (!*pp_dest) {
303 *err = NT_STATUS_INVALID_PARAMETER;
304 return ret;
305 }
306
307 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
308 /*
309 * For a DFS path the function parse_dfs_path()
310 * will do the path processing, just make a copy.
311 */
312 *err = NT_STATUS_OK;
313 return ret;
314 }
315
316 if (lp_posix_pathnames()) {
317 *err = check_path_syntax_posix(*pp_dest);
318 } else {
319 *err = check_path_syntax(*pp_dest);
320 }
321
322 return ret;
323 }
324
325 /****************************************************************************
326 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
327 ****************************************************************************/
328
329 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
330 files_struct *fsp)
331 {
332 if (!(fsp) || !(conn)) {
333 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
334 return False;
335 }
336 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
337 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
338 return False;
339 }
340 return True;
341 }
342
343 /****************************************************************************
344 Check if we have a correct fsp pointing to a file. Replacement for the
345 CHECK_FSP macro.
346 ****************************************************************************/
347
348 bool check_fsp(connection_struct *conn, struct smb_request *req,
349 files_struct *fsp)
350 {
351 if (!check_fsp_open(conn, req, fsp)) {
352 return False;
353 }
354 if ((fsp)->is_directory) {
355 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
356 return False;
357 }
358 if ((fsp)->fh->fd == -1) {
359 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
360 return False;
361 }
362 (fsp)->num_smb_operations++;
363 return True;
364 }
365
366 /****************************************************************************
367 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
368 ****************************************************************************/
369
370 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
371 files_struct *fsp)
372 {
373 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
374 && (req->vuid == (fsp)->vuid)) {
375 return True;
376 }
377
378 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
379 return False;
380 }
381
382 /****************************************************************************
383 Reply to a (netbios-level) special message.
384 ****************************************************************************/
385
386 void reply_special(char *inbuf)
387 {
388 int msg_type = CVAL(inbuf,0);
389 int msg_flags = CVAL(inbuf,1);
390 fstring name1,name2;
391 char name_type = 0;
392
393 /*
394 * We only really use 4 bytes of the outbuf, but for the smb_setlen
395 * calculation & friends (srv_send_smb uses that) we need the full smb
396 * header.
397 */
398 char outbuf[smb_size];
399
400 static bool already_got_session = False;
401
402 *name1 = *name2 = 0;
403
404 memset(outbuf, '\0', sizeof(outbuf));
405
406 smb_setlen(outbuf,0);
407
408 switch (msg_type) {
409 case 0x81: /* session request */
410
411 if (already_got_session) {
412 exit_server_cleanly("multiple session request not permitted");
413 }
414
415 SCVAL(outbuf,0,0x82);
416 SCVAL(outbuf,3,0);
417 if (name_len(inbuf+4) > 50 ||
418 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
419 DEBUG(0,("Invalid name length in session request\n"));
420 return;
421 }
422 name_extract(inbuf,4,name1);
423 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
424 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
425 name1,name2));
426
427 set_local_machine_name(name1, True);
428 set_remote_machine_name(name2, True);
429
430 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
431 get_local_machine_name(), get_remote_machine_name(),
432 name_type));
433
434 if (name_type == 'R') {
435 /* We are being asked for a pathworks session ---
436 no thanks! */
437 SCVAL(outbuf, 0,0x83);
438 break;
439 }
440
441 /* only add the client's machine name to the list
442 of possibly valid usernames if we are operating
443 in share mode security */
444 if (lp_security() == SEC_SHARE) {
445 add_session_user(get_remote_machine_name());
446 }
447
448 reload_services(True);
449 reopen_logs();
450
451 already_got_session = True;
452 break;
453
454 case 0x89: /* session keepalive request
455 (some old clients produce this?) */
456 SCVAL(outbuf,0,SMBkeepalive);
457 SCVAL(outbuf,3,0);
458 break;
459
460 case 0x82: /* positive session response */
461 case 0x83: /* negative session response */
462 case 0x84: /* retarget session response */
463 DEBUG(0,("Unexpected session response\n"));
464 break;
465
466 case SMBkeepalive: /* session keepalive */
467 default:
468 return;
469 }
470
471 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
472 msg_type, msg_flags));
473
474 srv_send_smb(smbd_server_fd(), outbuf, false);
475 return;
476 }
477
478 /****************************************************************************
479 Reply to a tcon.
480 conn POINTER CAN BE NULL HERE !
481 ****************************************************************************/
482
483 void reply_tcon(struct smb_request *req)
484 {
485 connection_struct *conn = req->conn;
486 const char *service;
487 char *service_buf = NULL;
488 char *password = NULL;
489 char *dev = NULL;
490 int pwlen=0;
491 NTSTATUS nt_status;
492 char *p;
493 DATA_BLOB password_blob;
494 TALLOC_CTX *ctx = talloc_tos();
495
496 START_PROFILE(SMBtcon);
497
498 if (smb_buflen(req->inbuf) < 4) {
499 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
500 END_PROFILE(SMBtcon);
501 return;
502 }
503
504 p = smb_buf(req->inbuf)+1;
505 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
506 &service_buf, p, STR_TERMINATE) + 1;
507 pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
508 &password, p, STR_TERMINATE) + 1;
509 p += pwlen;
510 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
511 &dev, p, STR_TERMINATE) + 1;
512
513 if (service_buf == NULL || password == NULL || dev == NULL) {
514 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
515 END_PROFILE(SMBtcon);
516 return;
517 }
518 p = strrchr_m(service_buf,'\\');
519 if (p) {
520 service = p+1;
521 } else {
522 service = service_buf;
523 }
524
525 password_blob = data_blob(password, pwlen+1);
526
527 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
528 req->conn = conn;
529
530 data_blob_clear_free(&password_blob);
531
532 if (!conn) {
533 reply_nterror(req, nt_status);
534 END_PROFILE(SMBtcon);
535 return;
536 }
537
538 reply_outbuf(req, 2, 0);
539 SSVAL(req->outbuf,smb_vwv0,max_recv);
540 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
541 SSVAL(req->outbuf,smb_tid,conn->cnum);
542
543 DEBUG(3,("tcon service=%s cnum=%d\n",
544 service, conn->cnum));
545
546 END_PROFILE(SMBtcon);
547 return;
548 }
549
550 /****************************************************************************
551 Reply to a tcon and X.
552 conn POINTER CAN BE NULL HERE !
553 ****************************************************************************/
554
555 void reply_tcon_and_X(struct smb_request *req)
556 {
557 connection_struct *conn = req->conn;
558 char *service = NULL;
559 DATA_BLOB password;
560 TALLOC_CTX *ctx = talloc_tos();
561 /* what the cleint thinks the device is */
562 char *client_devicetype = NULL;
563 /* what the server tells the client the share represents */
564 const char *server_devicetype;
565 NTSTATUS nt_status;
566 int passlen;
567 char *path = NULL;
568 char *p, *q;
569 uint16 tcon_flags;
570
571 START_PROFILE(SMBtconX);
572
573 if (req->wct < 4) {
574 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
575 END_PROFILE(SMBtconX);
576 return;
577 }
578
579 passlen = SVAL(req->inbuf,smb_vwv3);
580 tcon_flags = SVAL(req->inbuf,smb_vwv2);
581
582 /* we might have to close an old one */
583 if ((tcon_flags & 0x1) && conn) {
584 close_cnum(conn,req->vuid);
585 req->conn = NULL;
586 conn = NULL;
587 }
588
589 if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
590 reply_doserror(req, ERRDOS, ERRbuftoosmall);
591 END_PROFILE(SMBtconX);
592 return;
593 }
594
595 if (global_encrypted_passwords_negotiated) {
596 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
597 passlen);
598 if (lp_security() == SEC_SHARE) {
599 /*
600 * Security = share always has a pad byte
601 * after the password.
602 */
603 p = smb_buf(req->inbuf) + passlen + 1;
604 } else {
605 p = smb_buf(req->inbuf) + passlen;
606 }
607 } else {
608 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
609 passlen+1);
610 /* Ensure correct termination */
611 password.data[passlen]=0;
612 p = smb_buf(req->inbuf) + passlen + 1;
613 }
614
615 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
616 STR_TERMINATE);
617
618 if (path == NULL) {
619 data_blob_clear_free(&password);
620 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
621 END_PROFILE(SMBtconX);
622 return;
623 }
624
625 /*
626 * the service name can be either: \\server\share
627 * or share directly like on the DELL PowerVault 705
628 */
629 if (*path=='\\') {
630 q = strchr_m(path+2,'\\');
631 if (!q) {
632 data_blob_clear_free(&password);
633 reply_doserror(req, ERRDOS, ERRnosuchshare);
634 END_PROFILE(SMBtconX);
635 return;
636 }
637 service = q+1;
638 } else {
639 service = path;
640 }
641
642 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
643 &client_devicetype, p,
644 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
645
646 if (client_devicetype == NULL) {
647 data_blob_clear_free(&password);
648 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
649 END_PROFILE(SMBtconX);
650 return;
651 }
652
653 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
654
655 conn = make_connection(service, password, client_devicetype,
656 req->vuid, &nt_status);
657 req->conn =conn;
658
659 data_blob_clear_free(&password);
660
661 if (!conn) {
662 reply_nterror(req, nt_status);
663 END_PROFILE(SMBtconX);
664 return;
665 }
666
667 if ( IS_IPC(conn) )
668 server_devicetype = "IPC";
669 else if ( IS_PRINT(conn) )
670 server_devicetype = "LPT1:";
671 else
672 server_devicetype = "A:";
673
674 if (Protocol < PROTOCOL_NT1) {
675 reply_outbuf(req, 2, 0);
676 if (message_push_string(&req->outbuf, server_devicetype,
677 STR_TERMINATE|STR_ASCII) == -1) {
678 reply_nterror(req, NT_STATUS_NO_MEMORY);
679 END_PROFILE(SMBtconX);
680 return;
681 }
682 } else {
683 /* NT sets the fstype of IPC$ to the null string */
684 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
685
686 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
687 /* Return permissions. */
688 uint32 perm1 = 0;
689 uint32 perm2 = 0;
690
691 reply_outbuf(req, 7, 0);
692
693 if (IS_IPC(conn)) {
694 perm1 = FILE_ALL_ACCESS;
695 perm2 = FILE_ALL_ACCESS;
696 } else {
697 perm1 = CAN_WRITE(conn) ?
698 SHARE_ALL_ACCESS :
699 SHARE_READ_ONLY;
700 }
701
702 SIVAL(req->outbuf, smb_vwv3, perm1);
703 SIVAL(req->outbuf, smb_vwv5, perm2);
704 } else {
705 reply_outbuf(req, 3, 0);
706 }
707
708 if ((message_push_string(&req->outbuf, server_devicetype,
709 STR_TERMINATE|STR_ASCII) == -1)
710 || (message_push_string(&req->outbuf, fstype,
711 STR_TERMINATE) == -1)) {
712 reply_nterror(req, NT_STATUS_NO_MEMORY);
713 END_PROFILE(SMBtconX);
714 return;
715 }
716
717 /* what does setting this bit do? It is set by NT4 and
718 may affect the ability to autorun mounted cdroms */
719 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
720 (lp_csc_policy(SNUM(conn)) << 2));
721
722 init_dfsroot(conn, req->inbuf, req->outbuf);
723 }
724
725
726 DEBUG(3,("tconX service=%s \n",
727 service));
728
729 /* set the incoming and outgoing tid to the just created one */
730 SSVAL(req->inbuf,smb_tid,conn->cnum);
731 SSVAL(req->outbuf,smb_tid,conn->cnum);
732
733 END_PROFILE(SMBtconX);
734
735 chain_reply(req);
736 return;
737 }
738
739 /****************************************************************************
740 Reply to an unknown type.
741 ****************************************************************************/
742
743 void reply_unknown_new(struct smb_request *req, uint8 type)
744 {
745 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
746 smb_fn_name(type), type, type));
747 reply_doserror(req, ERRSRV, ERRunknownsmb);
748 return;
749 }
750
751 /****************************************************************************
752 Reply to an ioctl.
753 conn POINTER CAN BE NULL HERE !
754 ****************************************************************************/
755
756 void reply_ioctl(struct smb_request *req)
757 {
758 connection_struct *conn = req->conn;
759 uint16 device;
760 uint16 function;
761 uint32 ioctl_code;
762 int replysize;
763 char *p;
764
765 START_PROFILE(SMBioctl);
766
767 if (req->wct < 3) {
768 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
769 END_PROFILE(SMBioctl);
770 return;
771 }
772
773 device = SVAL(req->inbuf,smb_vwv1);
774 function = SVAL(req->inbuf,smb_vwv2);
775 ioctl_code = (device << 16) + function;
776
777 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
778
779 switch (ioctl_code) {
780 case IOCTL_QUERY_JOB_INFO:
781 replysize = 32;
782 break;
783 default:
784 reply_doserror(req, ERRSRV, ERRnosupport);
785 END_PROFILE(SMBioctl);
786 return;
787 }
788
789 reply_outbuf(req, 8, replysize+1);
790 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
791 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
792 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
793 p = smb_buf(req->outbuf);
794 memset(p, '\0', replysize+1); /* valgrind-safe. */
795 p += 1; /* Allow for alignment */
796
797 switch (ioctl_code) {
798 case IOCTL_QUERY_JOB_INFO:
799 {
800 files_struct *fsp = file_fsp(SVAL(req->inbuf,
801 smb_vwv0));
802 if (!fsp) {
803 reply_doserror(req, ERRDOS, ERRbadfid);
804 END_PROFILE(SMBioctl);
805 return;
806 }
807 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
808 srvstr_push((char *)req->outbuf, req->flags2, p+2,
809 global_myname(), 15,
810 STR_TERMINATE|STR_ASCII);
811 if (conn) {
812 srvstr_push((char *)req->outbuf, req->flags2,
813 p+18, lp_servicename(SNUM(conn)),
814 13, STR_TERMINATE|STR_ASCII);
815 } else {
816 memset(p+18, 0, 13);
817 }
818 break;
819 }
820 }
821
822 END_PROFILE(SMBioctl);
823 return;
824 }
825
826 /****************************************************************************
827 Strange checkpath NTSTATUS mapping.
828 ****************************************************************************/
829
830 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
831 {
832 /* Strange DOS error code semantics only for checkpath... */
833 if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
834 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
835 /* We need to map to ERRbadpath */
836 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
837 }
838 }
839 return status;
840 }
841
842 /****************************************************************************
843 Reply to a checkpath.
844 ****************************************************************************/
845
846 void reply_checkpath(struct smb_request *req)
847 {
848 connection_struct *conn = req->conn;
849 char *name = NULL;
850 SMB_STRUCT_STAT sbuf;
851 NTSTATUS status;
852 TALLOC_CTX *ctx = talloc_tos();
853
854 START_PROFILE(SMBcheckpath);
855
856 srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
857 smb_buf(req->inbuf) + 1, 0,
858 STR_TERMINATE, &status);
859 if (!NT_STATUS_IS_OK(status)) {
860 status = map_checkpath_error((char *)req->inbuf, status);
861 reply_nterror(req, status);
862 END_PROFILE(SMBcheckpath);
863 return;
864 }
865
866 status = resolve_dfspath(ctx, conn,
867 req->flags2 & FLAGS2_DFS_PATHNAMES,
868 name,
869 &name);
870 if (!NT_STATUS_IS_OK(status)) {
871 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
872 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
873 ERRSRV, ERRbadpath);
874 END_PROFILE(SMBcheckpath);
875 return;
876 }
877 goto path_err;
878 }
879
880 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
881
882 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
883 if (!NT_STATUS_IS_OK(status)) {
884 goto path_err;
885 }
886
887 status = check_name(conn, name);
888 if (!NT_STATUS_IS_OK(status)) {
889 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
890 goto path_err;
891 }
892
893 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
894 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
895 status = map_nt_error_from_unix(errno);
896 goto path_err;
897 }
898
899 if (!S_ISDIR(sbuf.st_mode)) {
900 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
901 ERRDOS, ERRbadpath);
902 END_PROFILE(SMBcheckpath);
903 return;
904 }
905
906 reply_outbuf(req, 0, 0);
907
908 END_PROFILE(SMBcheckpath);
909 return;
910
911 path_err:
912
913 END_PROFILE(SMBcheckpath);
914
915 /* We special case this - as when a Windows machine
916 is parsing a path is steps through the components
917 one at a time - if a component fails it expects
918 ERRbadpath, not ERRbadfile.
919 */
920 status = map_checkpath_error((char *)req->inbuf, status);
921 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
922 /*
923 * Windows returns different error codes if
924 * the parent directory is valid but not the
925 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
926 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
927 * if the path is invalid.
928 */
929 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
930 ERRDOS, ERRbadpath);
931 return;
932 }
933
934 reply_nterror(req, status);
935 }
936
937 /****************************************************************************
938 Reply to a getatr.
939 ****************************************************************************/
940
941 void reply_getatr(struct smb_request *req)
942 {
943 connection_struct *conn = req->conn;
944 char *fname = NULL;
945 SMB_STRUCT_STAT sbuf;
946 int mode=0;
947 SMB_OFF_T size=0;
948 time_t mtime=0;
949 char *p;
950 NTSTATUS status;
951 TALLOC_CTX *ctx = talloc_tos();
952
953 START_PROFILE(SMBgetatr);
954
955 p = smb_buf(req->inbuf) + 1;
956 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
957 0, STR_TERMINATE, &status);
958 if (!NT_STATUS_IS_OK(status)) {
959 reply_nterror(req, status);
960 END_PROFILE(SMBgetatr);
961 return;
962 }
963
964 status = resolve_dfspath(ctx, conn,
965 req->flags2 & FLAGS2_DFS_PATHNAMES,
966 fname,
967 &fname);
968 if (!NT_STATUS_IS_OK(status)) {
969 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
970 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
971 ERRSRV, ERRbadpath);
972 END_PROFILE(SMBgetatr);
973 return;
974 }
975 reply_nterror(req, status);
976 END_PROFILE(SMBgetatr);
977 return;
978 }
979
980 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
981 under WfWg - weird! */
982 if (*fname == '\0') {
983 mode = aHIDDEN | aDIR;
984 if (!CAN_WRITE(conn)) {
985 mode |= aRONLY;
986 }
987 size = 0;
988 mtime = 0;
989 } else {
990 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
991 if (!NT_STATUS_IS_OK(status)) {
992 reply_nterror(req, status);
993 END_PROFILE(SMBgetatr);
994 return;
995 }
996 status = check_name(conn, fname);
997 if (!NT_STATUS_IS_OK(status)) {
998 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
999 reply_nterror(req, status);
1000 END_PROFILE(SMBgetatr);
1001 return;
1002 }
1003 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1004 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1005 reply_unixerror(req, ERRDOS,ERRbadfile);
1006 END_PROFILE(SMBgetatr);
1007 return;
1008 }
1009
1010 mode = dos_mode(conn,fname,&sbuf);
1011 size = sbuf.st_size;
1012 mtime = sbuf.st_mtime;
1013 if (mode & aDIR) {
1014 size = 0;
1015 }
1016 }
1017
1018 reply_outbuf(req, 10, 0);
1019
1020 SSVAL(req->outbuf,smb_vwv0,mode);
1021 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1022 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1023 } else {
1024 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1025 }
1026 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1027
1028 if (Protocol >= PROTOCOL_NT1) {
1029 SSVAL(req->outbuf, smb_flg2,
1030 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1031 }
1032
1033 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1034
1035 END_PROFILE(SMBgetatr);
1036 return;
1037 }
1038
1039 /****************************************************************************
1040 Reply to a setatr.
1041 ****************************************************************************/
1042
1043 void reply_setatr(struct smb_request *req)
1044 {
1045 struct timespec ts[2];
1046 connection_struct *conn = req->conn;
1047 char *fname = NULL;
1048 int mode;
1049 time_t mtime;
1050 SMB_STRUCT_STAT sbuf;
1051 char *p;
1052 NTSTATUS status;
1053 TALLOC_CTX *ctx = talloc_tos();
1054
1055 START_PROFILE(SMBsetatr);
1056
1057 ZERO_STRUCT(ts);
1058
1059 if (req->wct < 2) {
1060 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1061 return;
1062 }
1063
1064 p = smb_buf(req->inbuf) + 1;
1065 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1066 0, STR_TERMINATE, &status);
1067 if (!NT_STATUS_IS_OK(status)) {
1068 reply_nterror(req, status);
1069 END_PROFILE(SMBsetatr);
1070 return;
1071 }
1072
1073 status = resolve_dfspath(ctx, conn,
1074 req->flags2 & FLAGS2_DFS_PATHNAMES,
1075 fname,
1076 &fname);
1077 if (!NT_STATUS_IS_OK(status)) {
1078 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1079 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1080 ERRSRV, ERRbadpath);
1081 END_PROFILE(SMBsetatr);
1082 return;
1083 }
1084 reply_nterror(req, status);
1085 END_PROFILE(SMBsetatr);
1086 return;
1087 }
1088
1089 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1090 if (!NT_STATUS_IS_OK(status)) {
1091 reply_nterror(req, status);
1092 END_PROFILE(SMBsetatr);
1093 return;
1094 }
1095
1096 status = check_name(conn, fname);
1097 if (!NT_STATUS_IS_OK(status)) {
1098 reply_nterror(req, status);
1099 END_PROFILE(SMBsetatr);
1100 return;
1101 }
1102
1103 if (fname[0] == '.' && fname[1] == '\0') {
1104 /*
1105 * Not sure here is the right place to catch this
1106 * condition. Might be moved to somewhere else later -- vl
1107 */
1108 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1109 END_PROFILE(SMBsetatr);
1110 return;
1111 }
1112
1113 mode = SVAL(req->inbuf,smb_vwv0);
1114 mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1115
1116 ts[1] = convert_time_t_to_timespec(mtime);
1117 status = smb_set_file_time(conn, NULL, fname,
1118 &sbuf, ts, true);
1119 if (!NT_STATUS_IS_OK(status)) {
1120 reply_unixerror(req, ERRDOS, ERRnoaccess);
1121 END_PROFILE(SMBsetatr);
1122 return;
1123 }
1124
1125 if (mode != FILE_ATTRIBUTE_NORMAL) {
1126 if (VALID_STAT_OF_DIR(sbuf))
1127 mode |= aDIR;
1128 else
1129 mode &= ~aDIR;
1130
1131 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1132 reply_unixerror(req, ERRDOS, ERRnoaccess);
1133 END_PROFILE(SMBsetatr);
1134 return;
1135 }
1136 }
1137
1138 reply_outbuf(req, 0, 0);
1139
1140 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1141
1142 END_PROFILE(SMBsetatr);
1143 return;
1144 }
1145
1146 /****************************************************************************
1147 Reply to a dskattr.
1148 ****************************************************************************/
1149
1150 void reply_dskattr(struct smb_request *req)
1151 {
1152 connection_struct *conn = req->conn;
1153 SMB_BIG_UINT dfree,dsize,bsize;
1154 START_PROFILE(SMBdskattr);
1155
1156 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
1157 reply_unixerror(req, ERRHRD, ERRgeneral);
1158 END_PROFILE(SMBdskattr);
1159 return;
1160 }
1161
1162 reply_outbuf(req, 5, 0);
1163
1164 if (Protocol <= PROTOCOL_LANMAN2) {
1165 double total_space, free_space;
1166 /* we need to scale this to a number that DOS6 can handle. We
1167 use floating point so we can handle large drives on systems
1168 that don't have 64 bit integers
1169
1170 we end up displaying a maximum of 2G to DOS systems
1171 */
1172 total_space = dsize * (double)bsize;
1173 free_space = dfree * (double)bsize;
1174
1175 dsize = (SMB_BIG_UINT)((total_space+63*512) / (64*512));
1176 dfree = (SMB_BIG_UINT)((free_space+63*512) / (64*512));
1177
1178 if (dsize > 0xFFFF) dsize = 0xFFFF;
1179 if (dfree > 0xFFFF) dfree = 0xFFFF;
1180
1181 SSVAL(req->outbuf,smb_vwv0,dsize);
1182 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1183 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1184 SSVAL(req->outbuf,smb_vwv3,dfree);
1185 } else {
1186 SSVAL(req->outbuf,smb_vwv0,dsize);
1187 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1188 SSVAL(req->outbuf,smb_vwv2,512);
1189 SSVAL(req->outbuf,smb_vwv3,dfree);
1190 }
1191
1192 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1193
1194 END_PROFILE(SMBdskattr);
1195 return;
1196 }
1197
1198 /****************************************************************************
1199 Reply to a search.
1200 Can be called from SMBsearch, SMBffirst or SMBfunique.
1201 ****************************************************************************/
1202
1203 void reply_search(struct smb_request *req)
1204 {
1205 connection_struct *conn = req->conn;
1206 char *mask = NULL;
1207 char *directory = NULL;
1208 char *fname = NULL;
1209 SMB_OFF_T size;
1210 uint32 mode;
1211 time_t date;
1212 uint32 dirtype;
1213 unsigned int numentries = 0;
1214 unsigned int maxentries = 0;
1215 bool finished = False;
1216 char *p;
1217 int status_len;
1218 char *path = NULL;
1219 char status[21];
1220 int dptr_num= -1;
1221 bool check_descend = False;
1222 bool expect_close = False;
1223 NTSTATUS nt_status;
1224 bool mask_contains_wcard = False;
1225 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1226 TALLOC_CTX *ctx = talloc_tos();
1227 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1228
1229 START_PROFILE(SMBsearch);
1230
1231 if (req->wct < 2) {
1232 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1233 END_PROFILE(SMBsearch);
1234 return;
1235 }
1236
1237 if (lp_posix_pathnames()) {
1238 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1239 END_PROFILE(SMBsearch);
1240 return;
1241 }
1242
1243 /* If we were called as SMBffirst then we must expect close. */
1244 if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1245 expect_close = True;
1246 }
1247
1248 reply_outbuf(req, 1, 3);
1249 maxentries = SVAL(req->inbuf,smb_vwv0);
1250 dirtype = SVAL(req->inbuf,smb_vwv1);
1251 p = smb_buf(req->inbuf) + 1;
1252 p += srvstr_get_path_wcard(ctx,
1253 (char *)req->inbuf,
1254 req->flags2,
1255 &path,
1256 p,
1257 0,
1258 STR_TERMINATE,
1259 &nt_status,
1260 &mask_contains_wcard);
1261 if (!NT_STATUS_IS_OK(nt_status)) {
1262 reply_nterror(req, nt_status);
1263 END_PROFILE(SMBsearch);
1264 return;
1265 }
1266
1267 nt_status = resolve_dfspath_wcard(ctx, conn,
1268 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269 path,
1270 &path,
1271 &mask_contains_wcard);
1272 if (!NT_STATUS_IS_OK(nt_status)) {
1273 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1274 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1275 ERRSRV, ERRbadpath);
1276 END_PROFILE(SMBsearch);
1277 return;
1278 }
1279 reply_nterror(req, nt_status);
1280 END_PROFILE(SMBsearch);
1281 return;
1282 }
1283
1284 p++;
1285 status_len = SVAL(p, 0);
1286 p += 2;
1287
1288 /* dirtype &= ~aDIR; */
1289
1290 if (status_len == 0) {
1291 SMB_STRUCT_STAT sbuf;
1292
1293 nt_status = unix_convert(ctx, conn, path, True,
1294 &directory, NULL, &sbuf);
1295 if (!NT_STATUS_IS_OK(nt_status)) {
1296 reply_nterror(req, nt_status);
1297 END_PROFILE(SMBsearch);
1298 return;
1299 }
1300
1301 nt_status = check_name(conn, directory);
1302 if (!NT_STATUS_IS_OK(nt_status)) {
1303 reply_nterror(req, nt_status);
1304 END_PROFILE(SMBsearch);
1305 return;
1306 }
1307
1308 p = strrchr_m(directory,'/');
1309 if (!p) {
1310 mask = directory;
1311 directory = talloc_strdup(ctx,".");
1312 if (!directory) {
1313 reply_nterror(req, NT_STATUS_NO_MEMORY);
1314 END_PROFILE(SMBsearch);
1315 return;
1316 }
1317 } else {
1318 *p = 0;
1319 mask = p+1;
1320 }
1321
1322 if (*directory == '\0') {
1323 directory = talloc_strdup(ctx,".");
1324 if (!directory) {
1325 reply_nterror(req, NT_STATUS_NO_MEMORY);
1326 END_PROFILE(SMBsearch);
1327 return;
1328 }
1329 }
1330 memset((char *)status,'\0',21);
1331 SCVAL(status,0,(dirtype & 0x1F));
1332
1333 nt_status = dptr_create(conn,
1334 directory,
1335 True,
1336 expect_close,
1337 req->smbpid,
1338 mask,
1339 mask_contains_wcard,
1340 dirtype,
1341 &conn->dirptr);
1342 if (!NT_STATUS_IS_OK(nt_status)) {
1343 reply_nterror(req, nt_status);
1344 END_PROFILE(SMBsearch);
1345 return;
1346 }
1347 dptr_num = dptr_dnum(conn->dirptr);
1348 } else {
1349 int status_dirtype;
1350
1351 memcpy(status,p,21);
1352 status_dirtype = CVAL(status,0) & 0x1F;
1353 if (status_dirtype != (dirtype & 0x1F)) {
1354 dirtype = status_dirtype;
1355 }
1356
1357 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1358 if (!conn->dirptr) {
1359 goto SearchEmpty;
1360 }
1361 string_set(&conn->dirpath,dptr_path(dptr_num));
1362 mask = dptr_wcard(dptr_num);
1363 if (!mask) {
1364 goto SearchEmpty;
1365 }
1366 /*
1367 * For a 'continue' search we have no string. So
1368 * check from the initial saved string.
1369 */
1370 mask_contains_wcard = ms_has_wild(mask);
1371 dirtype = dptr_attr(dptr_num);
1372 }
1373
1374 DEBUG(4,("dptr_num is %d\n",dptr_num));
1375
1376 if ((dirtype&0x1F) == aVOLID) {
1377 char buf[DIR_STRUCT_SIZE];
1378 memcpy(buf,status,21);
1379 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1380 0,aVOLID,0,!allow_long_path_components)) {
1381 reply_nterror(req, NT_STATUS_NO_MEMORY);
1382 END_PROFILE(SMBsearch);
1383 return;
1384 }
1385 dptr_fill(buf+12,dptr_num);
1386 if (dptr_zero(buf+12) && (status_len==0)) {
1387 numentries = 1;
1388 } else {
1389 numentries = 0;
1390 }
1391 if (message_push_blob(&req->outbuf,
1392 data_blob_const(buf, sizeof(buf)))
1393 == -1) {
1394 reply_nterror(req, NT_STATUS_NO_MEMORY);
1395 END_PROFILE(SMBsearch);
1396 return;
1397 }
1398 } else {
1399 unsigned int i;
1400 maxentries = MIN(
1401 maxentries,
1402 ((BUFFER_SIZE -
1403 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1404 /DIR_STRUCT_SIZE));
1405
1406 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1407 conn->dirpath,lp_dontdescend(SNUM(conn))));
1408 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1409 check_descend = True;
1410 }
1411
1412 for (i=numentries;(i<maxentries) && !finished;i++) {
1413 finished = !get_dir_entry(ctx,
1414 conn,
1415 mask,
1416 dirtype,
1417 &fname,
1418 &size,
1419 &mode,
1420 &date,
1421 check_descend,
1422 ask_sharemode);
1423 if (!finished) {
1424 char buf[DIR_STRUCT_SIZE];
1425 memcpy(buf,status,21);
1426 if (!make_dir_struct(ctx,
1427 buf,
1428 mask,
1429 fname,
1430 size,
1431 mode,
1432 date,
1433 !allow_long_path_components)) {
1434 reply_nterror(req, NT_STATUS_NO_MEMORY);
1435 END_PROFILE(SMBsearch);
1436 return;
1437 }
1438 if (!dptr_fill(buf+12,dptr_num)) {
1439 break;
1440 }
1441 if (message_push_blob(&req->outbuf,
1442 data_blob_const(buf, sizeof(buf)))
1443 == -1) {
1444 reply_nterror(req, NT_STATUS_NO_MEMORY);
1445 END_PROFILE(SMBsearch);
1446 return;
1447 }
1448 numentries++;
1449 }
1450 }
1451 }
1452
1453 SearchEmpty:
1454
1455 /* If we were called as SMBffirst with smb_search_id == NULL
1456 and no entries were found then return error and close dirptr
1457 (X/Open spec) */
1458
1459 if (numentries == 0) {
1460 dptr_close(&dptr_num);
1461 } else if(expect_close && status_len == 0) {
1462 /* Close the dptr - we know it's gone */
1463 dptr_close(&dptr_num);
1464 }
1465
1466 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1467 if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1468 dptr_close(&dptr_num);
1469 }
1470
1471 if ((numentries == 0) && !mask_contains_wcard) {
1472 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1473 END_PROFILE(SMBsearch);
1474 return;
1475 }
1476
1477 SSVAL(req->outbuf,smb_vwv0,numentries);
1478 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1479 SCVAL(smb_buf(req->outbuf),0,5);
1480 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1481
1482 /* The replies here are never long name. */
1483 SSVAL(req->outbuf, smb_flg2,
1484 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1485 if (!allow_long_path_components) {
1486 SSVAL(req->outbuf, smb_flg2,
1487 SVAL(req->outbuf, smb_flg2)
1488 & (~FLAGS2_LONG_PATH_COMPONENTS));
1489 }
1490
1491 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1492 SSVAL(req->outbuf, smb_flg2,
1493 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1494
1495 if (!directory) {
1496 directory = dptr_path(dptr_num);
1497 }
1498
1499 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1500 smb_fn_name(CVAL(req->inbuf,smb_com)),
1501 mask,
1502 directory ? directory : "./",
1503 dirtype,
1504 numentries,
1505 maxentries ));
1506
1507 END_PROFILE(SMBsearch);
1508 return;
1509 }
1510
1511 /****************************************************************************
1512 Reply to a fclose (stop directory search).
1513 ****************************************************************************/
1514
1515 void reply_fclose(struct smb_request *req)
1516 {
1517 int status_len;
1518 char status[21];
1519 int dptr_num= -2;
1520 char *p;
1521 char *path = NULL;
1522 NTSTATUS err;
1523 bool path_contains_wcard = False;
1524 TALLOC_CTX *ctx = talloc_tos();
1525
1526 START_PROFILE(SMBfclose);
1527
1528 if (lp_posix_pathnames()) {
1529 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1530 END_PROFILE(SMBfclose);
1531 return;
1532 }
1533
1534 p = smb_buf(req->inbuf) + 1;
1535 p += srvstr_get_path_wcard(ctx,
1536 (char *)req->inbuf,
1537 req->flags2,
1538 &path,
1539 p,
1540 0,
1541 STR_TERMINATE,
1542 &err,
1543 &path_contains_wcard);
1544 if (!NT_STATUS_IS_OK(err)) {
1545 reply_nterror(req, err);
1546 END_PROFILE(SMBfclose);
1547 return;
1548 }
1549 p++;
1550 status_len = SVAL(p,0);
1551 p += 2;
1552
1553 if (status_len == 0) {
1554 reply_doserror(req, ERRSRV, ERRsrverror);
1555 END_PROFILE(SMBfclose);
1556 return;
1557 }
1558
1559 memcpy(status,p,21);
1560
1561 if(dptr_fetch(status+12,&dptr_num)) {
1562 /* Close the dptr - we know it's gone */
1563 dptr_close(&dptr_num);
1564 }
1565
1566 reply_outbuf(req, 1, 0);
1567 SSVAL(req->outbuf,smb_vwv0,0);
1568
1569 DEBUG(3,("search close\n"));
1570
1571 END_PROFILE(SMBfclose);
1572 return;
1573 }
1574
1575 /****************************************************************************
1576 Reply to an open.
1577 ****************************************************************************/
1578
1579 void reply_open(struct smb_request *req)
1580 {
1581 connection_struct *conn = req->conn;
1582 char *fname = NULL;
1583 uint32 fattr=0;
1584 SMB_OFF_T size = 0;
1585 time_t mtime=0;
1586 int info;
1587 SMB_STRUCT_STAT sbuf;
1588 files_struct *fsp;
1589 int oplock_request;
1590 int deny_mode;
1591 uint32 dos_attr;
1592 uint32 access_mask;
1593 uint32 share_mode;
1594 uint32 create_disposition;
1595 uint32 create_options = 0;
1596 NTSTATUS status;
1597 TALLOC_CTX *ctx = talloc_tos();
1598
1599 START_PROFILE(SMBopen);
1600
1601 if (req->wct < 2) {
1602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1603 END_PROFILE(SMBopen);
1604 return;
1605 }
1606
1607 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1608 deny_mode = SVAL(req->inbuf,smb_vwv0);
1609 dos_attr = SVAL(req->inbuf,smb_vwv1);
1610
1611 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1612 smb_buf(req->inbuf)+1, 0,
1613 STR_TERMINATE, &status);
1614 if (!NT_STATUS_IS_OK(status)) {
1615 reply_nterror(req, status);
1616 END_PROFILE(SMBopen);
1617 return;
1618 }
1619
1620 if (!map_open_params_to_ntcreate(
1621 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1622 &share_mode, &create_disposition, &create_options)) {
1623 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1624 END_PROFILE(SMBopen);
1625 return;
1626 }
1627
1628 status = create_file(conn, /* conn */
1629 req, /* req */
1630 0, /* root_dir_fid */
1631 fname, /* fname */
1632 access_mask, /* access_mask */
1633 share_mode, /* share_access */
1634 create_disposition, /* create_disposition*/
1635 create_options, /* create_options */
1636 dos_attr, /* file_attributes */
1637 oplock_request, /* oplock_request */
1638 0, /* allocation_size */
1639 NULL, /* sd */
1640 NULL, /* ea_list */
1641 &fsp, /* result */
1642 &info, /* pinfo */
1643 &sbuf); /* psbuf */
1644
1645 if (!NT_STATUS_IS_OK(status)) {
1646 if (open_was_deferred(req->mid)) {
1647 /* We have re-scheduled this call. */
1648 END_PROFILE(SMBopen);
1649 return;
1650 }
1651 reply_openerror(req, status);
1652 END_PROFILE(SMBopen);
1653 return;
1654 }
1655
1656 size = sbuf.st_size;
1657 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1658 mtime = sbuf.st_mtime;
1659
1660 if (fattr & aDIR) {
1661 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1662 close_file(fsp,ERROR_CLOSE);
1663 reply_doserror(req, ERRDOS,ERRnoaccess);
1664 END_PROFILE(SMBopen);
1665 return;
1666 }
1667
1668 reply_outbuf(req, 7, 0);
1669 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1670 SSVAL(req->outbuf,smb_vwv1,fattr);
1671 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1672 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1673 } else {
1674 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1675 }
1676 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1677 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1678
1679 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1680 SCVAL(req->outbuf,smb_flg,
1681 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1682 }
1683
1684 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1685 SCVAL(req->outbuf,smb_flg,
1686 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1687 }
1688 END_PROFILE(SMBopen);
1689 return;
1690 }
1691
1692 /****************************************************************************
1693 Reply to an open and X.
1694 ****************************************************************************/
1695
1696 void reply_open_and_X(struct smb_request *req)
1697 {
1698 connection_struct *conn = req->conn;
1699 char *fname = NULL;
1700 uint16 open_flags;
1701 int deny_mode;
1702 uint32 smb_attr;
1703 /* Breakout the oplock request bits so we can set the
1704 reply bits separately. */
1705 int ex_oplock_request;
1706 int core_oplock_request;
1707 int oplock_request;
1708 #if 0
1709 int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1710 uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1711 #endif
1712 int smb_ofun;
1713 uint32 fattr=0;
1714 int mtime=0;
1715 SMB_STRUCT_STAT sbuf;
1716 int smb_action = 0;
1717 files_struct *fsp;
1718 NTSTATUS status;
1719 SMB_BIG_UINT allocation_size;
1720 ssize_t retval = -1;
1721 uint32 access_mask;
1722 uint32 share_mode;
1723 uint32 create_disposition;
1724 uint32 create_options = 0;
1725 TALLOC_CTX *ctx = talloc_tos();
1726
1727 START_PROFILE(SMBopenX);
1728
1729 if (req->wct < 15) {
1730 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1731 END_PROFILE(SMBopenX);
1732 return;
1733 }
1734
1735 open_flags = SVAL(req->inbuf,smb_vwv2);
1736 deny_mode = SVAL(req->inbuf,smb_vwv3);
1737 smb_attr = SVAL(req->inbuf,smb_vwv5);
1738 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1739 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1740 oplock_request = ex_oplock_request | core_oplock_request;
1741 smb_ofun = SVAL(req->inbuf,smb_vwv8);
1742 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv9);
1743
1744 /* If it's an IPC, pass off the pipe handler. */
1745 if (IS_IPC(conn)) {
1746 if (lp_nt_pipe_support()) {
1747 reply_open_pipe_and_X(conn, req);
1748 } else {
1749 reply_doserror(req, ERRSRV, ERRaccess);
1750 }
1751 END_PROFILE(SMBopenX);
1752 return;
1753 }
1754
1755 /* XXXX we need to handle passed times, sattr and flags */
1756 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1757 smb_buf(req->inbuf), 0, STR_TERMINATE,
1758 &status);
1759 if (!NT_STATUS_IS_OK(status)) {
1760 reply_nterror(req, status);
1761 END_PROFILE(SMBopenX);
1762 return;
1763 }
1764
1765 if (!map_open_params_to_ntcreate(
1766 fname, deny_mode, smb_ofun, &access_mask,
1767 &share_mode, &create_disposition, &create_options)) {
1768 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1769 END_PROFILE(SMBopenX);
1770 return;
1771 }
1772
1773 status = create_file(conn, /* conn */
1774 req, /* req */
1775 0, /* root_dir_fid */
1776 fname, /* fname */
1777 access_mask, /* access_mask */
1778 share_mode, /* share_access */
1779 create_disposition, /* create_disposition*/
1780 create_options, /* create_options */
1781 smb_attr, /* file_attributes */
1782 oplock_request, /* oplock_request */
1783 0, /* allocation_size */
1784 NULL, /* sd */
1785 NULL, /* ea_list */
1786 &fsp, /* result */
1787 &smb_action, /* pinfo */
1788 &sbuf); /* psbuf */
1789
1790 if (!NT_STATUS_IS_OK(status)) {
1791 END_PROFILE(SMBopenX);
1792 if (open_was_deferred(req->mid)) {
1793 /* We have re-scheduled this call. */
1794 return;
1795 }
1796 reply_openerror(req, status);
1797 return;
1798 }
1799
1800 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1801 if the file is truncated or created. */
1802 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1803 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1804 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1805 close_file(fsp,ERROR_CLOSE);
1806 reply_nterror(req, NT_STATUS_DISK_FULL);
1807 END_PROFILE(SMBopenX);
1808 return;
1809 }
1810 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1811 if (retval < 0) {
1812 close_file(fsp,ERROR_CLOSE);
1813 reply_nterror(req, NT_STATUS_DISK_FULL);
1814 END_PROFILE(SMBopenX);
1815 return;
1816 }
1817 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1818 }
1819
1820 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1821 mtime = sbuf.st_mtime;
1822 if (fattr & aDIR) {
1823 close_file(fsp,ERROR_CLOSE);
1824 reply_doserror(req, ERRDOS, ERRnoaccess);
1825 END_PROFILE(SMBopenX);
1826 return;
1827 }
1828
1829 /* If the caller set the extended oplock request bit
1830 and we granted one (by whatever means) - set the
1831 correct bit for extended oplock reply.
1832 */
1833
1834 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1835 smb_action |= EXTENDED_OPLOCK_GRANTED;
1836 }
1837
1838 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1839 smb_action |= EXTENDED_OPLOCK_GRANTED;
1840 }
1841
1842 /* If the caller set the core oplock request bit
1843 and we granted one (by whatever means) - set the
1844 correct bit for core oplock reply.
1845 */
1846
1847 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1848 reply_outbuf(req, 19, 0);
1849 } else {
1850 reply_outbuf(req, 15, 0);
1851 }
1852
1853 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1854 SCVAL(req->outbuf, smb_flg,
1855 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1856 }
1857
1858 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1859 SCVAL(req->outbuf, smb_flg,
1860 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1861 }
1862
1863 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1864 SSVAL(req->outbuf,smb_vwv3,fattr);
1865 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1866 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1867 } else {
1868 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1869 }
1870 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1871 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1872 SSVAL(req->outbuf,smb_vwv11,smb_action);
1873
1874 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1875 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1876 }
1877
1878 END_PROFILE(SMBopenX);
1879 chain_reply(req);
1880 return;
1881 }
1882
1883 /****************************************************************************
1884 Reply to a SMBulogoffX.
1885 ****************************************************************************/
1886
1887 void reply_ulogoffX(struct smb_request *req)
1888 {
1889 user_struct *vuser;
1890
1891 START_PROFILE(SMBulogoffX);
1892
1893 vuser = get_valid_user_struct(req->vuid);
1894
1895 if(vuser == NULL) {
1896 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1897 req->vuid));
1898 }
1899
1900 /* in user level security we are supposed to close any files
1901 open by this user */
1902 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1903 file_close_user(req->vuid);
1904 }
1905
1906 invalidate_vuid(req->vuid);
1907
1908 reply_outbuf(req, 2, 0);
1909
1910 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1911
1912 END_PROFILE(SMBulogoffX);
1913 chain_reply(req);
1914 }
1915
1916 /****************************************************************************
1917 Reply to a mknew or a create.
1918 ****************************************************************************/
1919
1920 void reply_mknew(struct smb_request *req)
1921 {
1922 connection_struct *conn = req->conn;
1923 char *fname = NULL;
1924 int com;
1925 uint32 fattr = 0;
1926 struct timespec ts[2];
1927 files_struct *fsp;
1928 int oplock_request = 0;
1929 SMB_STRUCT_STAT sbuf;
1930 NTSTATUS status;
1931 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1932 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1933 uint32 create_disposition;
1934 uint32 create_options = 0;
1935 TALLOC_CTX *ctx = talloc_tos();
1936
1937 START_PROFILE(SMBcreate);
1938
1939 if (req->wct < 3) {
1940 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1941 END_PROFILE(SMBcreate);
1942 return;
1943 }
1944
1945 fattr = SVAL(req->inbuf,smb_vwv0);
1946 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1947 com = SVAL(req->inbuf,smb_com);
1948
1949 ts[1] =convert_time_t_to_timespec(
1950 srv_make_unix_date3(req->inbuf + smb_vwv1));
1951 /* mtime. */
1952
1953 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1954 smb_buf(req->inbuf) + 1, 0,
1955 STR_TERMINATE, &status);
1956 if (!NT_STATUS_IS_OK(status)) {
1957 reply_nterror(req, status);
1958 END_PROFILE(SMBcreate);
1959 return;
1960 }
1961
1962 if (fattr & aVOLID) {
1963 DEBUG(0,("Attempt to create file (%s) with volid set - "
1964 "please report this\n", fname));
1965 }
1966
1967 if(com == SMBmknew) {
1968 /* We should fail if file exists. */
1969 create_disposition = FILE_CREATE;
1970 } else {
1971 /* Create if file doesn't exist, truncate if it does. */
1972 create_disposition = FILE_OVERWRITE_IF;
1973 }
1974
1975 status = create_file(conn, /* conn */
1976 req, /* req */
1977 0, /* root_dir_fid */
1978 fname, /* fname */
1979 access_mask, /* access_mask */
1980 share_mode, /* share_access */
1981 create_disposition, /* create_disposition*/
1982 create_options, /* create_options */
1983 fattr, /* file_attributes */
1984 oplock_request, /* oplock_request */
1985 0, /* allocation_size */
1986 NULL, /* sd */
1987 NULL, /* ea_list */
1988 &fsp, /* result */
1989 NULL, /* pinfo */
1990 &sbuf); /* psbuf */
1991
1992 if (!NT_STATUS_IS_OK(status)) {
1993 END_PROFILE(SMBcreate);
1994 if (open_was_deferred(req->mid)) {
1995 /* We have re-scheduled this call. */
1996 return;
1997 }
1998 reply_openerror(req, status);
1999 return;
2000 }
2001
2002 ts[0] = get_atimespec(&sbuf); /* atime. */
2003 status = smb_set_file_time(conn, fsp, fname, &sbuf, ts, true);
2004 if (!NT_STATUS_IS_OK(status)) {
2005 END_PROFILE(SMBcreate);
2006 reply_openerror(req, status);
2007 return;
2008 }
2009
2010 reply_outbuf(req, 1, 0);
2011 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2012
2013 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2014 SCVAL(req->outbuf,smb_flg,
2015 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2016 }
2017
2018 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2019 SCVAL(req->outbuf,smb_flg,
2020 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2021 }
2022
2023 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2024 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2025 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2026
2027 END_PROFILE(SMBcreate);
2028 return;
2029 }
2030
2031 /****************************************************************************
2032 Reply to a create temporary file.
2033 ****************************************************************************/
2034
2035 void reply_ctemp(struct smb_request *req)
2036 {
2037 connection_struct *conn = req->conn;
2038 char *fname = NULL;
2039 uint32 fattr;
2040 files_struct *fsp;
2041 int oplock_request;
2042 int tmpfd;
2043 SMB_STRUCT_STAT sbuf;
2044 char *s;
2045 NTSTATUS status;
2046 TALLOC_CTX *ctx = talloc_tos();
2047
2048 START_PROFILE(SMBctemp);
2049
2050 if (req->wct < 3) {
2051 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2052 END_PROFILE(SMBctemp);
2053 return;
2054 }
2055
2056 fattr = SVAL(req->inbuf,smb_vwv0);
2057 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2058
2059 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2060 smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
2061 &status);
2062 if (!NT_STATUS_IS_OK(status)) {
2063 reply_nterror(req, status);
2064 END_PROFILE(SMBctemp);
2065 return;
2066 }
2067 if (*fname) {
2068 fname = talloc_asprintf(ctx,
2069 "%s/TMXXXXXX",
2070 fname);
2071 } else {
2072 fname = talloc_strdup(ctx, "TMXXXXXX");
2073 }
2074
2075 if (!fname) {
2076 reply_nterror(req, NT_STATUS_NO_MEMORY);
2077 END_PROFILE(SMBctemp);
2078 return;
2079 }
2080
2081 status = resolve_dfspath(ctx, conn,
2082 req->flags2 & FLAGS2_DFS_PATHNAMES,
2083 fname,
2084 &fname);
2085 if (!NT_STATUS_IS_OK(status)) {
2086 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2087 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2088 ERRSRV, ERRbadpath);
2089 END_PROFILE(SMBctemp);
2090 return;
2091 }
2092 reply_nterror(req, status);
2093 END_PROFILE(SMBctemp);
2094 return;
2095 }
2096
2097 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2098 if (!NT_STATUS_IS_OK(status)) {
2099 reply_nterror(req, status);
2100 END_PROFILE(SMBctemp);
2101 return;
2102 }
2103
2104 status = check_name(conn, CONST_DISCARD(char *,fname));
2105 if (!NT_STATUS_IS_OK(status)) {
2106 reply_nterror(req, status);
2107 END_PROFILE(SMBctemp);
2108 return;
2109 }
2110
2111 tmpfd = smb_mkstemp(fname);
2112 if (tmpfd == -1) {
2113 reply_unixerror(req, ERRDOS, ERRnoaccess);
2114 END_PROFILE(SMBctemp);
2115 return;
2116 }
2117
2118 SMB_VFS_STAT(conn,fname,&sbuf);
2119
2120 /* We should fail if file does not exist. */
2121 status = open_file_ntcreate(conn, req, fname, &sbuf,
2122 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2123 FILE_SHARE_READ|FILE_SHARE_WRITE,
2124 FILE_OPEN,
2125 0,
2126 fattr,
2127 oplock_request,
2128 NULL, &fsp);
2129
2130 /* close fd from smb_mkstemp() */
2131 close(tmpfd);
2132
2133 if (!NT_STATUS_IS_OK(status)) {
2134 if (open_was_deferred(req->mid)) {
2135 /* We have re-scheduled this call. */
2136 END_PROFILE(SMBctemp);
2137 return;
2138 }
2139 reply_openerror(req, status);
2140 END_PROFILE(SMBctemp);
2141 return;
2142 }
2143
2144 reply_outbuf(req, 1, 0);
2145 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2146
2147 /* the returned filename is relative to the directory */
2148 s = strrchr_m(fsp->fsp_name, '/');
2149 if (!s) {
2150 s = fsp->fsp_name;
2151 } else {
2152 s++;
2153 }
2154
2155 #if 0
2156 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2157 thing in the byte section. JRA */
2158 SSVALS(p, 0, -1); /* what is this? not in spec */
2159 #endif
2160 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2161 == -1) {
2162 reply_nterror(req, NT_STATUS_NO_MEMORY);
2163 END_PROFILE(SMBctemp);
2164 return;
2165 }
2166
2167 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2168 SCVAL(req->outbuf, smb_flg,
2169 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2170 }
2171
2172 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2173 SCVAL(req->outbuf, smb_flg,
2174 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2175 }
2176
2177 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2178 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2179 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2180
2181 END_PROFILE(SMBctemp);
2182 return;
2183 }
2184
2185 /*******************************************************************
2186 Check if a user is allowed to rename a file.
2187 ********************************************************************/
2188
2189 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2190 uint16 dirtype, SMB_STRUCT_STAT *pst)
2191 {
2192 uint32 fmode;
2193
2194 if (!CAN_WRITE(conn)) {
2195 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2196 }
2197
2198 fmode = dos_mode(conn, fsp->fsp_name, pst);
2199 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2200 return NT_STATUS_NO_SUCH_FILE;
2201 }
2202
2203 if (S_ISDIR(pst->st_mode)) {
2204 return NT_STATUS_OK;
2205 }
2206
2207 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2208 return NT_STATUS_OK;
2209 }
2210
2211 return NT_STATUS_ACCESS_DENIED;
2212 }
2213
2214 /*******************************************************************
2215 * unlink a file with all relevant access checks
2216 *******************************************************************/
2217
2218 static NTSTATUS do_unlink(connection_struct *conn,
2219 struct smb_request *req,
2220 const char *fname,
2221 uint32 dirtype)
2222 {
2223 SMB_STRUCT_STAT sbuf;
2224 uint32 fattr;
2225 files_struct *fsp;
2226 uint32 dirtype_orig = dirtype;
2227 NTSTATUS status;
2228
2229 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2230
2231 if (!CAN_WRITE(conn)) {
2232 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2233 }
2234
2235 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2236 return map_nt_error_from_unix(errno);
2237 }
2238
2239 fattr = dos_mode(conn,fname,&sbuf);
2240
2241 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2242 dirtype = aDIR|aARCH|aRONLY;
2243 }
2244
2245 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2246 if (!dirtype) {
2247 return NT_STATUS_NO_SUCH_FILE;
2248 }
2249
2250 if (!dir_check_ftype(conn, fattr, dirtype)) {
2251 if (fattr & aDIR) {
2252 return NT_STATUS_FILE_IS_A_DIRECTORY;
2253 }
2254 return NT_STATUS_NO_SUCH_FILE;
2255 }
2256
2257 if (dirtype_orig & 0x8000) {
2258 /* These will never be set for POSIX. */
2259 return NT_STATUS_NO_SUCH_FILE;
2260 }
2261
2262 #if 0
2263 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2264 return NT_STATUS_FILE_IS_A_DIRECTORY;
2265 }
2266
2267 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2268 return NT_STATUS_NO_SUCH_FILE;
2269 }
2270
2271 if (dirtype & 0xFF00) {
2272 /* These will never be set for POSIX. */
2273 return NT_STATUS_NO_SUCH_FILE;
2274 }
2275
2276 dirtype &= 0xFF;
2277 if (!dirtype) {
2278 return NT_STATUS_NO_SUCH_FILE;
2279 }
2280
2281 /* Can't delete a directory. */
2282 if (fattr & aDIR) {
2283 return NT_STATUS_FILE_IS_A_DIRECTORY;
2284 }
2285 #endif
2286
2287 #if 0 /* JRATEST */
2288 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2289 return NT_STATUS_OBJECT_NAME_INVALID;
2290 #endif /* JRATEST */
2291
2292 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2293
2294 On a Windows share, a file with read-only dosmode can be opened with
2295 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2296 fails with NT_STATUS_CANNOT_DELETE error.
2297
2298 This semantic causes a problem that a user can not
2299 rename a file with read-only dosmode on a Samba share
2300 from a Windows command prompt (i.e. cmd.exe, but can rename
2301 from Windows Explorer).
2302 */
2303
2304 if (!lp_delete_readonly(SNUM(conn))) {
2305 if (fattr & aRONLY) {
2306 return NT_STATUS_CANNOT_DELETE;
2307 }
2308 }
2309
2310 /* On open checks the open itself will check the share mode, so
2311 don't do it here as we'll get it wrong. */
2312
2313 status = create_file_unixpath
2314 (conn, /* conn */
2315 req, /* req */
2316 fname, /* fname */
2317 DELETE_ACCESS, /* access_mask */
2318 FILE_SHARE_NONE, /* share_access */
2319 FILE_OPEN, /* create_disposition*/
2320 FILE_NON_DIRECTORY_FILE, /* create_options */
2321 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2322 0, /* oplock_request */
2323 0, /* allocation_size */
2324 NULL, /* sd */
2325 NULL, /* ea_list */
2326 &fsp, /* result */
2327 NULL, /* pinfo */
2328 &sbuf); /* psbuf */
2329
2330 if (!NT_STATUS_IS_OK(status)) {
2331 DEBUG(10, ("open_file_ntcreate failed: %s\n",
2332 nt_errstr(status)));
2333 return status;
2334 }
2335
2336 /* The set is across all open files on this dev/inode pair. */
2337 if (!set_delete_on_close(fsp, True, &current_user.ut)) {
2338 close_file(fsp, NORMAL_CLOSE);
2339 return NT_STATUS_ACCESS_DENIED;
2340 }
2341
2342 return close_file(fsp,NORMAL_CLOSE);
2343 }
2344
2345 /****************************************************************************
2346 The guts of the unlink command, split out so it may be called by the NT SMB
2347 code.
2348 ****************************************************************************/
2349
2350 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2351 uint32 dirtype, const char *name_in, bool has_wild)
2352 {
2353 const char *directory = NULL;
2354 char *mask = NULL;
2355 char *name = NULL;
2356 char *p = NULL;
2357 int count=0;
2358 NTSTATUS status = NT_STATUS_OK;
2359 SMB_STRUCT_STAT sbuf;
2360 TALLOC_CTX *ctx = talloc_tos();
2361
2362 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2363 if (!NT_STATUS_IS_OK(status)) {
2364 return status;
2365 }
2366
2367 p = strrchr_m(name,'/');
2368 if (!p) {
2369 directory = talloc_strdup(ctx, ".");
2370 if (!directory) {
2371 return NT_STATUS_NO_MEMORY;
2372 }
2373 mask = name;
2374 } else {
2375 *p = 0;
2376 directory = name;
2377 mask = p+1;
2378 }
2379
2380 /*
2381 * We should only check the mangled cache
2382 * here if unix_convert failed. This means
2383 * that the path in 'mask' doesn't exist
2384 * on the file system and so we need to look
2385 * for a possible mangle. This patch from
2386 * Tine Smukavec <valentin.smukavec@hermes.si>.
2387 */
2388
2389 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2390 char *new_mask = NULL;
2391 mangle_lookup_name_from_8_3(ctx,
2392 mask,
2393 &new_mask,
2394 conn->params );
2395 if (new_mask) {
2396 mask = new_mask;
2397 }
2398 }
2399
2400 if (!has_wild) {
2401 directory = talloc_asprintf(ctx,
2402 "%s/%s",
2403 directory,
2404 mask);
2405 if (!directory) {
2406 return NT_STATUS_NO_MEMORY;
2407 }
2408 if (dirtype == 0) {
2409 dirtype = FILE_ATTRIBUTE_NORMAL;
2410 }
2411
2412 status = check_name(conn, directory);
2413 if (!NT_STATUS_IS_OK(status)) {
2414 return status;
2415 }
2416
2417 status = do_unlink(conn, req, directory, dirtype);
2418 if (!NT_STATUS_IS_OK(status)) {
2419 return status;
2420 }
2421
2422 count++;
2423 } else {
2424 struct smb_Dir *dir_hnd = NULL;
2425 long offset = 0;
2426 const char *dname;
2427
2428 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2429 return NT_STATUS_OBJECT_NAME_INVALID;
2430 }
2431
2432 if (strequal(mask,"????????.???")) {
2433 mask[0] = '*';
2434 mask[1] = '\0';
2435 }
2436
2437 status = check_name(conn, directory);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 return status;
2440 }
2441
2442 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2443 dirtype);
2444 if (dir_hnd == NULL) {
2445 return map_nt_error_from_unix(errno);
2446 }
2447
2448 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2449 the pattern matches against the long name, otherwise the short name
2450 We don't implement this yet XXXX
2451 */
2452
2453 status = NT_STATUS_NO_SUCH_FILE;
2454
2455 while ((dname = ReadDirName(dir_hnd, &offset))) {
2456 SMB_STRUCT_STAT st;
2457 char *fname = NULL;
2458
2459 if (!is_visible_file(conn, directory, dname, &st, True)) {
2460 continue;
2461 }
2462
2463 /* Quick check for "." and ".." */
2464 if (ISDOT(dname) || ISDOTDOT(dname)) {
2465 continue;
2466 }
2467
2468 if(!mask_match(dname, mask, conn->case_sensitive)) {
2469 continue;
2470 }
2471
2472 fname = talloc_asprintf(ctx, "%s/%s",
2473 directory,
2474 dname);
2475 if (!fname) {
2476 return NT_STATUS_NO_MEMORY;
2477 }
2478
2479 status = check_name(conn, fname);
2480 if (!NT_STATUS_IS_OK(status)) {
2481 TALLOC_FREE(dir_hnd);
2482 return status;
2483 }
2484
2485 status = do_unlink(conn, req, fname, dirtype);
2486 if (!NT_STATUS_IS_OK(status)) {
2487 TALLOC_FREE(fname);
2488 continue;
2489 }
2490
2491 count++;
2492 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2493 fname));
2494
2495 TALLOC_FREE(fname);
2496 }
2497 TALLOC_FREE(dir_hnd);
2498 }
2499
2500 if (count == 0 && NT_STATUS_IS_OK(status)) {
2501 status = map_nt_error_from_unix(errno);
2502 }
2503
2504 return status;
2505 }
2506
2507 /****************************************************************************
2508 Reply to a unlink
2509 ****************************************************************************/
2510
2511 void reply_unlink(struct smb_request *req)
2512 {
2513 connection_struct *conn = req->conn;
2514 char *name = NULL;
2515 uint32 dirtype;
2516 NTSTATUS status;
2517 bool path_contains_wcard = False;
2518 TALLOC_CTX *ctx = talloc_tos();
2519
2520 START_PROFILE(SMBunlink);
2521
2522 if (req->wct < 1) {
2523 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2524 END_PROFILE(SMBunlink);
2525 return;
2526 }
2527
2528 dirtype = SVAL(req->inbuf,smb_vwv0);
2529
2530 srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2531 smb_buf(req->inbuf) + 1, 0,
2532 STR_TERMINATE, &status, &path_contains_wcard);
2533 if (!NT_STATUS_IS_OK(status)) {
2534 reply_nterror(req, status);
2535 END_PROFILE(SMBunlink);
2536 return;
2537 }
2538
2539 status = resolve_dfspath_wcard(ctx, conn,
2540 req->flags2 & FLAGS2_DFS_PATHNAMES,
2541 name,
2542 &name,
2543 &path_contains_wcard);
2544 if (!NT_STATUS_IS_OK(status)) {
2545 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2546 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2547 ERRSRV, ERRbadpath);
2548 END_PROFILE(SMBunlink);
2549 return;
2550 }
2551 reply_nterror(req, status);
2552 END_PROFILE(SMBunlink);
2553 return;
2554 }
2555
2556 DEBUG(3,("reply_unlink : %s\n",name));
2557
2558 status = unlink_internals(conn, req, dirtype, name,
2559 path_contains_wcard);
2560 if (!NT_STATUS_IS_OK(status)) {
2561 if (open_was_deferred(req->mid)) {
2562 /* We have re-scheduled this call. */
2563 END_PROFILE(SMBunlink);
2564 return;
2565 }
2566 reply_nterror(req, status);
2567 END_PROFILE(SMBunlink);
2568 return;
2569 }
2570
2571 reply_outbuf(req, 0, 0);
2572 END_PROFILE(SMBunlink);
2573
2574 return;
2575 }
2576
2577 /****************************************************************************
2578 Fail for readbraw.
2579 ****************************************************************************/
2580
2581 static void fail_readraw(void)
2582 {
2583 const char *errstr = talloc_asprintf(talloc_tos(),
2584 "FAIL ! reply_readbraw: socket write fail (%s)",
2585 strerror(errno));
2586 if (!errstr) {
2587 errstr = "";
2588 }
2589 exit_server_cleanly(errstr);
2590 }
2591
2592 /****************************************************************************
2593 Fake (read/write) sendfile. Returns -1 on read or write fail.
2594 ****************************************************************************/
2595
2596 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2597 size_t nread)
2598 {
2599 size_t bufsize;
2600 size_t tosend = nread;
2601 char *buf;
2602
2603 if (nread == 0) {
2604 return 0;
2605 }
2606
2607 bufsize = MIN(nread, 65536);
2608
2609 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2610 return -1;
2611 }
2612
2613 while (tosend > 0) {
2614 ssize_t ret;
2615 size_t cur_read;
2616
2617 if (tosend > bufsize) {
2618 cur_read = bufsize;
2619 } else {
2620 cur_read = tosend;
2621 }
2622 ret = read_file(fsp,buf,startpos,cur_read);
2623 if (ret == -1) {
2624 SAFE_FREE(buf);
2625 return -1;
2626 }
2627
2628 /* If we had a short read, fill with zeros. */
2629 if (ret < cur_read) {
2630 memset(buf, '\0', cur_read - ret);
2631 }
2632
2633 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2634 SAFE_FREE(buf);
2635 return -1;
2636 }
2637 tosend -= cur_read;
2638 startpos += cur_read;
2639 }
2640
2641 SAFE_FREE(buf);
2642 return (ssize_t)nread;
2643 }
2644
2645 /****************************************************************************
2646 Return a readbraw error (4 bytes of zero).
2647 ****************************************************************************/
2648
2649 static void reply_readbraw_error(void)
2650 {
2651 char header[4];
2652 SIVAL(header,0,0);
2653 if (write_data(smbd_server_fd(),header,4) != 4) {
2654 fail_readraw();
2655 }
2656 }
2657
2658 /****************************************************************************
2659 Use sendfile in readbraw.
2660 ****************************************************************************/
2661
2662 void send_file_readbraw(connection_struct *conn,
2663 files_struct *fsp,
2664 SMB_OFF_T startpos,
2665 size_t nread,
2666 ssize_t mincount)
2667 {
2668 char *outbuf = NULL;
2669 ssize_t ret=0;
2670
2671 #if defined(WITH_SENDFILE)
2672 /*
2673 * We can only use sendfile on a non-chained packet
2674 * but we can use on a non-oplocked file. tridge proved this
2675 * on a train in Germany :-). JRA.
2676 * reply_readbraw has already checked the length.
2677 */
2678
2679 if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2680 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2681 char header[4];
2682 DATA_BLOB header_blob;
2683
2684 _smb_setlen(header,nread);
2685 header_blob = data_blob_const(header, 4);
2686
2687 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2688 &header_blob, startpos, nread) == -1) {
2689 /* Returning ENOSYS means no data at all was sent.
2690 * Do this as a normal read. */
2691 if (errno == ENOSYS) {
2692 goto normal_readbraw;
2693 }
2694
2695 /*
2696 * Special hack for broken Linux with no working sendfile. If we
2697 * return EINTR we sent the header but not the rest of the data.
2698 * Fake this up by doing read/write calls.
2699 */
2700 if (errno == EINTR) {
2701 /* Ensure we don't do this again. */
2702 set_use_sendfile(SNUM(conn), False);
2703 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2704
2705 if (fake_sendfile(fsp, startpos, nread) == -1) {
2706 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2707 fsp->fsp_name, strerror(errno) ));
2708 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2709 }
2710 return;
2711 }
2712
2713 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2714 fsp->fsp_name, strerror(errno) ));
2715 exit_server_cleanly("send_file_readbraw sendfile failed");
2716 }
2717
2718 return;
2719 }
2720 #endif
2721
2722 normal_readbraw:
2723
2724 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2725 if (!outbuf) {
2726 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2727 (unsigned)(nread+4)));
2728 reply_readbraw_error();
2729 return;
2730 }
2731
2732 if (nread > 0) {
2733 ret = read_file(fsp,outbuf+4,startpos,nread);
2734 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2735 if (ret < mincount)
2736 ret = 0;
2737 #else
2738 if (ret < nread)
2739 ret = 0;
2740 #endif
2741 }
2742
2743 _smb_setlen(outbuf,ret);
2744 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2745 fail_readraw();
2746
2747 TALLOC_FREE(outbuf);
2748 }
2749
2750 /****************************************************************************
2751 Reply to a readbraw (core+ protocol).
2752 ****************************************************************************/
2753
2754 void reply_readbraw(struct smb_request *req)
2755 {
2756 connection_struct *conn = req->conn;
2757 ssize_t maxcount,mincount;
2758 size_t nread = 0;
2759 SMB_OFF_T startpos;
2760 files_struct *fsp;
2761 SMB_STRUCT_STAT st;
2762 SMB_OFF_T size = 0;
2763
2764 START_PROFILE(SMBreadbraw);
2765
2766 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2767 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2768 "raw reads/writes are disallowed.");
2769 }
2770
2771 if (req->wct < 8) {
2772 reply_readbraw_error();
2773 END_PROFILE(SMBreadbraw);
2774 return;
2775 }
2776
2777 /*
2778 * Special check if an oplock break has been issued
2779 * and the readraw request croses on the wire, we must
2780 * return a zero length response here.
2781 */
2782
2783 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2784
2785 /*
2786 * We have to do a check_fsp by hand here, as
2787 * we must always return 4 zero bytes on error,
2788 * not a NTSTATUS.
2789 */
2790
2791 if (!fsp || !conn || conn != fsp->conn ||
2792 current_user.vuid != fsp->vuid ||
2793 fsp->is_directory || fsp->fh->fd == -1) {
2794 /*
2795 * fsp could be NULL here so use the value from the packet. JRA.
2796 */
2797 DEBUG(3,("reply_readbraw: fnum %d not valid "
2798 "- cache prime?\n",
2799 (int)SVAL(req->inbuf,smb_vwv0)));
2800 reply_readbraw_error();
2801 END_PROFILE(SMBreadbraw);
2802 return;
2803 }
2804
2805 /* Do a "by hand" version of CHECK_READ. */
2806 if (!(fsp->can_read ||
2807 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2808 (fsp->access_mask & FILE_EXECUTE)))) {
2809 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2810 (int)SVAL(req->inbuf,smb_vwv0)));
2811 reply_readbraw_error();
2812 END_PROFILE(SMBreadbraw);
2813 return;
2814 }
2815
2816 flush_write_cache(fsp, READRAW_FLUSH);
2817
2818 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2819 if(req->wct == 10) {
2820 /*
2821 * This is a large offset (64 bit) read.
2822 */
2823 #ifdef LARGE_SMB_OFF_T
2824
2825 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2826
2827 #else /* !LARGE_SMB_OFF_T */
2828
2829 /*
2830 * Ensure we haven't been sent a >32 bit offset.
2831 */
2832
2833 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2834 DEBUG(0,("reply_readbraw: large offset "
2835 "(%x << 32) used and we don't support "
2836 "64 bit offsets.\n",
2837 (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2838 reply_readbraw_error();
2839 END_PROFILE(SMBreadbraw);
2840 return;
2841 }
2842
2843 #endif /* LARGE_SMB_OFF_T */
2844
2845 if(startpos < 0) {
2846 DEBUG(0,("reply_readbraw: negative 64 bit "
2847 "readraw offset (%.0f) !\n",
2848 (double)startpos ));
2849 reply_readbraw_error();
2850 END_PROFILE(SMBreadbraw);
2851 return;
2852 }
2853 }
2854
2855 maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2856 mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2857
2858 /* ensure we don't overrun the packet size */
2859 maxcount = MIN(65535,maxcount);
2860
2861 if (is_locked(fsp,(uint32)req->smbpid,
2862 (SMB_BIG_UINT)maxcount,
2863 (SMB_BIG_UINT)startpos,
2864 READ_LOCK)) {
2865 reply_readbraw_error();
2866 END_PROFILE(SMBreadbraw);
2867 return;
2868 }
2869
2870 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2871 size = st.st_size;
2872 }
2873
2874 if (startpos >= size) {
2875 nread = 0;
2876 } else {
2877 nread = MIN(maxcount,(size - startpos));
2878 }
2879
2880 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2881 if (nread < mincount)
2882 nread = 0;
2883 #endif
2884
2885 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2886 "min=%lu nread=%lu\n",
2887 fsp->fnum, (double)startpos,
2888 (unsigned long)maxcount,
2889 (unsigned long)mincount,
2890 (unsigned long)nread ) );
2891
2892 send_file_readbraw(conn, fsp, startpos, nread, mincount);
2893
2894 DEBUG(5,("reply_readbraw finished\n"));
2895 END_PROFILE(SMBreadbraw);
2896 }
2897
2898 #undef DBGC_CLASS
2899 #define DBGC_CLASS DBGC_LOCKING
2900
2901 /****************************************************************************
2902 Reply to a lockread (core+ protocol).
2903 ****************************************************************************/
2904
2905 void reply_lockread(struct smb_request *req)
2906 {
2907 connection_struct *conn = req->conn;
2908 ssize_t nread = -1;
2909 char *data;
2910 SMB_OFF_T startpos;
2911 size_t numtoread;
2912 NTSTATUS status;
2913 files_struct *fsp;
2914 struct byte_range_lock *br_lck = NULL;
2915 char *p = NULL;
2916
2917 START_PROFILE(SMBlockread);
2918
2919 if (req->wct < 5) {
2920 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2921 END_PROFILE(SMBlockread);
2922 return;
2923 }
2924
2925 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2926
2927 if (!check_fsp(conn, req, fsp)) {
2928 END_PROFILE(SMBlockread);
2929 return;
2930 }
2931
2932 if (!CHECK_READ(fsp,req->inbuf)) {
2933 reply_doserror(req, ERRDOS, ERRbadaccess);
2934 END_PROFILE(SMBlockread);
2935 return;
2936 }
2937
2938 release_level_2_oplocks_on_change(fsp);
2939
2940 numtoread = SVAL(req->inbuf,smb_vwv1);
2941 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
2942
2943 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
2944
2945 reply_outbuf(req, 5, numtoread + 3);
2946
2947 data = smb_buf(req->outbuf) + 3;
2948
2949 /*
2950 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2951 * protocol request that predates the read/write lock concept.
2952 * Thus instead of asking for a read lock here we need to ask
2953 * for a write lock. JRA.
2954 * Note that the requested lock size is unaffected by max_recv.
2955 */
2956
2957 br_lck = do_lock(smbd_messaging_context(),
2958 fsp,
2959 req->smbpid,
2960 (SMB_BIG_UINT)numtoread,
2961 (SMB_BIG_UINT)startpos,
2962 WRITE_LOCK,
2963 WINDOWS_LOCK,
2964 False, /* Non-blocking lock. */
2965 &status,
2966 NULL);
2967 TALLOC_FREE(br_lck);
2968
2969 if (NT_STATUS_V(status)) {
2970 reply_nterror(req, status);
2971 END_PROFILE(SMBlockread);
2972 return;
2973 }
2974
2975 /*
2976 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2977 */
2978
2979 if (numtoread > max_recv) {
2980 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
2981 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2982 (unsigned int)numtoread, (unsigned int)max_recv ));
2983 numtoread = MIN(numtoread,max_recv);
2984 }
2985 nread = read_file(fsp,data,startpos,numtoread);
2986
2987 if (nread < 0) {
2988 reply_unixerror(req, ERRDOS, ERRnoaccess);
2989 END_PROFILE(SMBlockread);
2990 return;
2991 }
2992
2993 srv_set_message((char *)req->outbuf, 5, nread+3, False);
2994
2995 SSVAL(req->outbuf,smb_vwv0,nread);
2996 SSVAL(req->outbuf,smb_vwv5,nread+3);
2997 p = smb_buf(req->outbuf);
2998 SCVAL(p,0,0); /* pad byte. */
2999 SSVAL(p,1,nread);
3000
3001 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3002 fsp->fnum, (int)numtoread, (int)nread));
3003
3004 END_PROFILE(SMBlockread);
3005 return;
3006 }
3007
3008 #undef DBGC_CLASS
3009 #define DBGC_CLASS DBGC_ALL
3010
3011 /****************************************************************************
3012 Reply to a read.
3013 ****************************************************************************/
3014
3015 void reply_read(struct smb_request *req)
3016 {
3017 connection_struct *conn = req->conn;
3018 size_t numtoread;
3019 ssize_t nread = 0;
3020 char *data;
3021 SMB_OFF_T startpos;
3022 int outsize = 0;
3023 files_struct *fsp;
3024
3025 START_PROFILE(SMBread);
3026
3027 if (req->wct < 3) {
3028 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3029 END_PROFILE(SMBread);
3030 return;
3031 }
3032
3033 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3034
3035 if (!check_fsp(conn, req, fsp)) {
3036 END_PROFILE(SMBread);
3037 return;
3038 }
3039
3040 if (!CHECK_READ(fsp,req->inbuf)) {
3041 reply_doserror(req, ERRDOS, ERRbadaccess);
3042 END_PROFILE(SMBread);
3043 return;
3044 }
3045
3046 numtoread = SVAL(req->inbuf,smb_vwv1);
3047 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3048
3049 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3050
3051 /*
3052 * The requested read size cannot be greater than max_recv. JRA.
3053 */
3054 if (numtoread > max_recv) {
3055 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3056 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3057 (unsigned int)numtoread, (unsigned int)max_recv ));
3058 numtoread = MIN(numtoread,max_recv);
3059 }
3060
3061 reply_outbuf(req, 5, numtoread+3);
3062
3063 data = smb_buf(req->outbuf) + 3;
3064
3065 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtoread,
3066 (SMB_BIG_UINT)startpos, READ_LOCK)) {
3067 reply_doserror(req, ERRDOS,ERRlock);
3068 END_PROFILE(SMBread);
3069 return;
3070 }
3071
3072 if (numtoread > 0)
3073 nread = read_file(fsp,data,startpos,numtoread);
3074
3075 if (nread < 0) {
3076 reply_unixerror(req, ERRDOS,ERRnoaccess);
3077 END_PROFILE(SMBread);
3078 return;
3079 }
3080
3081 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3082
3083 SSVAL(req->outbuf,smb_vwv0,nread);
3084 SSVAL(req->outbuf,smb_vwv5,nread+3);
3085 SCVAL(smb_buf(req->outbuf),0,1);
3086 SSVAL(smb_buf(req->outbuf),1,nread);
3087
3088 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3089 fsp->fnum, (int)numtoread, (int)nread ) );
3090
3091 END_PROFILE(SMBread);
3092 return;
3093 }
3094
3095 /****************************************************************************
3096 Setup readX header.
3097 ****************************************************************************/
3098
3099 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3100 {
3101 int outsize;
3102 char *data;
3103
3104 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3105 data = smb_buf(outbuf);
3106
3107 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3108
3109 SCVAL(outbuf,smb_vwv0,0xFF);
3110 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3111 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3112 SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3113 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3114 SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3115 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3116 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3117 return outsize;
3118 }
3119
3120 /****************************************************************************
3121 Reply to a read and X - possibly using sendfile.
3122 ****************************************************************************/
3123
3124 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3125 files_struct *fsp, SMB_OFF_T startpos,
3126 size_t smb_maxcnt)
3127 {
3128 SMB_STRUCT_STAT sbuf;
3129 ssize_t nread = -1;
3130
3131 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3132 reply_unixerror(req, ERRDOS, ERRnoaccess);
3133 return;
3134 }
3135
3136 if (startpos > sbuf.st_size) {
3137 smb_maxcnt = 0;
3138 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3139 smb_maxcnt = (sbuf.st_size - startpos);
3140 }
3141
3142 if (smb_maxcnt == 0) {
3143 goto normal_read;
3144 }
3145
3146 #if defined(WITH_SENDFILE)
3147 /*
3148 * We can only use sendfile on a non-chained packet
3149 * but we can use on a non-oplocked file. tridge proved this
3150 * on a train in Germany :-). JRA.
3151 */
3152
3153 if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3154 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3155 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3156 uint8 headerbuf[smb_size + 12 * 2];
3157 DATA_BLOB header;
3158
3159 /*
3160 * Set up the packet header before send. We
3161 * assume here the sendfile will work (get the
3162 * correct amount of data).
3163 */
3164
3165 header = data_blob_const(headerbuf, sizeof(headerbuf));
3166
3167 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3168 setup_readX_header((char *)headerbuf, smb_maxcnt);
3169
3170 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3171 /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
3172 if (errno == ENOSYS) {
3173 goto normal_read;
3174 }
3175
3176 /*
3177 * Special hack for broken Linux with no working sendfile. If we
3178 * return EINTR we sent the header but not the rest of the data.
3179 * Fake this up by doing read/write calls.
3180 */
3181
3182 if (errno == EINTR) {
3183 /* Ensure we don't do this again. */
3184 set_use_sendfile(SNUM(conn), False);
3185 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3186 nread = fake_sendfile(fsp, startpos,
3187 smb_maxcnt);
3188 if (nread == -1) {
3189 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3190 fsp->fsp_name, strerror(errno) ));
3191 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3192 }
3193 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3194 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3195 /* No outbuf here means successful sendfile. */
3196 TALLOC_FREE(req->outbuf);
3197 return;
3198 }
3199
3200 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3201 fsp->fsp_name, strerror(errno) ));
3202 exit_server_cleanly("send_file_readX sendfile failed");
3203 }
3204
3205 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3206 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3207 /* No outbuf here means successful sendfile. */
3208 TALLOC_FREE(req->outbuf);
3209 return;
3210 }
3211 #endif
3212
3213 normal_read:
3214
3215 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3216 uint8 headerbuf[smb_size + 2*12];
3217
3218 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3219 setup_readX_header((char *)headerbuf, smb_maxcnt);
3220
3221 /* Send out the header. */
3222 if (write_data(smbd_server_fd(), (char *)headerbuf,
3223 sizeof(headerbuf)) != sizeof(headerbuf)) {
3224 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3225 fsp->fsp_name, strerror(errno) ));
3226 exit_server_cleanly("send_file_readX sendfile failed");
3227 }
3228 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3229 if (nread == -1) {
3230 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3231 fsp->fsp_name, strerror(errno) ));
3232 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3233 }
3234 TALLOC_FREE(req->outbuf);
3235 return;
3236 } else {
3237 reply_outbuf(req, 12, smb_maxcnt);
3238
3239 nread = read_file(fsp, smb_buf(req->outbuf), startpos,
3240 smb_maxcnt);
3241 if (nread < 0) {
3242 reply_unixerror(req, ERRDOS, ERRnoaccess);
3243 return;
3244 }
3245
3246 setup_readX_header((char *)req->outbuf, nread);
3247
3248 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3249 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3250
3251 chain_reply(req);
3252
3253 return;
3254 }
3255 }
3256
3257 /****************************************************************************
3258 Reply to a read and X.
3259 ****************************************************************************/
3260
3261 void reply_read_and_X(struct smb_request *req)
3262 {
3263 connection_struct *conn = req->conn;
3264 files_struct *fsp;
3265 SMB_OFF_T startpos;
3266 size_t smb_maxcnt;
3267 bool big_readX = False;
3268 #if 0
3269 size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3270 #endif
3271
3272 START_PROFILE(SMBreadX);
3273
3274 if ((req->wct != 10) && (req->wct != 12)) {
3275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3276 return;
3277 }
3278
3279 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3280 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3281 smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3282
3283 /* If it's an IPC, pass off the pipe handler. */
3284 if (IS_IPC(conn)) {
3285 reply_pipe_read_and_X(req);
3286 END_PROFILE(SMBreadX);
3287 return;
3288 }
3289
3290 if (!check_fsp(conn, req, fsp)) {
3291 END_PROFILE(SMBreadX);
3292 return;
3293 }
3294
3295 if (!CHECK_READ(fsp,req->inbuf)) {
3296 reply_doserror(req, ERRDOS,ERRbadaccess);
3297 END_PROFILE(SMBreadX);
3298 return;
3299 }
3300
3301 if (global_client_caps & CAP_LARGE_READX) {
3302 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3303 smb_maxcnt |= (upper_size<<16);
3304 if (upper_size > 1) {
3305 /* Can't do this on a chained packet. */
3306 if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3307 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3308 END_PROFILE(SMBreadX);
3309 return;
3310 }
3311 /* We currently don't do this on signed or sealed data. */
3312 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3313 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3314 END_PROFILE(SMBreadX);
3315 return;
3316 }
3317 /* Is there room in the reply for this data ? */
3318 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3319 reply_nterror(req,
3320 NT_STATUS_INVALID_PARAMETER);
3321 END_PROFILE(SMBreadX);
3322 return;
3323 }
3324 big_readX = True;
3325 }
3326 }
3327
3328 if (req->wct == 12) {
3329 #ifdef LARGE_SMB_OFF_T
3330 /*
3331 * This is a large offset (64 bit) read.
3332 */
3333 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3334
3335 #else /* !LARGE_SMB_OFF_T */
3336
3337 /*
3338 * Ensure we haven't been sent a >32 bit offset.
3339 */
3340
3341 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3342 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3343 "used and we don't support 64 bit offsets.\n",
3344 (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3345 END_PROFILE(SMBreadX);
3346 reply_doserror(req, ERRDOS, ERRbadaccess);
3347 return;
3348 }
3349
3350 #endif /* LARGE_SMB_OFF_T */
3351
3352 }
3353
3354 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)smb_maxcnt,
3355 (SMB_BIG_UINT)startpos, READ_LOCK)) {
3356 END_PROFILE(SMBreadX);
3357 reply_doserror(req, ERRDOS, ERRlock);
3358 return;
3359 }
3360
3361 if (!big_readX &&
3362 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3363 END_PROFILE(SMBreadX);
3364 return;
3365 }
3366
3367 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3368
3369 END_PROFILE(SMBreadX);
3370 return;
3371 }
3372
3373 /****************************************************************************
3374 Error replies to writebraw must have smb_wct == 1. Fix this up.
3375 ****************************************************************************/
3376
3377 void error_to_writebrawerr(struct smb_request *req)
3378 {
3379 uint8 *old_outbuf = req->outbuf;
3380
3381 reply_outbuf(req, 1, 0);
3382
3383 memcpy(req->outbuf, old_outbuf, smb_size);
3384 TALLOC_FREE(old_outbuf);
3385 }
3386
3387 /****************************************************************************
3388 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3389 ****************************************************************************/
3390
3391 void reply_writebraw(struct smb_request *req)
3392 {
3393 connection_struct *conn = req->conn;
3394 char *buf = NULL;
3395 ssize_t nwritten=0;
3396 ssize_t total_written=0;
3397 size_t numtowrite=0;
3398 size_t tcount;
3399 SMB_OFF_T startpos;
3400 char *data=NULL;
3401 bool write_through;
3402 files_struct *fsp;
3403 NTSTATUS status;
3404
3405 START_PROFILE(SMBwritebraw);
3406
3407 /*
3408 * If we ever reply with an error, it must have the SMB command
3409 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3410 * we're finished.
3411 */
3412 SCVAL(req->inbuf,smb_com,SMBwritec);
3413
3414 if (srv_is_signing_active()) {
3415 END_PROFILE(SMBwritebraw);
3416 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3417 "raw reads/writes are disallowed.");
3418 }
3419
3420 if (req->wct < 12) {
3421 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3422 error_to_writebrawerr(req);
3423 END_PROFILE(SMBwritebraw);
3424 return;
3425 }
3426
3427 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3428 if (!check_fsp(conn, req, fsp)) {
3429 error_to_writebrawerr(req);
3430 END_PROFILE(SMBwritebraw);
3431 return;
3432 }
3433
3434 if (!CHECK_WRITE(fsp)) {
3435 reply_doserror(req, ERRDOS, ERRbadaccess);
3436 error_to_writebrawerr(req);
3437 END_PROFILE(SMBwritebraw);
3438 return;
3439 }
3440
3441 tcount = IVAL(req->inbuf,smb_vwv1);
3442 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3443 write_through = BITSETW(req->inbuf+smb_vwv7,0);
3444
3445 /* We have to deal with slightly different formats depending
3446 on whether we are using the core+ or lanman1.0 protocol */
3447
3448 if(Protocol <= PROTOCOL_COREPLUS) {
3449 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3450 data = smb_buf(req->inbuf);
3451 } else {
3452 numtowrite = SVAL(req->inbuf,smb_vwv10);
3453 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3454 }
3455
3456 /* Ensure we don't write bytes past the end of this packet. */
3457 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3458 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3459 error_to_writebrawerr(req);
3460 END_PROFILE(SMBwritebraw);
3461 return;
3462 }
3463
3464 if (is_locked(fsp,(uint32)req->smbpid,(SMB_BIG_UINT)tcount,
3465 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3466 reply_doserror(req, ERRDOS, ERRlock);
3467 error_to_writebrawerr(req);
3468 END_PROFILE(SMBwritebraw);
3469 return;
3470 }
3471
3472 if (numtowrite>0) {
3473 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3474 }
3475
3476 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3477 "wrote=%d sync=%d\n",
3478 fsp->fnum, (double)startpos, (int)numtowrite,
3479 (int)nwritten, (int)write_through));
3480
3481 if (nwritten < (ssize_t)numtowrite) {
3482 reply_unixerror(req, ERRHRD, ERRdiskfull);
3483 error_to_writebrawerr(req);
3484 END_PROFILE(SMBwritebraw);
3485 return;
3486 }
3487
3488 total_written = nwritten;
3489
3490 /* Allocate a buffer of 64k + length. */
3491 buf = TALLOC_ARRAY(NULL, char, 65540);
3492 if (!buf) {
3493 reply_doserror(req, ERRDOS, ERRnomem);
3494 error_to_writebrawerr(req);
3495 END_PROFILE(SMBwritebraw);
3496 return;
3497 }
3498
3499 /* Return a SMBwritebraw message to the redirector to tell
3500 * it to send more bytes */
3501
3502 memcpy(buf, req->inbuf, smb_size);
3503 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3504 SCVAL(buf,smb_com,SMBwritebraw);
3505 SSVALS(buf,smb_vwv0,0xFFFF);
3506 show_msg(buf);
3507 if (!srv_send_smb(smbd_server_fd(),
3508 buf,
3509 IS_CONN_ENCRYPTED(conn))) {
3510 exit_server_cleanly("reply_writebraw: srv_send_smb "
3511 "failed.");
3512 }
3513
3514 /* Now read the raw data into the buffer and write it */
3515 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3516 &numtowrite);
3517 if (!NT_STATUS_IS_OK(status)) {
3518 exit_server_cleanly("secondary writebraw failed");
3519 }
3520
3521 /* Set up outbuf to return the correct size */
3522 reply_outbuf(req, 1, 0);
3523
3524 if (numtowrite != 0) {
3525
3526 if (numtowrite > 0xFFFF) {
3527 DEBUG(0,("reply_writebraw: Oversize secondary write "
3528 "raw requested (%u). Terminating\n",
3529 (unsigned int)numtowrite ));
3530 exit_server_cleanly("secondary writebraw failed");
3531 }
3532
3533 if (tcount > nwritten+numtowrite) {
3534 DEBUG(3,("reply_writebraw: Client overestimated the "
3535 "write %d %d %d\n",
3536 (int)tcount,(int)nwritten,(int)numtowrite));
3537 }
3538
3539 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3540
3541 if (!NT_STATUS_IS_OK(status)) {
3542 DEBUG(0,("reply_writebraw: Oversize secondary write "
3543 "raw read failed (%s). Terminating\n",
3544 nt_errstr(status)));
3545 exit_server_cleanly("secondary writebraw failed");
3546 }
3547
3548 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3549 if (nwritten == -1) {
3550 TALLOC_FREE(buf);
3551 reply_unixerror(req, ERRHRD, ERRdiskfull);
3552 error_to_writebrawerr(req);
3553 END_PROFILE(SMBwritebraw);
3554 return;
3555 }
3556
3557 if (nwritten < (ssize_t)numtowrite) {
3558 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3559 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3560 }
3561
3562 if (nwritten > 0) {
3563 total_written += nwritten;
3564 }
3565 }
3566
3567 TALLOC_FREE(buf);
3568 SSVAL(req->outbuf,smb_vwv0,total_written);
3569
3570 status = sync_file(conn, fsp, write_through);
3571 if (!NT_STATUS_IS_OK(status)) {
3572 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3573 fsp->fsp_name, nt_errstr(status) ));
3574 reply_nterror(req, status);
3575 error_to_writebrawerr(req);
3576 END_PROFILE(SMBwritebraw);
3577 return;
3578 }
3579
3580 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3581 "wrote=%d\n",
3582 fsp->fnum, (double)startpos, (int)numtowrite,
3583 (int)total_written));
3584
3585 /* We won't return a status if write through is not selected - this
3586 * follows what WfWg does */
3587 END_PROFILE(SMBwritebraw);
3588
3589 if (!write_through && total_written==tcount) {
3590
3591 #if RABBIT_PELLET_FIX
3592 /*
3593 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3594 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3595 * JRA.
3596 */
3597 if (!send_keepalive(smbd_server_fd())) {
3598 exit_server_cleanly("reply_writebraw: send of "
3599 "keepalive failed");
3600 }
3601 #endif
3602 TALLOC_FREE(req->outbuf);
3603 }
3604 return;
3605 }
3606
3607 #undef DBGC_CLASS
3608 #define DBGC_CLASS DBGC_LOCKING
3609
3610 /****************************************************************************
3611 Reply to a writeunlock (core+).
3612 ****************************************************************************/
3613
3614 void reply_writeunlock(struct smb_request *req)
3615 {
3616 connection_struct *conn = req->conn;
3617 ssize_t nwritten = -1;
3618 size_t numtowrite;
3619 SMB_OFF_T startpos;
3620 char *data;
3621 NTSTATUS status = NT_STATUS_OK;
3622 files_struct *fsp;
3623
3624 START_PROFILE(SMBwriteunlock);
3625
3626 if (req->wct < 5) {
3627 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3628 END_PROFILE(SMBwriteunlock);
3629 return;
3630 }
3631
3632 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3633
3634 if (!check_fsp(conn, req, fsp)) {
3635 END_PROFILE(SMBwriteunlock);
3636 return;
3637 }
3638
3639 if (!CHECK_WRITE(fsp)) {
3640 reply_doserror(req, ERRDOS,ERRbadaccess);
3641 END_PROFILE(SMBwriteunlock);
3642 return;
3643 }
3644
3645 numtowrite = SVAL(req->inbuf,smb_vwv1);
3646 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3647 data = smb_buf(req->inbuf) + 3;
3648
3649 if (numtowrite
3650 && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3651 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3652 reply_doserror(req, ERRDOS, ERRlock);
3653 END_PROFILE(SMBwriteunlock);
3654 return;
3655 }
3656
3657 /* The special X/Open SMB protocol handling of
3658 zero length writes is *NOT* done for
3659 this call */
3660 if(numtowrite == 0) {
3661 nwritten = 0;
3662 } else {
3663 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3664 }
3665
3666 status = sync_file(conn, fsp, False /* write through */);
3667 if (!NT_STATUS_IS_OK(status)) {
3668 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3669 fsp->fsp_name, nt_errstr(status) ));
3670 reply_nterror(req, status);
3671 END_PROFILE(SMBwriteunlock);
3672 return;
3673 }
3674
3675 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3676 reply_unixerror(req, ERRHRD, ERRdiskfull);
3677 END_PROFILE(SMBwriteunlock);
3678 return;
3679 }
3680
3681 if (numtowrite) {
3682 status = do_unlock(smbd_messaging_context(),
3683 fsp,
3684 req->smbpid,
3685 (SMB_BIG_UINT)numtowrite,
3686 (SMB_BIG_UINT)startpos,
3687 WINDOWS_LOCK);
3688
3689 if (NT_STATUS_V(status)) {
3690 reply_nterror(req, status);
3691 END_PROFILE(SMBwriteunlock);
3692 return;
3693 }
3694 }
3695
3696 reply_outbuf(req, 1, 0);
3697
3698 SSVAL(req->outbuf,smb_vwv0,nwritten);
3699
3700 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3701 fsp->fnum, (int)numtowrite, (int)nwritten));
3702
3703 END_PROFILE(SMBwriteunlock);
3704 return;
3705 }
3706
3707 #undef DBGC_CLASS
3708 #define DBGC_CLASS DBGC_ALL
3709
3710 /****************************************************************************
3711 Reply to a write.
3712 ****************************************************************************/
3713
3714 void reply_write(struct smb_request *req)
3715 {
3716 connection_struct *conn = req->conn;
3717 size_t numtowrite;
3718 ssize_t nwritten = -1;
3719 SMB_OFF_T startpos;
3720 char *data;
3721 files_struct *fsp;
3722 NTSTATUS status;
3723
3724 START_PROFILE(SMBwrite);
3725
3726 if (req->wct < 5) {
3727 END_PROFILE(SMBwrite);
3728 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3729 return;
3730 }
3731
3732 /* If it's an IPC, pass off the pipe handler. */
3733 if (IS_IPC(conn)) {
3734 reply_pipe_write(req);
3735 END_PROFILE(SMBwrite);
3736 return;
3737 }
3738
3739 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3740
3741 if (!check_fsp(conn, req, fsp)) {
3742 END_PROFILE(SMBwrite);
3743 return;
3744 }
3745
3746 if (!CHECK_WRITE(fsp)) {
3747 reply_doserror(req, ERRDOS, ERRbadaccess);
3748 END_PROFILE(SMBwrite);
3749 return;
3750 }
3751
3752 numtowrite = SVAL(req->inbuf,smb_vwv1);
3753 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3754 data = smb_buf(req->inbuf) + 3;
3755
3756 if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3757 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3758 reply_doserror(req, ERRDOS, ERRlock);
3759 END_PROFILE(SMBwrite);
3760 return;
3761 }
3762
3763 /*
3764 * X/Open SMB protocol says that if smb_vwv1 is
3765 * zero then the file size should be extended or
3766 * truncated to the size given in smb_vwv[2-3].
3767 */
3768
3769 if(numtowrite == 0) {
3770 /*
3771 * This is actually an allocate call, and set EOF. JRA.
3772 */
3773 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3774 if (nwritten < 0) {
3775 reply_nterror(req, NT_STATUS_DISK_FULL);
3776 END_PROFILE(SMBwrite);
3777 return;
3778 }
3779 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3780 if (nwritten < 0) {
3781 reply_nterror(req, NT_STATUS_DISK_FULL);
3782 END_PROFILE(SMBwrite);
3783 return;
3784 }
3785 } else
3786 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3787
3788 status = sync_file(conn, fsp, False);
3789 if (!NT_STATUS_IS_OK(status)) {
3790 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3791 fsp->fsp_name, nt_errstr(status) ));
3792 reply_nterror(req, status);
3793 END_PROFILE(SMBwrite);
3794 return;
3795 }
3796
3797 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3798 reply_unixerror(req, ERRHRD, ERRdiskfull);
3799 END_PROFILE(SMBwrite);
3800 return;
3801 }
3802
3803 reply_outbuf(req, 1, 0);
3804
3805 SSVAL(req->outbuf,smb_vwv0,nwritten);
3806
3807 if (nwritten < (ssize_t)numtowrite) {
3808 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3809 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3810 }
3811
3812 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3813
3814 END_PROFILE(SMBwrite);
3815 return;
3816 }
3817
3818 /****************************************************************************
3819 Ensure a buffer is a valid writeX for recvfile purposes.
3820 ****************************************************************************/
3821
3822 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3823 (2*14) + /* word count (including bcc) */ \
3824 1 /* pad byte */)
3825
3826 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3827 {
3828 size_t numtowrite;
3829 connection_struct *conn = NULL;
3830 unsigned int doff = 0;
3831 size_t len = smb_len_large(inbuf);
3832
3833 if (is_encrypted_packet(inbuf)) {
3834 /* Can't do this on encrypted
3835 * connections. */
3836 return false;
3837 }
3838
3839 if (CVAL(inbuf,smb_com) != SMBwriteX) {
3840 return false;
3841 }
3842
3843 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3844 CVAL(inbuf,smb_wct) != 14) {
3845 DEBUG(10,("is_valid_writeX_buffer: chained or "
3846 "invalid word length.\n"));
3847 return false;
3848 }
3849
3850 conn = conn_find(SVAL(inbuf, smb_tid));
3851 if (conn == NULL) {
3852 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3853 return false;
3854 }
3855 if (IS_IPC(conn)) {
3856 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3857 return false;
3858 }
3859 doff = SVAL(inbuf,smb_vwv11);
3860
3861 numtowrite = SVAL(inbuf,smb_vwv10);
3862
3863 if (len > doff && len - doff > 0xFFFF) {
3864 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3865 }
3866
3867 if (numtowrite == 0) {
3868 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3869 return false;
3870 }
3871
3872 /* Ensure the sizes match up. */
3873 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3874 /* no pad byte...old smbclient :-( */
3875 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3876 (unsigned int)doff,
3877 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3878 return false;
3879 }
3880
3881 if (len - doff != numtowrite) {
3882 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3883 "len = %u, doff = %u, numtowrite = %u\n",
3884 (unsigned int)len,
3885 (unsigned int)doff,
3886 (unsigned int)numtowrite ));
3887 return false;
3888 }
3889
3890 DEBUG(10,("is_valid_writeX_buffer: true "
3891 "len = %u, doff = %u, numtowrite = %u\n",
3892 (unsigned int)len,
3893 (unsigned int)doff,
3894 (unsigned int)numtowrite ));
3895
3896 return true;
3897 }
3898
3899 /****************************************************************************
3900 Reply to a write and X.
3901 ****************************************************************************/
3902
3903 void reply_write_and_X(struct smb_request *req)
3904 {
3905 connection_struct *conn = req->conn;
3906 files_struct *fsp;
3907 SMB_OFF_T startpos;
3908 size_t numtowrite;
3909 bool write_through;
3910 ssize_t nwritten;
3911 unsigned int smb_doff;
3912 unsigned int smblen;
3913 char *data;
3914 NTSTATUS status;
3915
3916 START_PROFILE(SMBwriteX);
3917
3918 if ((req->wct != 12) && (req->wct != 14)) {
3919 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3920 END_PROFILE(SMBwriteX);
3921 return;
3922 }
3923
3924 numtowrite = SVAL(req->inbuf,smb_vwv10);
3925 smb_doff = SVAL(req->inbuf,smb_vwv11);
3926 smblen = smb_len(req->inbuf);
3927
3928 if (req->unread_bytes > 0xFFFF ||
3929 (smblen > smb_doff &&
3930 smblen - smb_doff > 0xFFFF)) {
3931 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
3932 }
3933
3934 if (req->unread_bytes) {
3935 /* Can't do a recvfile write on IPC$ */
3936 if (IS_IPC(conn)) {
3937 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3938 END_PROFILE(SMBwriteX);
3939 return;
3940 }
3941 if (numtowrite != req->unread_bytes) {
3942 reply_doserror(req, ERRDOS, ERRbadmem);
3943 END_PROFILE(SMBwriteX);
3944 return;
3945 }
3946 } else {
3947 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
3948 smb_doff + numtowrite > smblen) {
3949 reply_doserror(req, ERRDOS, ERRbadmem);
3950 END_PROFILE(SMBwriteX);
3951 return;
3952 }
3953 }
3954
3955 /* If it's an IPC, pass off the pipe handler. */
3956 if (IS_IPC(conn)) {
3957 if (req->unread_bytes) {
3958 reply_doserror(req, ERRDOS, ERRbadmem);
3959 END_PROFILE(SMBwriteX);
3960 return;
3961 }
3962 reply_pipe_write_and_X(req);
3963 END_PROFILE(SMBwriteX);
3964 return;
3965 }
3966
3967 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3968 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3969 write_through = BITSETW(req->inbuf+smb_vwv7,0);
3970
3971 if (!check_fsp(conn, req, fsp)) {
3972 END_PROFILE(SMBwriteX);
3973 return;
3974 }
3975
3976 if (!CHECK_WRITE(fsp)) {
3977 reply_doserror(req, ERRDOS, ERRbadaccess);
3978 END_PROFILE(SMBwriteX);
3979 return;
3980 }
3981
3982 data = smb_base(req->inbuf) + smb_doff;
3983
3984 if(req->wct == 14) {
3985 #ifdef LARGE_SMB_OFF_T
3986 /*
3987 * This is a large offset (64 bit) write.
3988 */
3989 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
3990
3991 #else /* !LARGE_SMB_OFF_T */
3992
3993 /*
3994 * Ensure we haven't been sent a >32 bit offset.
3995 */
3996
3997 if(IVAL(req->inbuf,smb_vwv12) != 0) {
3998 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
3999 "used and we don't support 64 bit offsets.\n",
4000 (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
4001 reply_doserror(req, ERRDOS, ERRbadaccess);
4002 END_PROFILE(SMBwriteX);
4003 return;
4004 }
4005
4006 #endif /* LARGE_SMB_OFF_T */
4007 }
4008
4009 if (is_locked(fsp,(uint32)req->smbpid,
4010 (SMB_BIG_UINT)numtowrite,
4011 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4012 reply_doserror(req, ERRDOS, ERRlock);
4013 END_PROFILE(SMBwriteX);
4014 return;
4015 }
4016
4017 /* X/Open SMB protocol says that, unlike SMBwrite
4018 if the length is zero then NO truncation is
4019 done, just a write of zero. To truncate a file,
4020 use SMBwrite. */
4021
4022 if(numtowrite == 0) {
4023 nwritten = 0;
4024 } else {
4025
4026 if ((req->unread_bytes == 0) &&
4027 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4028 numtowrite)) {
4029 END_PROFILE(SMBwriteX);
4030 return;
4031 }
4032
4033 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4034 }
4035
4036 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4037 reply_unixerror(req, ERRHRD, ERRdiskfull);
4038 END_PROFILE(SMBwriteX);
4039 return;
4040 }
4041
4042 reply_outbuf(req, 6, 0);
4043 SSVAL(req->outbuf,smb_vwv2,nwritten);
4044 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4045
4046 if (nwritten < (ssize_t)numtowrite) {
4047 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4048 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4049 }
4050
4051 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4052 fsp->fnum, (int)numtowrite, (int)nwritten));
4053
4054 status = sync_file(conn, fsp, write_through);
4055 if (!NT_STATUS_IS_OK(status)) {
4056 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4057 fsp->fsp_name, nt_errstr(status) ));
4058 reply_nterror(req, status);
4059 END_PROFILE(SMBwriteX);
4060 return;
4061 }
4062
4063 END_PROFILE(SMBwriteX);
4064 chain_reply(req);
4065 return;
4066 }
4067
4068 /****************************************************************************
4069 Reply to a lseek.
4070 ****************************************************************************/
4071
4072 void reply_lseek(struct smb_request *req)
4073 {
4074 connection_struct *conn = req->conn;
4075 SMB_OFF_T startpos;
4076 SMB_OFF_T res= -1;
4077 int mode,umode;
4078 files_struct *fsp;
4079
4080 START_PROFILE(SMBlseek);
4081
4082 if (req->wct < 4) {
4083 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4084 END_PROFILE(SMBlseek);
4085 return;
4086 }
4087
4088 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4089
4090 if (!check_fsp(conn, req, fsp)) {
4091 return;
4092 }
4093
4094 flush_write_cache(fsp, SEEK_FLUSH);
4095
4096 mode = SVAL(req->inbuf,smb_vwv1) & 3;
4097 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4098 startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4099
4100 switch (mode) {
4101 case 0:
4102 umode = SEEK_SET;
4103 res = startpos;
4104 break;
4105 case 1:
4106 umode = SEEK_CUR;
4107 res = fsp->fh->pos + startpos;
4108 break;
4109 case 2:
4110 umode = SEEK_END;
4111 break;
4112 default:
4113 umode = SEEK_SET;
4114 res = startpos;
4115 break;
4116 }
4117
4118 if (umode == SEEK_END) {
4119 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4120 if(errno == EINVAL) {
4121 SMB_OFF_T current_pos = startpos;
4122 SMB_STRUCT_STAT sbuf;
4123
4124 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4125 reply_unixerror(req, ERRDOS,
4126 ERRnoaccess);
4127 END_PROFILE(SMBlseek);
4128 return;
4129 }
4130
4131 current_pos += sbuf.st_size;
4132 if(current_pos < 0)
4133 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4134 }
4135 }
4136
4137 if(res == -1) {
4138 reply_unixerror(req, ERRDOS, ERRnoaccess);
4139 END_PROFILE(SMBlseek);
4140 return;
4141 }
4142 }
4143
4144 fsp->fh->pos = res;
4145
4146 reply_outbuf(req, 2, 0);
4147 SIVAL(req->outbuf,smb_vwv0,res);
4148
4149 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4150 fsp->fnum, (double)startpos, (double)res, mode));
4151
4152 END_PROFILE(SMBlseek);
4153 return;
4154 }
4155
4156 /****************************************************************************
4157 Reply to a flush.
4158 ****************************************************************************/
4159
4160 void reply_flush(struct smb_request *req)
4161 {
4162 connection_struct *conn = req->conn;
4163 uint16 fnum;
4164 files_struct *fsp;
4165
4166 START_PROFILE(SMBflush);
4167
4168 if (req->wct < 1) {
4169 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4170 return;
4171 }
4172
4173 fnum = SVAL(req->inbuf,smb_vwv0);
4174 fsp = file_fsp(fnum);
4175
4176 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4177 return;
4178 }
4179
4180 if (!fsp) {
4181 file_sync_all(conn);
4182 } else {
4183 NTSTATUS status = sync_file(conn, fsp, True);
4184 if (!NT_STATUS_IS_OK(status)) {
4185 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4186 fsp->fsp_name, nt_errstr(status) ));
4187 reply_nterror(req, status);
4188 END_PROFILE(SMBflush);
4189 return;
4190 }
4191 }
4192
4193 reply_outbuf(req, 0, 0);
4194
4195 DEBUG(3,("flush\n"));
4196 END_PROFILE(SMBflush);
4197 return;
4198 }
4199
4200 /****************************************************************************
4201 Reply to a exit.
4202 conn POINTER CAN BE NULL HERE !
4203 ****************************************************************************/
4204
4205 void reply_exit(struct smb_request *req)
4206 {
4207 START_PROFILE(SMBexit);
4208
4209 file_close_pid(req->smbpid, req->vuid);
4210
4211 reply_outbuf(req, 0, 0);
4212
4213 DEBUG(3,("exit\n"));
4214
4215 END_PROFILE(SMBexit);
4216 return;
4217 }
4218
4219 /****************************************************************************
4220 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4221 ****************************************************************************/
4222
4223 void reply_close(struct smb_request *req)
4224 {
4225 connection_struct *conn = req->conn;
4226 NTSTATUS status = NT_STATUS_OK;
4227 files_struct *fsp = NULL;
4228 START_PROFILE(SMBclose);
4229
4230 if (req->wct < 3) {
4231 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4232 END_PROFILE(SMBclose);
4233 return;
4234 }
4235
4236 /* If it's an IPC, pass off to the pipe handler. */
4237 if (IS_IPC(conn)) {
4238 reply_pipe_close(conn, req);
4239 END_PROFILE(SMBclose);
4240 return;
4241 }
4242
4243 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4244
4245 /*
4246 * We can only use CHECK_FSP if we know it's not a directory.
4247 */
4248
4249 if(!fsp || (fsp->conn != conn) || (fsp->vuid != current_user.vuid)) {
4250 reply_doserror(req, ERRDOS, ERRbadfid);
4251 END_PROFILE(SMBclose);
4252 return;
4253 }
4254
4255 if(fsp->is_directory) {
4256 /*
4257 * Special case - close NT SMB directory handle.
4258 */
4259 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4260 status = close_file(fsp,NORMAL_CLOSE);
4261 } else {
4262 time_t t;
4263 /*
4264 * Close ordinary file.
4265 */
4266
4267 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4268 fsp->fh->fd, fsp->fnum,
4269 conn->num_files_open));
4270
4271 /*
4272 * Take care of any time sent in the close.
4273 */
4274
4275 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4276 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4277
4278 /*
4279 * close_file() returns the unix errno if an error
4280 * was detected on close - normally this is due to
4281 * a disk full error. If not then it was probably an I/O error.
4282 */
4283
4284 status = close_file(fsp,NORMAL_CLOSE);
4285 }
4286
4287 if (!NT_STATUS_IS_OK(status)) {
4288 reply_nterror(req, status);
4289 END_PROFILE(SMBclose);
4290 return;
4291 }
4292
4293 reply_outbuf(req, 0, 0);
4294 END_PROFILE(SMBclose);
4295 return;
4296 }
4297
4298 /****************************************************************************
4299 Reply to a writeclose (Core+ protocol).
4300 ****************************************************************************/
4301
4302 void reply_writeclose(struct smb_request *req)
4303 {
4304 connection_struct *conn = req->conn;
4305 size_t numtowrite;
4306 ssize_t nwritten = -1;
4307 NTSTATUS close_status = NT_STATUS_OK;
4308 SMB_OFF_T startpos;
4309 char *data;
4310 struct timespec mtime;
4311 files_struct *fsp;
4312
4313 START_PROFILE(SMBwriteclose);
4314
4315 if (req->wct < 6) {
4316 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4317 END_PROFILE(SMBwriteclose);
4318 return;
4319 }
4320
4321 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4322
4323 if (!check_fsp(conn, req, fsp)) {
4324 END_PROFILE(SMBwriteclose);
4325 return;
4326 }
4327 if (!CHECK_WRITE(fsp)) {
4328 reply_doserror(req, ERRDOS,ERRbadaccess);
4329 END_PROFILE(SMBwriteclose);
4330 return;
4331 }
4332
4333 numtowrite = SVAL(req->inbuf,smb_vwv1);
4334 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4335 mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4336 req->inbuf+smb_vwv4));
4337 data = smb_buf(req->inbuf) + 1;
4338
4339 if (numtowrite
4340 && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
4341 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4342 reply_doserror(req, ERRDOS,ERRlock);
4343 END_PROFILE(SMBwriteclose);
4344 return;
4345 }
4346
4347 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4348
4349 set_close_write_time(fsp, mtime);
4350
4351 /*
4352 * More insanity. W2K only closes the file if writelen > 0.
4353 * JRA.
4354 */
4355
4356 if (numtowrite) {
4357 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4358 fsp->fsp_name ));
4359 close_status = close_file(fsp,NORMAL_CLOSE);
4360 }
4361
4362 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4363 fsp->fnum, (int)numtowrite, (int)nwritten,
4364 conn->num_files_open));
4365
4366 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4367 reply_doserror(req, ERRHRD, ERRdiskfull);
4368 END_PROFILE(SMBwriteclose);
4369 return;
4370 }
4371
4372 if(!NT_STATUS_IS_OK(close_status)) {
4373 reply_nterror(req, close_status);
4374 END_PROFILE(SMBwriteclose);
4375 return;
4376 }
4377
4378 reply_outbuf(req, 1, 0);
4379
4380 SSVAL(req->outbuf,smb_vwv0,nwritten);
4381 END_PROFILE(SMBwriteclose);
4382 return;
4383 }
4384
4385 #undef DBGC_CLASS
4386 #define DBGC_CLASS DBGC_LOCKING
4387
4388 /****************************************************************************
4389 Reply to a lock.
4390 ****************************************************************************/
4391
4392 void reply_lock(struct smb_request *req)
4393 {
4394 connection_struct *conn = req->conn;
4395 SMB_BIG_UINT count,offset;
4396 NTSTATUS status;
4397 files_struct *fsp;
4398 struct byte_range_lock *br_lck = NULL;
4399
4400 START_PROFILE(SMBlock);
4401
4402 if (req->wct < 5) {
4403 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4404 END_PROFILE(SMBlock);
4405 return;
4406 }
4407
4408 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4409
4410 if (!check_fsp(conn, req, fsp)) {
4411 END_PROFILE(SMBlock);
4412 return;
4413 }
4414
4415 release_level_2_oplocks_on_change(fsp);
4416
4417 count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4418 offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4419
4420 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4421 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4422
4423 br_lck = do_lock(smbd_messaging_context(),
4424 fsp,
4425 req->smbpid,
4426 count,
4427 offset,
4428 WRITE_LOCK,
4429 WINDOWS_LOCK,
4430 False, /* Non-blocking lock. */
4431 &status,
4432 NULL);
4433
4434 TALLOC_FREE(br_lck);
4435
4436 if (NT_STATUS_V(status)) {
4437 reply_nterror(req, status);
4438 END_PROFILE(SMBlock);
4439 return;
4440 }
4441
4442 reply_outbuf(req, 0, 0);
4443
4444 END_PROFILE(SMBlock);
4445 return;
4446 }
4447
4448 /****************************************************************************
4449 Reply to a unlock.
4450 ****************************************************************************/
4451
4452 void reply_unlock(struct smb_request *req)
4453 {
4454 connection_struct *conn = req->conn;
4455 SMB_BIG_UINT count,offset;
4456 NTSTATUS status;
4457 files_struct *fsp;
4458
4459 START_PROFILE(SMBunlock);
4460
4461 if (req->wct < 5) {
4462 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4463 END_PROFILE(SMBunlock);
4464 return;
4465 }
4466
4467 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4468
4469 if (!check_fsp(conn, req, fsp)) {
4470 END_PROFILE(SMBunlock);
4471 return;
4472 }
4473
4474 count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4475 offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4476
4477 status = do_unlock(smbd_messaging_context(),
4478 fsp,
4479 req->smbpid,
4480 count,
4481 offset,
4482 WINDOWS_LOCK);
4483
4484 if (NT_STATUS_V(status)) {
4485 reply_nterror(req, status);
4486 END_PROFILE(SMBunlock);
4487 return;
4488 }
4489
4490 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4491 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4492
4493 reply_outbuf(req, 0, 0);
4494
4495 END_PROFILE(SMBunlock);
4496 return;
4497 }
4498
4499 #undef DBGC_CLASS
4500 #define DBGC_CLASS DBGC_ALL
4501
4502 /****************************************************************************
4503 Reply to a tdis.
4504 conn POINTER CAN BE NULL HERE !
4505 ****************************************************************************/
4506
4507 void reply_tdis(struct smb_request *req)
4508 {
4509 connection_struct *conn = req->conn;
4510 START_PROFILE(SMBtdis);
4511
4512 if (!conn) {
4513 DEBUG(4,("Invalid connection in tdis\n"));
4514 reply_doserror(req, ERRSRV, ERRinvnid);
4515 END_PROFILE(SMBtdis);
4516 return;
4517 }
4518
4519 conn->used = False;
4520
4521 close_cnum(conn,req->vuid);
4522 req->conn = NULL;
4523
4524 reply_outbuf(req, 0, 0);
4525 END_PROFILE(SMBtdis);
4526 return;
4527 }
4528
4529 /****************************************************************************
4530 Reply to a echo.
4531 conn POINTER CAN BE NULL HERE !
4532 ****************************************************************************/
4533
4534 void reply_echo(struct smb_request *req)
4535 {
4536 connection_struct *conn = req->conn;
4537 int smb_reverb;
4538 int seq_num;
4539 unsigned int data_len = smb_buflen(req->inbuf);
4540
4541 START_PROFILE(SMBecho);
4542
4543 if (req->wct < 1) {
4544 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4545 END_PROFILE(SMBecho);
4546 return;
4547 }
4548
4549 if (data_len > BUFFER_SIZE) {
4550 DEBUG(0,("reply_echo: data_len too large.\n"));
4551 reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
4552 END_PROFILE(SMBecho);
4553 return;
4554 }
4555
4556 smb_reverb = SVAL(req->inbuf,smb_vwv0);
4557
4558 reply_outbuf(req, 1, data_len);
4559
4560 /* copy any incoming data back out */
4561 if (data_len > 0) {
4562 memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
4563 }
4564
4565 if (smb_reverb > 100) {
4566 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4567 smb_reverb = 100;
4568 }
4569
4570 for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4571 SSVAL(req->outbuf,smb_vwv0,seq_num);
4572
4573 show_msg((char *)req->outbuf);
4574 if (!srv_send_smb(smbd_server_fd(),
4575 (char *)req->outbuf,
4576 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4577 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4578 }
4579
4580 DEBUG(3,("echo %d times\n", smb_reverb));
4581
4582 TALLOC_FREE(req->outbuf);
4583
4584 smb_echo_count++;
4585
4586 END_PROFILE(SMBecho);
4587 return;
4588 }
4589
4590 /****************************************************************************
4591 Reply to a printopen.
4592 ****************************************************************************/
4593
4594 void reply_printopen(struct smb_request *req)
4595 {
4596 connection_struct *conn = req->conn;
4597 files_struct *fsp;
4598 NTSTATUS status;
4599
4600 START_PROFILE(SMBsplopen);
4601
4602 if (req->wct < 2) {
4603 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4604 END_PROFILE(SMBsplopen);
4605 return;
4606 }
4607
4608 if (!CAN_PRINT(conn)) {
4609 reply_doserror(req, ERRDOS, ERRnoaccess);
4610 END_PROFILE(SMBsplopen);
4611 return;
4612 }
4613
4614 /* Open for exclusive use, write only. */
4615 status = print_fsp_open(conn, NULL, &fsp);
4616
4617 if (!NT_STATUS_IS_OK(status)) {
4618 reply_nterror(req, status);
4619 END_PROFILE(SMBsplopen);
4620 return;
4621 }
4622
4623 reply_outbuf(req, 1, 0);
4624 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4625
4626 DEBUG(3,("openprint fd=%d fnum=%d\n",
4627 fsp->fh->fd, fsp->fnum));
4628
4629 END_PROFILE(SMBsplopen);
4630 return;
4631 }
4632
4633 /****************************************************************************
4634 Reply to a printclose.
4635 ****************************************************************************/
4636
4637 void reply_printclose(struct smb_request *req)
4638 {
4639 connection_struct *conn = req->conn;
4640 files_struct *fsp;
4641 NTSTATUS status;
4642
4643 START_PROFILE(SMBsplclose);
4644
4645 if (req->wct < 1) {
4646 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4647 END_PROFILE(SMBsplclose);
4648 return;
4649 }
4650
4651 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4652
4653 if (!check_fsp(conn, req, fsp)) {
4654 END_PROFILE(SMBsplclose);
4655 return;
4656 }
4657
4658 if (!CAN_PRINT(conn)) {
4659 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4660 END_PROFILE(SMBsplclose);
4661 return;
4662 }
4663
4664 DEBUG(3,("printclose fd=%d fnum=%d\n",
4665 fsp->fh->fd,fsp->fnum));
4666
4667 status = close_file(fsp,NORMAL_CLOSE);
4668
4669 if(!NT_STATUS_IS_OK(status)) {
4670 reply_nterror(req, status);
4671 END_PROFILE(SMBsplclose);
4672 return;
4673 }
4674
4675 END_PROFILE(SMBsplclose);
4676 return;
4677 }
4678
4679 /****************************************************************************
4680 Reply to a printqueue.
4681 ****************************************************************************/
4682
4683 void reply_printqueue(struct smb_request *req)
4684 {
4685 connection_struct *conn = req->conn;
4686 int max_count;
4687 int start_index;
4688
4689 START_PROFILE(SMBsplretq);
4690
4691 if (req->wct < 2) {
4692 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4693 END_PROFILE(SMBsplretq);
4694 return;
4695 }
4696
4697 max_count = SVAL(req->inbuf,smb_vwv0);
4698 start_index = SVAL(req->inbuf,smb_vwv1);
4699
4700 /* we used to allow the client to get the cnum wrong, but that
4701 is really quite gross and only worked when there was only
4702 one printer - I think we should now only accept it if they
4703 get it right (tridge) */
4704 if (!CAN_PRINT(conn)) {
4705 reply_doserror(req, ERRDOS, ERRnoaccess);
4706 END_PROFILE(SMBsplretq);
4707 return;
4708 }
4709
4710 reply_outbuf(req, 2, 3);
4711 SSVAL(req->outbuf,smb_vwv0,0);
4712 SSVAL(req->outbuf,smb_vwv1,0);
4713 SCVAL(smb_buf(req->outbuf),0,1);
4714 SSVAL(smb_buf(req->outbuf),1,0);
4715
4716 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4717 start_index, max_count));
4718
4719 {
4720 print_queue_struct *queue = NULL;
4721 print_status_struct status;
4722 int count = print_queue_status(SNUM(conn), &queue, &status);
4723 int num_to_get = ABS(max_count);
4724 int first = (max_count>0?start_index:start_index+max_count+1);
4725 int i;
4726
4727 if (first >= count)
4728 num_to_get = 0;
4729 else
4730 num_to_get = MIN(num_to_get,count-first);
4731
4732
4733 for (i=first;i<first+num_to_get;i++) {
4734 char blob[28];
4735 char *p = blob;
4736
4737 srv_put_dos_date2(p,0,queue[i].time);
4738 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4739 SSVAL(p,5, queue[i].job);
4740 SIVAL(p,7,queue[i].size);
4741 SCVAL(p,11,0);
4742 srvstr_push(blob, req->flags2, p+12,
4743 queue[i].fs_user, 16, STR_ASCII);
4744
4745 if (message_push_blob(
4746 &req->outbuf,
4747 data_blob_const(
4748 blob, sizeof(blob))) == -1) {
4749 reply_nterror(req, NT_STATUS_NO_MEMORY);
4750 END_PROFILE(SMBsplretq);
4751 return;
4752 }
4753 }
4754
4755 if (count > 0) {
4756 SSVAL(req->outbuf,smb_vwv0,count);
4757 SSVAL(req->outbuf,smb_vwv1,
4758 (max_count>0?first+count:first-1));
4759 SCVAL(smb_buf(req->outbuf),0,1);
4760 SSVAL(smb_buf(req->outbuf),1,28*count);
4761 }
4762
4763 SAFE_FREE(queue);
4764
4765 DEBUG(3,("%d entries returned in queue\n",count));
4766 }
4767
4768 END_PROFILE(SMBsplretq);
4769 return;
4770 }
4771
4772 /****************************************************************************
4773 Reply to a printwrite.
4774 ****************************************************************************/
4775
4776 void reply_printwrite(struct smb_request *req)
4777 {
4778 connection_struct *conn = req->conn;
4779 int numtowrite;
4780 char *data;
4781 files_struct *fsp;
4782
4783 START_PROFILE(SMBsplwr);
4784
4785 if (req->wct < 1) {
4786 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4787 END_PROFILE(SMBsplwr);
4788 return;
4789 }
4790
4791 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4792
4793 if (!check_fsp(conn, req, fsp)) {
4794 END_PROFILE(SMBsplwr);
4795 return;
4796 }
4797
4798 if (!CAN_PRINT(conn)) {
4799 reply_doserror(req, ERRDOS, ERRnoaccess);
4800 END_PROFILE(SMBsplwr);
4801 return;
4802 }
4803
4804 if (!CHECK_WRITE(fsp)) {
4805 reply_doserror(req, ERRDOS, ERRbadaccess);
4806 END_PROFILE(SMBsplwr);
4807 return;
4808 }
4809
4810 numtowrite = SVAL(smb_buf(req->inbuf),1);
4811
4812 if (smb_buflen(req->inbuf) < numtowrite + 3) {
4813 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4814 END_PROFILE(SMBsplwr);
4815 return;
4816 }
4817
4818 data = smb_buf(req->inbuf) + 3;
4819
4820 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4821 reply_unixerror(req, ERRHRD, ERRdiskfull);
4822 END_PROFILE(SMBsplwr);
4823 return;
4824 }
4825
4826 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4827
4828 END_PROFILE(SMBsplwr);
4829 return;
4830 }
4831
4832 /****************************************************************************
4833 Reply to a mkdir.
4834 ****************************************************************************/
4835
4836 void reply_mkdir(struct smb_request *req)
4837 {
4838 connection_struct *conn = req->conn;
4839 char *directory = NULL;
4840 NTSTATUS status;
4841 SMB_STRUCT_STAT sbuf;
4842 TALLOC_CTX *ctx = talloc_tos();
4843
4844 START_PROFILE(SMBmkdir);
4845
4846 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4847 smb_buf(req->inbuf) + 1, 0,
4848 STR_TERMINATE, &status);
4849 if (!NT_STATUS_IS_OK(status)) {
4850 reply_nterror(req, status);
4851 END_PROFILE(SMBmkdir);
4852 return;
4853 }
4854
4855 status = resolve_dfspath(ctx, conn,
4856 req->flags2 & FLAGS2_DFS_PATHNAMES,
4857 directory,
4858 &directory);
4859 if (!NT_STATUS_IS_OK(status)) {
4860 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4861 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4862 ERRSRV, ERRbadpath);
4863 END_PROFILE(SMBmkdir);
4864 return;
4865 }
4866 reply_nterror(req, status);
4867 END_PROFILE(SMBmkdir);
4868 return;
4869 }
4870
4871 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4872 if (!NT_STATUS_IS_OK(status)) {
4873 reply_nterror(req, status);
4874 END_PROFILE(SMBmkdir);
4875 return;
4876 }
4877
4878 status = check_name(conn, directory);
4879 if (!NT_STATUS_IS_OK(status)) {
4880 reply_nterror(req, status);
4881 END_PROFILE(SMBmkdir);
4882 return;
4883 }
4884
4885 status = create_directory(conn, req, directory);
4886
4887 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4888
4889 if (!NT_STATUS_IS_OK(status)) {
4890
4891 if (!use_nt_status()
4892 && NT_STATUS_EQUAL(status,
4893 NT_STATUS_OBJECT_NAME_COLLISION)) {
4894 /*
4895 * Yes, in the DOS error code case we get a
4896 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4897 * samba4 torture test.
4898 */
4899 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4900 }
4901
4902 reply_nterror(req, status);
4903 END_PROFILE(SMBmkdir);
4904 return;
4905 }
4906
4907 reply_outbuf(req, 0, 0);
4908
4909 DEBUG( 3, ( "mkdir %s\n", directory ) );
4910
4911 END_PROFILE(SMBmkdir);
4912 return;
4913 }
4914
4915 /****************************************************************************
4916 Static function used by reply_rmdir to delete an entire directory
4917 tree recursively. Return True on ok, False on fail.
4918 ****************************************************************************/
4919
4920 static bool recursive_rmdir(TALLOC_CTX *ctx,
4921 connection_struct *conn,
4922 char *directory)
4923 {
4924 const char *dname = NULL;
4925 bool ret = True;
4926 long offset = 0;
4927 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
4928 NULL, 0);
4929
4930 if(dir_hnd == NULL)
4931 return False;
4932
4933 while((dname = ReadDirName(dir_hnd, &offset))) {
4934 char *fullname = NULL;
4935 SMB_STRUCT_STAT st;
4936
4937 if (ISDOT(dname) || ISDOTDOT(dname)) {
4938 continue;
4939 }
4940
4941 if (!is_visible_file(conn, directory, dname, &st, False)) {
4942 continue;
4943 }
4944
4945 /* Construct the full name. */
4946 fullname = talloc_asprintf(ctx,
4947 "%s/%s",
4948 directory,
4949 dname);
4950 if (!fullname) {
4951 errno = ENOMEM;
4952 ret = False;
4953 break;
4954 }
4955
4956 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
4957 ret = False;
4958 break;
4959 }
4960
4961 if(st.st_mode & S_IFDIR) {
4962 if(!recursive_rmdir(ctx, conn, fullname)) {
4963 ret = False;
4964 break;
4965 }
4966 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
4967 ret = False;
4968 break;
4969 }
4970 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
4971 ret = False;
4972 break;
4973 }
4974 TALLOC_FREE(fullname);
4975 }
4976 TALLOC_FREE(dir_hnd);
4977 return ret;
4978 }
4979
4980 /****************************************************************************
4981 The internals of the rmdir code - called elsewhere.
4982 ****************************************************************************/
4983
4984 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
4985 connection_struct *conn,
4986 const char *directory)
4987 {
4988 int ret;
4989 SMB_STRUCT_STAT st;
4990
4991 /* Might be a symlink. */
4992 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
4993 return map_nt_error_from_unix(errno);
4994 }
4995
4996 if (S_ISLNK(st.st_mode)) {
4997 /* Is what it points to a directory ? */
4998 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
4999 return map_nt_error_from_unix(errno);
5000 }
5001 if (!(S_ISDIR(st.st_mode))) {
5002 return NT_STATUS_NOT_A_DIRECTORY;
5003 }
5004 ret = SMB_VFS_UNLINK(conn,directory);
5005 } else {
5006 ret = SMB_VFS_RMDIR(conn,directory);
5007 }
5008 if (ret == 0) {
5009 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5010 FILE_NOTIFY_CHANGE_DIR_NAME,
5011 directory);
5012 return NT_STATUS_OK;
5013 }
5014
5015 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5016 /*
5017 * Check to see if the only thing in this directory are
5018 * vetoed files/directories. If so then delete them and
5019 * retry. If we fail to delete any of them (and we *don't*
5020 * do a recursive delete) then fail the rmdir.
5021 */
5022 const char *dname;
5023 long dirpos = 0;
5024 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5025 directory, NULL, 0);
5026
5027 if(dir_hnd == NULL) {
5028 errno = ENOTEMPTY;
5029 goto err;
5030 }
5031
5032 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5033 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5034 continue;
5035 if (!is_visible_file(conn, directory, dname, &st, False))
5036 continue;
5037 if(!IS_VETO_PATH(conn, dname)) {
5038 TALLOC_FREE(dir_hnd);
5039 errno = ENOTEMPTY;
5040 goto err;
5041 }
5042 }
5043
5044 /* We only have veto files/directories. Recursive delete. */
5045
5046 RewindDir(dir_hnd,&dirpos);
5047 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5048 char *fullname = NULL;
5049
5050 if (ISDOT(dname) || ISDOTDOT(dname)) {
5051 continue;
5052 }
5053 if (!is_visible_file(conn, directory, dname, &st, False)) {
5054 continue;
5055 }
5056
5057 fullname = talloc_asprintf(ctx,
5058 "%s/%s",
5059 directory,
5060 dname);
5061
5062 if(!fullname) {
5063 errno = ENOMEM;
5064 break;
5065 }
5066
5067 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5068 break;
5069 }
5070 if(st.st_mode & S_IFDIR) {
5071 if(lp_recursive_veto_delete(SNUM(conn))) {
5072 if(!recursive_rmdir(ctx, conn, fullname))
5073 break;
5074 }
5075 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5076 break;
5077 }
5078 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5079 break;
5080 }
5081 TALLOC_FREE(fullname);
5082 }
5083 TALLOC_FREE(dir_hnd);
5084 /* Retry the rmdir */
5085 ret = SMB_VFS_RMDIR(conn,directory);
5086 }
5087
5088 err:
5089
5090 if (ret != 0) {
5091 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5092 "%s\n", directory,strerror(errno)));
5093 return map_nt_error_from_unix(errno);
5094 }
5095
5096 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5097 FILE_NOTIFY_CHANGE_DIR_NAME,
5098 directory);
5099
5100 return NT_STATUS_OK;
5101 }
5102
5103 /****************************************************************************
5104 Reply to a rmdir.
5105 ****************************************************************************/
5106
5107 void reply_rmdir(struct smb_request *req)
5108 {
5109 connection_struct *conn = req->conn;
5110 char *directory = NULL;
5111 SMB_STRUCT_STAT sbuf;
5112 NTSTATUS status;
5113 TALLOC_CTX *ctx = talloc_tos();
5114
5115 START_PROFILE(SMBrmdir);
5116
5117 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5118 smb_buf(req->inbuf) + 1, 0,
5119 STR_TERMINATE, &status);
5120 if (!NT_STATUS_IS_OK(status)) {
5121 reply_nterror(req, status);
5122 END_PROFILE(SMBrmdir);
5123 return;
5124 }
5125
5126 status = resolve_dfspath(ctx, conn,
5127 req->flags2 & FLAGS2_DFS_PATHNAMES,
5128 directory,
5129 &directory);
5130 if (!NT_STATUS_IS_OK(status)) {
5131 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5132 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5133 ERRSRV, ERRbadpath);
5134 END_PROFILE(SMBrmdir);
5135 return;
5136 }
5137 reply_nterror(req, status);
5138 END_PROFILE(SMBrmdir);
5139 return;
5140 }
5141
5142 status = unix_convert(ctx, conn, directory, False, &directory,
5143 NULL, &sbuf);
5144 if (!NT_STATUS_IS_OK(status)) {
5145 reply_nterror(req, status);
5146 END_PROFILE(SMBrmdir);
5147 return;
5148 }
5149
5150 status = check_name(conn, directory);
5151 if (!NT_STATUS_IS_OK(status)) {
5152 reply_nterror(req, status);
5153 END_PROFILE(SMBrmdir);
5154 return;
5155 }
5156
5157 dptr_closepath(directory, req->smbpid);
5158 status = rmdir_internals(ctx, conn, directory);
5159 if (!NT_STATUS_IS_OK(status)) {
5160 reply_nterror(req, status);
5161 END_PROFILE(SMBrmdir);
5162 return;
5163 }
5164
5165 reply_outbuf(req, 0, 0);
5166
5167 DEBUG( 3, ( "rmdir %s\n", directory ) );
5168
5169 END_PROFILE(SMBrmdir);
5170 return;
5171 }
5172
5173 /*******************************************************************
5174 Resolve wildcards in a filename rename.
5175 ********************************************************************/
5176
5177 static bool resolve_wildcards(TALLOC_CTX *ctx,
5178 const char *name1,
5179 const char *name2,
5180 char **pp_newname)
5181 {
5182 char *name2_copy = NULL;
5183 char *root1 = NULL;
5184 char *root2 = NULL;
5185 char *ext1 = NULL;
5186 char *ext2 = NULL;
5187 char *p,*p2, *pname1, *pname2;
5188
5189 name2_copy = talloc_strdup(ctx, name2);
5190 if (!name2_copy) {
5191 return False;
5192 }
5193
5194 pname1 = strrchr_m(name1,'/');
5195 pname2 = strrchr_m(name2_copy,'/');
5196
5197 if (!pname1 || !pname2) {
5198 return False;
5199 }
5200
5201 /* Truncate the copy of name2 at the last '/' */
5202 *pname2 = '\0';
5203
5204 /* Now go past the '/' */
5205 pname1++;
5206 pname2++;
5207
5208 root1 = talloc_strdup(ctx, pname1);
5209 root2 = talloc_strdup(ctx, pname2);
5210
5211 if (!root1 || !root2) {
5212 return False;
5213 }
5214
5215 p = strrchr_m(root1,'.');
5216 if (p) {
5217 *p = 0;
5218 ext1 = talloc_strdup(ctx, p+1);
5219 } else {
5220 ext1 = talloc_strdup(ctx, "");
5221 }
5222 p = strrchr_m(root2,'.');
5223 if (p) {
5224 *p = 0;
5225 ext2 = talloc_strdup(ctx, p+1);
5226 } else {
5227 ext2 = talloc_strdup(ctx, "");
5228 }
5229
5230 if (!ext1 || !ext2) {
5231 return False;
5232 }
5233
5234 p = root1;
5235 p2 = root2;
5236 while (*p2) {
5237 if (*p2 == '?') {
5238 /* Hmmm. Should this be mb-aware ? */
5239 *p2 = *p;
5240 p2++;
5241 } else if (*p2 == '*') {
5242 *p2 = '\0';
5243 root2 = talloc_asprintf(ctx, "%s%s",
5244 root2,
5245 p);
5246 if (!root2) {
5247 return False;
5248 }
5249 break;
5250 } else {
5251 p2++;
5252 }
5253 if (*p) {
5254 p++;
5255 }
5256 }
5257
5258 p = ext1;
5259 p2 = ext2;
5260 while (*p2) {
5261 if (*p2 == '?') {
5262 /* Hmmm. Should this be mb-aware ? */
5263 *p2 = *p;
5264 p2++;
5265 } else if (*p2 == '*') {
5266 *p2 = '\0';
5267 ext2 = talloc_asprintf(ctx, "%s%s",
5268 ext2,
5269 p);
5270 if (!ext2) {
5271 return False;
5272 }
5273 break;
5274 } else {
5275 p2++;
5276 }
5277 if (*p) {
5278 p++;
5279 }
5280 }
5281
5282 if (*ext2) {
5283 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5284 name2_copy,
5285 root2,
5286 ext2);
5287 } else {
5288 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5289 name2_copy,
5290 root2);
5291 }
5292
5293 if (!*pp_newname) {
5294 return False;
5295 }
5296
5297 return True;
5298 }
5299
5300 /****************************************************************************
5301 Ensure open files have their names updated. Updated to notify other smbd's
5302 asynchronously.
5303 ****************************************************************************/
5304
5305 static void rename_open_files(connection_struct *conn,
5306 struct share_mode_lock *lck,
5307 const char *newname)
5308 {
5309 files_struct *fsp;
5310 bool did_rename = False;
5311
5312 for(fsp = file_find_di_first(lck->id); fsp;
5313 fsp = file_find_di_next(fsp)) {
5314 /* fsp_name is a relative path under the fsp. To change this for other
5315 sharepaths we need to manipulate relative paths. */
5316 /* TODO - create the absolute path and manipulate the newname
5317 relative to the sharepath. */
5318 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5319 continue;
5320 }
5321 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5322 fsp->fnum, file_id_string_tos(&fsp->file_id),
5323 fsp->fsp_name, newname ));
5324 string_set(&fsp->fsp_name, newname);
5325 did_rename = True;
5326 }
5327
5328 if (!did_rename) {
5329 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5330 file_id_string_tos(&lck->id), newname ));
5331 }
5332
5333 /* Send messages to all smbd's (not ourself) that the name has changed. */
5334 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5335 newname);
5336 }
5337
5338 /****************************************************************************
5339 We need to check if the source path is a parent directory of the destination
5340 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5341 refuse the rename with a sharing violation. Under UNIX the above call can
5342 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5343 probably need to check that the client is a Windows one before disallowing
5344 this as a UNIX client (one with UNIX extensions) can know the source is a
5345 symlink and make this decision intelligently. Found by an excellent bug
5346 report from <AndyLiebman@aol.com>.
5347 ****************************************************************************/
5348
5349 static bool rename_path_prefix_equal(const char *src, const char *dest)
5350 {
5351 const char *psrc = src;
5352 const char *pdst = dest;
5353 size_t slen;
5354
5355 if (psrc[0] == '.' && psrc[1] == '/') {
5356 psrc += 2;
5357 }
5358 if (pdst[0] == '.' && pdst[1] == '/') {
5359 pdst += 2;
5360 }
5361 if ((slen = strlen(psrc)) > strlen(pdst)) {
5362 return False;
5363 }
5364 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5365 }
5366
5367 /*
5368 * Do the notify calls from a rename
5369 */
5370
5371 static void notify_rename(connection_struct *conn, bool is_dir,
5372 const char *oldpath, const char *newpath)
5373 {
5374 char *olddir, *newdir;
5375 const char *oldname, *newname;
5376 uint32 mask;
5377
5378 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5379 : FILE_NOTIFY_CHANGE_FILE_NAME;
5380
5381 if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5382 || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5383 TALLOC_FREE(olddir);
5384 return;
5385 }
5386
5387 if (strcmp(olddir, newdir) == 0) {
5388 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5389 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5390 }
5391 else {
5392 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5393 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5394 }
5395 TALLOC_FREE(olddir);
5396 TALLOC_FREE(newdir);
5397
5398 /* this is a strange one. w2k3 gives an additional event for
5399 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5400 files, but not directories */
5401 if (!is_dir) {
5402 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5403 FILE_NOTIFY_CHANGE_ATTRIBUTES
5404 |FILE_NOTIFY_CHANGE_CREATION,
5405 newpath);
5406 }
5407 }
5408
5409 /****************************************************************************
5410 Rename an open file - given an fsp.
5411 ****************************************************************************/
5412
5413 NTSTATUS rename_internals_fsp(connection_struct *conn,
5414 files_struct *fsp,
5415 char *newname,
5416 const char *newname_last_component,
5417 uint32 attrs,
5418 bool replace_if_exists)
5419 {
5420 TALLOC_CTX *ctx = talloc_tos();
5421 SMB_STRUCT_STAT sbuf, sbuf1;
5422 NTSTATUS status = NT_STATUS_OK;
5423 struct share_mode_lock *lck = NULL;
5424 bool dst_exists;
5425
5426 ZERO_STRUCT(sbuf);
5427
5428 status = check_name(conn, newname);
5429 if (!NT_STATUS_IS_OK(status)) {
5430 return status;
5431 }
5432
5433 /* Ensure newname contains a '/' */
5434 if(strrchr_m(newname,'/') == 0) {
5435 newname = talloc_asprintf(ctx,
5436 "./%s",
5437 newname);
5438 if (!newname) {
5439 return NT_STATUS_NO_MEMORY;
5440 }
5441 }
5442
5443 /*
5444 * Check for special case with case preserving and not
5445 * case sensitive. If the old last component differs from the original
5446 * last component only by case, then we should allow
5447 * the rename (user is trying to change the case of the
5448 * filename).
5449 */
5450
5451 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5452 strequal(newname, fsp->fsp_name)) {
5453 char *p;
5454 char *newname_modified_last_component = NULL;
5455
5456 /*
5457 * Get the last component of the modified name.
5458 * Note that we guarantee that newname contains a '/'
5459 * character above.
5460 */
5461 p = strrchr_m(newname,'/');
5462 newname_modified_last_component = talloc_strdup(ctx,
5463 p+1);
5464 if (!newname_modified_last_component) {
5465 return NT_STATUS_NO_MEMORY;
5466 }
5467
5468 if(strcsequal(newname_modified_last_component,
5469 newname_last_component) == False) {
5470 /*
5471 * Replace the modified last component with
5472 * the original.
5473 */
5474 *p = '\0'; /* Truncate at the '/' */
5475 newname = talloc_asprintf(ctx,
5476 "%s/%s",
5477 newname,
5478 newname_last_component);
5479 }
5480 }
5481
5482 /*
5483 * If the src and dest names are identical - including case,
5484 * don't do the rename, just return success.
5485 */
5486
5487 if (strcsequal(fsp->fsp_name, newname)) {
5488 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5489 newname));
5490 return NT_STATUS_OK;
5491 }
5492
5493 /*
5494 * Have vfs_object_exist also fill sbuf1
5495 */
5496 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5497
5498 if(!replace_if_exists && dst_exists) {
5499 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5500 fsp->fsp_name,newname));
5501 return NT_STATUS_OBJECT_NAME_COLLISION;
5502 }
5503
5504 if (dst_exists) {
5505 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5506 files_struct *dst_fsp = file_find_di_first(fileid);
5507 if (dst_fsp) {
5508 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5509 return NT_STATUS_ACCESS_DENIED;
5510 }
5511 }
5512
5513 /* Ensure we have a valid stat struct for the source. */
5514 if (fsp->fh->fd != -1) {
5515 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5516 return map_nt_error_from_unix(errno);
5517 }
5518 } else {
5519 if (SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf) == -1) {
5520 return map_nt_error_from_unix(errno);
5521 }
5522 }
5523
5524 status = can_rename(conn, fsp, attrs, &sbuf);
5525
5526 if (!NT_STATUS_IS_OK(status)) {
5527 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5528 nt_errstr(status), fsp->fsp_name,newname));
5529 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5530 status = NT_STATUS_ACCESS_DENIED;
5531 return status;
5532 }
5533
5534 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5535 return NT_STATUS_ACCESS_DENIED;
5536 }
5537
5538 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5539 NULL);
5540
5541 /*
5542 * We have the file open ourselves, so not being able to get the
5543 * corresponding share mode lock is a fatal error.
5544 */
5545
5546 SMB_ASSERT(lck != NULL);
5547
5548 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5549 uint32 create_options = fsp->fh->private_options;
5550
5551 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5552 fsp->fsp_name,newname));
5553
5554 rename_open_files(conn, lck, newname);
5555
5556 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5557
5558 /*
5559 * A rename acts as a new file create w.r.t. allowing an initial delete
5560 * on close, probably because in Windows there is a new handle to the
5561 * new file. If initial delete on close was requested but not
5562 * originally set, we need to set it here. This is probably not 100% correct,
5563 * but will work for the CIFSFS client which in non-posix mode
5564 * depends on these semantics. JRA.
5565 */
5566
5567 set_allow_initial_delete_on_close(lck, fsp, True);
5568
5569 if (create_options & FILE_DELETE_ON_CLOSE) {
5570 status = can_set_delete_on_close(fsp, True, 0);
5571
5572 if (NT_STATUS_IS_OK(status)) {
5573 /* Note that here we set the *inital* delete on close flag,
5574 * not the regular one. The magic gets handled in close. */
5575 fsp->initial_delete_on_close = True;
5576 }
5577 }
5578 TALLOC_FREE(lck);
5579 return NT_STATUS_OK;
5580 }
5581
5582 TALLOC_FREE(lck);
5583
5584 if (errno == ENOTDIR || errno == EISDIR) {
5585 status = NT_STATUS_OBJECT_NAME_COLLISION;
5586 } else {
5587 status = map_nt_error_from_unix(errno);
5588 }
5589
5590 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5591 nt_errstr(status), fsp->fsp_name,newname));
5592
5593 return status;
5594 }
5595
5596 /****************************************************************************
5597 The guts of the rename command, split out so it may be called by the NT SMB
5598 code.
5599 ****************************************************************************/
5600
5601 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5602 connection_struct *conn,
5603 struct smb_request *req,
5604 const char *name_in,
5605 const char *newname_in,
5606 uint32 attrs,
5607 bool replace_if_exists,
5608 bool src_has_wild,
5609 bool dest_has_wild,
5610 uint32_t access_mask)
5611 {
5612 char *directory = NULL;
5613 char *mask = NULL;
5614 char *last_component_src = NULL;
5615 char *last_component_dest = NULL;
5616 char *name = NULL;
5617 char *newname = NULL;
5618 char *p;
5619 int count=0;
5620 NTSTATUS status = NT_STATUS_OK;
5621 SMB_STRUCT_STAT sbuf1, sbuf2;
5622 struct smb_Dir *dir_hnd = NULL;
5623 const char *dname;
5624 long offset = 0;
5625
5626 ZERO_STRUCT(sbuf1);
5627 ZERO_STRUCT(sbuf2);
5628
5629 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5630 &last_component_src, &sbuf1);
5631 if (!NT_STATUS_IS_OK(status)) {
5632 return status;
5633 }
5634
5635 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5636 &last_component_dest, &sbuf2);
5637 if (!NT_STATUS_IS_OK(status)) {
5638 return status;
5639 }
5640
5641 /*
5642 * Split the old name into directory and last component
5643 * strings. Note that unix_convert may have stripped off a
5644 * leading ./ from both name and newname if the rename is
5645 * at the root of the share. We need to make sure either both
5646 * name and newname contain a / character or neither of them do
5647 * as this is checked in resolve_wildcards().
5648 */
5649
5650 p = strrchr_m(name,'/');
5651 if (!p) {
5652 directory = talloc_strdup(ctx, ".");
5653 if (!directory) {
5654 return NT_STATUS_NO_MEMORY;
5655 }
5656 mask = name;
5657 } else {
5658 *p = 0;
5659 directory = talloc_strdup(ctx, name);
5660 if (!directory) {
5661 return NT_STATUS_NO_MEMORY;
5662 }
5663 mask = p+1;
5664 *p = '/'; /* Replace needed for exceptional test below. */
5665 }
5666
5667 /*
5668 * We should only check the mangled cache
5669 * here if unix_convert failed. This means
5670 * that the path in 'mask' doesn't exist
5671 * on the file system and so we need to look
5672 * for a possible mangle. This patch from
5673 * Tine Smukavec <valentin.smukavec@hermes.si>.
5674 */
5675
5676 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5677 char *new_mask = NULL;
5678 mangle_lookup_name_from_8_3(ctx,
5679 mask,
5680 &new_mask,
5681 conn->params );
5682 if (new_mask) {
5683 mask = new_mask;
5684 }
5685 }
5686
5687 if (!src_has_wild) {
5688 files_struct *fsp;
5689
5690 /*
5691 * No wildcards - just process the one file.
5692 */
5693 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5694
5695 /* Add a terminating '/' to the directory name. */
5696 directory = talloc_asprintf_append(directory,
5697 "/%s",
5698 mask);
5699 if (!directory) {
5700 return NT_STATUS_NO_MEMORY;
5701 }
5702
5703 /* Ensure newname contains a '/' also */
5704 if(strrchr_m(newname,'/') == 0) {
5705 newname = talloc_asprintf(ctx,
5706 "./%s",
5707 newname);
5708 if (!newname) {
5709 return NT_STATUS_NO_MEMORY;
5710 }
5711 }
5712
5713 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5714 "case_preserve = %d, short case preserve = %d, "
5715 "directory = %s, newname = %s, "
5716 "last_component_dest = %s, is_8_3 = %d\n",
5717 conn->case_sensitive, conn->case_preserve,
5718 conn->short_case_preserve, directory,
5719 newname, last_component_dest, is_short_name));
5720
5721 /* The dest name still may have wildcards. */
5722 if (dest_has_wild) {
5723 char *mod_newname = NULL;
5724 if (!resolve_wildcards(ctx,
5725 directory,newname,&mod_newname)) {
5726 DEBUG(6, ("rename_internals: resolve_wildcards "
5727 "%s %s failed\n",
5728 directory,
5729 newname));
5730 return NT_STATUS_NO_MEMORY;
5731 }
5732 newname = mod_newname;
5733 }
5734
5735 ZERO_STRUCT(sbuf1);
5736 SMB_VFS_STAT(conn, directory, &sbuf1);
5737
5738 status = S_ISDIR(sbuf1.st_mode) ?
5739 open_directory(conn, req, directory, &sbuf1,
5740 access_mask,
5741 FILE_SHARE_READ|FILE_SHARE_WRITE,
5742 FILE_OPEN, 0, 0, NULL,
5743 &fsp)
5744 : open_file_ntcreate(conn, req, directory, &sbuf1,
5745 access_mask,
5746 FILE_SHARE_READ|FILE_SHARE_WRITE,
5747 FILE_OPEN, 0, 0, 0, NULL,
5748 &fsp);
5749
5750 if (!NT_STATUS_IS_OK(status)) {
5751 DEBUG(3, ("Could not open rename source %s: %s\n",
5752 directory, nt_errstr(status)));
5753 return status;
5754 }
5755
5756 status = rename_internals_fsp(conn, fsp, newname,
5757 last_component_dest,
5758 attrs, replace_if_exists);
5759
5760 close_file(fsp, NORMAL_CLOSE);
5761
5762 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5763 nt_errstr(status), directory,newname));
5764
5765 return status;
5766 }
5767
5768 /*
5769 * Wildcards - process each file that matches.
5770 */
5771 if (strequal(mask,"????????.???")) {
5772 mask[0] = '*';
5773 mask[1] = '\0';
5774 }
5775
5776 status = check_name(conn, directory);
5777 if (!NT_STATUS_IS_OK(status)) {
5778 return status;
5779 }
5780
5781 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5782 if (dir_hnd == NULL) {
5783 return map_nt_error_from_unix(errno);
5784 }
5785
5786 status = NT_STATUS_NO_SUCH_FILE;
5787 /*
5788 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5789 * - gentest fix. JRA
5790 */
5791
5792 while ((dname = ReadDirName(dir_hnd, &offset))) {
5793 files_struct *fsp = NULL;
5794 char *fname = NULL;
5795 char *destname = NULL;
5796 bool sysdir_entry = False;
5797
5798 /* Quick check for "." and ".." */
5799 if (ISDOT(dname) || ISDOTDOT(dname)) {
5800 if (attrs & aDIR) {
5801 sysdir_entry = True;
5802 } else {
5803 continue;
5804 }
5805 }
5806
5807 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5808 continue;
5809 }
5810
5811 if(!mask_match(dname, mask, conn->case_sensitive)) {
5812 continue;
5813 }
5814
5815 if (sysdir_entry) {
5816 status = NT_STATUS_OBJECT_NAME_INVALID;
5817 break;
5818 }
5819
5820 fname = talloc_asprintf(ctx,
5821 "%s/%s",
5822 directory,
5823 dname);
5824 if (!fname) {
5825 return NT_STATUS_NO_MEMORY;
5826 }
5827
5828 if (!resolve_wildcards(ctx,
5829 fname,newname,&destname)) {
5830 DEBUG(6, ("resolve_wildcards %s %s failed\n",
5831 fname, destname));
5832 TALLOC_FREE(fname);
5833 continue;
5834 }
5835 if (!destname) {
5836 return NT_STATUS_NO_MEMORY;
5837 }
5838
5839 ZERO_STRUCT(sbuf1);
5840 SMB_VFS_STAT(conn, fname, &sbuf1);
5841
5842 status = S_ISDIR(sbuf1.st_mode) ?
5843 open_directory(conn, req, fname, &sbuf1,
5844 access_mask,
5845 FILE_SHARE_READ|FILE_SHARE_WRITE,
5846 FILE_OPEN, 0, 0, NULL,
5847 &fsp)
5848 : open_file_ntcreate(conn, req, fname, &sbuf1,
5849 access_mask,
5850 FILE_SHARE_READ|FILE_SHARE_WRITE,
5851 FILE_OPEN, 0, 0, 0, NULL,
5852 &fsp);
5853
5854 if (!NT_STATUS_IS_OK(status)) {
5855 DEBUG(3,("rename_internals: open_file_ntcreate "
5856 "returned %s rename %s -> %s\n",
5857 nt_errstr(status), directory, newname));
5858 break;
5859 }
5860
5861 status = rename_internals_fsp(conn, fsp, destname, dname,
5862 attrs, replace_if_exists);
5863
5864 close_file(fsp, NORMAL_CLOSE);
5865
5866 if (!NT_STATUS_IS_OK(status)) {
5867 DEBUG(3, ("rename_internals_fsp returned %s for "
5868 "rename %s -> %s\n", nt_errstr(status),
5869 directory, newname));
5870 break;
5871 }
5872
5873 count++;
5874
5875 DEBUG(3,("rename_internals: doing rename on %s -> "
5876 "%s\n",fname,destname));
5877
5878 TALLOC_FREE(fname);
5879 TALLOC_FREE(destname);
5880 }
5881 TALLOC_FREE(dir_hnd);
5882
5883 if (count == 0 && NT_STATUS_IS_OK(status)) {
5884 status = map_nt_error_from_unix(errno);
5885 }
5886
5887 return status;
5888 }
5889
5890 /****************************************************************************
5891 Reply to a mv.
5892 ****************************************************************************/
5893
5894 void reply_mv(struct smb_request *req)
5895 {
5896 connection_struct *conn = req->conn;
5897 char *name = NULL;
5898 char *newname = NULL;
5899 char *p;
5900 uint32 attrs;
5901 NTSTATUS status;
5902 bool src_has_wcard = False;
5903 bool dest_has_wcard = False;
5904 TALLOC_CTX *ctx = talloc_tos();
5905
5906 START_PROFILE(SMBmv);
5907
5908 if (req->wct < 1) {
5909 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5910 END_PROFILE(SMBmv);
5911 return;
5912 }
5913
5914 attrs = SVAL(req->inbuf,smb_vwv0);
5915
5916 p = smb_buf(req->inbuf) + 1;
5917 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
5918 0, STR_TERMINATE, &status,
5919 &src_has_wcard);
5920 if (!NT_STATUS_IS_OK(status)) {
5921 reply_nterror(req, status);
5922 END_PROFILE(SMBmv);
5923 return;
5924 }
5925 p++;
5926 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
5927 0, STR_TERMINATE, &status,
5928 &dest_has_wcard);
5929 if (!NT_STATUS_IS_OK(status)) {
5930 reply_nterror(req, status);
5931 END_PROFILE(SMBmv);
5932 return;
5933 }
5934
5935 status = resolve_dfspath_wcard(ctx, conn,
5936 req->flags2 & FLAGS2_DFS_PATHNAMES,
5937 name,
5938 &name,
5939 &src_has_wcard);
5940 if (!NT_STATUS_IS_OK(status)) {
5941 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5942 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5943 ERRSRV, ERRbadpath);
5944 END_PROFILE(SMBmv);
5945 return;
5946 }
5947 reply_nterror(req, status);
5948 END_PROFILE(SMBmv);
5949 return;
5950 }
5951
5952 status = resolve_dfspath_wcard(ctx, conn,
5953 req->flags2 & FLAGS2_DFS_PATHNAMES,
5954 newname,
5955 &newname,
5956 &dest_has_wcard);
5957 if (!NT_STATUS_IS_OK(status)) {
5958 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5959 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5960 ERRSRV, ERRbadpath);
5961 END_PROFILE(SMBmv);
5962 return;
5963 }
5964 reply_nterror(req, status);
5965 END_PROFILE(SMBmv);
5966 return;
5967 }
5968
5969 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
5970
5971 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
5972 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
5973 if (!NT_STATUS_IS_OK(status)) {
5974 if (open_was_deferred(req->mid)) {
5975 /* We have re-scheduled this call. */
5976 END_PROFILE(SMBmv);
5977 return;
5978 }
5979 reply_nterror(req, status);
5980 END_PROFILE(SMBmv);
5981 return;
5982 }
5983
5984 reply_outbuf(req, 0, 0);
5985
5986 END_PROFILE(SMBmv);
5987 return;
5988 }
5989
5990 /*******************************************************************
5991 Copy a file as part of a reply_copy.
5992 ******************************************************************/
5993
5994 /*
5995 * TODO: check error codes on all callers
5996 */
5997
5998 NTSTATUS copy_file(TALLOC_CTX *ctx,
5999 connection_struct *conn,
6000 const char *src,
6001 const char *dest1,
6002 int ofun,
6003 int count,
6004 bool target_is_directory)
6005 {
6006 SMB_STRUCT_STAT src_sbuf, sbuf2;
6007 SMB_OFF_T ret=-1;
6008 files_struct *fsp1,*fsp2;
6009 char *dest = NULL;
6010 uint32 dosattrs;
6011 uint32 new_create_disposition;
6012 NTSTATUS status;
6013
6014 dest = talloc_strdup(ctx, dest1);
6015 if (!dest) {
6016 return NT_STATUS_NO_MEMORY;
6017 }
6018 if (target_is_directory) {
6019 const char *p = strrchr_m(src,'/');
6020 if (p) {
6021 p++;
6022 } else {
6023 p = src;
6024 }
6025 dest = talloc_asprintf_append(dest,
6026 "/%s",
6027 p);
6028 if (!dest) {
6029 return NT_STATUS_NO_MEMORY;
6030 }
6031 }
6032
6033 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6034 TALLOC_FREE(dest);
6035 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6036 }
6037
6038 if (!target_is_directory && count) {
6039 new_create_disposition = FILE_OPEN;
6040 } else {
6041 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6042 NULL, NULL, &new_create_disposition, NULL)) {
6043 TALLOC_FREE(dest);
6044 return NT_STATUS_INVALID_PARAMETER;
6045 }
6046 }
6047
6048 status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6049 FILE_GENERIC_READ,
6050 FILE_SHARE_READ|FILE_SHARE_WRITE,
6051 FILE_OPEN,
6052 0,
6053 FILE_ATTRIBUTE_NORMAL,
6054 INTERNAL_OPEN_ONLY,
6055 NULL, &fsp1);
6056
6057 if (!NT_STATUS_IS_OK(status)) {
6058 TALLOC_FREE(dest);
6059 return status;
6060 }
6061
6062 dosattrs = dos_mode(conn, src, &src_sbuf);
6063 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6064 ZERO_STRUCTP(&sbuf2);
6065 }
6066
6067 status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6068 FILE_GENERIC_WRITE,
6069 FILE_SHARE_READ|FILE_SHARE_WRITE,
6070 new_create_disposition,
6071 0,
6072 dosattrs,
6073 INTERNAL_OPEN_ONLY,
6074 NULL, &fsp2);
6075
6076 TALLOC_FREE(dest);
6077
6078 if (!NT_STATUS_IS_OK(status)) {
6079 close_file(fsp1,ERROR_CLOSE);
6080 return status;
6081 }
6082
6083 if ((ofun&3) == 1) {
6084 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6085 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6086 /*
6087 * Stop the copy from occurring.
6088 */
6089 ret = -1;
6090 src_sbuf.st_size = 0;
6091 }
6092 }
6093
6094 if (src_sbuf.st_size) {
6095 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6096 }
6097
6098 close_file(fsp1,NORMAL_CLOSE);
6099
6100 /* Ensure the modtime is set correctly on the destination file. */
6101 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6102
6103 /*
6104 * As we are opening fsp1 read-only we only expect
6105 * an error on close on fsp2 if we are out of space.
6106 * Thus we don't look at the error return from the
6107 * close of fsp1.
6108 */
6109 status = close_file(fsp2,NORMAL_CLOSE);
6110
6111 if (!NT_STATUS_IS_OK(status)) {
6112 return status;
6113 }
6114
6115 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6116 return NT_STATUS_DISK_FULL;
6117 }
6118
6119 return NT_STATUS_OK;
6120 }
6121
6122 /****************************************************************************
6123 Reply to a file copy.
6124 ****************************************************************************/
6125
6126 void reply_copy(struct smb_request *req)
6127 {
6128 connection_struct *conn = req->conn;
6129 char *name = NULL;
6130 char *newname = NULL;
6131 char *directory = NULL;
6132 char *mask = NULL;
6133 char *p;
6134 int count=0;
6135 int error = ERRnoaccess;
6136 int err = 0;
6137 int tid2;
6138 int ofun;
6139 int flags;
6140 bool target_is_directory=False;
6141 bool source_has_wild = False;
6142 bool dest_has_wild = False;
6143 SMB_STRUCT_STAT sbuf1, sbuf2;
6144 NTSTATUS status;
6145 TALLOC_CTX *ctx = talloc_tos();
6146
6147 START_PROFILE(SMBcopy);
6148
6149 if (req->wct < 3) {
6150 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6151 END_PROFILE(SMBcopy);
6152 return;
6153 }
6154
6155 tid2 = SVAL(req->inbuf,smb_vwv0);
6156 ofun = SVAL(req->inbuf,smb_vwv1);
6157 flags = SVAL(req->inbuf,smb_vwv2);
6158
6159 p = smb_buf(req->inbuf);
6160 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6161 0, STR_TERMINATE, &status,
6162 &source_has_wild);
6163 if (!NT_STATUS_IS_OK(status)) {
6164 reply_nterror(req, status);
6165 END_PROFILE(SMBcopy);
6166 return;
6167 }
6168 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6169 0, STR_TERMINATE, &status,
6170 &dest_has_wild);
6171 if (!NT_STATUS_IS_OK(status)) {
6172 reply_nterror(req, status);
6173 END_PROFILE(SMBcopy);
6174 return;
6175 }
6176
6177 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6178
6179 if (tid2 != conn->cnum) {
6180 /* can't currently handle inter share copies XXXX */
6181 DEBUG(3,("Rejecting inter-share copy\n"));
6182 reply_doserror(req, ERRSRV, ERRinvdevice);
6183 END_PROFILE(SMBcopy);
6184 return;
6185 }
6186
6187 status = resolve_dfspath_wcard(ctx, conn,
6188 req->flags2 & FLAGS2_DFS_PATHNAMES,
6189 name,
6190 &name,
6191 &source_has_wild);
6192 if (!NT_STATUS_IS_OK(status)) {
6193 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6194 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6195 ERRSRV, ERRbadpath);
6196 END_PROFILE(SMBcopy);
6197 return;
6198 }
6199 reply_nterror(req, status);
6200 END_PROFILE(SMBcopy);
6201 return;
6202 }
6203
6204 status = resolve_dfspath_wcard(ctx, conn,
6205 req->flags2 & FLAGS2_DFS_PATHNAMES,
6206 newname,
6207 &newname,
6208 &dest_has_wild);
6209 if (!NT_STATUS_IS_OK(status)) {
6210 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6211 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6212 ERRSRV, ERRbadpath);
6213 END_PROFILE(SMBcopy);
6214 return;
6215 }
6216 reply_nterror(req, status);
6217 END_PROFILE(SMBcopy);
6218 return;
6219 }
6220
6221 status = unix_convert(ctx, conn, name, source_has_wild,
6222 &name, NULL, &sbuf1);
6223 if (!NT_STATUS_IS_OK(status)) {
6224 reply_nterror(req, status);
6225 END_PROFILE(SMBcopy);
6226 return;
6227 }
6228
6229 status = unix_convert(ctx, conn, newname, dest_has_wild,
6230 &newname, NULL, &sbuf2);
6231 if (!NT_STATUS_IS_OK(status)) {
6232 reply_nterror(req, status);
6233 END_PROFILE(SMBcopy);
6234 return;
6235 }
6236
6237 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6238
6239 if ((flags&1) && target_is_directory) {
6240 reply_doserror(req, ERRDOS, ERRbadfile);
6241 END_PROFILE(SMBcopy);
6242 return;
6243 }
6244
6245 if ((flags&2) && !target_is_directory) {
6246 reply_doserror(req, ERRDOS, ERRbadpath);
6247 END_PROFILE(SMBcopy);
6248 return;
6249 }
6250
6251 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6252 /* wants a tree copy! XXXX */
6253 DEBUG(3,("Rejecting tree copy\n"));
6254 reply_doserror(req, ERRSRV, ERRerror);
6255 END_PROFILE(SMBcopy);
6256 return;
6257 }
6258
6259 p = strrchr_m(name,'/');
6260 if (!p) {
6261 directory = talloc_strdup(ctx, "./");
6262 if (!directory) {
6263 reply_nterror(req, NT_STATUS_NO_MEMORY);
6264 END_PROFILE(SMBcopy);
6265 return;
6266 }
6267 mask = name;
6268 } else {
6269 *p = 0;
6270 directory = talloc_strdup(ctx, name);
6271 if (!directory) {
6272 reply_nterror(req, NT_STATUS_NO_MEMORY);
6273 END_PROFILE(SMBcopy);
6274 return;
6275 }
6276 mask = p+1;
6277 }
6278
6279 /*
6280 * We should only check the mangled cache
6281 * here if unix_convert failed. This means
6282 * that the path in 'mask' doesn't exist
6283 * on the file system and so we need to look
6284 * for a possible mangle. This patch from
6285 * Tine Smukavec <valentin.smukavec@hermes.si>.
6286 */
6287
6288 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6289 char *new_mask = NULL;
6290 mangle_lookup_name_from_8_3(ctx,
6291 mask,
6292 &new_mask,
6293 conn->params );
6294 if (new_mask) {
6295 mask = new_mask;
6296 }
6297 }
6298
6299 if (!source_has_wild) {
6300 directory = talloc_asprintf_append(directory,
6301 "/%s",
6302 mask);
6303 if (dest_has_wild) {
6304 char *mod_newname = NULL;
6305 if (!resolve_wildcards(ctx,
6306 directory,newname,&mod_newname)) {
6307 reply_nterror(req, NT_STATUS_NO_MEMORY);
6308 END_PROFILE(SMBcopy);
6309 return;
6310 }
6311 newname = mod_newname;
6312 }
6313
6314 status = check_name(conn, directory);
6315 if (!NT_STATUS_IS_OK(status)) {
6316 reply_nterror(req, status);
6317 END_PROFILE(SMBcopy);
6318 return;
6319 }
6320
6321 status = check_name(conn, newname);
6322 if (!NT_STATUS_IS_OK(status)) {
6323 reply_nterror(req, status);
6324 END_PROFILE(SMBcopy);
6325 return;
6326 }
6327
6328 status = copy_file(ctx,conn,directory,newname,ofun,
6329 count,target_is_directory);
6330
6331 if(!NT_STATUS_IS_OK(status)) {
6332 reply_nterror(req, status);
6333 END_PROFILE(SMBcopy);
6334 return;
6335 } else {
6336 count++;
6337 }
6338 } else {
6339 struct smb_Dir *dir_hnd = NULL;
6340 const char *dname = NULL;
6341 long offset = 0;
6342
6343 if (strequal(mask,"????????.???")) {
6344 mask[0] = '*';
6345 mask[1] = '\0';
6346 }
6347
6348 status = check_name(conn, directory);
6349 if (!NT_STATUS_IS_OK(status)) {
6350 reply_nterror(req, status);
6351 END_PROFILE(SMBcopy);
6352 return;
6353 }
6354
6355 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6356 if (dir_hnd == NULL) {
6357 status = map_nt_error_from_unix(errno);
6358 reply_nterror(req, status);
6359 END_PROFILE(SMBcopy);
6360 return;
6361 }
6362
6363 error = ERRbadfile;
6364
6365 while ((dname = ReadDirName(dir_hnd, &offset))) {
6366 char *destname = NULL;
6367 char *fname = NULL;
6368
6369 if (ISDOT(dname) || ISDOTDOT(dname)) {
6370 continue;
6371 }
6372
6373 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6374 continue;
6375 }
6376
6377 if(!mask_match(dname, mask, conn->case_sensitive)) {
6378 continue;
6379 }
6380
6381 error = ERRnoaccess;
6382 fname = talloc_asprintf(ctx,
6383 "%s/%s",
6384 directory,
6385 dname);
6386 if (!fname) {
6387 TALLOC_FREE(dir_hnd);
6388 reply_nterror(req, NT_STATUS_NO_MEMORY);
6389 END_PROFILE(SMBcopy);
6390 return;
6391 }
6392
6393 if (!resolve_wildcards(ctx,
6394 fname,newname,&destname)) {
6395 continue;
6396 }
6397 if (!destname) {
6398 TALLOC_FREE(dir_hnd);
6399 reply_nterror(req, NT_STATUS_NO_MEMORY);
6400 END_PROFILE(SMBcopy);
6401 return;
6402 }
6403
6404 status = check_name(conn, fname);
6405 if (!NT_STATUS_IS_OK(status)) {
6406 TALLOC_FREE(dir_hnd);
6407 reply_nterror(req, status);
6408 END_PROFILE(SMBcopy);
6409 return;
6410 }
6411
6412 status = check_name(conn, destname);
6413 if (!NT_STATUS_IS_OK(status)) {
6414 TALLOC_FREE(dir_hnd);
6415 reply_nterror(req, status);
6416 END_PROFILE(SMBcopy);
6417 return;
6418 }
6419
6420 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6421
6422 status = copy_file(ctx,conn,fname,destname,ofun,
6423 count,target_is_directory);
6424 if (NT_STATUS_IS_OK(status)) {
6425 count++;
6426 }
6427 TALLOC_FREE(fname);
6428 TALLOC_FREE(destname);
6429 }
6430 TALLOC_FREE(dir_hnd);
6431 }
6432
6433 if (count == 0) {
6434 if(err) {
6435 /* Error on close... */
6436 errno = err;
6437 reply_unixerror(req, ERRHRD, ERRgeneral);
6438 END_PROFILE(SMBcopy);
6439 return;
6440 }
6441
6442 reply_doserror(req, ERRDOS, error);
6443 END_PROFILE(SMBcopy);
6444 return;
6445 }
6446
6447 reply_outbuf(req, 1, 0);
6448 SSVAL(req->outbuf,smb_vwv0,count);
6449
6450 END_PROFILE(SMBcopy);
6451 return;
6452 }
6453
6454 #undef DBGC_CLASS
6455 #define DBGC_CLASS DBGC_LOCKING
6456
6457 /****************************************************************************
6458 Get a lock pid, dealing with large count requests.
6459 ****************************************************************************/
6460
6461 uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
6462 {
6463 if(!large_file_format)
6464 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6465 else
6466 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6467 }
6468
6469 /****************************************************************************
6470 Get a lock count, dealing with large count requests.
6471 ****************************************************************************/
6472
6473 SMB_BIG_UINT get_lock_count( char *data, int data_offset, bool large_file_format)
6474 {
6475 SMB_BIG_UINT count = 0;
6476
6477 if(!large_file_format) {
6478 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6479 } else {
6480
6481 #if defined(HAVE_LONGLONG)
6482 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6483 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6484 #else /* HAVE_LONGLONG */
6485
6486 /*
6487 * NT4.x seems to be broken in that it sends large file (64 bit)
6488 * lockingX calls even if the CAP_LARGE_FILES was *not*
6489 * negotiated. For boxes without large unsigned ints truncate the
6490 * lock count by dropping the top 32 bits.
6491 */
6492
6493 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6494 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6495 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6496 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6497 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6498 }
6499
6500 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6501 #endif /* HAVE_LONGLONG */
6502 }
6503
6504 return count;
6505 }
6506
6507 #if !defined(HAVE_LONGLONG)
6508 /****************************************************************************
6509 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6510 ****************************************************************************/
6511
6512 static uint32 map_lock_offset(uint32 high, uint32 low)
6513 {
6514 unsigned int i;
6515 uint32 mask = 0;
6516 uint32 highcopy = high;
6517
6518 /*
6519 * Try and find out how many significant bits there are in high.
6520 */
6521
6522 for(i = 0; highcopy; i++)
6523 highcopy >>= 1;
6524
6525 /*
6526 * We use 31 bits not 32 here as POSIX
6527 * lock offsets may not be negative.
6528 */
6529
6530 mask = (~0) << (31 - i);
6531
6532 if(low & mask)
6533 return 0; /* Fail. */
6534
6535 high <<= (31 - i);
6536
6537 return (high|low);
6538 }
6539 #endif /* !defined(HAVE_LONGLONG) */
6540
6541 /****************************************************************************
6542 Get a lock offset, dealing with large offset requests.
6543 ****************************************************************************/
6544
6545 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
6546 {
6547 SMB_BIG_UINT offset = 0;
6548
6549 *err = False;
6550
6551 if(!large_file_format) {
6552 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6553 } else {
6554
6555 #if defined(HAVE_LONGLONG)
6556 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6557 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6558 #else /* HAVE_LONGLONG */
6559
6560 /*
6561 * NT4.x seems to be broken in that it sends large file (64 bit)
6562 * lockingX calls even if the CAP_LARGE_FILES was *not*
6563 * negotiated. For boxes without large unsigned ints mangle the
6564 * lock offset by mapping the top 32 bits onto the lower 32.
6565 */
6566
6567 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6568 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6569 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6570 uint32 new_low = 0;
6571
6572 if((new_low = map_lock_offset(high, low)) == 0) {
6573 *err = True;
6574 return (SMB_BIG_UINT)-1;
6575 }
6576
6577 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6578 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6579 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6580 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6581 }
6582
6583 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6584 #endif /* HAVE_LONGLONG */
6585 }
6586
6587 return offset;
6588 }
6589
6590 /****************************************************************************
6591 Reply to a lockingX request.
6592 ****************************************************************************/
6593
6594 void reply_lockingX(struct smb_request *req)
6595 {
6596 connection_struct *conn = req->conn;
6597 files_struct *fsp;
6598 unsigned char locktype;
6599 unsigned char oplocklevel;
6600 uint16 num_ulocks;
6601 uint16 num_locks;
6602 SMB_BIG_UINT count = 0, offset = 0;
6603 uint32 lock_pid;
6604 int32 lock_timeout;
6605 int i;
6606 char *data;
6607 bool large_file_format;
6608 bool err;
6609 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6610
6611 START_PROFILE(SMBlockingX);
6612
6613 if (req->wct < 8) {
6614 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6615 END_PROFILE(SMBlockingX);
6616 return;
6617 }
6618
6619 fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
6620 locktype = CVAL(req->inbuf,smb_vwv3);
6621 oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6622 num_ulocks = SVAL(req->inbuf,smb_vwv6);
6623 num_locks = SVAL(req->inbuf,smb_vwv7);
6624 lock_timeout = IVAL(req->inbuf,smb_vwv4);
6625 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6626
6627 if (!check_fsp(conn, req, fsp)) {
6628 END_PROFILE(SMBlockingX);
6629 return;
6630 }
6631
6632 data = smb_buf(req->inbuf);
6633
6634 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6635 /* we don't support these - and CANCEL_LOCK makes w2k
6636 and XP reboot so I don't really want to be
6637 compatible! (tridge) */
6638 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6639 END_PROFILE(SMBlockingX);
6640 return;
6641 }
6642
6643 /* Check if this is an oplock break on a file
6644 we have granted an oplock on.
6645 */
6646 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6647 /* Client can insist on breaking to none. */
6648 bool break_to_none = (oplocklevel == 0);
6649 bool result;
6650
6651 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6652 "for fnum = %d\n", (unsigned int)oplocklevel,
6653 fsp->fnum ));
6654
6655 /*
6656 * Make sure we have granted an exclusive or batch oplock on
6657 * this file.
6658 */
6659
6660 if (fsp->oplock_type == 0) {
6661
6662 /* The Samba4 nbench simulator doesn't understand
6663 the difference between break to level2 and break
6664 to none from level2 - it sends oplock break
6665 replies in both cases. Don't keep logging an error
6666 message here - just ignore it. JRA. */
6667
6668 DEBUG(5,("reply_lockingX: Error : oplock break from "
6669 "client for fnum = %d (oplock=%d) and no "
6670 "oplock granted on this file (%s).\n",
6671 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6672
6673 /* if this is a pure oplock break request then don't
6674 * send a reply */
6675 if (num_locks == 0 && num_ulocks == 0) {
6676 END_PROFILE(SMBlockingX);
6677 return;
6678 } else {
6679 END_PROFILE(SMBlockingX);
6680 reply_doserror(req, ERRDOS, ERRlock);
6681 return;
6682 }
6683 }
6684
6685 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6686 (break_to_none)) {
6687 result = remove_oplock(fsp);
6688 } else {
6689 result = downgrade_oplock(fsp);
6690 }
6691
6692 if (!result) {
6693 DEBUG(0, ("reply_lockingX: error in removing "
6694 "oplock on file %s\n", fsp->fsp_name));
6695 /* Hmmm. Is this panic justified? */
6696 smb_panic("internal tdb error");
6697 }
6698
6699 reply_to_oplock_break_requests(fsp);
6700
6701 /* if this is a pure oplock break request then don't send a
6702 * reply */
6703 if (num_locks == 0 && num_ulocks == 0) {
6704 /* Sanity check - ensure a pure oplock break is not a
6705 chained request. */
6706 if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6707 DEBUG(0,("reply_lockingX: Error : pure oplock "
6708 "break is a chained %d request !\n",
6709 (unsigned int)CVAL(req->inbuf,
6710 smb_vwv0) ));
6711 END_PROFILE(SMBlockingX);
6712 return;
6713 }
6714 }
6715
6716 /*
6717 * We do this check *after* we have checked this is not a oplock break
6718 * response message. JRA.
6719 */
6720
6721 release_level_2_oplocks_on_change(fsp);
6722
6723 if (smb_buflen(req->inbuf) <
6724 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6725 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6726 END_PROFILE(SMBlockingX);
6727 return;
6728 }
6729
6730 /* Data now points at the beginning of the list
6731 of smb_unlkrng structs */
6732 for(i = 0; i < (int)num_ulocks; i++) {
6733 lock_pid = get_lock_pid( data, i, large_file_format);
6734 count = get_lock_count( data, i, large_file_format);
6735 offset = get_lock_offset( data, i, large_file_format, &err);
6736
6737 /*
6738 * There is no error code marked "stupid client bug".... :-).
6739 */
6740 if(err) {
6741 END_PROFILE(SMBlockingX);
6742 reply_doserror(req, ERRDOS, ERRnoaccess);
6743 return;
6744 }
6745
6746 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6747 "pid %u, file %s\n", (double)offset, (double)count,
6748 (unsigned int)lock_pid, fsp->fsp_name ));
6749
6750 status = do_unlock(smbd_messaging_context(),
6751 fsp,
6752 lock_pid,
6753 count,
6754 offset,
6755 WINDOWS_LOCK);
6756
6757 if (NT_STATUS_V(status)) {
6758 END_PROFILE(SMBlockingX);
6759 reply_nterror(req, status);
6760 return;
6761 }
6762 }
6763
6764 /* Setup the timeout in seconds. */
6765
6766 if (!lp_blocking_locks(SNUM(conn))) {
6767 lock_timeout = 0;
6768 }
6769
6770 /* Now do any requested locks */
6771 data += ((large_file_format ? 20 : 10)*num_ulocks);
6772
6773 /* Data now points at the beginning of the list
6774 of smb_lkrng structs */
6775
6776 for(i = 0; i < (int)num_locks; i++) {
6777 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6778 READ_LOCK:WRITE_LOCK);
6779 lock_pid = get_lock_pid( data, i, large_file_format);
6780 count = get_lock_count( data, i, large_file_format);
6781 offset = get_lock_offset( data, i, large_file_format, &err);
6782
6783 /*
6784 * There is no error code marked "stupid client bug".... :-).
6785 */
6786 if(err) {
6787 END_PROFILE(SMBlockingX);
6788 reply_doserror(req, ERRDOS, ERRnoaccess);
6789 return;
6790 }
6791
6792 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6793 "%u, file %s timeout = %d\n", (double)offset,
6794 (double)count, (unsigned int)lock_pid,
6795 fsp->fsp_name, (int)lock_timeout ));
6796
6797 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6798 if (lp_blocking_locks(SNUM(conn))) {
6799
6800 /* Schedule a message to ourselves to
6801 remove the blocking lock record and
6802 return the right error. */
6803
6804 if (!blocking_lock_cancel(fsp,
6805 lock_pid,
6806 offset,
6807 count,
6808 WINDOWS_LOCK,
6809 locktype,
6810 NT_STATUS_FILE_LOCK_CONFLICT)) {
6811 END_PROFILE(SMBlockingX);
6812 reply_nterror(
6813 req,
6814 NT_STATUS_DOS(
6815 ERRDOS,
6816 ERRcancelviolation));
6817 return;
6818 }
6819 }
6820 /* Remove a matching pending lock. */
6821 status = do_lock_cancel(fsp,
6822 lock_pid,
6823 count,
6824 offset,
6825 WINDOWS_LOCK);
6826 } else {
6827 bool blocking_lock = lock_timeout ? True : False;
6828 bool defer_lock = False;
6829 struct byte_range_lock *br_lck;
6830 uint32 block_smbpid;
6831
6832 br_lck = do_lock(smbd_messaging_context(),
6833 fsp,
6834 lock_pid,
6835 count,
6836 offset,
6837 lock_type,
6838 WINDOWS_LOCK,
6839 blocking_lock,
6840 &status,
6841 &block_smbpid);
6842
6843 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6844 /* Windows internal resolution for blocking locks seems
6845 to be about 200ms... Don't wait for less than that. JRA. */
6846 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6847 lock_timeout = lp_lock_spin_time();
6848 }
6849 defer_lock = True;
6850 }
6851
6852 /* This heuristic seems to match W2K3 very well. If a
6853 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6854 it pretends we asked for a timeout of between 150 - 300 milliseconds as
6855 far as I can tell. Replacement for do_lock_spin(). JRA. */
6856
6857 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6858 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6859 defer_lock = True;
6860 lock_timeout = lp_lock_spin_time();
6861 }
6862
6863 if (br_lck && defer_lock) {
6864 /*
6865 * A blocking lock was requested. Package up
6866 * this smb into a queued request and push it
6867 * onto the blocking lock queue.
6868 */
6869 if(push_blocking_lock_request(br_lck,
6870 req,
6871 fsp,
6872 lock_timeout,
6873 i,
6874 lock_pid,
6875 lock_type,
6876 WINDOWS_LOCK,
6877 offset,
6878 count,
6879 block_smbpid)) {
6880 TALLOC_FREE(br_lck);
6881 END_PROFILE(SMBlockingX);
6882 return;
6883 }
6884 }
6885
6886 TALLOC_FREE(br_lck);
6887 }
6888
6889 if (NT_STATUS_V(status)) {
6890 END_PROFILE(SMBlockingX);
6891 reply_nterror(req, status);
6892 return;
6893 }
6894 }
6895
6896 /* If any of the above locks failed, then we must unlock
6897 all of the previous locks (X/Open spec). */
6898
6899 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
6900 (i != num_locks) &&
6901 (num_locks != 0)) {
6902 /*
6903 * Ensure we don't do a remove on the lock that just failed,
6904 * as under POSIX rules, if we have a lock already there, we
6905 * will delete it (and we shouldn't) .....
6906 */
6907 for(i--; i >= 0; i--) {
6908 lock_pid = get_lock_pid( data, i, large_file_format);
6909 count = get_lock_count( data, i, large_file_format);
6910 offset = get_lock_offset( data, i, large_file_format,
6911 &err);
6912
6913 /*
6914 * There is no error code marked "stupid client
6915 * bug".... :-).
6916 */
6917 if(err) {
6918 END_PROFILE(SMBlockingX);
6919 reply_doserror(req, ERRDOS, ERRnoaccess);
6920 return;
6921 }
6922
6923 do_unlock(smbd_messaging_context(),
6924 fsp,
6925 lock_pid,
6926 count,
6927 offset,
6928 WINDOWS_LOCK);
6929 }
6930 END_PROFILE(SMBlockingX);
6931 reply_nterror(req, status);
6932 return;
6933 }
6934
6935 reply_outbuf(req, 2, 0);
6936
6937 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
6938 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
6939
6940 END_PROFILE(SMBlockingX);
6941 chain_reply(req);
6942 }
6943
6944 #undef DBGC_CLASS
6945 #define DBGC_CLASS DBGC_ALL
6946
6947 /****************************************************************************
6948 Reply to a SMBreadbmpx (read block multiplex) request.
6949 Always reply with an error, if someone has a platform really needs this,
6950 please contact vl@samba.org
6951 ****************************************************************************/
6952
6953 void reply_readbmpx(struct smb_request *req)
6954 {
6955 START_PROFILE(SMBreadBmpx);
6956 reply_doserror(req, ERRSRV, ERRuseSTD);
6957 END_PROFILE(SMBreadBmpx);
6958 return;
6959 }
6960
6961 /****************************************************************************
6962 Reply to a SMBreadbs (read block multiplex secondary) request.
6963 Always reply with an error, if someone has a platform really needs this,
6964 please contact vl@samba.org
6965 ****************************************************************************/
6966
6967 void reply_readbs(struct smb_request *req)
6968 {
6969 START_PROFILE(SMBreadBs);
6970 reply_doserror(req, ERRSRV, ERRuseSTD);
6971 END_PROFILE(SMBreadBs);
6972 return;
6973 }
6974
6975 /****************************************************************************
6976 Reply to a SMBsetattrE.
6977 ****************************************************************************/
6978
6979 void reply_setattrE(struct smb_request *req)
6980 {
6981 connection_struct *conn = req->conn;
6982 struct timespec ts[2];
6983 files_struct *fsp;
6984 SMB_STRUCT_STAT sbuf;
6985 NTSTATUS status;
6986
6987 START_PROFILE(SMBsetattrE);
6988
6989 if (req->wct < 7) {
6990 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6991 END_PROFILE(SMBsetattrE);
6992 return;
6993 }
6994
6995 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
6996
6997 if(!fsp || (fsp->conn != conn)) {
6998 reply_doserror(req, ERRDOS, ERRbadfid);
6999 END_PROFILE(SMBsetattrE);
7000 return;
7001 }
7002
7003
7004 /*
7005 * Convert the DOS times into unix times. Ignore create
7006 * time as UNIX can't set this.
7007 */
7008
7009 ts[0] = convert_time_t_to_timespec(
7010 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7011 ts[1] = convert_time_t_to_timespec(
7012 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7013
7014 reply_outbuf(req, 0, 0);
7015
7016 /*
7017 * Patch from Ray Frush <frush@engr.colostate.edu>
7018 * Sometimes times are sent as zero - ignore them.
7019 */
7020
7021 /* Ensure we have a valid stat struct for the source. */
7022 if (fsp->fh->fd != -1) {
7023 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7024 status = map_nt_error_from_unix(errno);
7025 reply_nterror(req, status);
7026 END_PROFILE(SMBsetattrE);
7027 return;
7028 }
7029 } else {
7030 if (SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf) == -1) {
7031 status = map_nt_error_from_unix(errno);
7032 reply_nterror(req, status);
7033 END_PROFILE(SMBsetattrE);
7034 return;
7035 }
7036 }
7037
7038 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7039 &sbuf, ts, true);
7040 if (!NT_STATUS_IS_OK(status)) {
7041 reply_doserror(req, ERRDOS, ERRnoaccess);
7042 END_PROFILE(SMBsetattrE);
7043 return;
7044 }
7045
7046 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7047 fsp->fnum,
7048 (unsigned int)ts[0].tv_sec,
7049 (unsigned int)ts[1].tv_sec));
7050
7051 END_PROFILE(SMBsetattrE);
7052 return;
7053 }
7054
7055
7056 /* Back from the dead for OS/2..... JRA. */
7057
7058 /****************************************************************************
7059 Reply to a SMBwritebmpx (write block multiplex primary) request.
7060 Always reply with an error, if someone has a platform really needs this,
7061 please contact vl@samba.org
7062 ****************************************************************************/
7063
7064 void reply_writebmpx(struct smb_request *req)
7065 {
7066 START_PROFILE(SMBwriteBmpx);
7067 reply_doserror(req, ERRSRV, ERRuseSTD);
7068 END_PROFILE(SMBwriteBmpx);
7069 return;
7070 }
7071
7072 /****************************************************************************
7073 Reply to a SMBwritebs (write block multiplex secondary) request.
7074 Always reply with an error, if someone has a platform really needs this,
7075 please contact vl@samba.org
7076 ****************************************************************************/
7077
7078 void reply_writebs(struct smb_request *req)
7079 {
7080 START_PROFILE(SMBwriteBs);
7081 reply_doserror(req, ERRSRV, ERRuseSTD);
7082 END_PROFILE(SMBwriteBs);
7083 return;
7084 }
7085
7086 /****************************************************************************
7087 Reply to a SMBgetattrE.
7088 ****************************************************************************/
7089
7090 void reply_getattrE(struct smb_request *req)
7091 {
7092 connection_struct *conn = req->conn;
7093 SMB_STRUCT_STAT sbuf;
7094 int mode;
7095 files_struct *fsp;
7096
7097 START_PROFILE(SMBgetattrE);
7098
7099 if (req->wct < 1) {
7100 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7101 END_PROFILE(SMBgetattrE);
7102 return;
7103 }
7104
7105 fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7106
7107 if(!fsp || (fsp->conn != conn)) {
7108 reply_doserror(req, ERRDOS, ERRbadfid);
7109 END_PROFILE(SMBgetattrE);
7110 return;
7111 }
7112
7113 /* Do an fstat on this file */
7114 if(fsp_stat(fsp, &sbuf)) {
7115 reply_unixerror(req, ERRDOS, ERRnoaccess);
7116 END_PROFILE(SMBgetattrE);
7117 return;
7118 }
7119
7120 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7121
7122 /*
7123 * Convert the times into dos times. Set create
7124 * date to be last modify date as UNIX doesn't save
7125 * this.
7126 */
7127
7128 reply_outbuf(req, 11, 0);
7129
7130 srv_put_dos_date2((char *)req->outbuf, smb_vwv0,
7131 get_create_time(&sbuf,
7132 lp_fake_dir_create_times(SNUM(conn))));
7133 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7134 /* Should we check pending modtime here ? JRA */
7135 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7136
7137 if (mode & aDIR) {
7138 SIVAL(req->outbuf, smb_vwv6, 0);
7139 SIVAL(req->outbuf, smb_vwv8, 0);
7140 } else {
7141 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7142 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7143 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7144 }
7145 SSVAL(req->outbuf,smb_vwv10, mode);
7146
7147 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7148
7149 END_PROFILE(SMBgetattrE);
7150 return;
7151 }
Samba GIT mirror