?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
get rid of unneeded argument in get_methods and get_alloc_methods
[Samba.git] / source / smbd / nttrans.c
blobb6951272d7b8373ebb300ab97b9b8a6bcbd6d326
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25
26 static char *nttrans_realloc(char **ptr, size_t size)
27 {
28 if (ptr==NULL) {
29 smb_panic("nttrans_realloc() called with NULL ptr");
30 }
31
32 *ptr = (char *)SMB_REALLOC(*ptr, size);
33 if(*ptr == NULL) {
34 return NULL;
35 }
36 memset(*ptr,'\0',size);
37 return *ptr;
38 }
39
40 /****************************************************************************
41 Send the required number of replies back.
42 We assume all fields other than the data fields are
43 set correctly for the type of call.
44 HACK ! Always assumes smb_setup field is zero.
45 ****************************************************************************/
46
47 void send_nt_replies(connection_struct *conn,
48 struct smb_request *req, NTSTATUS nt_error,
49 char *params, int paramsize,
50 char *pdata, int datasize)
51 {
52 int data_to_send = datasize;
53 int params_to_send = paramsize;
54 int useable_space;
55 char *pp = params;
56 char *pd = pdata;
57 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
58 int alignment_offset = 3;
59 int data_alignment_offset = 0;
60
61 /*
62 * If there genuinely are no parameters or data to send just send
63 * the empty packet.
64 */
65
66 if(params_to_send == 0 && data_to_send == 0) {
67 reply_outbuf(req, 18, 0);
68 show_msg((char *)req->outbuf);
69 return;
70 }
71
72 /*
73 * When sending params and data ensure that both are nicely aligned.
74 * Only do this alignment when there is also data to send - else
75 * can cause NT redirector problems.
76 */
77
78 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
79 data_alignment_offset = 4 - (params_to_send % 4);
80 }
81
82 /*
83 * Space is bufsize minus Netbios over TCP header minus SMB header.
84 * The alignment_offset is to align the param bytes on a four byte
85 * boundary (2 bytes for data len, one byte pad).
86 * NT needs this to work correctly.
87 */
88
89 useable_space = max_send - (smb_size
90 + 2 * 18 /* wct */
91 + alignment_offset
92 + data_alignment_offset);
93
94 /*
95 * useable_space can never be more than max_send minus the
96 * alignment offset.
97 */
98
99 useable_space = MIN(useable_space,
100 max_send - (alignment_offset+data_alignment_offset));
101
102
103 while (params_to_send || data_to_send) {
104
105 /*
106 * Calculate whether we will totally or partially fill this packet.
107 */
108
109 total_sent_thistime = params_to_send + data_to_send +
110 alignment_offset + data_alignment_offset;
111
112 /*
113 * We can never send more than useable_space.
114 */
115
116 total_sent_thistime = MIN(total_sent_thistime, useable_space);
117
118 reply_outbuf(req, 18, total_sent_thistime);
119
120 /*
121 * Set total params and data to be sent.
122 */
123
124 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
125 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
126
127 /*
128 * Calculate how many parameters and data we can fit into
129 * this packet. Parameters get precedence.
130 */
131
132 params_sent_thistime = MIN(params_to_send,useable_space);
133 data_sent_thistime = useable_space - params_sent_thistime;
134 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
135
136 SIVAL(req->outbuf, smb_ntr_ParameterCount,
137 params_sent_thistime);
138
139 if(params_sent_thistime == 0) {
140 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
141 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
142 } else {
143 /*
144 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
145 * parameter bytes, however the first 4 bytes of outbuf are
146 * the Netbios over TCP header. Thus use smb_base() to subtract
147 * them from the calculation.
148 */
149
150 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
151 ((smb_buf(req->outbuf)+alignment_offset)
152 - smb_base(req->outbuf)));
153 /*
154 * Absolute displacement of param bytes sent in this packet.
155 */
156
157 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
158 pp - params);
159 }
160
161 /*
162 * Deal with the data portion.
163 */
164
165 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
166
167 if(data_sent_thistime == 0) {
168 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
169 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
170 } else {
171 /*
172 * The offset of the data bytes is the offset of the
173 * parameter bytes plus the number of parameters being sent this time.
174 */
175
176 SIVAL(req->outbuf, smb_ntr_DataOffset,
177 ((smb_buf(req->outbuf)+alignment_offset) -
178 smb_base(req->outbuf))
179 + params_sent_thistime + data_alignment_offset);
180 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
181 }
182
183 /*
184 * Copy the param bytes into the packet.
185 */
186
187 if(params_sent_thistime) {
188 if (alignment_offset != 0) {
189 memset(smb_buf(req->outbuf), 0,
190 alignment_offset);
191 }
192 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
193 params_sent_thistime);
194 }
195
196 /*
197 * Copy in the data bytes
198 */
199
200 if(data_sent_thistime) {
201 if (data_alignment_offset != 0) {
202 memset((smb_buf(req->outbuf)+alignment_offset+
203 params_sent_thistime), 0,
204 data_alignment_offset);
205 }
206 memcpy(smb_buf(req->outbuf)+alignment_offset
207 +params_sent_thistime+data_alignment_offset,
208 pd,data_sent_thistime);
209 }
210
211 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
212 params_sent_thistime, data_sent_thistime, useable_space));
213 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
214 params_to_send, data_to_send, paramsize, datasize));
215
216 if (NT_STATUS_V(nt_error)) {
217 error_packet_set((char *)req->outbuf,
218 0, 0, nt_error,
219 __LINE__,__FILE__);
220 }
221
222 /* Send the packet */
223 show_msg((char *)req->outbuf);
224 if (!srv_send_smb(smbd_server_fd(),
225 (char *)req->outbuf,
226 IS_CONN_ENCRYPTED(conn))) {
227 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
228 }
229
230 TALLOC_FREE(req->outbuf);
231
232 pp += params_sent_thistime;
233 pd += data_sent_thistime;
234
235 params_to_send -= params_sent_thistime;
236 data_to_send -= data_sent_thistime;
237
238 /*
239 * Sanity check
240 */
241
242 if(params_to_send < 0 || data_to_send < 0) {
243 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
244 params_to_send, data_to_send));
245 return;
246 }
247 }
248 }
249
250 /****************************************************************************
251 Is it an NTFS stream name ?
252 An NTFS file name is <path>.<extention>:<stream name>:<stream type>
253 $DATA can be used as both a stream name and a stream type. A missing stream
254 name or type implies $DATA.
255 ****************************************************************************/
256
257 bool is_ntfs_stream_name(const char *fname)
258 {
259 if (lp_posix_pathnames()) {
260 return False;
261 }
262 return (strchr_m(fname, ':') != NULL) ? True : False;
263 }
264
265 /****************************************************************************
266 Reply to an NT create and X call on a pipe
267 ****************************************************************************/
268
269 static void nt_open_pipe(char *fname, connection_struct *conn,
270 struct smb_request *req, int *ppnum)
271 {
272 smb_np_struct *p = NULL;
273
274 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
275
276 /* See if it is one we want to handle. */
277
278 if (!is_known_pipename(fname)) {
279 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
280 ERRDOS, ERRbadpipe);
281 return;
282 }
283
284 /* Strip \\ off the name. */
285 fname++;
286
287 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
288
289 p = open_rpc_pipe_p(fname, conn, req->vuid);
290 if (!p) {
291 reply_doserror(req, ERRSRV, ERRnofids);
292 return;
293 }
294
295 /* TODO: Add pipe to db */
296
297 if ( !store_pipe_opendb( p ) ) {
298 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
299 }
300
301 *ppnum = p->pnum;
302 return;
303 }
304
305 /****************************************************************************
306 Reply to an NT create and X call for pipes.
307 ****************************************************************************/
308
309 static void do_ntcreate_pipe_open(connection_struct *conn,
310 struct smb_request *req)
311 {
312 char *fname = NULL;
313 int pnum = -1;
314 char *p = NULL;
315 uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
316 TALLOC_CTX *ctx = talloc_tos();
317
318 srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
319 smb_buf(req->inbuf), STR_TERMINATE);
320
321 if (!fname) {
322 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
323 ERRDOS, ERRbadpipe);
324 return;
325 }
326 nt_open_pipe(fname, conn, req, &pnum);
327
328 if (req->outbuf) {
329 /* error reply */
330 return;
331 }
332
333 /*
334 * Deal with pipe return.
335 */
336
337 if (flags & EXTENDED_RESPONSE_REQUIRED) {
338 /* This is very strange. We
339 * return 50 words, but only set
340 * the wcnt to 42 ? It's definately
341 * what happens on the wire....
342 */
343 reply_outbuf(req, 50, 0);
344 SCVAL(req->outbuf,smb_wct,42);
345 } else {
346 reply_outbuf(req, 34, 0);
347 }
348
349 p = (char *)req->outbuf + smb_vwv2;
350 p++;
351 SSVAL(p,0,pnum);
352 p += 2;
353 SIVAL(p,0,FILE_WAS_OPENED);
354 p += 4;
355 p += 32;
356 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
357 p += 20;
358 /* File type. */
359 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
360 /* Device state. */
361 SSVAL(p,2, 0x5FF); /* ? */
362 p += 4;
363
364 if (flags & EXTENDED_RESPONSE_REQUIRED) {
365 p += 25;
366 SIVAL(p,0,FILE_GENERIC_ALL);
367 /*
368 * For pipes W2K3 seems to return
369 * 0x12019B next.
370 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
371 */
372 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
373 }
374
375 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
376
377 chain_reply(req);
378 }
379
380 /****************************************************************************
381 Reply to an NT create and X call.
382 ****************************************************************************/
383
384 void reply_ntcreate_and_X(struct smb_request *req)
385 {
386 connection_struct *conn = req->conn;
387 char *fname = NULL;
388 uint32 flags;
389 uint32 access_mask;
390 uint32 file_attributes;
391 uint32 share_access;
392 uint32 create_disposition;
393 uint32 create_options;
394 uint16 root_dir_fid;
395 SMB_BIG_UINT allocation_size;
396 /* Breakout the oplock request bits so we can set the
397 reply bits separately. */
398 uint32 fattr=0;
399 SMB_OFF_T file_len = 0;
400 SMB_STRUCT_STAT sbuf;
401 int info = 0;
402 files_struct *fsp = NULL;
403 char *p = NULL;
404 struct timespec c_timespec;
405 struct timespec a_timespec;
406 struct timespec m_timespec;
407 NTSTATUS status;
408 int oplock_request;
409 uint8_t oplock_granted = NO_OPLOCK_RETURN;
410 TALLOC_CTX *ctx = talloc_tos();
411
412 START_PROFILE(SMBntcreateX);
413
414 if (req->wct < 24) {
415 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
416 return;
417 }
418
419 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
420 access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
421 file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
422 share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
423 create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
424 create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
425 root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
426
427 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
428 smb_ntcreate_AllocationSize);
429 #ifdef LARGE_SMB_OFF_T
430 allocation_size |= (((SMB_BIG_UINT)IVAL(
431 req->inbuf,
432 smb_ntcreate_AllocationSize + 4)) << 32);
433 #endif
434
435 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
436 smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
437
438 if (!NT_STATUS_IS_OK(status)) {
439 reply_nterror(req, status);
440 END_PROFILE(SMBntcreateX);
441 return;
442 }
443
444 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
445 "file_attributes = 0x%x, share_access = 0x%x, "
446 "create_disposition = 0x%x create_options = 0x%x "
447 "root_dir_fid = 0x%x, fname = %s\n",
448 (unsigned int)flags,
449 (unsigned int)access_mask,
450 (unsigned int)file_attributes,
451 (unsigned int)share_access,
452 (unsigned int)create_disposition,
453 (unsigned int)create_options,
454 (unsigned int)root_dir_fid,
455 fname));
456
457 /*
458 * we need to remove ignored bits when they come directly from the client
459 * because we reuse some of them for internal stuff
460 */
461 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
462
463 /*
464 * If it's an IPC, use the pipe handler.
465 */
466
467 if (IS_IPC(conn)) {
468 if (lp_nt_pipe_support()) {
469 do_ntcreate_pipe_open(conn, req);
470 END_PROFILE(SMBntcreateX);
471 return;
472 }
473 reply_doserror(req, ERRDOS, ERRnoaccess);
474 END_PROFILE(SMBntcreateX);
475 return;
476 }
477
478 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
479 if (oplock_request) {
480 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
481 ? BATCH_OPLOCK : 0;
482 }
483
484 status = create_file(conn, req, root_dir_fid, fname,
485 access_mask, share_access, create_disposition,
486 create_options, file_attributes, oplock_request,
487 allocation_size, NULL, NULL, &fsp, &info, &sbuf);
488
489 if (!NT_STATUS_IS_OK(status)) {
490 if (open_was_deferred(req->mid)) {
491 /* We have re-scheduled this call, no error. */
492 END_PROFILE(SMBntcreateX);
493 return;
494 }
495 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
496 reply_botherror(req, status, ERRDOS, ERRfilexists);
497 }
498 else {
499 reply_nterror(req, status);
500 }
501 END_PROFILE(SMBntcreateX);
502 return;
503 }
504
505 /*
506 * If the caller set the extended oplock request bit
507 * and we granted one (by whatever means) - set the
508 * correct bit for extended oplock reply.
509 */
510
511 if (oplock_request &&
512 (lp_fake_oplocks(SNUM(conn))
513 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
514
515 /*
516 * Exclusive oplock granted
517 */
518
519 if (flags & REQUEST_BATCH_OPLOCK) {
520 oplock_granted = BATCH_OPLOCK_RETURN;
521 } else {
522 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
523 }
524 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
525 oplock_granted = LEVEL_II_OPLOCK_RETURN;
526 } else {
527 oplock_granted = NO_OPLOCK_RETURN;
528 }
529
530 file_len = sbuf.st_size;
531 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
532 if (fattr == 0) {
533 fattr = FILE_ATTRIBUTE_NORMAL;
534 }
535
536 if (flags & EXTENDED_RESPONSE_REQUIRED) {
537 /* This is very strange. We
538 * return 50 words, but only set
539 * the wcnt to 42 ? It's definately
540 * what happens on the wire....
541 */
542 reply_outbuf(req, 50, 0);
543 SCVAL(req->outbuf,smb_wct,42);
544 } else {
545 reply_outbuf(req, 34, 0);
546 }
547
548 p = (char *)req->outbuf + smb_vwv2;
549
550 SCVAL(p, 0, oplock_granted);
551
552 p++;
553 SSVAL(p,0,fsp->fnum);
554 p += 2;
555 if ((create_disposition == FILE_SUPERSEDE)
556 && (info == FILE_WAS_OVERWRITTEN)) {
557 SIVAL(p,0,FILE_WAS_SUPERSEDED);
558 } else {
559 SIVAL(p,0,info);
560 }
561 p += 4;
562
563 /* Create time. */
564 c_timespec = get_create_timespec(
565 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
566 a_timespec = get_atimespec(&sbuf);
567 m_timespec = get_mtimespec(&sbuf);
568
569 if (lp_dos_filetime_resolution(SNUM(conn))) {
570 dos_filetime_timespec(&c_timespec);
571 dos_filetime_timespec(&a_timespec);
572 dos_filetime_timespec(&m_timespec);
573 }
574
575 put_long_date_timespec(p, c_timespec); /* create time. */
576 p += 8;
577 put_long_date_timespec(p, a_timespec); /* access time */
578 p += 8;
579 put_long_date_timespec(p, m_timespec); /* write time */
580 p += 8;
581 put_long_date_timespec(p, m_timespec); /* change time */
582 p += 8;
583 SIVAL(p,0,fattr); /* File Attributes. */
584 p += 4;
585 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
586 p += 8;
587 SOFF_T(p,0,file_len);
588 p += 8;
589 if (flags & EXTENDED_RESPONSE_REQUIRED) {
590 SSVAL(p,2,0x7);
591 }
592 p += 4;
593 SCVAL(p,0,fsp->is_directory ? 1 : 0);
594
595 if (flags & EXTENDED_RESPONSE_REQUIRED) {
596 uint32 perms = 0;
597 p += 25;
598 if (fsp->is_directory
599 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
600 perms = FILE_GENERIC_ALL;
601 } else {
602 perms = FILE_GENERIC_READ|FILE_EXECUTE;
603 }
604 SIVAL(p,0,perms);
605 }
606
607 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
608 fsp->fnum, fsp->fsp_name));
609
610 chain_reply(req);
611 END_PROFILE(SMBntcreateX);
612 return;
613 }
614
615 /****************************************************************************
616 Reply to a NT_TRANSACT_CREATE call to open a pipe.
617 ****************************************************************************/
618
619 static void do_nt_transact_create_pipe(connection_struct *conn,
620 struct smb_request *req,
621 uint16 **ppsetup, uint32 setup_count,
622 char **ppparams, uint32 parameter_count,
623 char **ppdata, uint32 data_count)
624 {
625 char *fname = NULL;
626 char *params = *ppparams;
627 int pnum = -1;
628 char *p = NULL;
629 NTSTATUS status;
630 size_t param_len;
631 uint32 flags;
632 TALLOC_CTX *ctx = talloc_tos();
633
634 /*
635 * Ensure minimum number of parameters sent.
636 */
637
638 if(parameter_count < 54) {
639 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
640 reply_doserror(req, ERRDOS, ERRnoaccess);
641 return;
642 }
643
644 flags = IVAL(params,0);
645
646 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
647 parameter_count-53, STR_TERMINATE,
648 &status);
649 if (!NT_STATUS_IS_OK(status)) {
650 reply_nterror(req, status);
651 return;
652 }
653
654 nt_open_pipe(fname, conn, req, &pnum);
655
656 if (req->outbuf) {
657 /* Error return */
658 return;
659 }
660
661 /* Realloc the size of parameters and data we will return */
662 if (flags & EXTENDED_RESPONSE_REQUIRED) {
663 /* Extended response is 32 more byyes. */
664 param_len = 101;
665 } else {
666 param_len = 69;
667 }
668 params = nttrans_realloc(ppparams, param_len);
669 if(params == NULL) {
670 reply_doserror(req, ERRDOS, ERRnomem);
671 return;
672 }
673
674 p = params;
675 SCVAL(p,0,NO_OPLOCK_RETURN);
676
677 p += 2;
678 SSVAL(p,0,pnum);
679 p += 2;
680 SIVAL(p,0,FILE_WAS_OPENED);
681 p += 8;
682
683 p += 32;
684 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
685 p += 20;
686 /* File type. */
687 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
688 /* Device state. */
689 SSVAL(p,2, 0x5FF); /* ? */
690 p += 4;
691
692 if (flags & EXTENDED_RESPONSE_REQUIRED) {
693 p += 25;
694 SIVAL(p,0,FILE_GENERIC_ALL);
695 /*
696 * For pipes W2K3 seems to return
697 * 0x12019B next.
698 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
699 */
700 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
701 }
702
703 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
704
705 /* Send the required number of replies */
706 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
707
708 return;
709 }
710
711 /****************************************************************************
712 Internal fn to set security descriptors.
713 ****************************************************************************/
714
715 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
716 uint32 security_info_sent)
717 {
718 SEC_DESC *psd = NULL;
719 NTSTATUS status;
720
721 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
722 return NT_STATUS_OK;
723 }
724
725 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
726
727 if (!NT_STATUS_IS_OK(status)) {
728 return status;
729 }
730
731 if (psd->owner_sid==0) {
732 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
733 }
734 if (psd->group_sid==0) {
735 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
736 }
737 if (psd->sacl==0) {
738 security_info_sent &= ~SACL_SECURITY_INFORMATION;
739 }
740 if (psd->dacl==0) {
741 security_info_sent &= ~DACL_SECURITY_INFORMATION;
742 }
743
744 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
745
746 TALLOC_FREE(psd);
747
748 return status;
749 }
750
751 /****************************************************************************
752 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
753 ****************************************************************************/
754
755 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
756 {
757 struct ea_list *ea_list_head = NULL;
758 size_t offset = 0;
759
760 if (data_size < 4) {
761 return NULL;
762 }
763
764 while (offset + 4 <= data_size) {
765 size_t next_offset = IVAL(pdata,offset);
766 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
767
768 if (!eal) {
769 return NULL;
770 }
771
772 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
773 if (next_offset == 0) {
774 break;
775 }
776 offset += next_offset;
777 }
778
779 return ea_list_head;
780 }
781
782 /****************************************************************************
783 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
784 ****************************************************************************/
785
786 static void call_nt_transact_create(connection_struct *conn,
787 struct smb_request *req,
788 uint16 **ppsetup, uint32 setup_count,
789 char **ppparams, uint32 parameter_count,
790 char **ppdata, uint32 data_count,
791 uint32 max_data_count)
792 {
793 char *fname = NULL;
794 char *params = *ppparams;
795 char *data = *ppdata;
796 /* Breakout the oplock request bits so we can set the reply bits separately. */
797 uint32 fattr=0;
798 SMB_OFF_T file_len = 0;
799 SMB_STRUCT_STAT sbuf;
800 int info = 0;
801 files_struct *fsp = NULL;
802 char *p = NULL;
803 uint32 flags;
804 uint32 access_mask;
805 uint32 file_attributes;
806 uint32 share_access;
807 uint32 create_disposition;
808 uint32 create_options;
809 uint32 sd_len;
810 struct security_descriptor *sd = NULL;
811 uint32 ea_len;
812 uint16 root_dir_fid;
813 struct timespec c_timespec;
814 struct timespec a_timespec;
815 struct timespec m_timespec;
816 struct ea_list *ea_list = NULL;
817 NTSTATUS status;
818 size_t param_len;
819 SMB_BIG_UINT allocation_size;
820 int oplock_request;
821 uint8_t oplock_granted;
822 TALLOC_CTX *ctx = talloc_tos();
823
824 DEBUG(5,("call_nt_transact_create\n"));
825
826 /*
827 * If it's an IPC, use the pipe handler.
828 */
829
830 if (IS_IPC(conn)) {
831 if (lp_nt_pipe_support()) {
832 do_nt_transact_create_pipe(
833 conn, req,
834 ppsetup, setup_count,
835 ppparams, parameter_count,
836 ppdata, data_count);
837 return;
838 }
839 reply_doserror(req, ERRDOS, ERRnoaccess);
840 return;
841 }
842
843 /*
844 * Ensure minimum number of parameters sent.
845 */
846
847 if(parameter_count < 54) {
848 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
849 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
850 return;
851 }
852
853 flags = IVAL(params,0);
854 access_mask = IVAL(params,8);
855 file_attributes = IVAL(params,20);
856 share_access = IVAL(params,24);
857 create_disposition = IVAL(params,28);
858 create_options = IVAL(params,32);
859 sd_len = IVAL(params,36);
860 ea_len = IVAL(params,40);
861 root_dir_fid = (uint16)IVAL(params,4);
862 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
863 #ifdef LARGE_SMB_OFF_T
864 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
865 #endif
866
867 /*
868 * we need to remove ignored bits when they come directly from the client
869 * because we reuse some of them for internal stuff
870 */
871 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
872
873 /* Ensure the data_len is correct for the sd and ea values given. */
874 if ((ea_len + sd_len > data_count)
875 || (ea_len > data_count) || (sd_len > data_count)
876 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
877 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
878 "%u, data_count = %u\n", (unsigned int)ea_len,
879 (unsigned int)sd_len, (unsigned int)data_count));
880 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
881 return;
882 }
883
884 if (sd_len) {
885 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
886 sd_len));
887
888 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
889 &sd);
890 if (!NT_STATUS_IS_OK(status)) {
891 DEBUG(10, ("call_nt_transact_create: "
892 "unmarshall_sec_desc failed: %s\n",
893 nt_errstr(status)));
894 reply_nterror(req, status);
895 return;
896 }
897 }
898
899 if (ea_len) {
900 if (!lp_ea_support(SNUM(conn))) {
901 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
902 "EA's not supported.\n",
903 (unsigned int)ea_len));
904 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
905 return;
906 }
907
908 if (ea_len < 10) {
909 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
910 "too small (should be more than 10)\n",
911 (unsigned int)ea_len ));
912 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
913 return;
914 }
915
916 /* We have already checked that ea_len <= data_count here. */
917 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
918 ea_len);
919 if (ea_list == NULL) {
920 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
921 return;
922 }
923 }
924
925 srvstr_get_path(ctx, params, req->flags2, &fname,
926 params+53, parameter_count-53,
927 STR_TERMINATE, &status);
928 if (!NT_STATUS_IS_OK(status)) {
929 reply_nterror(req, status);
930 return;
931 }
932
933 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
934 if (oplock_request) {
935 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
936 ? BATCH_OPLOCK : 0;
937 }
938
939 status = create_file(conn, req, root_dir_fid, fname,
940 access_mask, share_access, create_disposition,
941 create_options, file_attributes, oplock_request,
942 allocation_size, sd, ea_list, &fsp, &info, &sbuf);
943
944 if(!NT_STATUS_IS_OK(status)) {
945 if (open_was_deferred(req->mid)) {
946 /* We have re-scheduled this call, no error. */
947 return;
948 }
949 reply_openerror(req, status);
950 return;
951 }
952
953 /*
954 * If the caller set the extended oplock request bit
955 * and we granted one (by whatever means) - set the
956 * correct bit for extended oplock reply.
957 */
958
959 if (oplock_request &&
960 (lp_fake_oplocks(SNUM(conn))
961 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
962
963 /*
964 * Exclusive oplock granted
965 */
966
967 if (flags & REQUEST_BATCH_OPLOCK) {
968 oplock_granted = BATCH_OPLOCK_RETURN;
969 } else {
970 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
971 }
972 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
973 oplock_granted = LEVEL_II_OPLOCK_RETURN;
974 } else {
975 oplock_granted = NO_OPLOCK_RETURN;
976 }
977
978 file_len = sbuf.st_size;
979 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
980 if (fattr == 0) {
981 fattr = FILE_ATTRIBUTE_NORMAL;
982 }
983
984 /* Realloc the size of parameters and data we will return */
985 if (flags & EXTENDED_RESPONSE_REQUIRED) {
986 /* Extended response is 32 more byyes. */
987 param_len = 101;
988 } else {
989 param_len = 69;
990 }
991 params = nttrans_realloc(ppparams, param_len);
992 if(params == NULL) {
993 reply_doserror(req, ERRDOS, ERRnomem);
994 return;
995 }
996
997 p = params;
998 SCVAL(p, 0, oplock_granted);
999
1000 p += 2;
1001 SSVAL(p,0,fsp->fnum);
1002 p += 2;
1003 if ((create_disposition == FILE_SUPERSEDE)
1004 && (info == FILE_WAS_OVERWRITTEN)) {
1005 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1006 } else {
1007 SIVAL(p,0,info);
1008 }
1009 p += 8;
1010
1011 /* Create time. */
1012 c_timespec = get_create_timespec(
1013 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1014 a_timespec = get_atimespec(&sbuf);
1015 m_timespec = get_mtimespec(&sbuf);
1016
1017 if (lp_dos_filetime_resolution(SNUM(conn))) {
1018 dos_filetime_timespec(&c_timespec);
1019 dos_filetime_timespec(&a_timespec);
1020 dos_filetime_timespec(&m_timespec);
1021 }
1022
1023 put_long_date_timespec(p, c_timespec); /* create time. */
1024 p += 8;
1025 put_long_date_timespec(p, a_timespec); /* access time */
1026 p += 8;
1027 put_long_date_timespec(p, m_timespec); /* write time */
1028 p += 8;
1029 put_long_date_timespec(p, m_timespec); /* change time */
1030 p += 8;
1031 SIVAL(p,0,fattr); /* File Attributes. */
1032 p += 4;
1033 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1034 p += 8;
1035 SOFF_T(p,0,file_len);
1036 p += 8;
1037 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1038 SSVAL(p,2,0x7);
1039 }
1040 p += 4;
1041 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1042
1043 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1044 uint32 perms = 0;
1045 p += 25;
1046 if (fsp->is_directory
1047 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1048 perms = FILE_GENERIC_ALL;
1049 } else {
1050 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1051 }
1052 SIVAL(p,0,perms);
1053 }
1054
1055 DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1056
1057 /* Send the required number of replies */
1058 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1059
1060 return;
1061 }
1062
1063 /****************************************************************************
1064 Reply to a NT CANCEL request.
1065 conn POINTER CAN BE NULL HERE !
1066 ****************************************************************************/
1067
1068 void reply_ntcancel(struct smb_request *req)
1069 {
1070 /*
1071 * Go through and cancel any pending change notifies.
1072 */
1073
1074 START_PROFILE(SMBntcancel);
1075 remove_pending_change_notify_requests_by_mid(req->mid);
1076 remove_pending_lock_requests_by_mid(req->mid);
1077 srv_cancel_sign_response(req->mid);
1078
1079 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1080
1081 END_PROFILE(SMBntcancel);
1082 return;
1083 }
1084
1085 /****************************************************************************
1086 Copy a file.
1087 ****************************************************************************/
1088
1089 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1090 connection_struct *conn,
1091 struct smb_request *req,
1092 const char *oldname_in,
1093 const char *newname_in,
1094 uint32 attrs)
1095 {
1096 SMB_STRUCT_STAT sbuf1, sbuf2;
1097 char *oldname = NULL;
1098 char *newname = NULL;
1099 char *last_component_oldname = NULL;
1100 char *last_component_newname = NULL;
1101 files_struct *fsp1,*fsp2;
1102 uint32 fattr;
1103 int info;
1104 SMB_OFF_T ret=-1;
1105 NTSTATUS status = NT_STATUS_OK;
1106
1107 ZERO_STRUCT(sbuf1);
1108 ZERO_STRUCT(sbuf2);
1109
1110 if (!CAN_WRITE(conn)) {
1111 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1112 }
1113
1114 status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1115 &last_component_oldname, &sbuf1);
1116 if (!NT_STATUS_IS_OK(status)) {
1117 return status;
1118 }
1119
1120 status = check_name(conn, oldname);
1121 if (!NT_STATUS_IS_OK(status)) {
1122 return status;
1123 }
1124
1125 /* Source must already exist. */
1126 if (!VALID_STAT(sbuf1)) {
1127 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1128 }
1129 /* Ensure attributes match. */
1130 fattr = dos_mode(conn,oldname,&sbuf1);
1131 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1132 return NT_STATUS_NO_SUCH_FILE;
1133 }
1134
1135 status = unix_convert(ctx, conn, newname_in, False, &newname,
1136 &last_component_newname, &sbuf2);
1137 if (!NT_STATUS_IS_OK(status)) {
1138 return status;
1139 }
1140
1141 status = check_name(conn, newname);
1142 if (!NT_STATUS_IS_OK(status)) {
1143 return status;
1144 }
1145
1146 /* Disallow if newname already exists. */
1147 if (VALID_STAT(sbuf2)) {
1148 return NT_STATUS_OBJECT_NAME_COLLISION;
1149 }
1150
1151 /* No links from a directory. */
1152 if (S_ISDIR(sbuf1.st_mode)) {
1153 return NT_STATUS_FILE_IS_A_DIRECTORY;
1154 }
1155
1156 /* Ensure this is within the share. */
1157 status = check_reduced_name(conn, oldname);
1158 if (!NT_STATUS_IS_OK(status)) {
1159 return status;
1160 }
1161
1162 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1163 oldname, newname));
1164
1165 status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1166 FILE_READ_DATA, /* Read-only. */
1167 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1168 FILE_OPEN,
1169 0, /* No create options. */
1170 FILE_ATTRIBUTE_NORMAL,
1171 NO_OPLOCK,
1172 &info, &fsp1);
1173
1174 if (!NT_STATUS_IS_OK(status)) {
1175 return status;
1176 }
1177
1178 status = open_file_ntcreate(conn, req, newname, &sbuf2,
1179 FILE_WRITE_DATA, /* Read-only. */
1180 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1181 FILE_CREATE,
1182 0, /* No create options. */
1183 fattr,
1184 NO_OPLOCK,
1185 &info, &fsp2);
1186
1187 if (!NT_STATUS_IS_OK(status)) {
1188 close_file(fsp1,ERROR_CLOSE);
1189 return status;
1190 }
1191
1192 if (sbuf1.st_size) {
1193 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1194 }
1195
1196 /*
1197 * As we are opening fsp1 read-only we only expect
1198 * an error on close on fsp2 if we are out of space.
1199 * Thus we don't look at the error return from the
1200 * close of fsp1.
1201 */
1202 close_file(fsp1,NORMAL_CLOSE);
1203
1204 /* Ensure the modtime is set correctly on the destination file. */
1205 set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1206
1207 status = close_file(fsp2,NORMAL_CLOSE);
1208
1209 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1210 creates the file. This isn't the correct thing to do in the copy
1211 case. JRA */
1212 file_set_dosmode(conn, newname, fattr, &sbuf2,
1213 parent_dirname(newname),false);
1214
1215 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1216 return NT_STATUS_DISK_FULL;
1217 }
1218
1219 if (!NT_STATUS_IS_OK(status)) {
1220 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1221 nt_errstr(status), oldname, newname));
1222 }
1223 return status;
1224 }
1225
1226 /****************************************************************************
1227 Reply to a NT rename request.
1228 ****************************************************************************/
1229
1230 void reply_ntrename(struct smb_request *req)
1231 {
1232 connection_struct *conn = req->conn;
1233 char *oldname = NULL;
1234 char *newname = NULL;
1235 char *p;
1236 NTSTATUS status;
1237 bool src_has_wcard = False;
1238 bool dest_has_wcard = False;
1239 uint32 attrs;
1240 uint16 rename_type;
1241 TALLOC_CTX *ctx = talloc_tos();
1242
1243 START_PROFILE(SMBntrename);
1244
1245 if (req->wct < 4) {
1246 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1247 END_PROFILE(SMBntrename);
1248 return;
1249 }
1250
1251 attrs = SVAL(req->inbuf,smb_vwv0);
1252 rename_type = SVAL(req->inbuf,smb_vwv1);
1253
1254 p = smb_buf(req->inbuf) + 1;
1255 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1256 0, STR_TERMINATE, &status,
1257 &src_has_wcard);
1258 if (!NT_STATUS_IS_OK(status)) {
1259 reply_nterror(req, status);
1260 END_PROFILE(SMBntrename);
1261 return;
1262 }
1263
1264 if( is_ntfs_stream_name(oldname)) {
1265 /* Can't rename a stream. */
1266 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1267 END_PROFILE(SMBntrename);
1268 return;
1269 }
1270
1271 if (ms_has_wild(oldname)) {
1272 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1273 END_PROFILE(SMBntrename);
1274 return;
1275 }
1276
1277 p++;
1278 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1279 0, STR_TERMINATE, &status,
1280 &dest_has_wcard);
1281 if (!NT_STATUS_IS_OK(status)) {
1282 reply_nterror(req, status);
1283 END_PROFILE(SMBntrename);
1284 return;
1285 }
1286
1287 status = resolve_dfspath(ctx, conn,
1288 req->flags2 & FLAGS2_DFS_PATHNAMES,
1289 oldname,
1290 &oldname);
1291 if (!NT_STATUS_IS_OK(status)) {
1292 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1293 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1294 ERRSRV, ERRbadpath);
1295 END_PROFILE(SMBntrename);
1296 return;
1297 }
1298 reply_nterror(req, status);
1299 END_PROFILE(SMBntrename);
1300 return;
1301 }
1302
1303 status = resolve_dfspath(ctx, conn,
1304 req->flags2 & FLAGS2_DFS_PATHNAMES,
1305 newname,
1306 &newname);
1307 if (!NT_STATUS_IS_OK(status)) {
1308 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1309 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1310 ERRSRV, ERRbadpath);
1311 END_PROFILE(SMBntrename);
1312 return;
1313 }
1314 reply_nterror(req, status);
1315 END_PROFILE(SMBntrename);
1316 return;
1317 }
1318
1319 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1320
1321 switch(rename_type) {
1322 case RENAME_FLAG_RENAME:
1323 status = rename_internals(ctx, conn, req, oldname,
1324 newname, attrs, False, src_has_wcard,
1325 dest_has_wcard, DELETE_ACCESS);
1326 break;
1327 case RENAME_FLAG_HARD_LINK:
1328 if (src_has_wcard || dest_has_wcard) {
1329 /* No wildcards. */
1330 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1331 } else {
1332 status = hardlink_internals(ctx,
1333 conn,
1334 oldname,
1335 newname);
1336 }
1337 break;
1338 case RENAME_FLAG_COPY:
1339 if (src_has_wcard || dest_has_wcard) {
1340 /* No wildcards. */
1341 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1342 } else {
1343 status = copy_internals(ctx, conn, req, oldname,
1344 newname, attrs);
1345 }
1346 break;
1347 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1348 status = NT_STATUS_INVALID_PARAMETER;
1349 break;
1350 default:
1351 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1352 break;
1353 }
1354
1355 if (!NT_STATUS_IS_OK(status)) {
1356 if (open_was_deferred(req->mid)) {
1357 /* We have re-scheduled this call. */
1358 END_PROFILE(SMBntrename);
1359 return;
1360 }
1361
1362 reply_nterror(req, status);
1363 END_PROFILE(SMBntrename);
1364 return;
1365 }
1366
1367 reply_outbuf(req, 0, 0);
1368
1369 END_PROFILE(SMBntrename);
1370 return;
1371 }
1372
1373 /****************************************************************************
1374 Reply to a notify change - queue the request and
1375 don't allow a directory to be opened.
1376 ****************************************************************************/
1377
1378 static void call_nt_transact_notify_change(connection_struct *conn,
1379 struct smb_request *req,
1380 uint16 **ppsetup,
1381 uint32 setup_count,
1382 char **ppparams,
1383 uint32 parameter_count,
1384 char **ppdata, uint32 data_count,
1385 uint32 max_data_count,
1386 uint32 max_param_count)
1387 {
1388 uint16 *setup = *ppsetup;
1389 files_struct *fsp;
1390 uint32 filter;
1391 NTSTATUS status;
1392 bool recursive;
1393
1394 if(setup_count < 6) {
1395 reply_doserror(req, ERRDOS, ERRbadfunc);
1396 return;
1397 }
1398
1399 fsp = file_fsp(SVAL(setup,4));
1400 filter = IVAL(setup, 0);
1401 recursive = (SVAL(setup, 6) != 0) ? True : False;
1402
1403 DEBUG(3,("call_nt_transact_notify_change\n"));
1404
1405 if(!fsp) {
1406 reply_doserror(req, ERRDOS, ERRbadfid);
1407 return;
1408 }
1409
1410 {
1411 char *filter_string;
1412
1413 if (!(filter_string = notify_filter_string(NULL, filter))) {
1414 reply_nterror(req,NT_STATUS_NO_MEMORY);
1415 return;
1416 }
1417
1418 DEBUG(3,("call_nt_transact_notify_change: notify change "
1419 "called on %s, filter = %s, recursive = %d\n",
1420 fsp->fsp_name, filter_string, recursive));
1421
1422 TALLOC_FREE(filter_string);
1423 }
1424
1425 if((!fsp->is_directory) || (conn != fsp->conn)) {
1426 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1427 return;
1428 }
1429
1430 if (fsp->notify == NULL) {
1431
1432 status = change_notify_create(fsp, filter, recursive);
1433
1434 if (!NT_STATUS_IS_OK(status)) {
1435 DEBUG(10, ("change_notify_create returned %s\n",
1436 nt_errstr(status)));
1437 reply_nterror(req, status);
1438 return;
1439 }
1440 }
1441
1442 if (fsp->notify->num_changes != 0) {
1443
1444 /*
1445 * We've got changes pending, respond immediately
1446 */
1447
1448 /*
1449 * TODO: write a torture test to check the filtering behaviour
1450 * here.
1451 */
1452
1453 change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1454
1455 /*
1456 * change_notify_reply() above has independently sent its
1457 * results
1458 */
1459 return;
1460 }
1461
1462 /*
1463 * No changes pending, queue the request
1464 */
1465
1466 status = change_notify_add_request(req,
1467 max_param_count,
1468 filter,
1469 recursive, fsp);
1470 if (!NT_STATUS_IS_OK(status)) {
1471 reply_nterror(req, status);
1472 }
1473 return;
1474 }
1475
1476 /****************************************************************************
1477 Reply to an NT transact rename command.
1478 ****************************************************************************/
1479
1480 static void call_nt_transact_rename(connection_struct *conn,
1481 struct smb_request *req,
1482 uint16 **ppsetup, uint32 setup_count,
1483 char **ppparams, uint32 parameter_count,
1484 char **ppdata, uint32 data_count,
1485 uint32 max_data_count)
1486 {
1487 char *params = *ppparams;
1488 char *new_name = NULL;
1489 files_struct *fsp = NULL;
1490 bool dest_has_wcard = False;
1491 NTSTATUS status;
1492 TALLOC_CTX *ctx = talloc_tos();
1493
1494 if(parameter_count < 5) {
1495 reply_doserror(req, ERRDOS, ERRbadfunc);
1496 return;
1497 }
1498
1499 fsp = file_fsp(SVAL(params, 0));
1500 if (!check_fsp(conn, req, fsp)) {
1501 return;
1502 }
1503 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1504 parameter_count - 4,
1505 STR_TERMINATE, &status, &dest_has_wcard);
1506 if (!NT_STATUS_IS_OK(status)) {
1507 reply_nterror(req, status);
1508 return;
1509 }
1510
1511 /*
1512 * W2K3 ignores this request as the RAW-RENAME test
1513 * demonstrates, so we do.
1514 */
1515 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1516
1517 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1518 fsp->fsp_name, new_name));
1519
1520 return;
1521 }
1522
1523 /******************************************************************************
1524 Fake up a completely empty SD.
1525 *******************************************************************************/
1526
1527 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1528 {
1529 size_t sd_size;
1530
1531 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1532 if(!*ppsd) {
1533 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1534 return NT_STATUS_NO_MEMORY;
1535 }
1536
1537 return NT_STATUS_OK;
1538 }
1539
1540 /****************************************************************************
1541 Reply to query a security descriptor.
1542 ****************************************************************************/
1543
1544 static void call_nt_transact_query_security_desc(connection_struct *conn,
1545 struct smb_request *req,
1546 uint16 **ppsetup,
1547 uint32 setup_count,
1548 char **ppparams,
1549 uint32 parameter_count,
1550 char **ppdata,
1551 uint32 data_count,
1552 uint32 max_data_count)
1553 {
1554 char *params = *ppparams;
1555 char *data = *ppdata;
1556 SEC_DESC *psd = NULL;
1557 size_t sd_size;
1558 uint32 security_info_wanted;
1559 files_struct *fsp = NULL;
1560 NTSTATUS status;
1561 DATA_BLOB blob;
1562
1563 if(parameter_count < 8) {
1564 reply_doserror(req, ERRDOS, ERRbadfunc);
1565 return;
1566 }
1567
1568 fsp = file_fsp(SVAL(params,0));
1569 if(!fsp) {
1570 reply_doserror(req, ERRDOS, ERRbadfid);
1571 return;
1572 }
1573
1574 security_info_wanted = IVAL(params,4);
1575
1576 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1577 (unsigned int)security_info_wanted ));
1578
1579 params = nttrans_realloc(ppparams, 4);
1580 if(params == NULL) {
1581 reply_doserror(req, ERRDOS, ERRnomem);
1582 return;
1583 }
1584
1585 /*
1586 * Get the permissions to return.
1587 */
1588
1589 if (!lp_nt_acl_support(SNUM(conn))) {
1590 status = get_null_nt_acl(talloc_tos(), &psd);
1591 } else {
1592 status = SMB_VFS_FGET_NT_ACL(
1593 fsp, security_info_wanted, &psd);
1594 }
1595
1596 if (!NT_STATUS_IS_OK(status)) {
1597 reply_nterror(req, status);
1598 return;
1599 }
1600
1601 sd_size = ndr_size_security_descriptor(psd, 0);
1602
1603 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1604
1605 SIVAL(params,0,(uint32)sd_size);
1606
1607 if (max_data_count < sd_size) {
1608 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1609 params, 4, *ppdata, 0);
1610 return;
1611 }
1612
1613 /*
1614 * Allocate the data we will point this at.
1615 */
1616
1617 data = nttrans_realloc(ppdata, sd_size);
1618 if(data == NULL) {
1619 reply_doserror(req, ERRDOS, ERRnomem);
1620 return;
1621 }
1622
1623 status = marshall_sec_desc(talloc_tos(), psd,
1624 &blob.data, &blob.length);
1625
1626 if (!NT_STATUS_IS_OK(status)) {
1627 reply_nterror(req, status);
1628 return;
1629 }
1630
1631 SMB_ASSERT(sd_size == blob.length);
1632 memcpy(data, blob.data, sd_size);
1633
1634 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1635
1636 return;
1637 }
1638
1639 /****************************************************************************
1640 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1641 ****************************************************************************/
1642
1643 static void call_nt_transact_set_security_desc(connection_struct *conn,
1644 struct smb_request *req,
1645 uint16 **ppsetup,
1646 uint32 setup_count,
1647 char **ppparams,
1648 uint32 parameter_count,
1649 char **ppdata,
1650 uint32 data_count,
1651 uint32 max_data_count)
1652 {
1653 char *params= *ppparams;
1654 char *data = *ppdata;
1655 files_struct *fsp = NULL;
1656 uint32 security_info_sent = 0;
1657 NTSTATUS status;
1658
1659 if(parameter_count < 8) {
1660 reply_doserror(req, ERRDOS, ERRbadfunc);
1661 return;
1662 }
1663
1664 if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1665 reply_doserror(req, ERRDOS, ERRbadfid);
1666 return;
1667 }
1668
1669 if(!lp_nt_acl_support(SNUM(conn))) {
1670 goto done;
1671 }
1672
1673 security_info_sent = IVAL(params,4);
1674
1675 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1676 (unsigned int)security_info_sent ));
1677
1678 if (data_count == 0) {
1679 reply_doserror(req, ERRDOS, ERRnoaccess);
1680 return;
1681 }
1682
1683 status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1684
1685 if (!NT_STATUS_IS_OK(status)) {
1686 reply_nterror(req, status);
1687 return;
1688 }
1689
1690 done:
1691 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1692 return;
1693 }
1694
1695 /****************************************************************************
1696 Reply to NT IOCTL
1697 ****************************************************************************/
1698
1699 static void call_nt_transact_ioctl(connection_struct *conn,
1700 struct smb_request *req,
1701 uint16 **ppsetup, uint32 setup_count,
1702 char **ppparams, uint32 parameter_count,
1703 char **ppdata, uint32 data_count,
1704 uint32 max_data_count)
1705 {
1706 uint32 function;
1707 uint16 fidnum;
1708 files_struct *fsp;
1709 uint8 isFSctl;
1710 uint8 compfilter;
1711 static bool logged_message;
1712 char *pdata = *ppdata;
1713
1714 if (setup_count != 8) {
1715 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1716 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1717 return;
1718 }
1719
1720 function = IVAL(*ppsetup, 0);
1721 fidnum = SVAL(*ppsetup, 4);
1722 isFSctl = CVAL(*ppsetup, 6);
1723 compfilter = CVAL(*ppsetup, 7);
1724
1725 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1726 function, fidnum, isFSctl, compfilter));
1727
1728 fsp=file_fsp(fidnum);
1729 /* this check is done in each implemented function case for now
1730 because I don't want to break anything... --metze
1731 FSP_BELONGS_CONN(fsp,conn);*/
1732
1733 switch (function) {
1734 case FSCTL_SET_SPARSE:
1735 /* pretend this succeeded - tho strictly we should
1736 mark the file sparse (if the local fs supports it)
1737 so we can know if we need to pre-allocate or not */
1738
1739 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1740 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1741 return;
1742
1743 case FSCTL_CREATE_OR_GET_OBJECT_ID:
1744 {
1745 unsigned char objid[16];
1746
1747 /* This should return the object-id on this file.
1748 * I think I'll make this be the inode+dev. JRA.
1749 */
1750
1751 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1752
1753 if (!fsp_belongs_conn(conn, req, fsp)) {
1754 return;
1755 }
1756
1757 data_count = 64;
1758 pdata = nttrans_realloc(ppdata, data_count);
1759 if (pdata == NULL) {
1760 reply_nterror(req, NT_STATUS_NO_MEMORY);
1761 return;
1762 }
1763 push_file_id_16(pdata, &fsp->file_id);
1764 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1765 push_file_id_16(pdata+32, &fsp->file_id);
1766 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1767 pdata, data_count);
1768 return;
1769 }
1770
1771 case FSCTL_GET_REPARSE_POINT:
1772 /* pretend this fail - my winXP does it like this
1773 * --metze
1774 */
1775
1776 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1777 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1778 return;
1779
1780 case FSCTL_SET_REPARSE_POINT:
1781 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1782 * --metze
1783 */
1784
1785 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1786 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1787 return;
1788
1789 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1790 {
1791 /*
1792 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1793 * and return their volume names. If max_data_count is 16, then it is just
1794 * asking for the number of volumes and length of the combined names.
1795 *
1796 * pdata is the data allocated by our caller, but that uses
1797 * total_data_count (which is 0 in our case) rather than max_data_count.
1798 * Allocate the correct amount and return the pointer to let
1799 * it be deallocated when we return.
1800 */
1801 SHADOW_COPY_DATA *shadow_data = NULL;
1802 TALLOC_CTX *shadow_mem_ctx = NULL;
1803 bool labels = False;
1804 uint32 labels_data_count = 0;
1805 uint32 i;
1806 char *cur_pdata;
1807
1808 if (!fsp_belongs_conn(conn, req, fsp)) {
1809 return;
1810 }
1811
1812 if (max_data_count < 16) {
1813 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1814 max_data_count));
1815 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1816 return;
1817 }
1818
1819 if (max_data_count > 16) {
1820 labels = True;
1821 }
1822
1823 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1824 if (shadow_mem_ctx == NULL) {
1825 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1826 reply_nterror(req, NT_STATUS_NO_MEMORY);
1827 return;
1828 }
1829
1830 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1831 if (shadow_data == NULL) {
1832 DEBUG(0,("TALLOC_ZERO() failed!\n"));
1833 talloc_destroy(shadow_mem_ctx);
1834 reply_nterror(req, NT_STATUS_NO_MEMORY);
1835 return;
1836 }
1837
1838 shadow_data->mem_ctx = shadow_mem_ctx;
1839
1840 /*
1841 * Call the VFS routine to actually do the work.
1842 */
1843 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1844 talloc_destroy(shadow_data->mem_ctx);
1845 if (errno == ENOSYS) {
1846 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1847 conn->connectpath));
1848 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1849 return;
1850 } else {
1851 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1852 conn->connectpath));
1853 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1854 return;
1855 }
1856 }
1857
1858 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1859
1860 if (!labels) {
1861 data_count = 16;
1862 } else {
1863 data_count = 12+labels_data_count+4;
1864 }
1865
1866 if (max_data_count<data_count) {
1867 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1868 max_data_count,data_count));
1869 talloc_destroy(shadow_data->mem_ctx);
1870 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1871 return;
1872 }
1873
1874 pdata = nttrans_realloc(ppdata, data_count);
1875 if (pdata == NULL) {
1876 talloc_destroy(shadow_data->mem_ctx);
1877 reply_nterror(req, NT_STATUS_NO_MEMORY);
1878 return;
1879 }
1880
1881 cur_pdata = pdata;
1882
1883 /* num_volumes 4 bytes */
1884 SIVAL(pdata,0,shadow_data->num_volumes);
1885
1886 if (labels) {
1887 /* num_labels 4 bytes */
1888 SIVAL(pdata,4,shadow_data->num_volumes);
1889 }
1890
1891 /* needed_data_count 4 bytes */
1892 SIVAL(pdata,8,labels_data_count);
1893
1894 cur_pdata+=12;
1895
1896 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1897 shadow_data->num_volumes,fsp->fsp_name));
1898 if (labels && shadow_data->labels) {
1899 for (i=0;i<shadow_data->num_volumes;i++) {
1900 srvstr_push(pdata, req->flags2,
1901 cur_pdata, shadow_data->labels[i],
1902 2*sizeof(SHADOW_COPY_LABEL),
1903 STR_UNICODE|STR_TERMINATE);
1904 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1905 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1906 }
1907 }
1908
1909 talloc_destroy(shadow_data->mem_ctx);
1910
1911 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1912 pdata, data_count);
1913
1914 return;
1915 }
1916
1917 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1918 {
1919 /* pretend this succeeded -
1920 *
1921 * we have to send back a list with all files owned by this SID
1922 *
1923 * but I have to check that --metze
1924 */
1925 DOM_SID sid;
1926 uid_t uid;
1927 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1928
1929 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1930
1931 if (!fsp_belongs_conn(conn, req, fsp)) {
1932 return;
1933 }
1934
1935 /* unknown 4 bytes: this is not the length of the sid :-( */
1936 /*unknown = IVAL(pdata,0);*/
1937
1938 sid_parse(pdata+4,sid_len,&sid);
1939 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1940
1941 if (!sid_to_uid(&sid, &uid)) {
1942 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1943 sid_string_dbg(&sid),
1944 (unsigned long)sid_len));
1945 uid = (-1);
1946 }
1947
1948 /* we can take a look at the find source :-)
1949 *
1950 * find ./ -uid $uid -name '*' is what we need here
1951 *
1952 *
1953 * and send 4bytes len and then NULL terminated unicode strings
1954 * for each file
1955 *
1956 * but I don't know how to deal with the paged results
1957 * (maybe we can hang the result anywhere in the fsp struct)
1958 *
1959 * we don't send all files at once
1960 * and at the next we should *not* start from the beginning,
1961 * so we have to cache the result
1962 *
1963 * --metze
1964 */
1965
1966 /* this works for now... */
1967 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1968 return;
1969 }
1970 default:
1971 if (!logged_message) {
1972 logged_message = True; /* Only print this once... */
1973 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1974 function));
1975 }
1976 }
1977
1978 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1979 }
1980
1981
1982 #ifdef HAVE_SYS_QUOTAS
1983 /****************************************************************************
1984 Reply to get user quota
1985 ****************************************************************************/
1986
1987 static void call_nt_transact_get_user_quota(connection_struct *conn,
1988 struct smb_request *req,
1989 uint16 **ppsetup,
1990 uint32 setup_count,
1991 char **ppparams,
1992 uint32 parameter_count,
1993 char **ppdata,
1994 uint32 data_count,
1995 uint32 max_data_count)
1996 {
1997 NTSTATUS nt_status = NT_STATUS_OK;
1998 char *params = *ppparams;
1999 char *pdata = *ppdata;
2000 char *entry;
2001 int data_len=0,param_len=0;
2002 int qt_len=0;
2003 int entry_len = 0;
2004 files_struct *fsp = NULL;
2005 uint16 level = 0;
2006 size_t sid_len;
2007 DOM_SID sid;
2008 bool start_enum = True;
2009 SMB_NTQUOTA_STRUCT qt;
2010 SMB_NTQUOTA_LIST *tmp_list;
2011 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2012
2013 ZERO_STRUCT(qt);
2014
2015 /* access check */
2016 if (conn->server_info->utok.uid != 0) {
2017 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2018 "[%s]\n", lp_servicename(SNUM(conn)),
2019 conn->server_info->unix_name));
2020 reply_doserror(req, ERRDOS, ERRnoaccess);
2021 return;
2022 }
2023
2024 /*
2025 * Ensure minimum number of parameters sent.
2026 */
2027
2028 if (parameter_count < 4) {
2029 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2030 reply_doserror(req, ERRDOS, ERRinvalidparam);
2031 return;
2032 }
2033
2034 /* maybe we can check the quota_fnum */
2035 fsp = file_fsp(SVAL(params,0));
2036 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2037 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2038 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2039 return;
2040 }
2041
2042 /* the NULL pointer checking for fsp->fake_file_handle->pd
2043 * is done by CHECK_NTQUOTA_HANDLE_OK()
2044 */
2045 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2046
2047 level = SVAL(params,2);
2048
2049 /* unknown 12 bytes leading in params */
2050
2051 switch (level) {
2052 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2053 /* seems that we should continue with the enum here --metze */
2054
2055 if (qt_handle->quota_list!=NULL &&
2056 qt_handle->tmp_list==NULL) {
2057
2058 /* free the list */
2059 free_ntquota_list(&(qt_handle->quota_list));
2060
2061 /* Realloc the size of parameters and data we will return */
2062 param_len = 4;
2063 params = nttrans_realloc(ppparams, param_len);
2064 if(params == NULL) {
2065 reply_doserror(req, ERRDOS, ERRnomem);
2066 return;
2067 }
2068
2069 data_len = 0;
2070 SIVAL(params,0,data_len);
2071
2072 break;
2073 }
2074
2075 start_enum = False;
2076
2077 case TRANSACT_GET_USER_QUOTA_LIST_START:
2078
2079 if (qt_handle->quota_list==NULL &&
2080 qt_handle->tmp_list==NULL) {
2081 start_enum = True;
2082 }
2083
2084 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2085 reply_doserror(req, ERRSRV, ERRerror);
2086 return;
2087 }
2088
2089 /* Realloc the size of parameters and data we will return */
2090 param_len = 4;
2091 params = nttrans_realloc(ppparams, param_len);
2092 if(params == NULL) {
2093 reply_doserror(req, ERRDOS, ERRnomem);
2094 return;
2095 }
2096
2097 /* we should not trust the value in max_data_count*/
2098 max_data_count = MIN(max_data_count,2048);
2099
2100 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2101 if(pdata == NULL) {
2102 reply_doserror(req, ERRDOS, ERRnomem);
2103 return;
2104 }
2105
2106 entry = pdata;
2107
2108 /* set params Size of returned Quota Data 4 bytes*/
2109 /* but set it later when we know it */
2110
2111 /* for each entry push the data */
2112
2113 if (start_enum) {
2114 qt_handle->tmp_list = qt_handle->quota_list;
2115 }
2116
2117 tmp_list = qt_handle->tmp_list;
2118
2119 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2120 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2121
2122 sid_len = ndr_size_dom_sid(
2123 &tmp_list->quotas->sid, 0);
2124 entry_len = 40 + sid_len;
2125
2126 /* nextoffset entry 4 bytes */
2127 SIVAL(entry,0,entry_len);
2128
2129 /* then the len of the SID 4 bytes */
2130 SIVAL(entry,4,sid_len);
2131
2132 /* unknown data 8 bytes SMB_BIG_UINT */
2133 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2134
2135 /* the used disk space 8 bytes SMB_BIG_UINT */
2136 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2137
2138 /* the soft quotas 8 bytes SMB_BIG_UINT */
2139 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2140
2141 /* the hard quotas 8 bytes SMB_BIG_UINT */
2142 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2143
2144 /* and now the SID */
2145 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2146 }
2147
2148 qt_handle->tmp_list = tmp_list;
2149
2150 /* overwrite the offset of the last entry */
2151 SIVAL(entry-entry_len,0,0);
2152
2153 data_len = 4+qt_len;
2154 /* overwrite the params quota_data_len */
2155 SIVAL(params,0,data_len);
2156
2157 break;
2158
2159 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2160
2161 /* unknown 4 bytes IVAL(pdata,0) */
2162
2163 if (data_count < 8) {
2164 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2165 reply_doserror(req, ERRDOS, ERRunknownlevel);
2166 return;
2167 }
2168
2169 sid_len = IVAL(pdata,4);
2170 /* Ensure this is less than 1mb. */
2171 if (sid_len > (1024*1024)) {
2172 reply_doserror(req, ERRDOS, ERRnomem);
2173 return;
2174 }
2175
2176 if (data_count < 8+sid_len) {
2177 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2178 reply_doserror(req, ERRDOS, ERRunknownlevel);
2179 return;
2180 }
2181
2182 data_len = 4+40+sid_len;
2183
2184 if (max_data_count < data_len) {
2185 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2186 max_data_count, data_len));
2187 param_len = 4;
2188 SIVAL(params,0,data_len);
2189 data_len = 0;
2190 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2191 break;
2192 }
2193
2194 sid_parse(pdata+8,sid_len,&sid);
2195
2196 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2197 ZERO_STRUCT(qt);
2198 /*
2199 * we have to return zero's in all fields
2200 * instead of returning an error here
2201 * --metze
2202 */
2203 }
2204
2205 /* Realloc the size of parameters and data we will return */
2206 param_len = 4;
2207 params = nttrans_realloc(ppparams, param_len);
2208 if(params == NULL) {
2209 reply_doserror(req, ERRDOS, ERRnomem);
2210 return;
2211 }
2212
2213 pdata = nttrans_realloc(ppdata, data_len);
2214 if(pdata == NULL) {
2215 reply_doserror(req, ERRDOS, ERRnomem);
2216 return;
2217 }
2218
2219 entry = pdata;
2220
2221 /* set params Size of returned Quota Data 4 bytes*/
2222 SIVAL(params,0,data_len);
2223
2224 /* nextoffset entry 4 bytes */
2225 SIVAL(entry,0,0);
2226
2227 /* then the len of the SID 4 bytes */
2228 SIVAL(entry,4,sid_len);
2229
2230 /* unknown data 8 bytes SMB_BIG_UINT */
2231 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2232
2233 /* the used disk space 8 bytes SMB_BIG_UINT */
2234 SBIG_UINT(entry,16,qt.usedspace);
2235
2236 /* the soft quotas 8 bytes SMB_BIG_UINT */
2237 SBIG_UINT(entry,24,qt.softlim);
2238
2239 /* the hard quotas 8 bytes SMB_BIG_UINT */
2240 SBIG_UINT(entry,32,qt.hardlim);
2241
2242 /* and now the SID */
2243 sid_linearize(entry+40, sid_len, &sid);
2244
2245 break;
2246
2247 default:
2248 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2249 reply_doserror(req, ERRSRV, ERRerror);
2250 return;
2251 break;
2252 }
2253
2254 send_nt_replies(conn, req, nt_status, params, param_len,
2255 pdata, data_len);
2256 }
2257
2258 /****************************************************************************
2259 Reply to set user quota
2260 ****************************************************************************/
2261
2262 static void call_nt_transact_set_user_quota(connection_struct *conn,
2263 struct smb_request *req,
2264 uint16 **ppsetup,
2265 uint32 setup_count,
2266 char **ppparams,
2267 uint32 parameter_count,
2268 char **ppdata,
2269 uint32 data_count,
2270 uint32 max_data_count)
2271 {
2272 char *params = *ppparams;
2273 char *pdata = *ppdata;
2274 int data_len=0,param_len=0;
2275 SMB_NTQUOTA_STRUCT qt;
2276 size_t sid_len;
2277 DOM_SID sid;
2278 files_struct *fsp = NULL;
2279
2280 ZERO_STRUCT(qt);
2281
2282 /* access check */
2283 if (conn->server_info->utok.uid != 0) {
2284 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2285 "[%s]\n", lp_servicename(SNUM(conn)),
2286 conn->server_info->unix_name));
2287 reply_doserror(req, ERRDOS, ERRnoaccess);
2288 return;
2289 }
2290
2291 /*
2292 * Ensure minimum number of parameters sent.
2293 */
2294
2295 if (parameter_count < 2) {
2296 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2297 reply_doserror(req, ERRDOS, ERRinvalidparam);
2298 return;
2299 }
2300
2301 /* maybe we can check the quota_fnum */
2302 fsp = file_fsp(SVAL(params,0));
2303 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2304 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2305 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2306 return;
2307 }
2308
2309 if (data_count < 40) {
2310 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2311 reply_doserror(req, ERRDOS, ERRunknownlevel);
2312 return;
2313 }
2314
2315 /* offset to next quota record.
2316 * 4 bytes IVAL(pdata,0)
2317 * unused here...
2318 */
2319
2320 /* sid len */
2321 sid_len = IVAL(pdata,4);
2322
2323 if (data_count < 40+sid_len) {
2324 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2325 reply_doserror(req, ERRDOS, ERRunknownlevel);
2326 return;
2327 }
2328
2329 /* unknown 8 bytes in pdata
2330 * maybe its the change time in NTTIME
2331 */
2332
2333 /* the used space 8 bytes (SMB_BIG_UINT)*/
2334 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2335 #ifdef LARGE_SMB_OFF_T
2336 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2337 #else /* LARGE_SMB_OFF_T */
2338 if ((IVAL(pdata,20) != 0)&&
2339 ((qt.usedspace != 0xFFFFFFFF)||
2340 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2341 /* more than 32 bits? */
2342 reply_doserror(req, ERRDOS, ERRunknownlevel);
2343 return;
2344 }
2345 #endif /* LARGE_SMB_OFF_T */
2346
2347 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2348 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2349 #ifdef LARGE_SMB_OFF_T
2350 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2351 #else /* LARGE_SMB_OFF_T */
2352 if ((IVAL(pdata,28) != 0)&&
2353 ((qt.softlim != 0xFFFFFFFF)||
2354 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2355 /* more than 32 bits? */
2356 reply_doserror(req, ERRDOS, ERRunknownlevel);
2357 return;
2358 }
2359 #endif /* LARGE_SMB_OFF_T */
2360
2361 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2362 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2363 #ifdef LARGE_SMB_OFF_T
2364 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2365 #else /* LARGE_SMB_OFF_T */
2366 if ((IVAL(pdata,36) != 0)&&
2367 ((qt.hardlim != 0xFFFFFFFF)||
2368 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2369 /* more than 32 bits? */
2370 reply_doserror(req, ERRDOS, ERRunknownlevel);
2371 return;
2372 }
2373 #endif /* LARGE_SMB_OFF_T */
2374
2375 sid_parse(pdata+40,sid_len,&sid);
2376 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2377
2378 /* 44 unknown bytes left... */
2379
2380 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2381 reply_doserror(req, ERRSRV, ERRerror);
2382 return;
2383 }
2384
2385 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2386 pdata, data_len);
2387 }
2388 #endif /* HAVE_SYS_QUOTAS */
2389
2390 static void handle_nttrans(connection_struct *conn,
2391 struct trans_state *state,
2392 struct smb_request *req)
2393 {
2394 if (Protocol >= PROTOCOL_NT1) {
2395 req->flags2 |= 0x40; /* IS_LONG_NAME */
2396 SSVAL(req->inbuf,smb_flg2,req->flags2);
2397 }
2398
2399 /* Now we must call the relevant NT_TRANS function */
2400 switch(state->call) {
2401 case NT_TRANSACT_CREATE:
2402 {
2403 START_PROFILE(NT_transact_create);
2404 call_nt_transact_create(
2405 conn, req,
2406 &state->setup, state->setup_count,
2407 &state->param, state->total_param,
2408 &state->data, state->total_data,
2409 state->max_data_return);
2410 END_PROFILE(NT_transact_create);
2411 break;
2412 }
2413
2414 case NT_TRANSACT_IOCTL:
2415 {
2416 START_PROFILE(NT_transact_ioctl);
2417 call_nt_transact_ioctl(
2418 conn, req,
2419 &state->setup, state->setup_count,
2420 &state->param, state->total_param,
2421 &state->data, state->total_data,
2422 state->max_data_return);
2423 END_PROFILE(NT_transact_ioctl);
2424 break;
2425 }
2426
2427 case NT_TRANSACT_SET_SECURITY_DESC:
2428 {
2429 START_PROFILE(NT_transact_set_security_desc);
2430 call_nt_transact_set_security_desc(
2431 conn, req,
2432 &state->setup, state->setup_count,
2433 &state->param, state->total_param,
2434 &state->data, state->total_data,
2435 state->max_data_return);
2436 END_PROFILE(NT_transact_set_security_desc);
2437 break;
2438 }
2439
2440 case NT_TRANSACT_NOTIFY_CHANGE:
2441 {
2442 START_PROFILE(NT_transact_notify_change);
2443 call_nt_transact_notify_change(
2444 conn, req,
2445 &state->setup, state->setup_count,
2446 &state->param, state->total_param,
2447 &state->data, state->total_data,
2448 state->max_data_return,
2449 state->max_param_return);
2450 END_PROFILE(NT_transact_notify_change);
2451 break;
2452 }
2453
2454 case NT_TRANSACT_RENAME:
2455 {
2456 START_PROFILE(NT_transact_rename);
2457 call_nt_transact_rename(
2458 conn, req,
2459 &state->setup, state->setup_count,
2460 &state->param, state->total_param,
2461 &state->data, state->total_data,
2462 state->max_data_return);
2463 END_PROFILE(NT_transact_rename);
2464 break;
2465 }
2466
2467 case NT_TRANSACT_QUERY_SECURITY_DESC:
2468 {
2469 START_PROFILE(NT_transact_query_security_desc);
2470 call_nt_transact_query_security_desc(
2471 conn, req,
2472 &state->setup, state->setup_count,
2473 &state->param, state->total_param,
2474 &state->data, state->total_data,
2475 state->max_data_return);
2476 END_PROFILE(NT_transact_query_security_desc);
2477 break;
2478 }
2479
2480 #ifdef HAVE_SYS_QUOTAS
2481 case NT_TRANSACT_GET_USER_QUOTA:
2482 {
2483 START_PROFILE(NT_transact_get_user_quota);
2484 call_nt_transact_get_user_quota(
2485 conn, req,
2486 &state->setup, state->setup_count,
2487 &state->param, state->total_param,
2488 &state->data, state->total_data,
2489 state->max_data_return);
2490 END_PROFILE(NT_transact_get_user_quota);
2491 break;
2492 }
2493
2494 case NT_TRANSACT_SET_USER_QUOTA:
2495 {
2496 START_PROFILE(NT_transact_set_user_quota);
2497 call_nt_transact_set_user_quota(
2498 conn, req,
2499 &state->setup, state->setup_count,
2500 &state->param, state->total_param,
2501 &state->data, state->total_data,
2502 state->max_data_return);
2503 END_PROFILE(NT_transact_set_user_quota);
2504 break;
2505 }
2506 #endif /* HAVE_SYS_QUOTAS */
2507
2508 default:
2509 /* Error in request */
2510 DEBUG(0,("handle_nttrans: Unknown request %d in "
2511 "nttrans call\n", state->call));
2512 reply_doserror(req, ERRSRV, ERRerror);
2513 return;
2514 }
2515 return;
2516 }
2517
2518 /****************************************************************************
2519 Reply to a SMBNTtrans.
2520 ****************************************************************************/
2521
2522 void reply_nttrans(struct smb_request *req)
2523 {
2524 connection_struct *conn = req->conn;
2525 uint32_t pscnt;
2526 uint32_t psoff;
2527 uint32_t dscnt;
2528 uint32_t dsoff;
2529 uint16 function_code;
2530 NTSTATUS result;
2531 struct trans_state *state;
2532 uint32_t size;
2533 uint32_t av_size;
2534
2535 START_PROFILE(SMBnttrans);
2536
2537 if (req->wct < 19) {
2538 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2539 END_PROFILE(SMBnttrans);
2540 return;
2541 }
2542
2543 size = smb_len(req->inbuf) + 4;
2544 av_size = smb_len(req->inbuf);
2545 pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2546 psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2547 dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2548 dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2549 function_code = SVAL(req->inbuf, smb_nt_Function);
2550
2551 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2552 reply_doserror(req, ERRSRV, ERRaccess);
2553 END_PROFILE(SMBnttrans);
2554 return;
2555 }
2556
2557 result = allow_new_trans(conn->pending_trans, req->mid);
2558 if (!NT_STATUS_IS_OK(result)) {
2559 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2560 reply_nterror(req, result);
2561 END_PROFILE(SMBnttrans);
2562 return;
2563 }
2564
2565 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2566 reply_doserror(req, ERRSRV, ERRaccess);
2567 END_PROFILE(SMBnttrans);
2568 return;
2569 }
2570
2571 state->cmd = SMBnttrans;
2572
2573 state->mid = req->mid;
2574 state->vuid = req->vuid;
2575 state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2576 state->data = NULL;
2577 state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2578 state->param = NULL;
2579 state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2580 state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2581
2582 /* setup count is in *words* */
2583 state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2584 state->setup = NULL;
2585 state->call = function_code;
2586
2587 /*
2588 * All nttrans messages we handle have smb_wct == 19 +
2589 * state->setup_count. Ensure this is so as a sanity check.
2590 */
2591
2592 if(req->wct != 19 + (state->setup_count/2)) {
2593 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2594 req->wct, 19 + (state->setup_count/2)));
2595 goto bad_param;
2596 }
2597
2598 /* Don't allow more than 128mb for each value. */
2599 if ((state->total_data > (1024*1024*128)) ||
2600 (state->total_param > (1024*1024*128))) {
2601 reply_doserror(req, ERRDOS, ERRnomem);
2602 END_PROFILE(SMBnttrans);
2603 return;
2604 }
2605
2606 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2607 goto bad_param;
2608
2609 if (state->total_data) {
2610 /* Can't use talloc here, the core routines do realloc on the
2611 * params and data. */
2612 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2613 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2614 "bytes !\n", (unsigned int)state->total_data));
2615 TALLOC_FREE(state);
2616 reply_doserror(req, ERRDOS, ERRnomem);
2617 END_PROFILE(SMBnttrans);
2618 return;
2619 }
2620
2621 if (dscnt > state->total_data ||
2622 dsoff+dscnt < dsoff) {
2623 goto bad_param;
2624 }
2625
2626 if (dsoff > av_size ||
2627 dscnt > av_size ||
2628 dsoff+dscnt > av_size) {
2629 goto bad_param;
2630 }
2631
2632 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2633 }
2634
2635 if (state->total_param) {
2636 /* Can't use talloc here, the core routines do realloc on the
2637 * params and data. */
2638 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2639 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2640 "bytes !\n", (unsigned int)state->total_param));
2641 SAFE_FREE(state->data);
2642 TALLOC_FREE(state);
2643 reply_doserror(req, ERRDOS, ERRnomem);
2644 END_PROFILE(SMBnttrans);
2645 return;
2646 }
2647
2648 if (pscnt > state->total_param ||
2649 psoff+pscnt < psoff) {
2650 goto bad_param;
2651 }
2652
2653 if (psoff > av_size ||
2654 pscnt > av_size ||
2655 psoff+pscnt > av_size) {
2656 goto bad_param;
2657 }
2658
2659 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2660 }
2661
2662 state->received_data = dscnt;
2663 state->received_param = pscnt;
2664
2665 if(state->setup_count > 0) {
2666 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2667 state->setup_count));
2668 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2669 if (state->setup == NULL) {
2670 DEBUG(0,("reply_nttrans : Out of memory\n"));
2671 SAFE_FREE(state->data);
2672 SAFE_FREE(state->param);
2673 TALLOC_FREE(state);
2674 reply_doserror(req, ERRDOS, ERRnomem);
2675 END_PROFILE(SMBnttrans);
2676 return;
2677 }
2678
2679 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2680 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2681 goto bad_param;
2682 }
2683 if (smb_nt_SetupStart + state->setup_count > size) {
2684 goto bad_param;
2685 }
2686
2687 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2688 state->setup_count);
2689 dump_data(10, (uint8 *)state->setup, state->setup_count);
2690 }
2691
2692 if ((state->received_data == state->total_data) &&
2693 (state->received_param == state->total_param)) {
2694 handle_nttrans(conn, state, req);
2695 SAFE_FREE(state->param);
2696 SAFE_FREE(state->data);
2697 TALLOC_FREE(state);
2698 END_PROFILE(SMBnttrans);
2699 return;
2700 }
2701
2702 DLIST_ADD(conn->pending_trans, state);
2703
2704 /* We need to send an interim response then receive the rest
2705 of the parameter/data bytes */
2706 reply_outbuf(req, 0, 0);
2707 show_msg((char *)req->outbuf);
2708 END_PROFILE(SMBnttrans);
2709 return;
2710
2711 bad_param:
2712
2713 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2714 SAFE_FREE(state->data);
2715 SAFE_FREE(state->param);
2716 TALLOC_FREE(state);
2717 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2718 END_PROFILE(SMBnttrans);
2719 return;
2720 }
2721
2722 /****************************************************************************
2723 Reply to a SMBnttranss
2724 ****************************************************************************/
2725
2726 void reply_nttranss(struct smb_request *req)
2727 {
2728 connection_struct *conn = req->conn;
2729 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2730 struct trans_state *state;
2731 uint32_t av_size;
2732 uint32_t size;
2733
2734 START_PROFILE(SMBnttranss);
2735
2736 show_msg((char *)req->inbuf);
2737
2738 if (req->wct < 18) {
2739 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2740 END_PROFILE(SMBnttranss);
2741 return;
2742 }
2743
2744 for (state = conn->pending_trans; state != NULL;
2745 state = state->next) {
2746 if (state->mid == req->mid) {
2747 break;
2748 }
2749 }
2750
2751 if ((state == NULL) || (state->cmd != SMBnttrans)) {
2752 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2753 END_PROFILE(SMBnttranss);
2754 return;
2755 }
2756
2757 /* Revise state->total_param and state->total_data in case they have
2758 changed downwards */
2759 if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2760 < state->total_param) {
2761 state->total_param = IVAL(req->inbuf,
2762 smb_nts_TotalParameterCount);
2763 }
2764 if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2765 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2766 }
2767
2768 size = smb_len(req->inbuf) + 4;
2769 av_size = smb_len(req->inbuf);
2770
2771 pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2772 poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2773 pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2774
2775 dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2776 ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2777 doff = IVAL(req->inbuf, smb_nts_DataOffset);
2778
2779 state->received_param += pcnt;
2780 state->received_data += dcnt;
2781
2782 if ((state->received_data > state->total_data) ||
2783 (state->received_param > state->total_param))
2784 goto bad_param;
2785
2786 if (pcnt) {
2787 if (pdisp > state->total_param ||
2788 pcnt > state->total_param ||
2789 pdisp+pcnt > state->total_param ||
2790 pdisp+pcnt < pdisp) {
2791 goto bad_param;
2792 }
2793
2794 if (poff > av_size ||
2795 pcnt > av_size ||
2796 poff+pcnt > av_size ||
2797 poff+pcnt < poff) {
2798 goto bad_param;
2799 }
2800
2801 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2802 pcnt);
2803 }
2804
2805 if (dcnt) {
2806 if (ddisp > state->total_data ||
2807 dcnt > state->total_data ||
2808 ddisp+dcnt > state->total_data ||
2809 ddisp+dcnt < ddisp) {
2810 goto bad_param;
2811 }
2812
2813 if (ddisp > av_size ||
2814 dcnt > av_size ||
2815 ddisp+dcnt > av_size ||
2816 ddisp+dcnt < ddisp) {
2817 goto bad_param;
2818 }
2819
2820 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2821 dcnt);
2822 }
2823
2824 if ((state->received_param < state->total_param) ||
2825 (state->received_data < state->total_data)) {
2826 END_PROFILE(SMBnttranss);
2827 return;
2828 }
2829
2830 /*
2831 * construct_reply_common will copy smb_com from inbuf to
2832 * outbuf. SMBnttranss is wrong here.
2833 */
2834 SCVAL(req->inbuf,smb_com,SMBnttrans);
2835
2836 handle_nttrans(conn, state, req);
2837
2838 DLIST_REMOVE(conn->pending_trans, state);
2839 SAFE_FREE(state->data);
2840 SAFE_FREE(state->param);
2841 TALLOC_FREE(state);
2842 END_PROFILE(SMBnttranss);
2843 return;
2844
2845 bad_param:
2846
2847 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2848 DLIST_REMOVE(conn->pending_trans, state);
2849 SAFE_FREE(state->data);
2850 SAFE_FREE(state->param);
2851 TALLOC_FREE(state);
2852 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2853 END_PROFILE(SMBnttranss);
2854 return;
2855 }
Samba GIT mirror