2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 extern enum protocol_types Protocol
;
25 extern struct current_user current_user
;
27 static const char *known_nt_pipes
[] = {
48 static char *nttrans_realloc(char **ptr
, size_t size
)
51 smb_panic("nttrans_realloc() called with NULL ptr");
54 *ptr
= (char *)SMB_REALLOC(*ptr
, size
);
58 memset(*ptr
,'\0',size
);
62 /****************************************************************************
63 Send the required number of replies back.
64 We assume all fields other than the data fields are
65 set correctly for the type of call.
66 HACK ! Always assumes smb_setup field is zero.
67 ****************************************************************************/
69 void send_nt_replies(connection_struct
*conn
,
70 struct smb_request
*req
, NTSTATUS nt_error
,
71 char *params
, int paramsize
,
72 char *pdata
, int datasize
)
74 int data_to_send
= datasize
;
75 int params_to_send
= paramsize
;
79 int params_sent_thistime
, data_sent_thistime
, total_sent_thistime
;
80 int alignment_offset
= 3;
81 int data_alignment_offset
= 0;
84 * If there genuinely are no parameters or data to send just send
88 if(params_to_send
== 0 && data_to_send
== 0) {
89 reply_outbuf(req
, 18, 0);
90 show_msg((char *)req
->outbuf
);
95 * When sending params and data ensure that both are nicely aligned.
96 * Only do this alignment when there is also data to send - else
97 * can cause NT redirector problems.
100 if (((params_to_send
% 4) != 0) && (data_to_send
!= 0)) {
101 data_alignment_offset
= 4 - (params_to_send
% 4);
105 * Space is bufsize minus Netbios over TCP header minus SMB header.
106 * The alignment_offset is to align the param bytes on a four byte
107 * boundary (2 bytes for data len, one byte pad).
108 * NT needs this to work correctly.
111 useable_space
= max_send
- (smb_size
114 + data_alignment_offset
);
117 * useable_space can never be more than max_send minus the
121 useable_space
= MIN(useable_space
,
122 max_send
- (alignment_offset
+data_alignment_offset
));
125 while (params_to_send
|| data_to_send
) {
128 * Calculate whether we will totally or partially fill this packet.
131 total_sent_thistime
= params_to_send
+ data_to_send
+
132 alignment_offset
+ data_alignment_offset
;
135 * We can never send more than useable_space.
138 total_sent_thistime
= MIN(total_sent_thistime
, useable_space
);
140 reply_outbuf(req
, 18, total_sent_thistime
);
143 * Set total params and data to be sent.
146 SIVAL(req
->outbuf
,smb_ntr_TotalParameterCount
,paramsize
);
147 SIVAL(req
->outbuf
,smb_ntr_TotalDataCount
,datasize
);
150 * Calculate how many parameters and data we can fit into
151 * this packet. Parameters get precedence.
154 params_sent_thistime
= MIN(params_to_send
,useable_space
);
155 data_sent_thistime
= useable_space
- params_sent_thistime
;
156 data_sent_thistime
= MIN(data_sent_thistime
,data_to_send
);
158 SIVAL(req
->outbuf
, smb_ntr_ParameterCount
,
159 params_sent_thistime
);
161 if(params_sent_thistime
== 0) {
162 SIVAL(req
->outbuf
,smb_ntr_ParameterOffset
,0);
163 SIVAL(req
->outbuf
,smb_ntr_ParameterDisplacement
,0);
166 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
167 * parameter bytes, however the first 4 bytes of outbuf are
168 * the Netbios over TCP header. Thus use smb_base() to subtract
169 * them from the calculation.
172 SIVAL(req
->outbuf
,smb_ntr_ParameterOffset
,
173 ((smb_buf(req
->outbuf
)+alignment_offset
)
174 - smb_base(req
->outbuf
)));
176 * Absolute displacement of param bytes sent in this packet.
179 SIVAL(req
->outbuf
, smb_ntr_ParameterDisplacement
,
184 * Deal with the data portion.
187 SIVAL(req
->outbuf
, smb_ntr_DataCount
, data_sent_thistime
);
189 if(data_sent_thistime
== 0) {
190 SIVAL(req
->outbuf
,smb_ntr_DataOffset
,0);
191 SIVAL(req
->outbuf
,smb_ntr_DataDisplacement
, 0);
194 * The offset of the data bytes is the offset of the
195 * parameter bytes plus the number of parameters being sent this time.
198 SIVAL(req
->outbuf
, smb_ntr_DataOffset
,
199 ((smb_buf(req
->outbuf
)+alignment_offset
) -
200 smb_base(req
->outbuf
))
201 + params_sent_thistime
+ data_alignment_offset
);
202 SIVAL(req
->outbuf
,smb_ntr_DataDisplacement
, pd
- pdata
);
206 * Copy the param bytes into the packet.
209 if(params_sent_thistime
) {
210 if (alignment_offset
!= 0) {
211 memset(smb_buf(req
->outbuf
), 0,
214 memcpy((smb_buf(req
->outbuf
)+alignment_offset
), pp
,
215 params_sent_thistime
);
219 * Copy in the data bytes
222 if(data_sent_thistime
) {
223 if (data_alignment_offset
!= 0) {
224 memset((smb_buf(req
->outbuf
)+alignment_offset
+
225 params_sent_thistime
), 0,
226 data_alignment_offset
);
228 memcpy(smb_buf(req
->outbuf
)+alignment_offset
229 +params_sent_thistime
+data_alignment_offset
,
230 pd
,data_sent_thistime
);
233 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
234 params_sent_thistime
, data_sent_thistime
, useable_space
));
235 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
236 params_to_send
, data_to_send
, paramsize
, datasize
));
238 if (NT_STATUS_V(nt_error
)) {
239 error_packet_set((char *)req
->outbuf
,
244 /* Send the packet */
245 show_msg((char *)req
->outbuf
);
246 if (!srv_send_smb(smbd_server_fd(),
248 IS_CONN_ENCRYPTED(conn
))) {
249 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
252 TALLOC_FREE(req
->outbuf
);
254 pp
+= params_sent_thistime
;
255 pd
+= data_sent_thistime
;
257 params_to_send
-= params_sent_thistime
;
258 data_to_send
-= data_sent_thistime
;
264 if(params_to_send
< 0 || data_to_send
< 0) {
265 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
266 params_to_send
, data_to_send
));
272 /****************************************************************************
273 Is it an NTFS stream name ?
274 An NTFS file name is <path>.<extention>:<stream name>:<stream type>
275 $DATA can be used as both a stream name and a stream type. A missing stream
276 name or type implies $DATA.
277 ****************************************************************************/
279 bool is_ntfs_stream_name(const char *fname
)
281 if (lp_posix_pathnames()) {
284 return (strchr_m(fname
, ':') != NULL
) ? True
: False
;
287 /****************************************************************************
288 Reply to an NT create and X call on a pipe
289 ****************************************************************************/
291 static void nt_open_pipe(char *fname
, connection_struct
*conn
,
292 struct smb_request
*req
, int *ppnum
)
294 smb_np_struct
*p
= NULL
;
297 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname
));
299 /* See if it is one we want to handle. */
301 if (lp_disable_spoolss() && strequal(fname
, "\\spoolss")) {
302 reply_botherror(req
, NT_STATUS_OBJECT_NAME_NOT_FOUND
,
307 for( i
= 0; known_nt_pipes
[i
]; i
++ ) {
308 if( strequal(fname
,known_nt_pipes
[i
])) {
313 if ( known_nt_pipes
[i
] == NULL
) {
314 reply_botherror(req
, NT_STATUS_OBJECT_NAME_NOT_FOUND
,
319 /* Strip \\ off the name. */
322 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname
));
324 p
= open_rpc_pipe_p(fname
, conn
, req
->vuid
);
326 reply_doserror(req
, ERRSRV
, ERRnofids
);
330 /* TODO: Add pipe to db */
332 if ( !store_pipe_opendb( p
) ) {
333 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname
));
340 /****************************************************************************
341 Reply to an NT create and X call for pipes.
342 ****************************************************************************/
344 static void do_ntcreate_pipe_open(connection_struct
*conn
,
345 struct smb_request
*req
)
350 uint32 flags
= IVAL(req
->inbuf
,smb_ntcreate_Flags
);
351 TALLOC_CTX
*ctx
= talloc_tos();
353 srvstr_pull_buf_talloc(ctx
, (char *)req
->inbuf
, req
->flags2
, &fname
,
354 smb_buf(req
->inbuf
), STR_TERMINATE
);
357 reply_botherror(req
, NT_STATUS_OBJECT_NAME_NOT_FOUND
,
361 nt_open_pipe(fname
, conn
, req
, &pnum
);
369 * Deal with pipe return.
372 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
373 /* This is very strange. We
374 * return 50 words, but only set
375 * the wcnt to 42 ? It's definately
376 * what happens on the wire....
378 reply_outbuf(req
, 50, 0);
379 SCVAL(req
->outbuf
,smb_wct
,42);
381 reply_outbuf(req
, 34, 0);
384 p
= (char *)req
->outbuf
+ smb_vwv2
;
388 SIVAL(p
,0,FILE_WAS_OPENED
);
391 SIVAL(p
,0,FILE_ATTRIBUTE_NORMAL
); /* File Attributes. */
394 SSVAL(p
,0,FILE_TYPE_MESSAGE_MODE_PIPE
);
396 SSVAL(p
,2, 0x5FF); /* ? */
399 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
401 SIVAL(p
,0,FILE_GENERIC_ALL
);
403 * For pipes W2K3 seems to return
405 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
407 SIVAL(p
,4,(FILE_GENERIC_READ
|FILE_GENERIC_WRITE
)&~FILE_APPEND_DATA
);
410 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname
));
415 /****************************************************************************
416 Reply to an NT create and X call.
417 ****************************************************************************/
419 void reply_ntcreate_and_X(struct smb_request
*req
)
421 connection_struct
*conn
= req
->conn
;
425 uint32 file_attributes
;
427 uint32 create_disposition
;
428 uint32 create_options
;
430 SMB_BIG_UINT allocation_size
;
431 /* Breakout the oplock request bits so we can set the
432 reply bits separately. */
434 SMB_OFF_T file_len
= 0;
435 SMB_STRUCT_STAT sbuf
;
437 files_struct
*fsp
= NULL
;
439 struct timespec c_timespec
;
440 struct timespec a_timespec
;
441 struct timespec m_timespec
;
444 uint8_t oplock_granted
= NO_OPLOCK_RETURN
;
445 TALLOC_CTX
*ctx
= talloc_tos();
447 START_PROFILE(SMBntcreateX
);
450 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
454 flags
= IVAL(req
->inbuf
,smb_ntcreate_Flags
);
455 access_mask
= IVAL(req
->inbuf
,smb_ntcreate_DesiredAccess
);
456 file_attributes
= IVAL(req
->inbuf
,smb_ntcreate_FileAttributes
);
457 share_access
= IVAL(req
->inbuf
,smb_ntcreate_ShareAccess
);
458 create_disposition
= IVAL(req
->inbuf
,smb_ntcreate_CreateDisposition
);
459 create_options
= IVAL(req
->inbuf
,smb_ntcreate_CreateOptions
);
460 root_dir_fid
= (uint16
)IVAL(req
->inbuf
,smb_ntcreate_RootDirectoryFid
);
462 allocation_size
= (SMB_BIG_UINT
)IVAL(req
->inbuf
,
463 smb_ntcreate_AllocationSize
);
464 #ifdef LARGE_SMB_OFF_T
465 allocation_size
|= (((SMB_BIG_UINT
)IVAL(
467 smb_ntcreate_AllocationSize
+ 4)) << 32);
470 srvstr_get_path(ctx
, (char *)req
->inbuf
, req
->flags2
, &fname
,
471 smb_buf(req
->inbuf
), 0, STR_TERMINATE
, &status
);
473 if (!NT_STATUS_IS_OK(status
)) {
474 reply_nterror(req
, status
);
475 END_PROFILE(SMBntcreateX
);
479 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
480 "file_attributes = 0x%x, share_access = 0x%x, "
481 "create_disposition = 0x%x create_options = 0x%x "
482 "root_dir_fid = 0x%x, fname = %s\n",
484 (unsigned int)access_mask
,
485 (unsigned int)file_attributes
,
486 (unsigned int)share_access
,
487 (unsigned int)create_disposition
,
488 (unsigned int)create_options
,
489 (unsigned int)root_dir_fid
,
493 * If it's an IPC, use the pipe handler.
497 if (lp_nt_pipe_support()) {
498 do_ntcreate_pipe_open(conn
, req
);
499 END_PROFILE(SMBntcreateX
);
502 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
503 END_PROFILE(SMBntcreateX
);
507 oplock_request
= (flags
& REQUEST_OPLOCK
) ? EXCLUSIVE_OPLOCK
: 0;
508 if (oplock_request
) {
509 oplock_request
|= (flags
& REQUEST_BATCH_OPLOCK
)
513 status
= create_file(conn
, req
, root_dir_fid
, fname
,
514 access_mask
, share_access
, create_disposition
,
515 create_options
, file_attributes
, oplock_request
,
516 allocation_size
, NULL
, NULL
, &fsp
, &info
, &sbuf
);
518 if (!NT_STATUS_IS_OK(status
)) {
519 if (open_was_deferred(req
->mid
)) {
520 /* We have re-scheduled this call, no error. */
521 END_PROFILE(SMBntcreateX
);
524 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_COLLISION
)) {
525 reply_botherror(req
, status
, ERRDOS
, ERRfilexists
);
528 reply_nterror(req
, status
);
530 END_PROFILE(SMBntcreateX
);
535 * If the caller set the extended oplock request bit
536 * and we granted one (by whatever means) - set the
537 * correct bit for extended oplock reply.
540 if (oplock_request
&&
541 (lp_fake_oplocks(SNUM(conn
))
542 || EXCLUSIVE_OPLOCK_TYPE(fsp
->oplock_type
))) {
545 * Exclusive oplock granted
548 if (flags
& REQUEST_BATCH_OPLOCK
) {
549 oplock_granted
= BATCH_OPLOCK_RETURN
;
551 oplock_granted
= EXCLUSIVE_OPLOCK_RETURN
;
553 } else if (fsp
->oplock_type
== LEVEL_II_OPLOCK
) {
554 oplock_granted
= LEVEL_II_OPLOCK_RETURN
;
556 oplock_granted
= NO_OPLOCK_RETURN
;
559 file_len
= sbuf
.st_size
;
560 fattr
= dos_mode(conn
,fsp
->fsp_name
,&sbuf
);
562 fattr
= FILE_ATTRIBUTE_NORMAL
;
565 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
566 /* This is very strange. We
567 * return 50 words, but only set
568 * the wcnt to 42 ? It's definately
569 * what happens on the wire....
571 reply_outbuf(req
, 50, 0);
572 SCVAL(req
->outbuf
,smb_wct
,42);
574 reply_outbuf(req
, 34, 0);
577 p
= (char *)req
->outbuf
+ smb_vwv2
;
579 SCVAL(p
, 0, oplock_granted
);
582 SSVAL(p
,0,fsp
->fnum
);
584 if ((create_disposition
== FILE_SUPERSEDE
)
585 && (info
== FILE_WAS_OVERWRITTEN
)) {
586 SIVAL(p
,0,FILE_WAS_SUPERSEDED
);
593 c_timespec
= get_create_timespec(
594 &sbuf
,lp_fake_dir_create_times(SNUM(conn
)));
595 a_timespec
= get_atimespec(&sbuf
);
596 m_timespec
= get_mtimespec(&sbuf
);
598 if (lp_dos_filetime_resolution(SNUM(conn
))) {
599 dos_filetime_timespec(&c_timespec
);
600 dos_filetime_timespec(&a_timespec
);
601 dos_filetime_timespec(&m_timespec
);
604 put_long_date_timespec(p
, c_timespec
); /* create time. */
606 put_long_date_timespec(p
, a_timespec
); /* access time */
608 put_long_date_timespec(p
, m_timespec
); /* write time */
610 put_long_date_timespec(p
, m_timespec
); /* change time */
612 SIVAL(p
,0,fattr
); /* File Attributes. */
614 SOFF_T(p
, 0, get_allocation_size(conn
,fsp
,&sbuf
));
616 SOFF_T(p
,0,file_len
);
618 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
622 SCVAL(p
,0,fsp
->is_directory
? 1 : 0);
624 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
627 if (fsp
->is_directory
628 || can_write_to_file(conn
, fsp
->fsp_name
, &sbuf
)) {
629 perms
= FILE_GENERIC_ALL
;
631 perms
= FILE_GENERIC_READ
|FILE_EXECUTE
;
636 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
637 fsp
->fnum
, fsp
->fsp_name
));
640 END_PROFILE(SMBntcreateX
);
644 /****************************************************************************
645 Reply to a NT_TRANSACT_CREATE call to open a pipe.
646 ****************************************************************************/
648 static void do_nt_transact_create_pipe(connection_struct
*conn
,
649 struct smb_request
*req
,
650 uint16
**ppsetup
, uint32 setup_count
,
651 char **ppparams
, uint32 parameter_count
,
652 char **ppdata
, uint32 data_count
)
655 char *params
= *ppparams
;
661 TALLOC_CTX
*ctx
= talloc_tos();
664 * Ensure minimum number of parameters sent.
667 if(parameter_count
< 54) {
668 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count
));
669 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
673 flags
= IVAL(params
,0);
675 srvstr_get_path(ctx
, params
, req
->flags2
, &fname
, params
+53,
676 parameter_count
-53, STR_TERMINATE
,
678 if (!NT_STATUS_IS_OK(status
)) {
679 reply_nterror(req
, status
);
683 nt_open_pipe(fname
, conn
, req
, &pnum
);
690 /* Realloc the size of parameters and data we will return */
691 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
692 /* Extended response is 32 more byyes. */
697 params
= nttrans_realloc(ppparams
, param_len
);
699 reply_doserror(req
, ERRDOS
, ERRnomem
);
704 SCVAL(p
,0,NO_OPLOCK_RETURN
);
709 SIVAL(p
,0,FILE_WAS_OPENED
);
713 SIVAL(p
,0,FILE_ATTRIBUTE_NORMAL
); /* File Attributes. */
716 SSVAL(p
,0,FILE_TYPE_MESSAGE_MODE_PIPE
);
718 SSVAL(p
,2, 0x5FF); /* ? */
721 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
723 SIVAL(p
,0,FILE_GENERIC_ALL
);
725 * For pipes W2K3 seems to return
727 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
729 SIVAL(p
,4,(FILE_GENERIC_READ
|FILE_GENERIC_WRITE
)&~FILE_APPEND_DATA
);
732 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname
));
734 /* Send the required number of replies */
735 send_nt_replies(conn
, req
, NT_STATUS_OK
, params
, param_len
, *ppdata
, 0);
740 /****************************************************************************
741 Internal fn to set security descriptors.
742 ****************************************************************************/
744 static NTSTATUS
set_sd(files_struct
*fsp
, uint8
*data
, uint32 sd_len
,
745 uint32 security_info_sent
)
747 SEC_DESC
*psd
= NULL
;
750 if (sd_len
== 0 || !lp_nt_acl_support(SNUM(fsp
->conn
))) {
754 status
= unmarshall_sec_desc(talloc_tos(), data
, sd_len
, &psd
);
756 if (!NT_STATUS_IS_OK(status
)) {
760 if (psd
->owner_sid
==0) {
761 security_info_sent
&= ~OWNER_SECURITY_INFORMATION
;
763 if (psd
->group_sid
==0) {
764 security_info_sent
&= ~GROUP_SECURITY_INFORMATION
;
767 security_info_sent
&= ~SACL_SECURITY_INFORMATION
;
770 security_info_sent
&= ~DACL_SECURITY_INFORMATION
;
773 if (fsp
->fh
->fd
!= -1) {
774 status
= SMB_VFS_FSET_NT_ACL(fsp
, security_info_sent
, psd
);
777 status
= SMB_VFS_SET_NT_ACL(fsp
, fsp
->fsp_name
,
778 security_info_sent
, psd
);
786 /****************************************************************************
787 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
788 ****************************************************************************/
790 static struct ea_list
*read_nttrans_ea_list(TALLOC_CTX
*ctx
, const char *pdata
, size_t data_size
)
792 struct ea_list
*ea_list_head
= NULL
;
799 while (offset
+ 4 <= data_size
) {
800 size_t next_offset
= IVAL(pdata
,offset
);
801 struct ea_list
*eal
= read_ea_list_entry(ctx
, pdata
+ offset
+ 4, data_size
- offset
- 4, NULL
);
807 DLIST_ADD_END(ea_list_head
, eal
, struct ea_list
*);
808 if (next_offset
== 0) {
811 offset
+= next_offset
;
817 /****************************************************************************
818 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
819 ****************************************************************************/
821 static void call_nt_transact_create(connection_struct
*conn
,
822 struct smb_request
*req
,
823 uint16
**ppsetup
, uint32 setup_count
,
824 char **ppparams
, uint32 parameter_count
,
825 char **ppdata
, uint32 data_count
,
826 uint32 max_data_count
)
829 char *params
= *ppparams
;
830 char *data
= *ppdata
;
831 /* Breakout the oplock request bits so we can set the reply bits separately. */
833 SMB_OFF_T file_len
= 0;
834 SMB_STRUCT_STAT sbuf
;
836 files_struct
*fsp
= NULL
;
840 uint32 file_attributes
;
842 uint32 create_disposition
;
843 uint32 create_options
;
845 struct security_descriptor
*sd
= NULL
;
848 struct timespec c_timespec
;
849 struct timespec a_timespec
;
850 struct timespec m_timespec
;
851 struct ea_list
*ea_list
= NULL
;
854 SMB_BIG_UINT allocation_size
;
856 uint8_t oplock_granted
;
857 TALLOC_CTX
*ctx
= talloc_tos();
859 DEBUG(5,("call_nt_transact_create\n"));
862 * If it's an IPC, use the pipe handler.
866 if (lp_nt_pipe_support()) {
867 do_nt_transact_create_pipe(
869 ppsetup
, setup_count
,
870 ppparams
, parameter_count
,
874 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
879 * Ensure minimum number of parameters sent.
882 if(parameter_count
< 54) {
883 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count
));
884 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
888 flags
= IVAL(params
,0);
889 access_mask
= IVAL(params
,8);
890 file_attributes
= IVAL(params
,20);
891 share_access
= IVAL(params
,24);
892 create_disposition
= IVAL(params
,28);
893 create_options
= IVAL(params
,32);
894 sd_len
= IVAL(params
,36);
895 ea_len
= IVAL(params
,40);
896 root_dir_fid
= (uint16
)IVAL(params
,4);
897 allocation_size
= (SMB_BIG_UINT
)IVAL(params
,12);
898 #ifdef LARGE_SMB_OFF_T
899 allocation_size
|= (((SMB_BIG_UINT
)IVAL(params
,16)) << 32);
902 /* Ensure the data_len is correct for the sd and ea values given. */
903 if ((ea_len
+ sd_len
> data_count
)
904 || (ea_len
> data_count
) || (sd_len
> data_count
)
905 || (ea_len
+ sd_len
< ea_len
) || (ea_len
+ sd_len
< sd_len
)) {
906 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
907 "%u, data_count = %u\n", (unsigned int)ea_len
,
908 (unsigned int)sd_len
, (unsigned int)data_count
));
909 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
914 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
917 status
= unmarshall_sec_desc(ctx
, (uint8_t *)data
, sd_len
,
919 if (!NT_STATUS_IS_OK(status
)) {
920 DEBUG(10, ("call_nt_transact_create: "
921 "unmarshall_sec_desc failed: %s\n",
923 reply_nterror(req
, status
);
929 if (!lp_ea_support(SNUM(conn
))) {
930 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
931 "EA's not supported.\n",
932 (unsigned int)ea_len
));
933 reply_nterror(req
, NT_STATUS_EAS_NOT_SUPPORTED
);
938 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
939 "too small (should be more than 10)\n",
940 (unsigned int)ea_len
));
941 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
945 /* We have already checked that ea_len <= data_count here. */
946 ea_list
= read_nttrans_ea_list(talloc_tos(), data
+ sd_len
,
948 if (ea_list
== NULL
) {
949 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
954 srvstr_get_path(ctx
, params
, req
->flags2
, &fname
,
955 params
+53, parameter_count
-53,
956 STR_TERMINATE
, &status
);
957 if (!NT_STATUS_IS_OK(status
)) {
958 reply_nterror(req
, status
);
962 oplock_request
= (flags
& REQUEST_OPLOCK
) ? EXCLUSIVE_OPLOCK
: 0;
963 if (oplock_request
) {
964 oplock_request
|= (flags
& REQUEST_BATCH_OPLOCK
)
968 status
= create_file(conn
, req
, root_dir_fid
, fname
,
969 access_mask
, share_access
, create_disposition
,
970 create_options
, file_attributes
, oplock_request
,
971 allocation_size
, sd
, ea_list
, &fsp
, &info
, &sbuf
);
973 if(!NT_STATUS_IS_OK(status
)) {
974 if (open_was_deferred(req
->mid
)) {
975 /* We have re-scheduled this call, no error. */
978 reply_openerror(req
, status
);
983 * If the caller set the extended oplock request bit
984 * and we granted one (by whatever means) - set the
985 * correct bit for extended oplock reply.
988 if (oplock_request
&&
989 (lp_fake_oplocks(SNUM(conn
))
990 || EXCLUSIVE_OPLOCK_TYPE(fsp
->oplock_type
))) {
993 * Exclusive oplock granted
996 if (flags
& REQUEST_BATCH_OPLOCK
) {
997 oplock_granted
= BATCH_OPLOCK_RETURN
;
999 oplock_granted
= EXCLUSIVE_OPLOCK_RETURN
;
1001 } else if (fsp
->oplock_type
== LEVEL_II_OPLOCK
) {
1002 oplock_granted
= LEVEL_II_OPLOCK_RETURN
;
1004 oplock_granted
= NO_OPLOCK_RETURN
;
1007 file_len
= sbuf
.st_size
;
1008 fattr
= dos_mode(conn
,fsp
->fsp_name
,&sbuf
);
1010 fattr
= FILE_ATTRIBUTE_NORMAL
;
1013 /* Realloc the size of parameters and data we will return */
1014 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
1015 /* Extended response is 32 more byyes. */
1020 params
= nttrans_realloc(ppparams
, param_len
);
1021 if(params
== NULL
) {
1022 reply_doserror(req
, ERRDOS
, ERRnomem
);
1027 SCVAL(p
, 0, oplock_granted
);
1030 SSVAL(p
,0,fsp
->fnum
);
1032 if ((create_disposition
== FILE_SUPERSEDE
)
1033 && (info
== FILE_WAS_OVERWRITTEN
)) {
1034 SIVAL(p
,0,FILE_WAS_SUPERSEDED
);
1041 c_timespec
= get_create_timespec(
1042 &sbuf
,lp_fake_dir_create_times(SNUM(conn
)));
1043 a_timespec
= get_atimespec(&sbuf
);
1044 m_timespec
= get_mtimespec(&sbuf
);
1046 if (lp_dos_filetime_resolution(SNUM(conn
))) {
1047 dos_filetime_timespec(&c_timespec
);
1048 dos_filetime_timespec(&a_timespec
);
1049 dos_filetime_timespec(&m_timespec
);
1052 put_long_date_timespec(p
, c_timespec
); /* create time. */
1054 put_long_date_timespec(p
, a_timespec
); /* access time */
1056 put_long_date_timespec(p
, m_timespec
); /* write time */
1058 put_long_date_timespec(p
, m_timespec
); /* change time */
1060 SIVAL(p
,0,fattr
); /* File Attributes. */
1062 SOFF_T(p
, 0, get_allocation_size(conn
,fsp
,&sbuf
));
1064 SOFF_T(p
,0,file_len
);
1066 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
1070 SCVAL(p
,0,fsp
->is_directory
? 1 : 0);
1072 if (flags
& EXTENDED_RESPONSE_REQUIRED
) {
1075 if (fsp
->is_directory
1076 || can_write_to_file(conn
, fsp
->fsp_name
, &sbuf
)) {
1077 perms
= FILE_GENERIC_ALL
;
1079 perms
= FILE_GENERIC_READ
|FILE_EXECUTE
;
1084 DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp
->fsp_name
));
1086 /* Send the required number of replies */
1087 send_nt_replies(conn
, req
, NT_STATUS_OK
, params
, param_len
, *ppdata
, 0);
1092 /****************************************************************************
1093 Reply to a NT CANCEL request.
1094 conn POINTER CAN BE NULL HERE !
1095 ****************************************************************************/
1097 void reply_ntcancel(struct smb_request
*req
)
1100 * Go through and cancel any pending change notifies.
1103 START_PROFILE(SMBntcancel
);
1104 remove_pending_change_notify_requests_by_mid(req
->mid
);
1105 remove_pending_lock_requests_by_mid(req
->mid
);
1106 srv_cancel_sign_response(req
->mid
);
1108 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req
->mid
));
1110 END_PROFILE(SMBntcancel
);
1114 /****************************************************************************
1116 ****************************************************************************/
1118 static NTSTATUS
copy_internals(TALLOC_CTX
*ctx
,
1119 connection_struct
*conn
,
1120 struct smb_request
*req
,
1121 const char *oldname_in
,
1122 const char *newname_in
,
1125 SMB_STRUCT_STAT sbuf1
, sbuf2
;
1126 char *oldname
= NULL
;
1127 char *newname
= NULL
;
1128 char *last_component_oldname
= NULL
;
1129 char *last_component_newname
= NULL
;
1130 files_struct
*fsp1
,*fsp2
;
1134 NTSTATUS status
= NT_STATUS_OK
;
1139 if (!CAN_WRITE(conn
)) {
1140 return NT_STATUS_MEDIA_WRITE_PROTECTED
;
1143 status
= unix_convert(ctx
, conn
, oldname_in
, False
, &oldname
,
1144 &last_component_oldname
, &sbuf1
);
1145 if (!NT_STATUS_IS_OK(status
)) {
1149 status
= check_name(conn
, oldname
);
1150 if (!NT_STATUS_IS_OK(status
)) {
1154 /* Source must already exist. */
1155 if (!VALID_STAT(sbuf1
)) {
1156 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1158 /* Ensure attributes match. */
1159 fattr
= dos_mode(conn
,oldname
,&sbuf1
);
1160 if ((fattr
& ~attrs
) & (aHIDDEN
| aSYSTEM
)) {
1161 return NT_STATUS_NO_SUCH_FILE
;
1164 status
= unix_convert(ctx
, conn
, newname_in
, False
, &newname
,
1165 &last_component_newname
, &sbuf2
);
1166 if (!NT_STATUS_IS_OK(status
)) {
1170 status
= check_name(conn
, newname
);
1171 if (!NT_STATUS_IS_OK(status
)) {
1175 /* Disallow if newname already exists. */
1176 if (VALID_STAT(sbuf2
)) {
1177 return NT_STATUS_OBJECT_NAME_COLLISION
;
1180 /* No links from a directory. */
1181 if (S_ISDIR(sbuf1
.st_mode
)) {
1182 return NT_STATUS_FILE_IS_A_DIRECTORY
;
1185 /* Ensure this is within the share. */
1186 status
= check_reduced_name(conn
, oldname
);
1187 if (!NT_STATUS_IS_OK(status
)) {
1191 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1194 status
= open_file_ntcreate(conn
, req
, oldname
, &sbuf1
,
1195 FILE_READ_DATA
, /* Read-only. */
1196 FILE_SHARE_READ
|FILE_SHARE_WRITE
|FILE_SHARE_DELETE
,
1198 0, /* No create options. */
1199 FILE_ATTRIBUTE_NORMAL
,
1203 if (!NT_STATUS_IS_OK(status
)) {
1207 status
= open_file_ntcreate(conn
, req
, newname
, &sbuf2
,
1208 FILE_WRITE_DATA
, /* Read-only. */
1209 FILE_SHARE_READ
|FILE_SHARE_WRITE
|FILE_SHARE_DELETE
,
1211 0, /* No create options. */
1216 if (!NT_STATUS_IS_OK(status
)) {
1217 close_file(fsp1
,ERROR_CLOSE
);
1221 if (sbuf1
.st_size
) {
1222 ret
= vfs_transfer_file(fsp1
, fsp2
, sbuf1
.st_size
);
1226 * As we are opening fsp1 read-only we only expect
1227 * an error on close on fsp2 if we are out of space.
1228 * Thus we don't look at the error return from the
1231 close_file(fsp1
,NORMAL_CLOSE
);
1233 /* Ensure the modtime is set correctly on the destination file. */
1234 set_close_write_time(fsp2
, get_mtimespec(&sbuf1
));
1236 status
= close_file(fsp2
,NORMAL_CLOSE
);
1238 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1239 creates the file. This isn't the correct thing to do in the copy
1241 file_set_dosmode(conn
, newname
, fattr
, &sbuf2
,
1242 parent_dirname(newname
),false);
1244 if (ret
< (SMB_OFF_T
)sbuf1
.st_size
) {
1245 return NT_STATUS_DISK_FULL
;
1248 if (!NT_STATUS_IS_OK(status
)) {
1249 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1250 nt_errstr(status
), oldname
, newname
));
1255 /****************************************************************************
1256 Reply to a NT rename request.
1257 ****************************************************************************/
1259 void reply_ntrename(struct smb_request
*req
)
1261 connection_struct
*conn
= req
->conn
;
1262 char *oldname
= NULL
;
1263 char *newname
= NULL
;
1266 bool src_has_wcard
= False
;
1267 bool dest_has_wcard
= False
;
1270 TALLOC_CTX
*ctx
= talloc_tos();
1272 START_PROFILE(SMBntrename
);
1275 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
1276 END_PROFILE(SMBntrename
);
1280 attrs
= SVAL(req
->inbuf
,smb_vwv0
);
1281 rename_type
= SVAL(req
->inbuf
,smb_vwv1
);
1283 p
= smb_buf(req
->inbuf
) + 1;
1284 p
+= srvstr_get_path_wcard(ctx
, (char *)req
->inbuf
, req
->flags2
, &oldname
, p
,
1285 0, STR_TERMINATE
, &status
,
1287 if (!NT_STATUS_IS_OK(status
)) {
1288 reply_nterror(req
, status
);
1289 END_PROFILE(SMBntrename
);
1293 if( is_ntfs_stream_name(oldname
)) {
1294 /* Can't rename a stream. */
1295 reply_nterror(req
, NT_STATUS_ACCESS_DENIED
);
1296 END_PROFILE(SMBntrename
);
1300 if (ms_has_wild(oldname
)) {
1301 reply_nterror(req
, NT_STATUS_OBJECT_PATH_SYNTAX_BAD
);
1302 END_PROFILE(SMBntrename
);
1307 p
+= srvstr_get_path_wcard(ctx
, (char *)req
->inbuf
, req
->flags2
, &newname
, p
,
1308 0, STR_TERMINATE
, &status
,
1310 if (!NT_STATUS_IS_OK(status
)) {
1311 reply_nterror(req
, status
);
1312 END_PROFILE(SMBntrename
);
1316 status
= resolve_dfspath(ctx
, conn
,
1317 req
->flags2
& FLAGS2_DFS_PATHNAMES
,
1320 if (!NT_STATUS_IS_OK(status
)) {
1321 if (NT_STATUS_EQUAL(status
,NT_STATUS_PATH_NOT_COVERED
)) {
1322 reply_botherror(req
, NT_STATUS_PATH_NOT_COVERED
,
1323 ERRSRV
, ERRbadpath
);
1324 END_PROFILE(SMBntrename
);
1327 reply_nterror(req
, status
);
1328 END_PROFILE(SMBntrename
);
1332 status
= resolve_dfspath(ctx
, conn
,
1333 req
->flags2
& FLAGS2_DFS_PATHNAMES
,
1336 if (!NT_STATUS_IS_OK(status
)) {
1337 if (NT_STATUS_EQUAL(status
,NT_STATUS_PATH_NOT_COVERED
)) {
1338 reply_botherror(req
, NT_STATUS_PATH_NOT_COVERED
,
1339 ERRSRV
, ERRbadpath
);
1340 END_PROFILE(SMBntrename
);
1343 reply_nterror(req
, status
);
1344 END_PROFILE(SMBntrename
);
1348 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname
,newname
));
1350 switch(rename_type
) {
1351 case RENAME_FLAG_RENAME
:
1352 status
= rename_internals(ctx
, conn
, req
, oldname
,
1353 newname
, attrs
, False
, src_has_wcard
,
1354 dest_has_wcard
, DELETE_ACCESS
);
1356 case RENAME_FLAG_HARD_LINK
:
1357 if (src_has_wcard
|| dest_has_wcard
) {
1359 status
= NT_STATUS_OBJECT_PATH_SYNTAX_BAD
;
1361 status
= hardlink_internals(ctx
,
1367 case RENAME_FLAG_COPY
:
1368 if (src_has_wcard
|| dest_has_wcard
) {
1370 status
= NT_STATUS_OBJECT_PATH_SYNTAX_BAD
;
1372 status
= copy_internals(ctx
, conn
, req
, oldname
,
1376 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION
:
1377 status
= NT_STATUS_INVALID_PARAMETER
;
1380 status
= NT_STATUS_ACCESS_DENIED
; /* Default error. */
1384 if (!NT_STATUS_IS_OK(status
)) {
1385 if (open_was_deferred(req
->mid
)) {
1386 /* We have re-scheduled this call. */
1387 END_PROFILE(SMBntrename
);
1391 reply_nterror(req
, status
);
1392 END_PROFILE(SMBntrename
);
1396 reply_outbuf(req
, 0, 0);
1398 END_PROFILE(SMBntrename
);
1402 /****************************************************************************
1403 Reply to a notify change - queue the request and
1404 don't allow a directory to be opened.
1405 ****************************************************************************/
1407 static void call_nt_transact_notify_change(connection_struct
*conn
,
1408 struct smb_request
*req
,
1412 uint32 parameter_count
,
1413 char **ppdata
, uint32 data_count
,
1414 uint32 max_data_count
,
1415 uint32 max_param_count
)
1417 uint16
*setup
= *ppsetup
;
1423 if(setup_count
< 6) {
1424 reply_doserror(req
, ERRDOS
, ERRbadfunc
);
1428 fsp
= file_fsp(SVAL(setup
,4));
1429 filter
= IVAL(setup
, 0);
1430 recursive
= (SVAL(setup
, 6) != 0) ? True
: False
;
1432 DEBUG(3,("call_nt_transact_notify_change\n"));
1435 reply_doserror(req
, ERRDOS
, ERRbadfid
);
1440 char *filter_string
;
1442 if (!(filter_string
= notify_filter_string(NULL
, filter
))) {
1443 reply_nterror(req
,NT_STATUS_NO_MEMORY
);
1447 DEBUG(3,("call_nt_transact_notify_change: notify change "
1448 "called on %s, filter = %s, recursive = %d\n",
1449 fsp
->fsp_name
, filter_string
, recursive
));
1451 TALLOC_FREE(filter_string
);
1454 if((!fsp
->is_directory
) || (conn
!= fsp
->conn
)) {
1455 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
1459 if (fsp
->notify
== NULL
) {
1461 status
= change_notify_create(fsp
, filter
, recursive
);
1463 if (!NT_STATUS_IS_OK(status
)) {
1464 DEBUG(10, ("change_notify_create returned %s\n",
1465 nt_errstr(status
)));
1466 reply_nterror(req
, status
);
1471 if (fsp
->notify
->num_changes
!= 0) {
1474 * We've got changes pending, respond immediately
1478 * TODO: write a torture test to check the filtering behaviour
1482 change_notify_reply(fsp
->conn
, req
->inbuf
, max_param_count
, fsp
->notify
);
1485 * change_notify_reply() above has independently sent its
1492 * No changes pending, queue the request
1495 status
= change_notify_add_request(req
,
1499 if (!NT_STATUS_IS_OK(status
)) {
1500 reply_nterror(req
, status
);
1505 /****************************************************************************
1506 Reply to an NT transact rename command.
1507 ****************************************************************************/
1509 static void call_nt_transact_rename(connection_struct
*conn
,
1510 struct smb_request
*req
,
1511 uint16
**ppsetup
, uint32 setup_count
,
1512 char **ppparams
, uint32 parameter_count
,
1513 char **ppdata
, uint32 data_count
,
1514 uint32 max_data_count
)
1516 char *params
= *ppparams
;
1517 char *new_name
= NULL
;
1518 files_struct
*fsp
= NULL
;
1519 bool dest_has_wcard
= False
;
1521 TALLOC_CTX
*ctx
= talloc_tos();
1523 if(parameter_count
< 5) {
1524 reply_doserror(req
, ERRDOS
, ERRbadfunc
);
1528 fsp
= file_fsp(SVAL(params
, 0));
1529 if (!check_fsp(conn
, req
, fsp
, ¤t_user
)) {
1532 srvstr_get_path_wcard(ctx
, params
, req
->flags2
, &new_name
, params
+4,
1533 parameter_count
- 4,
1534 STR_TERMINATE
, &status
, &dest_has_wcard
);
1535 if (!NT_STATUS_IS_OK(status
)) {
1536 reply_nterror(req
, status
);
1541 * W2K3 ignores this request as the RAW-RENAME test
1542 * demonstrates, so we do.
1544 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1546 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1547 fsp
->fsp_name
, new_name
));
1552 /******************************************************************************
1553 Fake up a completely empty SD.
1554 *******************************************************************************/
1556 static NTSTATUS
get_null_nt_acl(TALLOC_CTX
*mem_ctx
, SEC_DESC
**ppsd
)
1560 *ppsd
= make_standard_sec_desc( mem_ctx
, &global_sid_World
, &global_sid_World
, NULL
, &sd_size
);
1562 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1563 return NT_STATUS_NO_MEMORY
;
1566 return NT_STATUS_OK
;
1569 /****************************************************************************
1570 Reply to query a security descriptor.
1571 ****************************************************************************/
1573 static void call_nt_transact_query_security_desc(connection_struct
*conn
,
1574 struct smb_request
*req
,
1578 uint32 parameter_count
,
1581 uint32 max_data_count
)
1583 char *params
= *ppparams
;
1584 char *data
= *ppdata
;
1585 SEC_DESC
*psd
= NULL
;
1587 uint32 security_info_wanted
;
1588 files_struct
*fsp
= NULL
;
1592 if(parameter_count
< 8) {
1593 reply_doserror(req
, ERRDOS
, ERRbadfunc
);
1597 fsp
= file_fsp(SVAL(params
,0));
1599 reply_doserror(req
, ERRDOS
, ERRbadfid
);
1603 security_info_wanted
= IVAL(params
,4);
1605 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp
->fsp_name
,
1606 (unsigned int)security_info_wanted
));
1608 params
= nttrans_realloc(ppparams
, 4);
1609 if(params
== NULL
) {
1610 reply_doserror(req
, ERRDOS
, ERRnomem
);
1615 * Get the permissions to return.
1618 if (!lp_nt_acl_support(SNUM(conn
))) {
1619 status
= get_null_nt_acl(talloc_tos(), &psd
);
1621 if (fsp
->fh
->fd
!= -1) {
1622 status
= SMB_VFS_FGET_NT_ACL(
1623 fsp
, security_info_wanted
, &psd
);
1626 status
= SMB_VFS_GET_NT_ACL(
1627 conn
, fsp
->fsp_name
, security_info_wanted
, &psd
);
1631 if (!NT_STATUS_IS_OK(status
)) {
1632 reply_nterror(req
, status
);
1636 sd_size
= ndr_size_security_descriptor(psd
, 0);
1638 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size
));
1640 SIVAL(params
,0,(uint32
)sd_size
);
1642 if (max_data_count
< sd_size
) {
1643 send_nt_replies(conn
, req
, NT_STATUS_BUFFER_TOO_SMALL
,
1644 params
, 4, *ppdata
, 0);
1649 * Allocate the data we will point this at.
1652 data
= nttrans_realloc(ppdata
, sd_size
);
1654 reply_doserror(req
, ERRDOS
, ERRnomem
);
1658 status
= marshall_sec_desc(talloc_tos(), psd
,
1659 &blob
.data
, &blob
.length
);
1661 if (!NT_STATUS_IS_OK(status
)) {
1662 reply_nterror(req
, status
);
1666 SMB_ASSERT(sd_size
== blob
.length
);
1667 memcpy(data
, blob
.data
, sd_size
);
1669 send_nt_replies(conn
, req
, NT_STATUS_OK
, params
, 4, data
, (int)sd_size
);
1674 /****************************************************************************
1675 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1676 ****************************************************************************/
1678 static void call_nt_transact_set_security_desc(connection_struct
*conn
,
1679 struct smb_request
*req
,
1683 uint32 parameter_count
,
1686 uint32 max_data_count
)
1688 char *params
= *ppparams
;
1689 char *data
= *ppdata
;
1690 files_struct
*fsp
= NULL
;
1691 uint32 security_info_sent
= 0;
1694 if(parameter_count
< 8) {
1695 reply_doserror(req
, ERRDOS
, ERRbadfunc
);
1699 if((fsp
= file_fsp(SVAL(params
,0))) == NULL
) {
1700 reply_doserror(req
, ERRDOS
, ERRbadfid
);
1704 if(!lp_nt_acl_support(SNUM(conn
))) {
1708 security_info_sent
= IVAL(params
,4);
1710 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp
->fsp_name
,
1711 (unsigned int)security_info_sent
));
1713 if (data_count
== 0) {
1714 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
1718 status
= set_sd(fsp
, (uint8
*)data
, data_count
, security_info_sent
);
1720 if (!NT_STATUS_IS_OK(status
)) {
1721 reply_nterror(req
, status
);
1726 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1730 /****************************************************************************
1732 ****************************************************************************/
1734 static void call_nt_transact_ioctl(connection_struct
*conn
,
1735 struct smb_request
*req
,
1736 uint16
**ppsetup
, uint32 setup_count
,
1737 char **ppparams
, uint32 parameter_count
,
1738 char **ppdata
, uint32 data_count
,
1739 uint32 max_data_count
)
1746 static bool logged_message
;
1747 char *pdata
= *ppdata
;
1749 if (setup_count
!= 8) {
1750 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count
));
1751 reply_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
1755 function
= IVAL(*ppsetup
, 0);
1756 fidnum
= SVAL(*ppsetup
, 4);
1757 isFSctl
= CVAL(*ppsetup
, 6);
1758 compfilter
= CVAL(*ppsetup
, 7);
1760 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1761 function
, fidnum
, isFSctl
, compfilter
));
1763 fsp
=file_fsp(fidnum
);
1764 /* this check is done in each implemented function case for now
1765 because I don't want to break anything... --metze
1766 FSP_BELONGS_CONN(fsp,conn);*/
1769 case FSCTL_SET_SPARSE
:
1770 /* pretend this succeeded - tho strictly we should
1771 mark the file sparse (if the local fs supports it)
1772 so we can know if we need to pre-allocate or not */
1774 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum
));
1775 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
1778 case FSCTL_CREATE_OR_GET_OBJECT_ID
:
1780 unsigned char objid
[16];
1782 /* This should return the object-id on this file.
1783 * I think I'll make this be the inode+dev. JRA.
1786 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum
));
1788 if (!fsp_belongs_conn(conn
, req
, fsp
, ¤t_user
)) {
1793 pdata
= nttrans_realloc(ppdata
, data_count
);
1794 if (pdata
== NULL
) {
1795 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
1798 push_file_id_16(pdata
, &fsp
->file_id
);
1799 memcpy(pdata
+16,create_volume_objectid(conn
,objid
),16);
1800 push_file_id_16(pdata
+32, &fsp
->file_id
);
1801 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0,
1806 case FSCTL_GET_REPARSE_POINT
:
1807 /* pretend this fail - my winXP does it like this
1811 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum
));
1812 reply_nterror(req
, NT_STATUS_NOT_A_REPARSE_POINT
);
1815 case FSCTL_SET_REPARSE_POINT
:
1816 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1820 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum
));
1821 reply_nterror(req
, NT_STATUS_NOT_A_REPARSE_POINT
);
1824 case FSCTL_GET_SHADOW_COPY_DATA
: /* don't know if this name is right...*/
1827 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1828 * and return their volume names. If max_data_count is 16, then it is just
1829 * asking for the number of volumes and length of the combined names.
1831 * pdata is the data allocated by our caller, but that uses
1832 * total_data_count (which is 0 in our case) rather than max_data_count.
1833 * Allocate the correct amount and return the pointer to let
1834 * it be deallocated when we return.
1836 SHADOW_COPY_DATA
*shadow_data
= NULL
;
1837 TALLOC_CTX
*shadow_mem_ctx
= NULL
;
1838 bool labels
= False
;
1839 uint32 labels_data_count
= 0;
1843 if (!fsp_belongs_conn(conn
, req
, fsp
, ¤t_user
)) {
1847 if (max_data_count
< 16) {
1848 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1850 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
1854 if (max_data_count
> 16) {
1858 shadow_mem_ctx
= talloc_init("SHADOW_COPY_DATA");
1859 if (shadow_mem_ctx
== NULL
) {
1860 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1861 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
1865 shadow_data
= TALLOC_ZERO_P(shadow_mem_ctx
,SHADOW_COPY_DATA
);
1866 if (shadow_data
== NULL
) {
1867 DEBUG(0,("TALLOC_ZERO() failed!\n"));
1868 talloc_destroy(shadow_mem_ctx
);
1869 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
1873 shadow_data
->mem_ctx
= shadow_mem_ctx
;
1876 * Call the VFS routine to actually do the work.
1878 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp
, shadow_data
, labels
)!=0) {
1879 talloc_destroy(shadow_data
->mem_ctx
);
1880 if (errno
== ENOSYS
) {
1881 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1882 conn
->connectpath
));
1883 reply_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
1886 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1887 conn
->connectpath
));
1888 reply_nterror(req
, NT_STATUS_UNSUCCESSFUL
);
1893 labels_data_count
= (shadow_data
->num_volumes
*2*sizeof(SHADOW_COPY_LABEL
))+2;
1898 data_count
= 12+labels_data_count
+4;
1901 if (max_data_count
<data_count
) {
1902 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1903 max_data_count
,data_count
));
1904 talloc_destroy(shadow_data
->mem_ctx
);
1905 reply_nterror(req
, NT_STATUS_BUFFER_TOO_SMALL
);
1909 pdata
= nttrans_realloc(ppdata
, data_count
);
1910 if (pdata
== NULL
) {
1911 talloc_destroy(shadow_data
->mem_ctx
);
1912 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
1918 /* num_volumes 4 bytes */
1919 SIVAL(pdata
,0,shadow_data
->num_volumes
);
1922 /* num_labels 4 bytes */
1923 SIVAL(pdata
,4,shadow_data
->num_volumes
);
1926 /* needed_data_count 4 bytes */
1927 SIVAL(pdata
,8,labels_data_count
);
1931 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1932 shadow_data
->num_volumes
,fsp
->fsp_name
));
1933 if (labels
&& shadow_data
->labels
) {
1934 for (i
=0;i
<shadow_data
->num_volumes
;i
++) {
1935 srvstr_push(pdata
, req
->flags2
,
1936 cur_pdata
, shadow_data
->labels
[i
],
1937 2*sizeof(SHADOW_COPY_LABEL
),
1938 STR_UNICODE
|STR_TERMINATE
);
1939 cur_pdata
+=2*sizeof(SHADOW_COPY_LABEL
);
1940 DEBUGADD(10,("Label[%u]: '%s'\n",i
,shadow_data
->labels
[i
]));
1944 talloc_destroy(shadow_data
->mem_ctx
);
1946 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0,
1952 case FSCTL_FIND_FILES_BY_SID
: /* I hope this name is right */
1954 /* pretend this succeeded -
1956 * we have to send back a list with all files owned by this SID
1958 * but I have to check that --metze
1962 size_t sid_len
= MIN(data_count
-4,SID_MAX_SIZE
);
1964 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum
));
1966 if (!fsp_belongs_conn(conn
, req
, fsp
, ¤t_user
)) {
1970 /* unknown 4 bytes: this is not the length of the sid :-( */
1971 /*unknown = IVAL(pdata,0);*/
1973 sid_parse(pdata
+4,sid_len
,&sid
);
1974 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid
)));
1976 if (!sid_to_uid(&sid
, &uid
)) {
1977 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1978 sid_string_dbg(&sid
),
1979 (unsigned long)sid_len
));
1983 /* we can take a look at the find source :-)
1985 * find ./ -uid $uid -name '*' is what we need here
1988 * and send 4bytes len and then NULL terminated unicode strings
1991 * but I don't know how to deal with the paged results
1992 * (maybe we can hang the result anywhere in the fsp struct)
1994 * we don't send all files at once
1995 * and at the next we should *not* start from the beginning,
1996 * so we have to cache the result
2001 /* this works for now... */
2002 send_nt_replies(conn
, req
, NT_STATUS_OK
, NULL
, 0, NULL
, 0);
2006 if (!logged_message
) {
2007 logged_message
= True
; /* Only print this once... */
2008 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2013 reply_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
2017 #ifdef HAVE_SYS_QUOTAS
2018 /****************************************************************************
2019 Reply to get user quota
2020 ****************************************************************************/
2022 static void call_nt_transact_get_user_quota(connection_struct
*conn
,
2023 struct smb_request
*req
,
2027 uint32 parameter_count
,
2030 uint32 max_data_count
)
2032 NTSTATUS nt_status
= NT_STATUS_OK
;
2033 char *params
= *ppparams
;
2034 char *pdata
= *ppdata
;
2036 int data_len
=0,param_len
=0;
2039 files_struct
*fsp
= NULL
;
2043 bool start_enum
= True
;
2044 SMB_NTQUOTA_STRUCT qt
;
2045 SMB_NTQUOTA_LIST
*tmp_list
;
2046 SMB_NTQUOTA_HANDLE
*qt_handle
= NULL
;
2051 if (current_user
.ut
.uid
!= 0) {
2052 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2053 lp_servicename(SNUM(conn
)),conn
->user
));
2054 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
2059 * Ensure minimum number of parameters sent.
2062 if (parameter_count
< 4) {
2063 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count
));
2064 reply_doserror(req
, ERRDOS
, ERRinvalidparam
);
2068 /* maybe we can check the quota_fnum */
2069 fsp
= file_fsp(SVAL(params
,0));
2070 if (!CHECK_NTQUOTA_HANDLE_OK(fsp
,conn
)) {
2071 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2072 reply_nterror(req
, NT_STATUS_INVALID_HANDLE
);
2076 /* the NULL pointer checking for fsp->fake_file_handle->pd
2077 * is done by CHECK_NTQUOTA_HANDLE_OK()
2079 qt_handle
= (SMB_NTQUOTA_HANDLE
*)fsp
->fake_file_handle
->pd
;
2081 level
= SVAL(params
,2);
2083 /* unknown 12 bytes leading in params */
2086 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE
:
2087 /* seems that we should continue with the enum here --metze */
2089 if (qt_handle
->quota_list
!=NULL
&&
2090 qt_handle
->tmp_list
==NULL
) {
2093 free_ntquota_list(&(qt_handle
->quota_list
));
2095 /* Realloc the size of parameters and data we will return */
2097 params
= nttrans_realloc(ppparams
, param_len
);
2098 if(params
== NULL
) {
2099 reply_doserror(req
, ERRDOS
, ERRnomem
);
2104 SIVAL(params
,0,data_len
);
2111 case TRANSACT_GET_USER_QUOTA_LIST_START
:
2113 if (qt_handle
->quota_list
==NULL
&&
2114 qt_handle
->tmp_list
==NULL
) {
2118 if (start_enum
&& vfs_get_user_ntquota_list(fsp
,&(qt_handle
->quota_list
))!=0) {
2119 reply_doserror(req
, ERRSRV
, ERRerror
);
2123 /* Realloc the size of parameters and data we will return */
2125 params
= nttrans_realloc(ppparams
, param_len
);
2126 if(params
== NULL
) {
2127 reply_doserror(req
, ERRDOS
, ERRnomem
);
2131 /* we should not trust the value in max_data_count*/
2132 max_data_count
= MIN(max_data_count
,2048);
2134 pdata
= nttrans_realloc(ppdata
, max_data_count
);/* should be max data count from client*/
2136 reply_doserror(req
, ERRDOS
, ERRnomem
);
2142 /* set params Size of returned Quota Data 4 bytes*/
2143 /* but set it later when we know it */
2145 /* for each entry push the data */
2148 qt_handle
->tmp_list
= qt_handle
->quota_list
;
2151 tmp_list
= qt_handle
->tmp_list
;
2153 for (;((tmp_list
!=NULL
)&&((qt_len
+40+SID_MAX_SIZE
)<max_data_count
));
2154 tmp_list
=tmp_list
->next
,entry
+=entry_len
,qt_len
+=entry_len
) {
2156 sid_len
= ndr_size_dom_sid(
2157 &tmp_list
->quotas
->sid
, 0);
2158 entry_len
= 40 + sid_len
;
2160 /* nextoffset entry 4 bytes */
2161 SIVAL(entry
,0,entry_len
);
2163 /* then the len of the SID 4 bytes */
2164 SIVAL(entry
,4,sid_len
);
2166 /* unknown data 8 bytes SMB_BIG_UINT */
2167 SBIG_UINT(entry
,8,(SMB_BIG_UINT
)0); /* this is not 0 in windows...-metze*/
2169 /* the used disk space 8 bytes SMB_BIG_UINT */
2170 SBIG_UINT(entry
,16,tmp_list
->quotas
->usedspace
);
2172 /* the soft quotas 8 bytes SMB_BIG_UINT */
2173 SBIG_UINT(entry
,24,tmp_list
->quotas
->softlim
);
2175 /* the hard quotas 8 bytes SMB_BIG_UINT */
2176 SBIG_UINT(entry
,32,tmp_list
->quotas
->hardlim
);
2178 /* and now the SID */
2179 sid_linearize(entry
+40, sid_len
, &tmp_list
->quotas
->sid
);
2182 qt_handle
->tmp_list
= tmp_list
;
2184 /* overwrite the offset of the last entry */
2185 SIVAL(entry
-entry_len
,0,0);
2187 data_len
= 4+qt_len
;
2188 /* overwrite the params quota_data_len */
2189 SIVAL(params
,0,data_len
);
2193 case TRANSACT_GET_USER_QUOTA_FOR_SID
:
2195 /* unknown 4 bytes IVAL(pdata,0) */
2197 if (data_count
< 8) {
2198 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count
,8));
2199 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2203 sid_len
= IVAL(pdata
,4);
2204 /* Ensure this is less than 1mb. */
2205 if (sid_len
> (1024*1024)) {
2206 reply_doserror(req
, ERRDOS
, ERRnomem
);
2210 if (data_count
< 8+sid_len
) {
2211 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count
,(unsigned long)(8+sid_len
)));
2212 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2216 data_len
= 4+40+sid_len
;
2218 if (max_data_count
< data_len
) {
2219 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2220 max_data_count
, data_len
));
2222 SIVAL(params
,0,data_len
);
2224 nt_status
= NT_STATUS_BUFFER_TOO_SMALL
;
2228 sid_parse(pdata
+8,sid_len
,&sid
);
2230 if (vfs_get_ntquota(fsp
, SMB_USER_QUOTA_TYPE
, &sid
, &qt
)!=0) {
2233 * we have to return zero's in all fields
2234 * instead of returning an error here
2239 /* Realloc the size of parameters and data we will return */
2241 params
= nttrans_realloc(ppparams
, param_len
);
2242 if(params
== NULL
) {
2243 reply_doserror(req
, ERRDOS
, ERRnomem
);
2247 pdata
= nttrans_realloc(ppdata
, data_len
);
2249 reply_doserror(req
, ERRDOS
, ERRnomem
);
2255 /* set params Size of returned Quota Data 4 bytes*/
2256 SIVAL(params
,0,data_len
);
2258 /* nextoffset entry 4 bytes */
2261 /* then the len of the SID 4 bytes */
2262 SIVAL(entry
,4,sid_len
);
2264 /* unknown data 8 bytes SMB_BIG_UINT */
2265 SBIG_UINT(entry
,8,(SMB_BIG_UINT
)0); /* this is not 0 in windows...-mezte*/
2267 /* the used disk space 8 bytes SMB_BIG_UINT */
2268 SBIG_UINT(entry
,16,qt
.usedspace
);
2270 /* the soft quotas 8 bytes SMB_BIG_UINT */
2271 SBIG_UINT(entry
,24,qt
.softlim
);
2273 /* the hard quotas 8 bytes SMB_BIG_UINT */
2274 SBIG_UINT(entry
,32,qt
.hardlim
);
2276 /* and now the SID */
2277 sid_linearize(entry
+40, sid_len
, &sid
);
2282 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp
->fnum
,level
));
2283 reply_doserror(req
, ERRSRV
, ERRerror
);
2288 send_nt_replies(conn
, req
, nt_status
, params
, param_len
,
2292 /****************************************************************************
2293 Reply to set user quota
2294 ****************************************************************************/
2296 static void call_nt_transact_set_user_quota(connection_struct
*conn
,
2297 struct smb_request
*req
,
2301 uint32 parameter_count
,
2304 uint32 max_data_count
)
2306 char *params
= *ppparams
;
2307 char *pdata
= *ppdata
;
2308 int data_len
=0,param_len
=0;
2309 SMB_NTQUOTA_STRUCT qt
;
2312 files_struct
*fsp
= NULL
;
2317 if (current_user
.ut
.uid
!= 0) {
2318 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2319 lp_servicename(SNUM(conn
)),conn
->user
));
2320 reply_doserror(req
, ERRDOS
, ERRnoaccess
);
2325 * Ensure minimum number of parameters sent.
2328 if (parameter_count
< 2) {
2329 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count
));
2330 reply_doserror(req
, ERRDOS
, ERRinvalidparam
);
2334 /* maybe we can check the quota_fnum */
2335 fsp
= file_fsp(SVAL(params
,0));
2336 if (!CHECK_NTQUOTA_HANDLE_OK(fsp
,conn
)) {
2337 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2338 reply_nterror(req
, NT_STATUS_INVALID_HANDLE
);
2342 if (data_count
< 40) {
2343 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count
,40));
2344 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2348 /* offset to next quota record.
2349 * 4 bytes IVAL(pdata,0)
2354 sid_len
= IVAL(pdata
,4);
2356 if (data_count
< 40+sid_len
) {
2357 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count
,(unsigned long)40+sid_len
));
2358 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2362 /* unknown 8 bytes in pdata
2363 * maybe its the change time in NTTIME
2366 /* the used space 8 bytes (SMB_BIG_UINT)*/
2367 qt
.usedspace
= (SMB_BIG_UINT
)IVAL(pdata
,16);
2368 #ifdef LARGE_SMB_OFF_T
2369 qt
.usedspace
|= (((SMB_BIG_UINT
)IVAL(pdata
,20)) << 32);
2370 #else /* LARGE_SMB_OFF_T */
2371 if ((IVAL(pdata
,20) != 0)&&
2372 ((qt
.usedspace
!= 0xFFFFFFFF)||
2373 (IVAL(pdata
,20)!=0xFFFFFFFF))) {
2374 /* more than 32 bits? */
2375 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2378 #endif /* LARGE_SMB_OFF_T */
2380 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2381 qt
.softlim
= (SMB_BIG_UINT
)IVAL(pdata
,24);
2382 #ifdef LARGE_SMB_OFF_T
2383 qt
.softlim
|= (((SMB_BIG_UINT
)IVAL(pdata
,28)) << 32);
2384 #else /* LARGE_SMB_OFF_T */
2385 if ((IVAL(pdata
,28) != 0)&&
2386 ((qt
.softlim
!= 0xFFFFFFFF)||
2387 (IVAL(pdata
,28)!=0xFFFFFFFF))) {
2388 /* more than 32 bits? */
2389 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2392 #endif /* LARGE_SMB_OFF_T */
2394 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2395 qt
.hardlim
= (SMB_BIG_UINT
)IVAL(pdata
,32);
2396 #ifdef LARGE_SMB_OFF_T
2397 qt
.hardlim
|= (((SMB_BIG_UINT
)IVAL(pdata
,36)) << 32);
2398 #else /* LARGE_SMB_OFF_T */
2399 if ((IVAL(pdata
,36) != 0)&&
2400 ((qt
.hardlim
!= 0xFFFFFFFF)||
2401 (IVAL(pdata
,36)!=0xFFFFFFFF))) {
2402 /* more than 32 bits? */
2403 reply_doserror(req
, ERRDOS
, ERRunknownlevel
);
2406 #endif /* LARGE_SMB_OFF_T */
2408 sid_parse(pdata
+40,sid_len
,&sid
);
2409 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid
)));
2411 /* 44 unknown bytes left... */
2413 if (vfs_set_ntquota(fsp
, SMB_USER_QUOTA_TYPE
, &sid
, &qt
)!=0) {
2414 reply_doserror(req
, ERRSRV
, ERRerror
);
2418 send_nt_replies(conn
, req
, NT_STATUS_OK
, params
, param_len
,
2421 #endif /* HAVE_SYS_QUOTAS */
2423 static void handle_nttrans(connection_struct
*conn
,
2424 struct trans_state
*state
,
2425 struct smb_request
*req
)
2427 if (Protocol
>= PROTOCOL_NT1
) {
2428 req
->flags2
|= 0x40; /* IS_LONG_NAME */
2429 SSVAL(req
->inbuf
,smb_flg2
,req
->flags2
);
2432 /* Now we must call the relevant NT_TRANS function */
2433 switch(state
->call
) {
2434 case NT_TRANSACT_CREATE
:
2436 START_PROFILE(NT_transact_create
);
2437 call_nt_transact_create(
2439 &state
->setup
, state
->setup_count
,
2440 &state
->param
, state
->total_param
,
2441 &state
->data
, state
->total_data
,
2442 state
->max_data_return
);
2443 END_PROFILE(NT_transact_create
);
2447 case NT_TRANSACT_IOCTL
:
2449 START_PROFILE(NT_transact_ioctl
);
2450 call_nt_transact_ioctl(
2452 &state
->setup
, state
->setup_count
,
2453 &state
->param
, state
->total_param
,
2454 &state
->data
, state
->total_data
,
2455 state
->max_data_return
);
2456 END_PROFILE(NT_transact_ioctl
);
2460 case NT_TRANSACT_SET_SECURITY_DESC
:
2462 START_PROFILE(NT_transact_set_security_desc
);
2463 call_nt_transact_set_security_desc(
2465 &state
->setup
, state
->setup_count
,
2466 &state
->param
, state
->total_param
,
2467 &state
->data
, state
->total_data
,
2468 state
->max_data_return
);
2469 END_PROFILE(NT_transact_set_security_desc
);
2473 case NT_TRANSACT_NOTIFY_CHANGE
:
2475 START_PROFILE(NT_transact_notify_change
);
2476 call_nt_transact_notify_change(
2478 &state
->setup
, state
->setup_count
,
2479 &state
->param
, state
->total_param
,
2480 &state
->data
, state
->total_data
,
2481 state
->max_data_return
,
2482 state
->max_param_return
);
2483 END_PROFILE(NT_transact_notify_change
);
2487 case NT_TRANSACT_RENAME
:
2489 START_PROFILE(NT_transact_rename
);
2490 call_nt_transact_rename(
2492 &state
->setup
, state
->setup_count
,
2493 &state
->param
, state
->total_param
,
2494 &state
->data
, state
->total_data
,
2495 state
->max_data_return
);
2496 END_PROFILE(NT_transact_rename
);
2500 case NT_TRANSACT_QUERY_SECURITY_DESC
:
2502 START_PROFILE(NT_transact_query_security_desc
);
2503 call_nt_transact_query_security_desc(
2505 &state
->setup
, state
->setup_count
,
2506 &state
->param
, state
->total_param
,
2507 &state
->data
, state
->total_data
,
2508 state
->max_data_return
);
2509 END_PROFILE(NT_transact_query_security_desc
);
2513 #ifdef HAVE_SYS_QUOTAS
2514 case NT_TRANSACT_GET_USER_QUOTA
:
2516 START_PROFILE(NT_transact_get_user_quota
);
2517 call_nt_transact_get_user_quota(
2519 &state
->setup
, state
->setup_count
,
2520 &state
->param
, state
->total_param
,
2521 &state
->data
, state
->total_data
,
2522 state
->max_data_return
);
2523 END_PROFILE(NT_transact_get_user_quota
);
2527 case NT_TRANSACT_SET_USER_QUOTA
:
2529 START_PROFILE(NT_transact_set_user_quota
);
2530 call_nt_transact_set_user_quota(
2532 &state
->setup
, state
->setup_count
,
2533 &state
->param
, state
->total_param
,
2534 &state
->data
, state
->total_data
,
2535 state
->max_data_return
);
2536 END_PROFILE(NT_transact_set_user_quota
);
2539 #endif /* HAVE_SYS_QUOTAS */
2542 /* Error in request */
2543 DEBUG(0,("handle_nttrans: Unknown request %d in "
2544 "nttrans call\n", state
->call
));
2545 reply_doserror(req
, ERRSRV
, ERRerror
);
2551 /****************************************************************************
2552 Reply to a SMBNTtrans.
2553 ****************************************************************************/
2555 void reply_nttrans(struct smb_request
*req
)
2557 connection_struct
*conn
= req
->conn
;
2562 uint16 function_code
;
2564 struct trans_state
*state
;
2568 START_PROFILE(SMBnttrans
);
2570 if (req
->wct
< 19) {
2571 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
2572 END_PROFILE(SMBnttrans
);
2576 size
= smb_len(req
->inbuf
) + 4;
2577 av_size
= smb_len(req
->inbuf
);
2578 pscnt
= IVAL(req
->inbuf
,smb_nt_ParameterCount
);
2579 psoff
= IVAL(req
->inbuf
,smb_nt_ParameterOffset
);
2580 dscnt
= IVAL(req
->inbuf
,smb_nt_DataCount
);
2581 dsoff
= IVAL(req
->inbuf
,smb_nt_DataOffset
);
2582 function_code
= SVAL(req
->inbuf
, smb_nt_Function
);
2584 if (IS_IPC(conn
) && (function_code
!= NT_TRANSACT_CREATE
)) {
2585 reply_doserror(req
, ERRSRV
, ERRaccess
);
2586 END_PROFILE(SMBnttrans
);
2590 result
= allow_new_trans(conn
->pending_trans
, req
->mid
);
2591 if (!NT_STATUS_IS_OK(result
)) {
2592 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result
)));
2593 reply_nterror(req
, result
);
2594 END_PROFILE(SMBnttrans
);
2598 if ((state
= TALLOC_P(conn
->mem_ctx
, struct trans_state
)) == NULL
) {
2599 reply_doserror(req
, ERRSRV
, ERRaccess
);
2600 END_PROFILE(SMBnttrans
);
2604 state
->cmd
= SMBnttrans
;
2606 state
->mid
= req
->mid
;
2607 state
->vuid
= req
->vuid
;
2608 state
->total_data
= IVAL(req
->inbuf
, smb_nt_TotalDataCount
);
2610 state
->total_param
= IVAL(req
->inbuf
, smb_nt_TotalParameterCount
);
2611 state
->param
= NULL
;
2612 state
->max_data_return
= IVAL(req
->inbuf
,smb_nt_MaxDataCount
);
2613 state
->max_param_return
= IVAL(req
->inbuf
,smb_nt_MaxParameterCount
);
2615 /* setup count is in *words* */
2616 state
->setup_count
= 2*CVAL(req
->inbuf
,smb_nt_SetupCount
);
2617 state
->setup
= NULL
;
2618 state
->call
= function_code
;
2621 * All nttrans messages we handle have smb_wct == 19 +
2622 * state->setup_count. Ensure this is so as a sanity check.
2625 if(req
->wct
!= 19 + (state
->setup_count
/2)) {
2626 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2627 req
->wct
, 19 + (state
->setup_count
/2)));
2631 /* Don't allow more than 128mb for each value. */
2632 if ((state
->total_data
> (1024*1024*128)) ||
2633 (state
->total_param
> (1024*1024*128))) {
2634 reply_doserror(req
, ERRDOS
, ERRnomem
);
2635 END_PROFILE(SMBnttrans
);
2639 if ((dscnt
> state
->total_data
) || (pscnt
> state
->total_param
))
2642 if (state
->total_data
) {
2643 /* Can't use talloc here, the core routines do realloc on the
2644 * params and data. */
2645 if ((state
->data
= (char *)SMB_MALLOC(state
->total_data
)) == NULL
) {
2646 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2647 "bytes !\n", (unsigned int)state
->total_data
));
2649 reply_doserror(req
, ERRDOS
, ERRnomem
);
2650 END_PROFILE(SMBnttrans
);
2654 if (dscnt
> state
->total_data
||
2655 dsoff
+dscnt
< dsoff
) {
2659 if (dsoff
> av_size
||
2661 dsoff
+dscnt
> av_size
) {
2665 memcpy(state
->data
,smb_base(req
->inbuf
)+dsoff
,dscnt
);
2668 if (state
->total_param
) {
2669 /* Can't use talloc here, the core routines do realloc on the
2670 * params and data. */
2671 if ((state
->param
= (char *)SMB_MALLOC(state
->total_param
)) == NULL
) {
2672 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2673 "bytes !\n", (unsigned int)state
->total_param
));
2674 SAFE_FREE(state
->data
);
2676 reply_doserror(req
, ERRDOS
, ERRnomem
);
2677 END_PROFILE(SMBnttrans
);
2681 if (pscnt
> state
->total_param
||
2682 psoff
+pscnt
< psoff
) {
2686 if (psoff
> av_size
||
2688 psoff
+pscnt
> av_size
) {
2692 memcpy(state
->param
,smb_base(req
->inbuf
)+psoff
,pscnt
);
2695 state
->received_data
= dscnt
;
2696 state
->received_param
= pscnt
;
2698 if(state
->setup_count
> 0) {
2699 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2700 state
->setup_count
));
2701 state
->setup
= (uint16
*)TALLOC(state
, state
->setup_count
);
2702 if (state
->setup
== NULL
) {
2703 DEBUG(0,("reply_nttrans : Out of memory\n"));
2704 SAFE_FREE(state
->data
);
2705 SAFE_FREE(state
->param
);
2707 reply_doserror(req
, ERRDOS
, ERRnomem
);
2708 END_PROFILE(SMBnttrans
);
2712 if ((smb_nt_SetupStart
+ state
->setup_count
< smb_nt_SetupStart
) ||
2713 (smb_nt_SetupStart
+ state
->setup_count
< state
->setup_count
)) {
2716 if (smb_nt_SetupStart
+ state
->setup_count
> size
) {
2720 memcpy( state
->setup
, &req
->inbuf
[smb_nt_SetupStart
],
2721 state
->setup_count
);
2722 dump_data(10, (uint8
*)state
->setup
, state
->setup_count
);
2725 if ((state
->received_data
== state
->total_data
) &&
2726 (state
->received_param
== state
->total_param
)) {
2727 handle_nttrans(conn
, state
, req
);
2728 SAFE_FREE(state
->param
);
2729 SAFE_FREE(state
->data
);
2731 END_PROFILE(SMBnttrans
);
2735 DLIST_ADD(conn
->pending_trans
, state
);
2737 /* We need to send an interim response then receive the rest
2738 of the parameter/data bytes */
2739 reply_outbuf(req
, 0, 0);
2740 show_msg((char *)req
->outbuf
);
2741 END_PROFILE(SMBnttrans
);
2746 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2747 SAFE_FREE(state
->data
);
2748 SAFE_FREE(state
->param
);
2750 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
2751 END_PROFILE(SMBnttrans
);
2755 /****************************************************************************
2756 Reply to a SMBnttranss
2757 ****************************************************************************/
2759 void reply_nttranss(struct smb_request
*req
)
2761 connection_struct
*conn
= req
->conn
;
2762 uint32_t pcnt
,poff
,dcnt
,doff
,pdisp
,ddisp
;
2763 struct trans_state
*state
;
2767 START_PROFILE(SMBnttranss
);
2769 show_msg((char *)req
->inbuf
);
2771 if (req
->wct
< 18) {
2772 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
2773 END_PROFILE(SMBnttranss
);
2777 for (state
= conn
->pending_trans
; state
!= NULL
;
2778 state
= state
->next
) {
2779 if (state
->mid
== req
->mid
) {
2784 if ((state
== NULL
) || (state
->cmd
!= SMBnttrans
)) {
2785 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
2786 END_PROFILE(SMBnttranss
);
2790 /* Revise state->total_param and state->total_data in case they have
2791 changed downwards */
2792 if (IVAL(req
->inbuf
, smb_nts_TotalParameterCount
)
2793 < state
->total_param
) {
2794 state
->total_param
= IVAL(req
->inbuf
,
2795 smb_nts_TotalParameterCount
);
2797 if (IVAL(req
->inbuf
, smb_nts_TotalDataCount
) < state
->total_data
) {
2798 state
->total_data
= IVAL(req
->inbuf
, smb_nts_TotalDataCount
);
2801 size
= smb_len(req
->inbuf
) + 4;
2802 av_size
= smb_len(req
->inbuf
);
2804 pcnt
= IVAL(req
->inbuf
,smb_nts_ParameterCount
);
2805 poff
= IVAL(req
->inbuf
, smb_nts_ParameterOffset
);
2806 pdisp
= IVAL(req
->inbuf
, smb_nts_ParameterDisplacement
);
2808 dcnt
= IVAL(req
->inbuf
, smb_nts_DataCount
);
2809 ddisp
= IVAL(req
->inbuf
, smb_nts_DataDisplacement
);
2810 doff
= IVAL(req
->inbuf
, smb_nts_DataOffset
);
2812 state
->received_param
+= pcnt
;
2813 state
->received_data
+= dcnt
;
2815 if ((state
->received_data
> state
->total_data
) ||
2816 (state
->received_param
> state
->total_param
))
2820 if (pdisp
> state
->total_param
||
2821 pcnt
> state
->total_param
||
2822 pdisp
+pcnt
> state
->total_param
||
2823 pdisp
+pcnt
< pdisp
) {
2827 if (poff
> av_size
||
2829 poff
+pcnt
> av_size
||
2834 memcpy(state
->param
+pdisp
, smb_base(req
->inbuf
)+poff
,
2839 if (ddisp
> state
->total_data
||
2840 dcnt
> state
->total_data
||
2841 ddisp
+dcnt
> state
->total_data
||
2842 ddisp
+dcnt
< ddisp
) {
2846 if (ddisp
> av_size
||
2848 ddisp
+dcnt
> av_size
||
2849 ddisp
+dcnt
< ddisp
) {
2853 memcpy(state
->data
+ddisp
, smb_base(req
->inbuf
)+doff
,
2857 if ((state
->received_param
< state
->total_param
) ||
2858 (state
->received_data
< state
->total_data
)) {
2859 END_PROFILE(SMBnttranss
);
2864 * construct_reply_common will copy smb_com from inbuf to
2865 * outbuf. SMBnttranss is wrong here.
2867 SCVAL(req
->inbuf
,smb_com
,SMBnttrans
);
2869 handle_nttrans(conn
, state
, req
);
2871 DLIST_REMOVE(conn
->pending_trans
, state
);
2872 SAFE_FREE(state
->data
);
2873 SAFE_FREE(state
->param
);
2875 END_PROFILE(SMBnttranss
);
2880 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2881 DLIST_REMOVE(conn
->pending_trans
, state
);
2882 SAFE_FREE(state
->data
);
2883 SAFE_FREE(state
->param
);
2885 reply_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
2886 END_PROFILE(SMBnttranss
);