?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ctdb-logging: Separate out syslog and file logging backends
[Samba.git] / source3 / smbd / reply.c
blob9b3ed65447377bceee1ef14e50eec7a273d7ac0c
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "system/filesys.h"
29 #include "printing.h"
30 #include "smbd/smbd.h"
31 #include "smbd/globals.h"
32 #include "fake_file.h"
33 #include "rpc_client/rpc_client.h"
34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
35 #include "../librpc/gen_ndr/open_files.h"
36 #include "rpc_client/cli_spoolss.h"
37 #include "rpc_client/init_spoolss.h"
38 #include "rpc_server/rpc_ncacn_np.h"
39 #include "libcli/security/security.h"
40 #include "libsmb/nmblib.h"
41 #include "auth.h"
42 #include "smbprofile.h"
43 #include "../lib/tsocket/tsocket.h"
44 #include "lib/tevent_wait.h"
45 #include "libcli/smb/smb_signing.h"
46
47 /****************************************************************************
48 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
49 path or anything including wildcards.
50 We're assuming here that '/' is not the second byte in any multibyte char
51 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
52 set.
53 ****************************************************************************/
54
55 /* Custom version for processing POSIX paths. */
56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
57
58 static NTSTATUS check_path_syntax_internal(char *path,
59 bool posix_path,
60 bool *p_last_component_contains_wcard)
61 {
62 char *d = path;
63 const char *s = path;
64 NTSTATUS ret = NT_STATUS_OK;
65 bool start_of_name_component = True;
66 bool stream_started = false;
67
68 *p_last_component_contains_wcard = False;
69
70 while (*s) {
71 if (stream_started) {
72 switch (*s) {
73 case '/':
74 case '\\':
75 return NT_STATUS_OBJECT_NAME_INVALID;
76 case ':':
77 if (s[1] == '\0') {
78 return NT_STATUS_OBJECT_NAME_INVALID;
79 }
80 if (strchr_m(&s[1], ':')) {
81 return NT_STATUS_OBJECT_NAME_INVALID;
82 }
83 break;
84 }
85 }
86
87 if ((*s == ':') && !posix_path && !stream_started) {
88 if (*p_last_component_contains_wcard) {
89 return NT_STATUS_OBJECT_NAME_INVALID;
90 }
91 /* Stream names allow more characters than file names.
92 We're overloading posix_path here to allow a wider
93 range of characters. If stream_started is true this
94 is still a Windows path even if posix_path is true.
95 JRA.
96 */
97 stream_started = true;
98 start_of_name_component = false;
99 posix_path = true;
100
101 if (s[1] == '\0') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104 }
105
106 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
107 /*
108 * Safe to assume is not the second part of a mb char
109 * as this is handled below.
110 */
111 /* Eat multiple '/' or '\\' */
112 while (IS_PATH_SEP(*s,posix_path)) {
113 s++;
114 }
115 if ((d != path) && (*s != '\0')) {
116 /* We only care about non-leading or trailing '/' or '\\' */
117 *d++ = '/';
118 }
119
120 start_of_name_component = True;
121 /* New component. */
122 *p_last_component_contains_wcard = False;
123 continue;
124 }
125
126 if (start_of_name_component) {
127 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
128 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
129
130 /*
131 * No mb char starts with '.' so we're safe checking the directory separator here.
132 */
133
134 /* If we just added a '/' - delete it */
135 if ((d > path) && (*(d-1) == '/')) {
136 *(d-1) = '\0';
137 d--;
138 }
139
140 /* Are we at the start ? Can't go back further if so. */
141 if (d <= path) {
142 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
143 break;
144 }
145 /* Go back one level... */
146 /* We know this is safe as '/' cannot be part of a mb sequence. */
147 /* NOTE - if this assumption is invalid we are not in good shape... */
148 /* Decrement d first as d points to the *next* char to write into. */
149 for (d--; d > path; d--) {
150 if (*d == '/')
151 break;
152 }
153 s += 2; /* Else go past the .. */
154 /* We're still at the start of a name component, just the previous one. */
155 continue;
156
157 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
158 if (posix_path) {
159 /* Eat the '.' */
160 s++;
161 continue;
162 }
163 }
164
165 }
166
167 if (!(*s & 0x80)) {
168 if (!posix_path) {
169 if (*s <= 0x1f || *s == '|') {
170 return NT_STATUS_OBJECT_NAME_INVALID;
171 }
172 switch (*s) {
173 case '*':
174 case '?':
175 case '<':
176 case '>':
177 case '"':
178 *p_last_component_contains_wcard = True;
179 break;
180 default:
181 break;
182 }
183 }
184 *d++ = *s++;
185 } else {
186 size_t siz;
187 /* Get the size of the next MB character. */
188 next_codepoint(s,&siz);
189 switch(siz) {
190 case 5:
191 *d++ = *s++;
192 /*fall through*/
193 case 4:
194 *d++ = *s++;
195 /*fall through*/
196 case 3:
197 *d++ = *s++;
198 /*fall through*/
199 case 2:
200 *d++ = *s++;
201 /*fall through*/
202 case 1:
203 *d++ = *s++;
204 break;
205 default:
206 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
207 *d = '\0';
208 return NT_STATUS_INVALID_PARAMETER;
209 }
210 }
211 start_of_name_component = False;
212 }
213
214 *d = '\0';
215
216 return ret;
217 }
218
219 /****************************************************************************
220 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
221 No wildcards allowed.
222 ****************************************************************************/
223
224 NTSTATUS check_path_syntax(char *path)
225 {
226 bool ignore;
227 return check_path_syntax_internal(path, False, &ignore);
228 }
229
230 /****************************************************************************
231 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
232 Wildcards allowed - p_contains_wcard returns true if the last component contained
233 a wildcard.
234 ****************************************************************************/
235
236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
237 {
238 return check_path_syntax_internal(path, False, p_contains_wcard);
239 }
240
241 /****************************************************************************
242 Check the path for a POSIX client.
243 We're assuming here that '/' is not the second byte in any multibyte char
244 set (a safe assumption).
245 ****************************************************************************/
246
247 NTSTATUS check_path_syntax_posix(char *path)
248 {
249 bool ignore;
250 return check_path_syntax_internal(path, True, &ignore);
251 }
252
253 /****************************************************************************
254 Pull a string and check the path allowing a wilcard - provide for error return.
255 ****************************************************************************/
256
257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
258 const char *base_ptr,
259 uint16 smb_flags2,
260 char **pp_dest,
261 const char *src,
262 size_t src_len,
263 int flags,
264 NTSTATUS *err,
265 bool *contains_wcard)
266 {
267 size_t ret;
268
269 *pp_dest = NULL;
270
271 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
272 src_len, flags);
273
274 if (!*pp_dest) {
275 *err = NT_STATUS_INVALID_PARAMETER;
276 return ret;
277 }
278
279 *contains_wcard = False;
280
281 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
282 /*
283 * For a DFS path the function parse_dfs_path()
284 * will do the path processing, just make a copy.
285 */
286 *err = NT_STATUS_OK;
287 return ret;
288 }
289
290 if (lp_posix_pathnames()) {
291 *err = check_path_syntax_posix(*pp_dest);
292 } else {
293 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
294 }
295
296 return ret;
297 }
298
299 /****************************************************************************
300 Pull a string and check the path - provide for error return.
301 ****************************************************************************/
302
303 size_t srvstr_get_path(TALLOC_CTX *ctx,
304 const char *base_ptr,
305 uint16 smb_flags2,
306 char **pp_dest,
307 const char *src,
308 size_t src_len,
309 int flags,
310 NTSTATUS *err)
311 {
312 bool ignore;
313 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
314 src_len, flags, err, &ignore);
315 }
316
317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
318 char **pp_dest, const char *src, int flags,
319 NTSTATUS *err, bool *contains_wcard)
320 {
321 ssize_t bufrem = smbreq_bufrem(req, src);
322
323 if (bufrem < 0) {
324 *err = NT_STATUS_INVALID_PARAMETER;
325 return 0;
326 }
327
328 return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
329 req->flags2, pp_dest, src, bufrem, flags,
330 err, contains_wcard);
331 }
332
333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
334 char **pp_dest, const char *src, int flags,
335 NTSTATUS *err)
336 {
337 bool ignore;
338 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
339 flags, err, &ignore);
340 }
341
342 /**
343 * pull a string from the smb_buf part of a packet. In this case the
344 * string can either be null terminated or it can be terminated by the
345 * end of the smbbuf area
346 */
347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
348 char **dest, const uint8_t *src, int flags)
349 {
350 ssize_t bufrem = smbreq_bufrem(req, src);
351
352 if (bufrem < 0) {
353 return 0;
354 }
355
356 return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
357 bufrem, flags);
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
362 ****************************************************************************/
363
364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
365 files_struct *fsp)
366 {
367 if ((fsp == NULL) || (conn == NULL)) {
368 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
369 return False;
370 }
371 if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
372 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
373 return False;
374 }
375 return True;
376 }
377
378 /****************************************************************************
379 Check if we have a correct fsp pointing to a file.
380 ****************************************************************************/
381
382 bool check_fsp(connection_struct *conn, struct smb_request *req,
383 files_struct *fsp)
384 {
385 if (!check_fsp_open(conn, req, fsp)) {
386 return False;
387 }
388 if (fsp->is_directory) {
389 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
390 return False;
391 }
392 if (fsp->fh->fd == -1) {
393 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
394 return False;
395 }
396 fsp->num_smb_operations++;
397 return True;
398 }
399
400 /****************************************************************************
401 Check if we have a correct fsp pointing to a quota fake file. Replacement for
402 the CHECK_NTQUOTA_HANDLE_OK macro.
403 ****************************************************************************/
404
405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
406 files_struct *fsp)
407 {
408 if (!check_fsp_open(conn, req, fsp)) {
409 return false;
410 }
411
412 if (fsp->is_directory) {
413 return false;
414 }
415
416 if (fsp->fake_file_handle == NULL) {
417 return false;
418 }
419
420 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
421 return false;
422 }
423
424 if (fsp->fake_file_handle->private_data == NULL) {
425 return false;
426 }
427
428 return true;
429 }
430
431 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
432 const char *name, int name_type)
433 {
434 char *trim_name;
435 char *trim_name_type;
436 const char *retarget_parm;
437 char *retarget;
438 char *p;
439 int retarget_type = 0x20;
440 int retarget_port = NBT_SMB_PORT;
441 struct sockaddr_storage retarget_addr;
442 struct sockaddr_in *in_addr;
443 bool ret = false;
444 uint8_t outbuf[10];
445
446 if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
447 return false;
448 }
449
450 trim_name = talloc_strdup(talloc_tos(), name);
451 if (trim_name == NULL) {
452 goto fail;
453 }
454 trim_char(trim_name, ' ', ' ');
455
456 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
457 name_type);
458 if (trim_name_type == NULL) {
459 goto fail;
460 }
461
462 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
463 trim_name_type, NULL);
464 if (retarget_parm == NULL) {
465 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
466 trim_name, NULL);
467 }
468 if (retarget_parm == NULL) {
469 goto fail;
470 }
471
472 retarget = talloc_strdup(trim_name, retarget_parm);
473 if (retarget == NULL) {
474 goto fail;
475 }
476
477 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
478
479 p = strchr(retarget, ':');
480 if (p != NULL) {
481 *p++ = '\0';
482 retarget_port = atoi(p);
483 }
484
485 p = strchr_m(retarget, '#');
486 if (p != NULL) {
487 *p++ = '\0';
488 if (sscanf(p, "%x", &retarget_type) != 1) {
489 goto fail;
490 }
491 }
492
493 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
494 if (!ret) {
495 DEBUG(10, ("could not resolve %s\n", retarget));
496 goto fail;
497 }
498
499 if (retarget_addr.ss_family != AF_INET) {
500 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
501 goto fail;
502 }
503
504 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
505
506 _smb_setlen(outbuf, 6);
507 SCVAL(outbuf, 0, 0x84);
508 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
509 *(uint16_t *)(outbuf+8) = htons(retarget_port);
510
511 if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
512 NULL)) {
513 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
514 "failed.");
515 }
516
517 ret = true;
518 fail:
519 TALLOC_FREE(trim_name);
520 return ret;
521 }
522
523 static void reply_called_name_not_present(char *outbuf)
524 {
525 smb_setlen(outbuf, 1);
526 SCVAL(outbuf, 0, 0x83);
527 SCVAL(outbuf, 4, 0x82);
528 }
529
530 /****************************************************************************
531 Reply to a (netbios-level) special message.
532 ****************************************************************************/
533
534 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
535 {
536 struct smbd_server_connection *sconn = xconn->client->sconn;
537 int msg_type = CVAL(inbuf,0);
538 int msg_flags = CVAL(inbuf,1);
539 /*
540 * We only really use 4 bytes of the outbuf, but for the smb_setlen
541 * calculation & friends (srv_send_smb uses that) we need the full smb
542 * header.
543 */
544 char outbuf[smb_size];
545
546 memset(outbuf, '\0', sizeof(outbuf));
547
548 smb_setlen(outbuf,0);
549
550 switch (msg_type) {
551 case NBSSrequest: /* session request */
552 {
553 /* inbuf_size is guarenteed to be at least 4. */
554 fstring name1,name2;
555 int name_type1, name_type2;
556 int name_len1, name_len2;
557
558 *name1 = *name2 = 0;
559
560 if (xconn->transport.nbt.got_session) {
561 exit_server_cleanly("multiple session request not permitted");
562 }
563
564 SCVAL(outbuf,0,NBSSpositive);
565 SCVAL(outbuf,3,0);
566
567 /* inbuf_size is guaranteed to be at least 4. */
568 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
569 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
570 DEBUG(0,("Invalid name length in session request\n"));
571 reply_called_name_not_present(outbuf);
572 break;
573 }
574 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
575 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
576 DEBUG(0,("Invalid name length in session request\n"));
577 reply_called_name_not_present(outbuf);
578 break;
579 }
580
581 name_type1 = name_extract((unsigned char *)inbuf,
582 inbuf_size,(unsigned int)4,name1);
583 name_type2 = name_extract((unsigned char *)inbuf,
584 inbuf_size,(unsigned int)(4 + name_len1),name2);
585
586 if (name_type1 == -1 || name_type2 == -1) {
587 DEBUG(0,("Invalid name type in session request\n"));
588 reply_called_name_not_present(outbuf);
589 break;
590 }
591
592 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
593 name1, name_type1, name2, name_type2));
594
595 if (netbios_session_retarget(xconn, name1, name_type1)) {
596 exit_server_cleanly("retargeted client");
597 }
598
599 /*
600 * Windows NT/2k uses "*SMBSERVER" and XP uses
601 * "*SMBSERV" arrggg!!!
602 */
603 if (strequal(name1, "*SMBSERVER ")
604 || strequal(name1, "*SMBSERV ")) {
605 char *raddr;
606
607 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
608 talloc_tos());
609 if (raddr == NULL) {
610 exit_server_cleanly("could not allocate raddr");
611 }
612
613 fstrcpy(name1, raddr);
614 }
615
616 set_local_machine_name(name1, True);
617 set_remote_machine_name(name2, True);
618
619 if (is_ipaddress(sconn->remote_hostname)) {
620 char *p = discard_const_p(char, sconn->remote_hostname);
621
622 talloc_free(p);
623
624 sconn->remote_hostname = talloc_strdup(sconn,
625 get_remote_machine_name());
626 if (sconn->remote_hostname == NULL) {
627 exit_server_cleanly("could not copy remote name");
628 }
629 xconn->remote_hostname = sconn->remote_hostname;
630 }
631
632 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
633 get_local_machine_name(), get_remote_machine_name(),
634 name_type2));
635
636 if (name_type2 == 'R') {
637 /* We are being asked for a pathworks session ---
638 no thanks! */
639 reply_called_name_not_present(outbuf);
640 break;
641 }
642
643 reload_services(sconn, conn_snum_used, true);
644 reopen_logs();
645
646 xconn->transport.nbt.got_session = true;
647 break;
648 }
649
650 case 0x89: /* session keepalive request
651 (some old clients produce this?) */
652 SCVAL(outbuf,0,NBSSkeepalive);
653 SCVAL(outbuf,3,0);
654 break;
655
656 case NBSSpositive: /* positive session response */
657 case NBSSnegative: /* negative session response */
658 case NBSSretarget: /* retarget session response */
659 DEBUG(0,("Unexpected session response\n"));
660 break;
661
662 case NBSSkeepalive: /* session keepalive */
663 default:
664 return;
665 }
666
667 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
668 msg_type, msg_flags));
669
670 srv_send_smb(xconn, outbuf, false, 0, false, NULL);
671
672 if (CVAL(outbuf, 0) != 0x82) {
673 exit_server_cleanly("invalid netbios session");
674 }
675 return;
676 }
677
678 /****************************************************************************
679 Reply to a tcon.
680 conn POINTER CAN BE NULL HERE !
681 ****************************************************************************/
682
683 void reply_tcon(struct smb_request *req)
684 {
685 connection_struct *conn = req->conn;
686 const char *service;
687 char *service_buf = NULL;
688 char *password = NULL;
689 char *dev = NULL;
690 int pwlen=0;
691 NTSTATUS nt_status;
692 const uint8_t *p;
693 const char *p2;
694 TALLOC_CTX *ctx = talloc_tos();
695 struct smbXsrv_connection *xconn = req->xconn;
696 NTTIME now = timeval_to_nttime(&req->request_time);
697
698 START_PROFILE(SMBtcon);
699
700 if (req->buflen < 4) {
701 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
702 END_PROFILE(SMBtcon);
703 return;
704 }
705
706 p = req->buf + 1;
707 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
708 p += 1;
709 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
710 p += pwlen+1;
711 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
712 p += 1;
713
714 if (service_buf == NULL || password == NULL || dev == NULL) {
715 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
716 END_PROFILE(SMBtcon);
717 return;
718 }
719 p2 = strrchr_m(service_buf,'\\');
720 if (p2) {
721 service = p2+1;
722 } else {
723 service = service_buf;
724 }
725
726 conn = make_connection(req, now, service, dev,
727 req->vuid,&nt_status);
728 req->conn = conn;
729
730 if (!conn) {
731 reply_nterror(req, nt_status);
732 END_PROFILE(SMBtcon);
733 return;
734 }
735
736 reply_outbuf(req, 2, 0);
737 SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
738 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
739 SSVAL(req->outbuf,smb_tid,conn->cnum);
740
741 DEBUG(3,("tcon service=%s cnum=%d\n",
742 service, conn->cnum));
743
744 END_PROFILE(SMBtcon);
745 return;
746 }
747
748 /****************************************************************************
749 Reply to a tcon and X.
750 conn POINTER CAN BE NULL HERE !
751 ****************************************************************************/
752
753 void reply_tcon_and_X(struct smb_request *req)
754 {
755 connection_struct *conn = req->conn;
756 const char *service = NULL;
757 TALLOC_CTX *ctx = talloc_tos();
758 /* what the cleint thinks the device is */
759 char *client_devicetype = NULL;
760 /* what the server tells the client the share represents */
761 const char *server_devicetype;
762 NTSTATUS nt_status;
763 int passlen;
764 char *path = NULL;
765 const uint8_t *p;
766 const char *q;
767 uint16_t tcon_flags;
768 struct smbXsrv_session *session = NULL;
769 NTTIME now = timeval_to_nttime(&req->request_time);
770 bool session_key_updated = false;
771 uint16_t optional_support = 0;
772 struct smbXsrv_connection *xconn = req->xconn;
773
774 START_PROFILE(SMBtconX);
775
776 if (req->wct < 4) {
777 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
778 END_PROFILE(SMBtconX);
779 return;
780 }
781
782 passlen = SVAL(req->vwv+3, 0);
783 tcon_flags = SVAL(req->vwv+2, 0);
784
785 /* we might have to close an old one */
786 if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
787 struct smbXsrv_tcon *tcon;
788 NTSTATUS status;
789
790 tcon = conn->tcon;
791 req->conn = NULL;
792 conn = NULL;
793
794 /*
795 * TODO: cancel all outstanding requests on the tcon
796 */
797 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
798 if (!NT_STATUS_IS_OK(status)) {
799 DEBUG(0, ("reply_tcon_and_X: "
800 "smbXsrv_tcon_disconnect() failed: %s\n",
801 nt_errstr(status)));
802 /*
803 * If we hit this case, there is something completely
804 * wrong, so we better disconnect the transport connection.
805 */
806 END_PROFILE(SMBtconX);
807 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
808 return;
809 }
810
811 TALLOC_FREE(tcon);
812 }
813
814 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
815 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
816 END_PROFILE(SMBtconX);
817 return;
818 }
819
820 if (xconn->smb1.negprot.encrypted_passwords) {
821 p = req->buf + passlen;
822 } else {
823 p = req->buf + passlen + 1;
824 }
825
826 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
827
828 if (path == NULL) {
829 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
830 END_PROFILE(SMBtconX);
831 return;
832 }
833
834 /*
835 * the service name can be either: \\server\share
836 * or share directly like on the DELL PowerVault 705
837 */
838 if (*path=='\\') {
839 q = strchr_m(path+2,'\\');
840 if (!q) {
841 reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
842 END_PROFILE(SMBtconX);
843 return;
844 }
845 service = q+1;
846 } else {
847 service = path;
848 }
849
850 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
851 &client_devicetype, p,
852 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
853
854 if (client_devicetype == NULL) {
855 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
856 END_PROFILE(SMBtconX);
857 return;
858 }
859
860 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
861
862 nt_status = smb1srv_session_lookup(xconn,
863 req->vuid, now, &session);
864 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
865 reply_force_doserror(req, ERRSRV, ERRbaduid);
866 END_PROFILE(SMBtconX);
867 return;
868 }
869 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
870 reply_nterror(req, nt_status);
871 END_PROFILE(SMBtconX);
872 return;
873 }
874 if (!NT_STATUS_IS_OK(nt_status)) {
875 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
876 END_PROFILE(SMBtconX);
877 return;
878 }
879
880 if (session->global->auth_session_info == NULL) {
881 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
882 END_PROFILE(SMBtconX);
883 return;
884 }
885
886 /*
887 * If there is no application key defined yet
888 * we create one.
889 *
890 * This means we setup the application key on the
891 * first tcon that happens via the given session.
892 *
893 * Once the application key is defined, it does not
894 * change any more.
895 */
896 if (session->global->application_key.length == 0 &&
897 session->global->signing_key.length > 0)
898 {
899 struct smbXsrv_session *x = session;
900 struct auth_session_info *session_info =
901 session->global->auth_session_info;
902 uint8_t session_key[16];
903
904 ZERO_STRUCT(session_key);
905 memcpy(session_key, x->global->signing_key.data,
906 MIN(x->global->signing_key.length, sizeof(session_key)));
907
908 /*
909 * The application key is truncated/padded to 16 bytes
910 */
911 x->global->application_key = data_blob_talloc(x->global,
912 session_key,
913 sizeof(session_key));
914 ZERO_STRUCT(session_key);
915 if (x->global->application_key.data == NULL) {
916 reply_nterror(req, NT_STATUS_NO_MEMORY);
917 END_PROFILE(SMBtconX);
918 return;
919 }
920
921 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
922 smb_key_derivation(x->global->application_key.data,
923 x->global->application_key.length,
924 x->global->application_key.data);
925 optional_support |= SMB_EXTENDED_SIGNATURES;
926 }
927
928 /*
929 * Place the application key into the session_info
930 */
931 data_blob_clear_free(&session_info->session_key);
932 session_info->session_key = data_blob_dup_talloc(session_info,
933 x->global->application_key);
934 if (session_info->session_key.data == NULL) {
935 data_blob_clear_free(&x->global->application_key);
936 reply_nterror(req, NT_STATUS_NO_MEMORY);
937 END_PROFILE(SMBtconX);
938 return;
939 }
940 session_key_updated = true;
941 }
942
943 conn = make_connection(req, now, service, client_devicetype,
944 req->vuid, &nt_status);
945 req->conn =conn;
946
947 if (!conn) {
948 if (session_key_updated) {
949 struct smbXsrv_session *x = session;
950 struct auth_session_info *session_info =
951 session->global->auth_session_info;
952 data_blob_clear_free(&x->global->application_key);
953 data_blob_clear_free(&session_info->session_key);
954 }
955 reply_nterror(req, nt_status);
956 END_PROFILE(SMBtconX);
957 return;
958 }
959
960 if ( IS_IPC(conn) )
961 server_devicetype = "IPC";
962 else if ( IS_PRINT(conn) )
963 server_devicetype = "LPT1:";
964 else
965 server_devicetype = "A:";
966
967 if (get_Protocol() < PROTOCOL_NT1) {
968 reply_outbuf(req, 2, 0);
969 if (message_push_string(&req->outbuf, server_devicetype,
970 STR_TERMINATE|STR_ASCII) == -1) {
971 reply_nterror(req, NT_STATUS_NO_MEMORY);
972 END_PROFILE(SMBtconX);
973 return;
974 }
975 } else {
976 /* NT sets the fstype of IPC$ to the null string */
977 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
978
979 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
980 /* Return permissions. */
981 uint32 perm1 = 0;
982 uint32 perm2 = 0;
983
984 reply_outbuf(req, 7, 0);
985
986 if (IS_IPC(conn)) {
987 perm1 = FILE_ALL_ACCESS;
988 perm2 = FILE_ALL_ACCESS;
989 } else {
990 perm1 = conn->share_access;
991 }
992
993 SIVAL(req->outbuf, smb_vwv3, perm1);
994 SIVAL(req->outbuf, smb_vwv5, perm2);
995 } else {
996 reply_outbuf(req, 3, 0);
997 }
998
999 if ((message_push_string(&req->outbuf, server_devicetype,
1000 STR_TERMINATE|STR_ASCII) == -1)
1001 || (message_push_string(&req->outbuf, fstype,
1002 STR_TERMINATE) == -1)) {
1003 reply_nterror(req, NT_STATUS_NO_MEMORY);
1004 END_PROFILE(SMBtconX);
1005 return;
1006 }
1007
1008 /* what does setting this bit do? It is set by NT4 and
1009 may affect the ability to autorun mounted cdroms */
1010 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1011 optional_support |=
1012 (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1013
1014 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1015 DEBUG(2,("Serving %s as a Dfs root\n",
1016 lp_servicename(ctx, SNUM(conn)) ));
1017 optional_support |= SMB_SHARE_IN_DFS;
1018 }
1019
1020 SSVAL(req->outbuf, smb_vwv2, optional_support);
1021 }
1022
1023 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1024 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
1025
1026 DEBUG(3,("tconX service=%s \n",
1027 service));
1028
1029 /* set the incoming and outgoing tid to the just created one */
1030 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1031 SSVAL(req->outbuf,smb_tid,conn->cnum);
1032
1033 END_PROFILE(SMBtconX);
1034
1035 req->tid = conn->cnum;
1036 }
1037
1038 /****************************************************************************
1039 Reply to an unknown type.
1040 ****************************************************************************/
1041
1042 void reply_unknown_new(struct smb_request *req, uint8 type)
1043 {
1044 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1045 smb_fn_name(type), type, type));
1046 reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1047 return;
1048 }
1049
1050 /****************************************************************************
1051 Reply to an ioctl.
1052 conn POINTER CAN BE NULL HERE !
1053 ****************************************************************************/
1054
1055 void reply_ioctl(struct smb_request *req)
1056 {
1057 connection_struct *conn = req->conn;
1058 uint16 device;
1059 uint16 function;
1060 uint32 ioctl_code;
1061 int replysize;
1062 char *p;
1063
1064 START_PROFILE(SMBioctl);
1065
1066 if (req->wct < 3) {
1067 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1068 END_PROFILE(SMBioctl);
1069 return;
1070 }
1071
1072 device = SVAL(req->vwv+1, 0);
1073 function = SVAL(req->vwv+2, 0);
1074 ioctl_code = (device << 16) + function;
1075
1076 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1077
1078 switch (ioctl_code) {
1079 case IOCTL_QUERY_JOB_INFO:
1080 replysize = 32;
1081 break;
1082 default:
1083 reply_force_doserror(req, ERRSRV, ERRnosupport);
1084 END_PROFILE(SMBioctl);
1085 return;
1086 }
1087
1088 reply_outbuf(req, 8, replysize+1);
1089 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1090 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1091 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
1092 p = smb_buf(req->outbuf);
1093 memset(p, '\0', replysize+1); /* valgrind-safe. */
1094 p += 1; /* Allow for alignment */
1095
1096 switch (ioctl_code) {
1097 case IOCTL_QUERY_JOB_INFO:
1098 {
1099 NTSTATUS status;
1100 size_t len = 0;
1101 files_struct *fsp = file_fsp(
1102 req, SVAL(req->vwv+0, 0));
1103 if (!fsp) {
1104 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1105 END_PROFILE(SMBioctl);
1106 return;
1107 }
1108 /* Job number */
1109 SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1110
1111 status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
1112 lp_netbios_name(), 15,
1113 STR_TERMINATE|STR_ASCII, &len);
1114 if (!NT_STATUS_IS_OK(status)) {
1115 reply_nterror(req, status);
1116 END_PROFILE(SMBioctl);
1117 return;
1118 }
1119 if (conn) {
1120 status = srvstr_push((char *)req->outbuf, req->flags2,
1121 p+18,
1122 lp_servicename(talloc_tos(),
1123 SNUM(conn)),
1124 13, STR_TERMINATE|STR_ASCII, &len);
1125 if (!NT_STATUS_IS_OK(status)) {
1126 reply_nterror(req, status);
1127 END_PROFILE(SMBioctl);
1128 return;
1129 }
1130 } else {
1131 memset(p+18, 0, 13);
1132 }
1133 break;
1134 }
1135 }
1136
1137 END_PROFILE(SMBioctl);
1138 return;
1139 }
1140
1141 /****************************************************************************
1142 Strange checkpath NTSTATUS mapping.
1143 ****************************************************************************/
1144
1145 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1146 {
1147 /* Strange DOS error code semantics only for checkpath... */
1148 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1149 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1150 /* We need to map to ERRbadpath */
1151 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1152 }
1153 }
1154 return status;
1155 }
1156
1157 /****************************************************************************
1158 Reply to a checkpath.
1159 ****************************************************************************/
1160
1161 void reply_checkpath(struct smb_request *req)
1162 {
1163 connection_struct *conn = req->conn;
1164 struct smb_filename *smb_fname = NULL;
1165 char *name = NULL;
1166 NTSTATUS status;
1167 TALLOC_CTX *ctx = talloc_tos();
1168
1169 START_PROFILE(SMBcheckpath);
1170
1171 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1172 STR_TERMINATE, &status);
1173
1174 if (!NT_STATUS_IS_OK(status)) {
1175 status = map_checkpath_error(req->flags2, status);
1176 reply_nterror(req, status);
1177 END_PROFILE(SMBcheckpath);
1178 return;
1179 }
1180
1181 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1182
1183 status = filename_convert(ctx,
1184 conn,
1185 req->flags2 & FLAGS2_DFS_PATHNAMES,
1186 name,
1187 0,
1188 NULL,
1189 &smb_fname);
1190
1191 if (!NT_STATUS_IS_OK(status)) {
1192 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1193 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1194 ERRSRV, ERRbadpath);
1195 END_PROFILE(SMBcheckpath);
1196 return;
1197 }
1198 goto path_err;
1199 }
1200
1201 if (!VALID_STAT(smb_fname->st) &&
1202 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1203 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1204 smb_fname_str_dbg(smb_fname), strerror(errno)));
1205 status = map_nt_error_from_unix(errno);
1206 goto path_err;
1207 }
1208
1209 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1210 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1211 ERRDOS, ERRbadpath);
1212 goto out;
1213 }
1214
1215 reply_outbuf(req, 0, 0);
1216
1217 path_err:
1218 /* We special case this - as when a Windows machine
1219 is parsing a path is steps through the components
1220 one at a time - if a component fails it expects
1221 ERRbadpath, not ERRbadfile.
1222 */
1223 status = map_checkpath_error(req->flags2, status);
1224 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1225 /*
1226 * Windows returns different error codes if
1227 * the parent directory is valid but not the
1228 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1229 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1230 * if the path is invalid.
1231 */
1232 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1233 ERRDOS, ERRbadpath);
1234 goto out;
1235 }
1236
1237 reply_nterror(req, status);
1238
1239 out:
1240 TALLOC_FREE(smb_fname);
1241 END_PROFILE(SMBcheckpath);
1242 return;
1243 }
1244
1245 /****************************************************************************
1246 Reply to a getatr.
1247 ****************************************************************************/
1248
1249 void reply_getatr(struct smb_request *req)
1250 {
1251 connection_struct *conn = req->conn;
1252 struct smb_filename *smb_fname = NULL;
1253 char *fname = NULL;
1254 int mode=0;
1255 off_t size=0;
1256 time_t mtime=0;
1257 const char *p;
1258 NTSTATUS status;
1259 TALLOC_CTX *ctx = talloc_tos();
1260 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1261
1262 START_PROFILE(SMBgetatr);
1263
1264 p = (const char *)req->buf + 1;
1265 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 reply_nterror(req, status);
1268 goto out;
1269 }
1270
1271 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1272 under WfWg - weird! */
1273 if (*fname == '\0') {
1274 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1275 if (!CAN_WRITE(conn)) {
1276 mode |= FILE_ATTRIBUTE_READONLY;
1277 }
1278 size = 0;
1279 mtime = 0;
1280 } else {
1281 status = filename_convert(ctx,
1282 conn,
1283 req->flags2 & FLAGS2_DFS_PATHNAMES,
1284 fname,
1285 0,
1286 NULL,
1287 &smb_fname);
1288 if (!NT_STATUS_IS_OK(status)) {
1289 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1290 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1291 ERRSRV, ERRbadpath);
1292 goto out;
1293 }
1294 reply_nterror(req, status);
1295 goto out;
1296 }
1297 if (!VALID_STAT(smb_fname->st) &&
1298 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1299 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1300 smb_fname_str_dbg(smb_fname),
1301 strerror(errno)));
1302 reply_nterror(req, map_nt_error_from_unix(errno));
1303 goto out;
1304 }
1305
1306 mode = dos_mode(conn, smb_fname);
1307 size = smb_fname->st.st_ex_size;
1308
1309 if (ask_sharemode) {
1310 struct timespec write_time_ts;
1311 struct file_id fileid;
1312
1313 ZERO_STRUCT(write_time_ts);
1314 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1315 get_file_infos(fileid, 0, NULL, &write_time_ts);
1316 if (!null_timespec(write_time_ts)) {
1317 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1318 }
1319 }
1320
1321 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1322 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1323 size = 0;
1324 }
1325 }
1326
1327 reply_outbuf(req, 10, 0);
1328
1329 SSVAL(req->outbuf,smb_vwv0,mode);
1330 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1331 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1332 } else {
1333 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1334 }
1335 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1336
1337 if (get_Protocol() >= PROTOCOL_NT1) {
1338 SSVAL(req->outbuf, smb_flg2,
1339 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1340 }
1341
1342 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1343 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1344
1345 out:
1346 TALLOC_FREE(smb_fname);
1347 TALLOC_FREE(fname);
1348 END_PROFILE(SMBgetatr);
1349 return;
1350 }
1351
1352 /****************************************************************************
1353 Reply to a setatr.
1354 ****************************************************************************/
1355
1356 void reply_setatr(struct smb_request *req)
1357 {
1358 struct smb_file_time ft;
1359 connection_struct *conn = req->conn;
1360 struct smb_filename *smb_fname = NULL;
1361 char *fname = NULL;
1362 int mode;
1363 time_t mtime;
1364 const char *p;
1365 NTSTATUS status;
1366 TALLOC_CTX *ctx = talloc_tos();
1367
1368 START_PROFILE(SMBsetatr);
1369
1370 ZERO_STRUCT(ft);
1371
1372 if (req->wct < 2) {
1373 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374 goto out;
1375 }
1376
1377 p = (const char *)req->buf + 1;
1378 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1379 if (!NT_STATUS_IS_OK(status)) {
1380 reply_nterror(req, status);
1381 goto out;
1382 }
1383
1384 status = filename_convert(ctx,
1385 conn,
1386 req->flags2 & FLAGS2_DFS_PATHNAMES,
1387 fname,
1388 0,
1389 NULL,
1390 &smb_fname);
1391 if (!NT_STATUS_IS_OK(status)) {
1392 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1393 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1394 ERRSRV, ERRbadpath);
1395 goto out;
1396 }
1397 reply_nterror(req, status);
1398 goto out;
1399 }
1400
1401 if (smb_fname->base_name[0] == '.' &&
1402 smb_fname->base_name[1] == '\0') {
1403 /*
1404 * Not sure here is the right place to catch this
1405 * condition. Might be moved to somewhere else later -- vl
1406 */
1407 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1408 goto out;
1409 }
1410
1411 mode = SVAL(req->vwv+0, 0);
1412 mtime = srv_make_unix_date3(req->vwv+1);
1413
1414 if (mode != FILE_ATTRIBUTE_NORMAL) {
1415 if (VALID_STAT_OF_DIR(smb_fname->st))
1416 mode |= FILE_ATTRIBUTE_DIRECTORY;
1417 else
1418 mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1419
1420 status = check_access(conn, NULL, smb_fname,
1421 FILE_WRITE_ATTRIBUTES);
1422 if (!NT_STATUS_IS_OK(status)) {
1423 reply_nterror(req, status);
1424 goto out;
1425 }
1426
1427 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1428 false) != 0) {
1429 reply_nterror(req, map_nt_error_from_unix(errno));
1430 goto out;
1431 }
1432 }
1433
1434 ft.mtime = convert_time_t_to_timespec(mtime);
1435 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 reply_nterror(req, status);
1438 goto out;
1439 }
1440
1441 reply_outbuf(req, 0, 0);
1442
1443 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1444 mode));
1445 out:
1446 TALLOC_FREE(smb_fname);
1447 END_PROFILE(SMBsetatr);
1448 return;
1449 }
1450
1451 /****************************************************************************
1452 Reply to a dskattr.
1453 ****************************************************************************/
1454
1455 void reply_dskattr(struct smb_request *req)
1456 {
1457 connection_struct *conn = req->conn;
1458 uint64_t dfree,dsize,bsize;
1459 START_PROFILE(SMBdskattr);
1460
1461 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1462 reply_nterror(req, map_nt_error_from_unix(errno));
1463 END_PROFILE(SMBdskattr);
1464 return;
1465 }
1466
1467 reply_outbuf(req, 5, 0);
1468
1469 if (get_Protocol() <= PROTOCOL_LANMAN2) {
1470 double total_space, free_space;
1471 /* we need to scale this to a number that DOS6 can handle. We
1472 use floating point so we can handle large drives on systems
1473 that don't have 64 bit integers
1474
1475 we end up displaying a maximum of 2G to DOS systems
1476 */
1477 total_space = dsize * (double)bsize;
1478 free_space = dfree * (double)bsize;
1479
1480 dsize = (uint64_t)((total_space+63*512) / (64*512));
1481 dfree = (uint64_t)((free_space+63*512) / (64*512));
1482
1483 if (dsize > 0xFFFF) dsize = 0xFFFF;
1484 if (dfree > 0xFFFF) dfree = 0xFFFF;
1485
1486 SSVAL(req->outbuf,smb_vwv0,dsize);
1487 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1488 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1489 SSVAL(req->outbuf,smb_vwv3,dfree);
1490 } else {
1491 SSVAL(req->outbuf,smb_vwv0,dsize);
1492 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1493 SSVAL(req->outbuf,smb_vwv2,512);
1494 SSVAL(req->outbuf,smb_vwv3,dfree);
1495 }
1496
1497 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1498
1499 END_PROFILE(SMBdskattr);
1500 return;
1501 }
1502
1503 /*
1504 * Utility function to split the filename from the directory.
1505 */
1506 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1507 char **fname_dir_out,
1508 char **fname_mask_out)
1509 {
1510 const char *p = NULL;
1511 char *fname_dir = NULL;
1512 char *fname_mask = NULL;
1513
1514 p = strrchr_m(fname_in, '/');
1515 if (!p) {
1516 fname_dir = talloc_strdup(ctx, ".");
1517 fname_mask = talloc_strdup(ctx, fname_in);
1518 } else {
1519 fname_dir = talloc_strndup(ctx, fname_in,
1520 PTR_DIFF(p, fname_in));
1521 fname_mask = talloc_strdup(ctx, p+1);
1522 }
1523
1524 if (!fname_dir || !fname_mask) {
1525 TALLOC_FREE(fname_dir);
1526 TALLOC_FREE(fname_mask);
1527 return NT_STATUS_NO_MEMORY;
1528 }
1529
1530 *fname_dir_out = fname_dir;
1531 *fname_mask_out = fname_mask;
1532 return NT_STATUS_OK;
1533 }
1534
1535 /****************************************************************************
1536 Make a dir struct.
1537 ****************************************************************************/
1538
1539 static bool make_dir_struct(TALLOC_CTX *ctx,
1540 char *buf,
1541 const char *mask,
1542 const char *fname,
1543 off_t size,
1544 uint32 mode,
1545 time_t date,
1546 bool uc)
1547 {
1548 char *p;
1549 char *mask2 = talloc_strdup(ctx, mask);
1550
1551 if (!mask2) {
1552 return False;
1553 }
1554
1555 if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
1556 size = 0;
1557 }
1558
1559 memset(buf+1,' ',11);
1560 if ((p = strchr_m(mask2,'.')) != NULL) {
1561 *p = 0;
1562 push_ascii(buf+1,mask2,8, 0);
1563 push_ascii(buf+9,p+1,3, 0);
1564 *p = '.';
1565 } else {
1566 push_ascii(buf+1,mask2,11, 0);
1567 }
1568
1569 memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
1570 SCVAL(buf,21,mode);
1571 srv_put_dos_date(buf,22,date);
1572 SSVAL(buf,26,size & 0xFFFF);
1573 SSVAL(buf,28,(size >> 16)&0xFFFF);
1574 /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1575 Strange, but verified on W2K3. Needed for OS/2. JRA. */
1576 push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
1577 DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
1578 return True;
1579 }
1580
1581 /****************************************************************************
1582 Reply to a search.
1583 Can be called from SMBsearch, SMBffirst or SMBfunique.
1584 ****************************************************************************/
1585
1586 void reply_search(struct smb_request *req)
1587 {
1588 connection_struct *conn = req->conn;
1589 char *path = NULL;
1590 const char *mask = NULL;
1591 char *directory = NULL;
1592 struct smb_filename *smb_fname = NULL;
1593 char *fname = NULL;
1594 off_t size;
1595 uint32 mode;
1596 struct timespec date;
1597 uint32 dirtype;
1598 unsigned int numentries = 0;
1599 unsigned int maxentries = 0;
1600 bool finished = False;
1601 const char *p;
1602 int status_len;
1603 char status[21];
1604 int dptr_num= -1;
1605 bool check_descend = False;
1606 bool expect_close = False;
1607 NTSTATUS nt_status;
1608 bool mask_contains_wcard = False;
1609 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1610 TALLOC_CTX *ctx = talloc_tos();
1611 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1612 struct dptr_struct *dirptr = NULL;
1613 struct smbXsrv_connection *xconn = req->xconn;
1614 struct smbd_server_connection *sconn = req->sconn;
1615
1616 START_PROFILE(SMBsearch);
1617
1618 if (req->wct < 2) {
1619 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1620 goto out;
1621 }
1622
1623 if (lp_posix_pathnames()) {
1624 reply_unknown_new(req, req->cmd);
1625 goto out;
1626 }
1627
1628 /* If we were called as SMBffirst then we must expect close. */
1629 if(req->cmd == SMBffirst) {
1630 expect_close = True;
1631 }
1632
1633 reply_outbuf(req, 1, 3);
1634 maxentries = SVAL(req->vwv+0, 0);
1635 dirtype = SVAL(req->vwv+1, 0);
1636 p = (const char *)req->buf + 1;
1637 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1638 &nt_status, &mask_contains_wcard);
1639 if (!NT_STATUS_IS_OK(nt_status)) {
1640 reply_nterror(req, nt_status);
1641 goto out;
1642 }
1643
1644 p++;
1645 status_len = SVAL(p, 0);
1646 p += 2;
1647
1648 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1649
1650 if (status_len == 0) {
1651 nt_status = filename_convert(ctx, conn,
1652 req->flags2 & FLAGS2_DFS_PATHNAMES,
1653 path,
1654 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1655 &mask_contains_wcard,
1656 &smb_fname);
1657 if (!NT_STATUS_IS_OK(nt_status)) {
1658 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1659 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1660 ERRSRV, ERRbadpath);
1661 goto out;
1662 }
1663 reply_nterror(req, nt_status);
1664 goto out;
1665 }
1666
1667 directory = smb_fname->base_name;
1668
1669 p = strrchr_m(directory,'/');
1670 if ((p != NULL) && (*directory != '/')) {
1671 mask = p + 1;
1672 directory = talloc_strndup(ctx, directory,
1673 PTR_DIFF(p, directory));
1674 } else {
1675 mask = directory;
1676 directory = talloc_strdup(ctx,".");
1677 }
1678
1679 if (!directory) {
1680 reply_nterror(req, NT_STATUS_NO_MEMORY);
1681 goto out;
1682 }
1683
1684 memset((char *)status,'\0',21);
1685 SCVAL(status,0,(dirtype & 0x1F));
1686
1687 nt_status = dptr_create(conn,
1688 NULL, /* req */
1689 NULL, /* fsp */
1690 directory,
1691 True,
1692 expect_close,
1693 req->smbpid,
1694 mask,
1695 mask_contains_wcard,
1696 dirtype,
1697 &dirptr);
1698 if (!NT_STATUS_IS_OK(nt_status)) {
1699 reply_nterror(req, nt_status);
1700 goto out;
1701 }
1702 dptr_num = dptr_dnum(dirptr);
1703 } else {
1704 int status_dirtype;
1705 const char *dirpath;
1706
1707 memcpy(status,p,21);
1708 status_dirtype = CVAL(status,0) & 0x1F;
1709 if (status_dirtype != (dirtype & 0x1F)) {
1710 dirtype = status_dirtype;
1711 }
1712
1713 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1714 if (!dirptr) {
1715 goto SearchEmpty;
1716 }
1717 dirpath = dptr_path(sconn, dptr_num);
1718 directory = talloc_strdup(ctx, dirpath);
1719 if (!directory) {
1720 reply_nterror(req, NT_STATUS_NO_MEMORY);
1721 goto out;
1722 }
1723
1724 mask = dptr_wcard(sconn, dptr_num);
1725 if (!mask) {
1726 goto SearchEmpty;
1727 }
1728 /*
1729 * For a 'continue' search we have no string. So
1730 * check from the initial saved string.
1731 */
1732 mask_contains_wcard = ms_has_wild(mask);
1733 dirtype = dptr_attr(sconn, dptr_num);
1734 }
1735
1736 DEBUG(4,("dptr_num is %d\n",dptr_num));
1737
1738 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1739 dptr_init_search_op(dirptr);
1740
1741 if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1742 char buf[DIR_STRUCT_SIZE];
1743 memcpy(buf,status,21);
1744 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1745 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1746 reply_nterror(req, NT_STATUS_NO_MEMORY);
1747 goto out;
1748 }
1749 dptr_fill(sconn, buf+12,dptr_num);
1750 if (dptr_zero(buf+12) && (status_len==0)) {
1751 numentries = 1;
1752 } else {
1753 numentries = 0;
1754 }
1755 if (message_push_blob(&req->outbuf,
1756 data_blob_const(buf, sizeof(buf)))
1757 == -1) {
1758 reply_nterror(req, NT_STATUS_NO_MEMORY);
1759 goto out;
1760 }
1761 } else {
1762 unsigned int i;
1763 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1764 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1765
1766 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1767
1768 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1769 directory,lp_dont_descend(ctx, SNUM(conn))));
1770 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1771 check_descend = True;
1772 }
1773
1774 for (i=numentries;(i<maxentries) && !finished;i++) {
1775 finished = !get_dir_entry(ctx,
1776 dirptr,
1777 mask,
1778 dirtype,
1779 &fname,
1780 &size,
1781 &mode,
1782 &date,
1783 check_descend,
1784 ask_sharemode);
1785 if (!finished) {
1786 char buf[DIR_STRUCT_SIZE];
1787 memcpy(buf,status,21);
1788 if (!make_dir_struct(ctx,
1789 buf,
1790 mask,
1791 fname,
1792 size,
1793 mode,
1794 convert_timespec_to_time_t(date),
1795 !allow_long_path_components)) {
1796 reply_nterror(req, NT_STATUS_NO_MEMORY);
1797 goto out;
1798 }
1799 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1800 break;
1801 }
1802 if (message_push_blob(&req->outbuf,
1803 data_blob_const(buf, sizeof(buf)))
1804 == -1) {
1805 reply_nterror(req, NT_STATUS_NO_MEMORY);
1806 goto out;
1807 }
1808 numentries++;
1809 }
1810 }
1811 }
1812
1813 SearchEmpty:
1814
1815 /* If we were called as SMBffirst with smb_search_id == NULL
1816 and no entries were found then return error and close dirptr
1817 (X/Open spec) */
1818
1819 if (numentries == 0) {
1820 dptr_close(sconn, &dptr_num);
1821 } else if(expect_close && status_len == 0) {
1822 /* Close the dptr - we know it's gone */
1823 dptr_close(sconn, &dptr_num);
1824 }
1825
1826 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1827 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1828 dptr_close(sconn, &dptr_num);
1829 }
1830
1831 if ((numentries == 0) && !mask_contains_wcard) {
1832 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1833 goto out;
1834 }
1835
1836 SSVAL(req->outbuf,smb_vwv0,numentries);
1837 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1838 SCVAL(smb_buf(req->outbuf),0,5);
1839 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1840
1841 /* The replies here are never long name. */
1842 SSVAL(req->outbuf, smb_flg2,
1843 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1844 if (!allow_long_path_components) {
1845 SSVAL(req->outbuf, smb_flg2,
1846 SVAL(req->outbuf, smb_flg2)
1847 & (~FLAGS2_LONG_PATH_COMPONENTS));
1848 }
1849
1850 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1851 SSVAL(req->outbuf, smb_flg2,
1852 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1853
1854 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1855 smb_fn_name(req->cmd),
1856 mask,
1857 directory,
1858 dirtype,
1859 numentries,
1860 maxentries ));
1861 out:
1862 TALLOC_FREE(directory);
1863 TALLOC_FREE(smb_fname);
1864 END_PROFILE(SMBsearch);
1865 return;
1866 }
1867
1868 /****************************************************************************
1869 Reply to a fclose (stop directory search).
1870 ****************************************************************************/
1871
1872 void reply_fclose(struct smb_request *req)
1873 {
1874 int status_len;
1875 char status[21];
1876 int dptr_num= -2;
1877 const char *p;
1878 char *path = NULL;
1879 NTSTATUS err;
1880 bool path_contains_wcard = False;
1881 TALLOC_CTX *ctx = talloc_tos();
1882 struct smbd_server_connection *sconn = req->sconn;
1883
1884 START_PROFILE(SMBfclose);
1885
1886 if (lp_posix_pathnames()) {
1887 reply_unknown_new(req, req->cmd);
1888 END_PROFILE(SMBfclose);
1889 return;
1890 }
1891
1892 p = (const char *)req->buf + 1;
1893 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1894 &err, &path_contains_wcard);
1895 if (!NT_STATUS_IS_OK(err)) {
1896 reply_nterror(req, err);
1897 END_PROFILE(SMBfclose);
1898 return;
1899 }
1900 p++;
1901 status_len = SVAL(p,0);
1902 p += 2;
1903
1904 if (status_len == 0) {
1905 reply_force_doserror(req, ERRSRV, ERRsrverror);
1906 END_PROFILE(SMBfclose);
1907 return;
1908 }
1909
1910 memcpy(status,p,21);
1911
1912 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1913 /* Close the dptr - we know it's gone */
1914 dptr_close(sconn, &dptr_num);
1915 }
1916
1917 reply_outbuf(req, 1, 0);
1918 SSVAL(req->outbuf,smb_vwv0,0);
1919
1920 DEBUG(3,("search close\n"));
1921
1922 END_PROFILE(SMBfclose);
1923 return;
1924 }
1925
1926 /****************************************************************************
1927 Reply to an open.
1928 ****************************************************************************/
1929
1930 void reply_open(struct smb_request *req)
1931 {
1932 connection_struct *conn = req->conn;
1933 struct smb_filename *smb_fname = NULL;
1934 char *fname = NULL;
1935 uint32 fattr=0;
1936 off_t size = 0;
1937 time_t mtime=0;
1938 int info;
1939 files_struct *fsp;
1940 int oplock_request;
1941 int deny_mode;
1942 uint32 dos_attr;
1943 uint32 access_mask;
1944 uint32 share_mode;
1945 uint32 create_disposition;
1946 uint32 create_options = 0;
1947 uint32_t private_flags = 0;
1948 NTSTATUS status;
1949 TALLOC_CTX *ctx = talloc_tos();
1950
1951 START_PROFILE(SMBopen);
1952
1953 if (req->wct < 2) {
1954 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1955 goto out;
1956 }
1957
1958 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1959 deny_mode = SVAL(req->vwv+0, 0);
1960 dos_attr = SVAL(req->vwv+1, 0);
1961
1962 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1963 STR_TERMINATE, &status);
1964 if (!NT_STATUS_IS_OK(status)) {
1965 reply_nterror(req, status);
1966 goto out;
1967 }
1968
1969 if (!map_open_params_to_ntcreate(fname, deny_mode,
1970 OPENX_FILE_EXISTS_OPEN, &access_mask,
1971 &share_mode, &create_disposition,
1972 &create_options, &private_flags)) {
1973 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1974 goto out;
1975 }
1976
1977 status = filename_convert(ctx,
1978 conn,
1979 req->flags2 & FLAGS2_DFS_PATHNAMES,
1980 fname,
1981 UCF_PREP_CREATEFILE,
1982 NULL,
1983 &smb_fname);
1984 if (!NT_STATUS_IS_OK(status)) {
1985 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1986 reply_botherror(req,
1987 NT_STATUS_PATH_NOT_COVERED,
1988 ERRSRV, ERRbadpath);
1989 goto out;
1990 }
1991 reply_nterror(req, status);
1992 goto out;
1993 }
1994
1995 status = SMB_VFS_CREATE_FILE(
1996 conn, /* conn */
1997 req, /* req */
1998 0, /* root_dir_fid */
1999 smb_fname, /* fname */
2000 access_mask, /* access_mask */
2001 share_mode, /* share_access */
2002 create_disposition, /* create_disposition*/
2003 create_options, /* create_options */
2004 dos_attr, /* file_attributes */
2005 oplock_request, /* oplock_request */
2006 NULL, /* lease */
2007 0, /* allocation_size */
2008 private_flags,
2009 NULL, /* sd */
2010 NULL, /* ea_list */
2011 &fsp, /* result */
2012 &info); /* pinfo */
2013
2014 if (!NT_STATUS_IS_OK(status)) {
2015 if (open_was_deferred(req->xconn, req->mid)) {
2016 /* We have re-scheduled this call. */
2017 goto out;
2018 }
2019 reply_openerror(req, status);
2020 goto out;
2021 }
2022
2023 /* Ensure we're pointing at the correct stat struct. */
2024 TALLOC_FREE(smb_fname);
2025 smb_fname = fsp->fsp_name;
2026
2027 size = smb_fname->st.st_ex_size;
2028 fattr = dos_mode(conn, smb_fname);
2029
2030 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
2031
2032 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2033 DEBUG(3,("attempt to open a directory %s\n",
2034 fsp_str_dbg(fsp)));
2035 close_file(req, fsp, ERROR_CLOSE);
2036 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
2037 ERRDOS, ERRnoaccess);
2038 goto out;
2039 }
2040
2041 reply_outbuf(req, 7, 0);
2042 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2043 SSVAL(req->outbuf,smb_vwv1,fattr);
2044 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2045 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
2046 } else {
2047 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
2048 }
2049 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
2050 SSVAL(req->outbuf,smb_vwv6,deny_mode);
2051
2052 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2053 SCVAL(req->outbuf,smb_flg,
2054 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2055 }
2056
2057 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2058 SCVAL(req->outbuf,smb_flg,
2059 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2060 }
2061 out:
2062 END_PROFILE(SMBopen);
2063 return;
2064 }
2065
2066 /****************************************************************************
2067 Reply to an open and X.
2068 ****************************************************************************/
2069
2070 void reply_open_and_X(struct smb_request *req)
2071 {
2072 connection_struct *conn = req->conn;
2073 struct smb_filename *smb_fname = NULL;
2074 char *fname = NULL;
2075 uint16 open_flags;
2076 int deny_mode;
2077 uint32 smb_attr;
2078 /* Breakout the oplock request bits so we can set the
2079 reply bits separately. */
2080 int ex_oplock_request;
2081 int core_oplock_request;
2082 int oplock_request;
2083 #if 0
2084 int smb_sattr = SVAL(req->vwv+4, 0);
2085 uint32 smb_time = make_unix_date3(req->vwv+6);
2086 #endif
2087 int smb_ofun;
2088 uint32 fattr=0;
2089 int mtime=0;
2090 int smb_action = 0;
2091 files_struct *fsp;
2092 NTSTATUS status;
2093 uint64_t allocation_size;
2094 ssize_t retval = -1;
2095 uint32 access_mask;
2096 uint32 share_mode;
2097 uint32 create_disposition;
2098 uint32 create_options = 0;
2099 uint32_t private_flags = 0;
2100 TALLOC_CTX *ctx = talloc_tos();
2101
2102 START_PROFILE(SMBopenX);
2103
2104 if (req->wct < 15) {
2105 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2106 goto out;
2107 }
2108
2109 open_flags = SVAL(req->vwv+2, 0);
2110 deny_mode = SVAL(req->vwv+3, 0);
2111 smb_attr = SVAL(req->vwv+5, 0);
2112 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2113 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2114 oplock_request = ex_oplock_request | core_oplock_request;
2115 smb_ofun = SVAL(req->vwv+8, 0);
2116 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2117
2118 /* If it's an IPC, pass off the pipe handler. */
2119 if (IS_IPC(conn)) {
2120 if (lp_nt_pipe_support()) {
2121 reply_open_pipe_and_X(conn, req);
2122 } else {
2123 reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2124 }
2125 goto out;
2126 }
2127
2128 /* XXXX we need to handle passed times, sattr and flags */
2129 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2130 STR_TERMINATE, &status);
2131 if (!NT_STATUS_IS_OK(status)) {
2132 reply_nterror(req, status);
2133 goto out;
2134 }
2135
2136 if (!map_open_params_to_ntcreate(fname, deny_mode,
2137 smb_ofun,
2138 &access_mask, &share_mode,
2139 &create_disposition,
2140 &create_options,
2141 &private_flags)) {
2142 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2143 goto out;
2144 }
2145
2146 status = filename_convert(ctx,
2147 conn,
2148 req->flags2 & FLAGS2_DFS_PATHNAMES,
2149 fname,
2150 UCF_PREP_CREATEFILE,
2151 NULL,
2152 &smb_fname);
2153 if (!NT_STATUS_IS_OK(status)) {
2154 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2155 reply_botherror(req,
2156 NT_STATUS_PATH_NOT_COVERED,
2157 ERRSRV, ERRbadpath);
2158 goto out;
2159 }
2160 reply_nterror(req, status);
2161 goto out;
2162 }
2163
2164 status = SMB_VFS_CREATE_FILE(
2165 conn, /* conn */
2166 req, /* req */
2167 0, /* root_dir_fid */
2168 smb_fname, /* fname */
2169 access_mask, /* access_mask */
2170 share_mode, /* share_access */
2171 create_disposition, /* create_disposition*/
2172 create_options, /* create_options */
2173 smb_attr, /* file_attributes */
2174 oplock_request, /* oplock_request */
2175 NULL, /* lease */
2176 0, /* allocation_size */
2177 private_flags,
2178 NULL, /* sd */
2179 NULL, /* ea_list */
2180 &fsp, /* result */
2181 &smb_action); /* pinfo */
2182
2183 if (!NT_STATUS_IS_OK(status)) {
2184 if (open_was_deferred(req->xconn, req->mid)) {
2185 /* We have re-scheduled this call. */
2186 goto out;
2187 }
2188 reply_openerror(req, status);
2189 goto out;
2190 }
2191
2192 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2193 if the file is truncated or created. */
2194 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2195 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2196 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2197 close_file(req, fsp, ERROR_CLOSE);
2198 reply_nterror(req, NT_STATUS_DISK_FULL);
2199 goto out;
2200 }
2201 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2202 if (retval < 0) {
2203 close_file(req, fsp, ERROR_CLOSE);
2204 reply_nterror(req, NT_STATUS_DISK_FULL);
2205 goto out;
2206 }
2207 status = vfs_stat_fsp(fsp);
2208 if (!NT_STATUS_IS_OK(status)) {
2209 close_file(req, fsp, ERROR_CLOSE);
2210 reply_nterror(req, status);
2211 goto out;
2212 }
2213 }
2214
2215 fattr = dos_mode(conn, fsp->fsp_name);
2216 mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2217 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2218 close_file(req, fsp, ERROR_CLOSE);
2219 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2220 goto out;
2221 }
2222
2223 /* If the caller set the extended oplock request bit
2224 and we granted one (by whatever means) - set the
2225 correct bit for extended oplock reply.
2226 */
2227
2228 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2229 smb_action |= EXTENDED_OPLOCK_GRANTED;
2230 }
2231
2232 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2233 smb_action |= EXTENDED_OPLOCK_GRANTED;
2234 }
2235
2236 /* If the caller set the core oplock request bit
2237 and we granted one (by whatever means) - set the
2238 correct bit for core oplock reply.
2239 */
2240
2241 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2242 reply_outbuf(req, 19, 0);
2243 } else {
2244 reply_outbuf(req, 15, 0);
2245 }
2246
2247 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2248 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2249
2250 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2251 SCVAL(req->outbuf, smb_flg,
2252 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2253 }
2254
2255 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2256 SCVAL(req->outbuf, smb_flg,
2257 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2258 }
2259
2260 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2261 SSVAL(req->outbuf,smb_vwv3,fattr);
2262 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2263 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2264 } else {
2265 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2266 }
2267 SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2268 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2269 SSVAL(req->outbuf,smb_vwv11,smb_action);
2270
2271 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2272 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2273 }
2274
2275 out:
2276 TALLOC_FREE(smb_fname);
2277 END_PROFILE(SMBopenX);
2278 return;
2279 }
2280
2281 /****************************************************************************
2282 Reply to a SMBulogoffX.
2283 ****************************************************************************/
2284
2285 void reply_ulogoffX(struct smb_request *req)
2286 {
2287 struct smbd_server_connection *sconn = req->sconn;
2288 struct user_struct *vuser;
2289 struct smbXsrv_session *session = NULL;
2290 NTSTATUS status;
2291
2292 START_PROFILE(SMBulogoffX);
2293
2294 vuser = get_valid_user_struct(sconn, req->vuid);
2295
2296 if(vuser == NULL) {
2297 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2298 (unsigned long long)req->vuid));
2299
2300 req->vuid = UID_FIELD_INVALID;
2301 reply_force_doserror(req, ERRSRV, ERRbaduid);
2302 END_PROFILE(SMBulogoffX);
2303 return;
2304 }
2305
2306 session = vuser->session;
2307 vuser = NULL;
2308
2309 /*
2310 * TODO: cancel all outstanding requests on the session
2311 */
2312 status = smbXsrv_session_logoff(session);
2313 if (!NT_STATUS_IS_OK(status)) {
2314 DEBUG(0, ("reply_ulogoff: "
2315 "smbXsrv_session_logoff() failed: %s\n",
2316 nt_errstr(status)));
2317 /*
2318 * If we hit this case, there is something completely
2319 * wrong, so we better disconnect the transport connection.
2320 */
2321 END_PROFILE(SMBulogoffX);
2322 exit_server(__location__ ": smbXsrv_session_logoff failed");
2323 return;
2324 }
2325
2326 TALLOC_FREE(session);
2327
2328 reply_outbuf(req, 2, 0);
2329 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2330 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
2331
2332 DEBUG(3, ("ulogoffX vuid=%llu\n",
2333 (unsigned long long)req->vuid));
2334
2335 END_PROFILE(SMBulogoffX);
2336 req->vuid = UID_FIELD_INVALID;
2337 }
2338
2339 /****************************************************************************
2340 Reply to a mknew or a create.
2341 ****************************************************************************/
2342
2343 void reply_mknew(struct smb_request *req)
2344 {
2345 connection_struct *conn = req->conn;
2346 struct smb_filename *smb_fname = NULL;
2347 char *fname = NULL;
2348 uint32 fattr = 0;
2349 struct smb_file_time ft;
2350 files_struct *fsp;
2351 int oplock_request = 0;
2352 NTSTATUS status;
2353 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2354 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2355 uint32 create_disposition;
2356 uint32 create_options = 0;
2357 TALLOC_CTX *ctx = talloc_tos();
2358
2359 START_PROFILE(SMBcreate);
2360 ZERO_STRUCT(ft);
2361
2362 if (req->wct < 3) {
2363 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2364 goto out;
2365 }
2366
2367 fattr = SVAL(req->vwv+0, 0);
2368 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2369
2370 /* mtime. */
2371 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2372
2373 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2374 STR_TERMINATE, &status);
2375 if (!NT_STATUS_IS_OK(status)) {
2376 reply_nterror(req, status);
2377 goto out;
2378 }
2379
2380 status = filename_convert(ctx,
2381 conn,
2382 req->flags2 & FLAGS2_DFS_PATHNAMES,
2383 fname,
2384 UCF_PREP_CREATEFILE,
2385 NULL,
2386 &smb_fname);
2387 if (!NT_STATUS_IS_OK(status)) {
2388 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2389 reply_botherror(req,
2390 NT_STATUS_PATH_NOT_COVERED,
2391 ERRSRV, ERRbadpath);
2392 goto out;
2393 }
2394 reply_nterror(req, status);
2395 goto out;
2396 }
2397
2398 if (fattr & FILE_ATTRIBUTE_VOLUME) {
2399 DEBUG(0,("Attempt to create file (%s) with volid set - "
2400 "please report this\n",
2401 smb_fname_str_dbg(smb_fname)));
2402 }
2403
2404 if(req->cmd == SMBmknew) {
2405 /* We should fail if file exists. */
2406 create_disposition = FILE_CREATE;
2407 } else {
2408 /* Create if file doesn't exist, truncate if it does. */
2409 create_disposition = FILE_OVERWRITE_IF;
2410 }
2411
2412 status = SMB_VFS_CREATE_FILE(
2413 conn, /* conn */
2414 req, /* req */
2415 0, /* root_dir_fid */
2416 smb_fname, /* fname */
2417 access_mask, /* access_mask */
2418 share_mode, /* share_access */
2419 create_disposition, /* create_disposition*/
2420 create_options, /* create_options */
2421 fattr, /* file_attributes */
2422 oplock_request, /* oplock_request */
2423 NULL, /* lease */
2424 0, /* allocation_size */
2425 0, /* private_flags */
2426 NULL, /* sd */
2427 NULL, /* ea_list */
2428 &fsp, /* result */
2429 NULL); /* pinfo */
2430
2431 if (!NT_STATUS_IS_OK(status)) {
2432 if (open_was_deferred(req->xconn, req->mid)) {
2433 /* We have re-scheduled this call. */
2434 goto out;
2435 }
2436 reply_openerror(req, status);
2437 goto out;
2438 }
2439
2440 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2441 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2442 if (!NT_STATUS_IS_OK(status)) {
2443 END_PROFILE(SMBcreate);
2444 goto out;
2445 }
2446
2447 reply_outbuf(req, 1, 0);
2448 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2449
2450 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2451 SCVAL(req->outbuf,smb_flg,
2452 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2453 }
2454
2455 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2456 SCVAL(req->outbuf,smb_flg,
2457 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2458 }
2459
2460 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2461 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2462 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2463 (unsigned int)fattr));
2464
2465 out:
2466 TALLOC_FREE(smb_fname);
2467 END_PROFILE(SMBcreate);
2468 return;
2469 }
2470
2471 /****************************************************************************
2472 Reply to a create temporary file.
2473 ****************************************************************************/
2474
2475 void reply_ctemp(struct smb_request *req)
2476 {
2477 connection_struct *conn = req->conn;
2478 struct smb_filename *smb_fname = NULL;
2479 char *wire_name = NULL;
2480 char *fname = NULL;
2481 uint32 fattr;
2482 files_struct *fsp;
2483 int oplock_request;
2484 char *s;
2485 NTSTATUS status;
2486 int i;
2487 TALLOC_CTX *ctx = talloc_tos();
2488
2489 START_PROFILE(SMBctemp);
2490
2491 if (req->wct < 3) {
2492 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2493 goto out;
2494 }
2495
2496 fattr = SVAL(req->vwv+0, 0);
2497 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2498
2499 srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2500 STR_TERMINATE, &status);
2501 if (!NT_STATUS_IS_OK(status)) {
2502 reply_nterror(req, status);
2503 goto out;
2504 }
2505
2506 for (i = 0; i < 10; i++) {
2507 if (*wire_name) {
2508 fname = talloc_asprintf(ctx,
2509 "%s/TMP%s",
2510 wire_name,
2511 generate_random_str_list(ctx, 5, "0123456789"));
2512 } else {
2513 fname = talloc_asprintf(ctx,
2514 "TMP%s",
2515 generate_random_str_list(ctx, 5, "0123456789"));
2516 }
2517
2518 if (!fname) {
2519 reply_nterror(req, NT_STATUS_NO_MEMORY);
2520 goto out;
2521 }
2522
2523 status = filename_convert(ctx, conn,
2524 req->flags2 & FLAGS2_DFS_PATHNAMES,
2525 fname,
2526 UCF_PREP_CREATEFILE,
2527 NULL,
2528 &smb_fname);
2529 if (!NT_STATUS_IS_OK(status)) {
2530 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2531 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2532 ERRSRV, ERRbadpath);
2533 goto out;
2534 }
2535 reply_nterror(req, status);
2536 goto out;
2537 }
2538
2539 /* Create the file. */
2540 status = SMB_VFS_CREATE_FILE(
2541 conn, /* conn */
2542 req, /* req */
2543 0, /* root_dir_fid */
2544 smb_fname, /* fname */
2545 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2546 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2547 FILE_CREATE, /* create_disposition*/
2548 0, /* create_options */
2549 fattr, /* file_attributes */
2550 oplock_request, /* oplock_request */
2551 NULL, /* lease */
2552 0, /* allocation_size */
2553 0, /* private_flags */
2554 NULL, /* sd */
2555 NULL, /* ea_list */
2556 &fsp, /* result */
2557 NULL); /* pinfo */
2558
2559 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2560 TALLOC_FREE(fname);
2561 TALLOC_FREE(smb_fname);
2562 continue;
2563 }
2564
2565 if (!NT_STATUS_IS_OK(status)) {
2566 if (open_was_deferred(req->xconn, req->mid)) {
2567 /* We have re-scheduled this call. */
2568 goto out;
2569 }
2570 reply_openerror(req, status);
2571 goto out;
2572 }
2573
2574 break;
2575 }
2576
2577 if (i == 10) {
2578 /* Collision after 10 times... */
2579 reply_nterror(req, status);
2580 goto out;
2581 }
2582
2583 reply_outbuf(req, 1, 0);
2584 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2585
2586 /* the returned filename is relative to the directory */
2587 s = strrchr_m(fsp->fsp_name->base_name, '/');
2588 if (!s) {
2589 s = fsp->fsp_name->base_name;
2590 } else {
2591 s++;
2592 }
2593
2594 #if 0
2595 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2596 thing in the byte section. JRA */
2597 SSVALS(p, 0, -1); /* what is this? not in spec */
2598 #endif
2599 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2600 == -1) {
2601 reply_nterror(req, NT_STATUS_NO_MEMORY);
2602 goto out;
2603 }
2604
2605 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2606 SCVAL(req->outbuf, smb_flg,
2607 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2608 }
2609
2610 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2611 SCVAL(req->outbuf, smb_flg,
2612 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2613 }
2614
2615 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2616 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2617 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2618 out:
2619 TALLOC_FREE(smb_fname);
2620 TALLOC_FREE(wire_name);
2621 END_PROFILE(SMBctemp);
2622 return;
2623 }
2624
2625 /*******************************************************************
2626 Check if a user is allowed to rename a file.
2627 ********************************************************************/
2628
2629 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2630 uint16 dirtype)
2631 {
2632 if (!CAN_WRITE(conn)) {
2633 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2634 }
2635
2636 if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2637 (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2638 /* Only bother to read the DOS attribute if we might deny the
2639 rename on the grounds of attribute missmatch. */
2640 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2641 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2642 return NT_STATUS_NO_SUCH_FILE;
2643 }
2644 }
2645
2646 if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2647 if (fsp->posix_open) {
2648 return NT_STATUS_OK;
2649 }
2650
2651 /* If no pathnames are open below this
2652 directory, allow the rename. */
2653
2654 if (file_find_subpath(fsp)) {
2655 return NT_STATUS_ACCESS_DENIED;
2656 }
2657 return NT_STATUS_OK;
2658 }
2659
2660 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2661 return NT_STATUS_OK;
2662 }
2663
2664 return NT_STATUS_ACCESS_DENIED;
2665 }
2666
2667 /*******************************************************************
2668 * unlink a file with all relevant access checks
2669 *******************************************************************/
2670
2671 static NTSTATUS do_unlink(connection_struct *conn,
2672 struct smb_request *req,
2673 struct smb_filename *smb_fname,
2674 uint32 dirtype)
2675 {
2676 uint32 fattr;
2677 files_struct *fsp;
2678 uint32 dirtype_orig = dirtype;
2679 NTSTATUS status;
2680 int ret;
2681 bool posix_paths = lp_posix_pathnames();
2682
2683 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2684 smb_fname_str_dbg(smb_fname),
2685 dirtype));
2686
2687 if (!CAN_WRITE(conn)) {
2688 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2689 }
2690
2691 if (posix_paths) {
2692 ret = SMB_VFS_LSTAT(conn, smb_fname);
2693 } else {
2694 ret = SMB_VFS_STAT(conn, smb_fname);
2695 }
2696 if (ret != 0) {
2697 return map_nt_error_from_unix(errno);
2698 }
2699
2700 fattr = dos_mode(conn, smb_fname);
2701
2702 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2703 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2704 }
2705
2706 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2707 if (!dirtype) {
2708 return NT_STATUS_NO_SUCH_FILE;
2709 }
2710
2711 if (!dir_check_ftype(fattr, dirtype)) {
2712 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2713 return NT_STATUS_FILE_IS_A_DIRECTORY;
2714 }
2715 return NT_STATUS_NO_SUCH_FILE;
2716 }
2717
2718 if (dirtype_orig & 0x8000) {
2719 /* These will never be set for POSIX. */
2720 return NT_STATUS_NO_SUCH_FILE;
2721 }
2722
2723 #if 0
2724 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2725 return NT_STATUS_FILE_IS_A_DIRECTORY;
2726 }
2727
2728 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2729 return NT_STATUS_NO_SUCH_FILE;
2730 }
2731
2732 if (dirtype & 0xFF00) {
2733 /* These will never be set for POSIX. */
2734 return NT_STATUS_NO_SUCH_FILE;
2735 }
2736
2737 dirtype &= 0xFF;
2738 if (!dirtype) {
2739 return NT_STATUS_NO_SUCH_FILE;
2740 }
2741
2742 /* Can't delete a directory. */
2743 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2744 return NT_STATUS_FILE_IS_A_DIRECTORY;
2745 }
2746 #endif
2747
2748 #if 0 /* JRATEST */
2749 else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2750 return NT_STATUS_OBJECT_NAME_INVALID;
2751 #endif /* JRATEST */
2752
2753 /* On open checks the open itself will check the share mode, so
2754 don't do it here as we'll get it wrong. */
2755
2756 status = SMB_VFS_CREATE_FILE
2757 (conn, /* conn */
2758 req, /* req */
2759 0, /* root_dir_fid */
2760 smb_fname, /* fname */
2761 DELETE_ACCESS, /* access_mask */
2762 FILE_SHARE_NONE, /* share_access */
2763 FILE_OPEN, /* create_disposition*/
2764 FILE_NON_DIRECTORY_FILE, /* create_options */
2765 /* file_attributes */
2766 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2767 FILE_ATTRIBUTE_NORMAL,
2768 0, /* oplock_request */
2769 NULL, /* lease */
2770 0, /* allocation_size */
2771 0, /* private_flags */
2772 NULL, /* sd */
2773 NULL, /* ea_list */
2774 &fsp, /* result */
2775 NULL); /* pinfo */
2776
2777 if (!NT_STATUS_IS_OK(status)) {
2778 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2779 nt_errstr(status)));
2780 return status;
2781 }
2782
2783 status = can_set_delete_on_close(fsp, fattr);
2784 if (!NT_STATUS_IS_OK(status)) {
2785 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2786 "(%s)\n",
2787 smb_fname_str_dbg(smb_fname),
2788 nt_errstr(status)));
2789 close_file(req, fsp, NORMAL_CLOSE);
2790 return status;
2791 }
2792
2793 /* The set is across all open files on this dev/inode pair. */
2794 if (!set_delete_on_close(fsp, True,
2795 conn->session_info->security_token,
2796 conn->session_info->unix_token)) {
2797 close_file(req, fsp, NORMAL_CLOSE);
2798 return NT_STATUS_ACCESS_DENIED;
2799 }
2800
2801 return close_file(req, fsp, NORMAL_CLOSE);
2802 }
2803
2804 /****************************************************************************
2805 The guts of the unlink command, split out so it may be called by the NT SMB
2806 code.
2807 ****************************************************************************/
2808
2809 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2810 uint32 dirtype, struct smb_filename *smb_fname,
2811 bool has_wild)
2812 {
2813 char *fname_dir = NULL;
2814 char *fname_mask = NULL;
2815 int count=0;
2816 NTSTATUS status = NT_STATUS_OK;
2817 TALLOC_CTX *ctx = talloc_tos();
2818
2819 /* Split up the directory from the filename/mask. */
2820 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2821 &fname_dir, &fname_mask);
2822 if (!NT_STATUS_IS_OK(status)) {
2823 goto out;
2824 }
2825
2826 /*
2827 * We should only check the mangled cache
2828 * here if unix_convert failed. This means
2829 * that the path in 'mask' doesn't exist
2830 * on the file system and so we need to look
2831 * for a possible mangle. This patch from
2832 * Tine Smukavec <valentin.smukavec@hermes.si>.
2833 */
2834
2835 if (!VALID_STAT(smb_fname->st) &&
2836 mangle_is_mangled(fname_mask, conn->params)) {
2837 char *new_mask = NULL;
2838 mangle_lookup_name_from_8_3(ctx, fname_mask,
2839 &new_mask, conn->params);
2840 if (new_mask) {
2841 TALLOC_FREE(fname_mask);
2842 fname_mask = new_mask;
2843 }
2844 }
2845
2846 if (!has_wild) {
2847
2848 /*
2849 * Only one file needs to be unlinked. Append the mask back
2850 * onto the directory.
2851 */
2852 TALLOC_FREE(smb_fname->base_name);
2853 if (ISDOT(fname_dir)) {
2854 /* Ensure we use canonical names on open. */
2855 smb_fname->base_name = talloc_asprintf(smb_fname,
2856 "%s",
2857 fname_mask);
2858 } else {
2859 smb_fname->base_name = talloc_asprintf(smb_fname,
2860 "%s/%s",
2861 fname_dir,
2862 fname_mask);
2863 }
2864 if (!smb_fname->base_name) {
2865 status = NT_STATUS_NO_MEMORY;
2866 goto out;
2867 }
2868 if (dirtype == 0) {
2869 dirtype = FILE_ATTRIBUTE_NORMAL;
2870 }
2871
2872 status = check_name(conn, smb_fname->base_name);
2873 if (!NT_STATUS_IS_OK(status)) {
2874 goto out;
2875 }
2876
2877 status = do_unlink(conn, req, smb_fname, dirtype);
2878 if (!NT_STATUS_IS_OK(status)) {
2879 goto out;
2880 }
2881
2882 count++;
2883 } else {
2884 struct smb_Dir *dir_hnd = NULL;
2885 long offset = 0;
2886 const char *dname = NULL;
2887 char *talloced = NULL;
2888
2889 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2890 status = NT_STATUS_OBJECT_NAME_INVALID;
2891 goto out;
2892 }
2893
2894 if (strequal(fname_mask,"????????.???")) {
2895 TALLOC_FREE(fname_mask);
2896 fname_mask = talloc_strdup(ctx, "*");
2897 if (!fname_mask) {
2898 status = NT_STATUS_NO_MEMORY;
2899 goto out;
2900 }
2901 }
2902
2903 status = check_name(conn, fname_dir);
2904 if (!NT_STATUS_IS_OK(status)) {
2905 goto out;
2906 }
2907
2908 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2909 dirtype);
2910 if (dir_hnd == NULL) {
2911 status = map_nt_error_from_unix(errno);
2912 goto out;
2913 }
2914
2915 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2916 the pattern matches against the long name, otherwise the short name
2917 We don't implement this yet XXXX
2918 */
2919
2920 status = NT_STATUS_NO_SUCH_FILE;
2921
2922 while ((dname = ReadDirName(dir_hnd, &offset,
2923 &smb_fname->st, &talloced))) {
2924 TALLOC_CTX *frame = talloc_stackframe();
2925
2926 if (!is_visible_file(conn, fname_dir, dname,
2927 &smb_fname->st, true)) {
2928 TALLOC_FREE(frame);
2929 TALLOC_FREE(talloced);
2930 continue;
2931 }
2932
2933 /* Quick check for "." and ".." */
2934 if (ISDOT(dname) || ISDOTDOT(dname)) {
2935 TALLOC_FREE(frame);
2936 TALLOC_FREE(talloced);
2937 continue;
2938 }
2939
2940 if(!mask_match(dname, fname_mask,
2941 conn->case_sensitive)) {
2942 TALLOC_FREE(frame);
2943 TALLOC_FREE(talloced);
2944 continue;
2945 }
2946
2947 TALLOC_FREE(smb_fname->base_name);
2948 if (ISDOT(fname_dir)) {
2949 /* Ensure we use canonical names on open. */
2950 smb_fname->base_name =
2951 talloc_asprintf(smb_fname, "%s",
2952 dname);
2953 } else {
2954 smb_fname->base_name =
2955 talloc_asprintf(smb_fname, "%s/%s",
2956 fname_dir, dname);
2957 }
2958
2959 if (!smb_fname->base_name) {
2960 TALLOC_FREE(dir_hnd);
2961 status = NT_STATUS_NO_MEMORY;
2962 TALLOC_FREE(frame);
2963 TALLOC_FREE(talloced);
2964 goto out;
2965 }
2966
2967 status = check_name(conn, smb_fname->base_name);
2968 if (!NT_STATUS_IS_OK(status)) {
2969 TALLOC_FREE(dir_hnd);
2970 TALLOC_FREE(frame);
2971 TALLOC_FREE(talloced);
2972 goto out;
2973 }
2974
2975 status = do_unlink(conn, req, smb_fname, dirtype);
2976 if (!NT_STATUS_IS_OK(status)) {
2977 TALLOC_FREE(dir_hnd);
2978 TALLOC_FREE(frame);
2979 TALLOC_FREE(talloced);
2980 goto out;
2981 }
2982
2983 count++;
2984 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2985 smb_fname->base_name));
2986
2987 TALLOC_FREE(frame);
2988 TALLOC_FREE(talloced);
2989 }
2990 TALLOC_FREE(dir_hnd);
2991 }
2992
2993 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2994 status = map_nt_error_from_unix(errno);
2995 }
2996
2997 out:
2998 TALLOC_FREE(fname_dir);
2999 TALLOC_FREE(fname_mask);
3000 return status;
3001 }
3002
3003 /****************************************************************************
3004 Reply to a unlink
3005 ****************************************************************************/
3006
3007 void reply_unlink(struct smb_request *req)
3008 {
3009 connection_struct *conn = req->conn;
3010 char *name = NULL;
3011 struct smb_filename *smb_fname = NULL;
3012 uint32 dirtype;
3013 NTSTATUS status;
3014 bool path_contains_wcard = False;
3015 TALLOC_CTX *ctx = talloc_tos();
3016
3017 START_PROFILE(SMBunlink);
3018
3019 if (req->wct < 1) {
3020 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3021 goto out;
3022 }
3023
3024 dirtype = SVAL(req->vwv+0, 0);
3025
3026 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
3027 STR_TERMINATE, &status,
3028 &path_contains_wcard);
3029 if (!NT_STATUS_IS_OK(status)) {
3030 reply_nterror(req, status);
3031 goto out;
3032 }
3033
3034 status = filename_convert(ctx, conn,
3035 req->flags2 & FLAGS2_DFS_PATHNAMES,
3036 name,
3037 UCF_COND_ALLOW_WCARD_LCOMP,
3038 &path_contains_wcard,
3039 &smb_fname);
3040 if (!NT_STATUS_IS_OK(status)) {
3041 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3042 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
3043 ERRSRV, ERRbadpath);
3044 goto out;
3045 }
3046 reply_nterror(req, status);
3047 goto out;
3048 }
3049
3050 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
3051
3052 status = unlink_internals(conn, req, dirtype, smb_fname,
3053 path_contains_wcard);
3054 if (!NT_STATUS_IS_OK(status)) {
3055 if (open_was_deferred(req->xconn, req->mid)) {
3056 /* We have re-scheduled this call. */
3057 goto out;
3058 }
3059 reply_nterror(req, status);
3060 goto out;
3061 }
3062
3063 reply_outbuf(req, 0, 0);
3064 out:
3065 TALLOC_FREE(smb_fname);
3066 END_PROFILE(SMBunlink);
3067 return;
3068 }
3069
3070 /****************************************************************************
3071 Fail for readbraw.
3072 ****************************************************************************/
3073
3074 static void fail_readraw(void)
3075 {
3076 const char *errstr = talloc_asprintf(talloc_tos(),
3077 "FAIL ! reply_readbraw: socket write fail (%s)",
3078 strerror(errno));
3079 if (!errstr) {
3080 errstr = "";
3081 }
3082 exit_server_cleanly(errstr);
3083 }
3084
3085 /****************************************************************************
3086 Fake (read/write) sendfile. Returns -1 on read or write fail.
3087 ****************************************************************************/
3088
3089 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3090 off_t startpos, size_t nread)
3091 {
3092 size_t bufsize;
3093 size_t tosend = nread;
3094 char *buf;
3095
3096 if (nread == 0) {
3097 return 0;
3098 }
3099
3100 bufsize = MIN(nread, 65536);
3101
3102 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3103 return -1;
3104 }
3105
3106 while (tosend > 0) {
3107 ssize_t ret;
3108 size_t cur_read;
3109
3110 cur_read = MIN(tosend, bufsize);
3111 ret = read_file(fsp,buf,startpos,cur_read);
3112 if (ret == -1) {
3113 SAFE_FREE(buf);
3114 return -1;
3115 }
3116
3117 /* If we had a short read, fill with zeros. */
3118 if (ret < cur_read) {
3119 memset(buf + ret, '\0', cur_read - ret);
3120 }
3121
3122 ret = write_data(xconn->transport.sock, buf, cur_read);
3123 if (ret != cur_read) {
3124 int saved_errno = errno;
3125 /*
3126 * Try and give an error message saying what
3127 * client failed.
3128 */
3129 DEBUG(0, ("write_data failed for client %s. "
3130 "Error %s\n",
3131 smbXsrv_connection_dbg(xconn),
3132 strerror(saved_errno)));
3133 SAFE_FREE(buf);
3134 errno = saved_errno;
3135 return -1;
3136 }
3137 tosend -= cur_read;
3138 startpos += cur_read;
3139 }
3140
3141 SAFE_FREE(buf);
3142 return (ssize_t)nread;
3143 }
3144
3145 /****************************************************************************
3146 Deal with the case of sendfile reading less bytes from the file than
3147 requested. Fill with zeros (all we can do). Returns 0 on success
3148 ****************************************************************************/
3149
3150 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3151 files_struct *fsp,
3152 ssize_t nread,
3153 size_t headersize,
3154 size_t smb_maxcnt)
3155 {
3156 #define SHORT_SEND_BUFSIZE 1024
3157 if (nread < headersize) {
3158 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3159 "header for file %s (%s). Terminating\n",
3160 fsp_str_dbg(fsp), strerror(errno)));
3161 return -1;
3162 }
3163
3164 nread -= headersize;
3165
3166 if (nread < smb_maxcnt) {
3167 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3168 if (!buf) {
3169 DEBUG(0,("sendfile_short_send: malloc failed "
3170 "for file %s (%s). Terminating\n",
3171 fsp_str_dbg(fsp), strerror(errno)));
3172 return -1;
3173 }
3174
3175 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3176 "with zeros !\n", fsp_str_dbg(fsp)));
3177
3178 while (nread < smb_maxcnt) {
3179 /*
3180 * We asked for the real file size and told sendfile
3181 * to not go beyond the end of the file. But it can
3182 * happen that in between our fstat call and the
3183 * sendfile call the file was truncated. This is very
3184 * bad because we have already announced the larger
3185 * number of bytes to the client.
3186 *
3187 * The best we can do now is to send 0-bytes, just as
3188 * a read from a hole in a sparse file would do.
3189 *
3190 * This should happen rarely enough that I don't care
3191 * about efficiency here :-)
3192 */
3193 size_t to_write;
3194 ssize_t ret;
3195
3196 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3197 ret = write_data(xconn->transport.sock, buf, to_write);
3198 if (ret != to_write) {
3199 int saved_errno = errno;
3200 /*
3201 * Try and give an error message saying what
3202 * client failed.
3203 */
3204 DEBUG(0, ("write_data failed for client %s. "
3205 "Error %s\n",
3206 smbXsrv_connection_dbg(xconn),
3207 strerror(saved_errno)));
3208 errno = saved_errno;
3209 return -1;
3210 }
3211 nread += to_write;
3212 }
3213 SAFE_FREE(buf);
3214 }
3215
3216 return 0;
3217 }
3218
3219 /****************************************************************************
3220 Return a readbraw error (4 bytes of zero).
3221 ****************************************************************************/
3222
3223 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3224 {
3225 char header[4];
3226
3227 SIVAL(header,0,0);
3228
3229 smbd_lock_socket(xconn);
3230 if (write_data(xconn->transport.sock,header,4) != 4) {
3231 int saved_errno = errno;
3232 /*
3233 * Try and give an error message saying what
3234 * client failed.
3235 */
3236 DEBUG(0, ("write_data failed for client %s. "
3237 "Error %s\n",
3238 smbXsrv_connection_dbg(xconn),
3239 strerror(saved_errno)));
3240 errno = saved_errno;
3241
3242 fail_readraw();
3243 }
3244 smbd_unlock_socket(xconn);
3245 }
3246
3247 /****************************************************************************
3248 Use sendfile in readbraw.
3249 ****************************************************************************/
3250
3251 static void send_file_readbraw(connection_struct *conn,
3252 struct smb_request *req,
3253 files_struct *fsp,
3254 off_t startpos,
3255 size_t nread,
3256 ssize_t mincount)
3257 {
3258 struct smbXsrv_connection *xconn = req->xconn;
3259 char *outbuf = NULL;
3260 ssize_t ret=0;
3261
3262 /*
3263 * We can only use sendfile on a non-chained packet
3264 * but we can use on a non-oplocked file. tridge proved this
3265 * on a train in Germany :-). JRA.
3266 * reply_readbraw has already checked the length.
3267 */
3268
3269 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3270 (fsp->wcp == NULL) &&
3271 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3272 ssize_t sendfile_read = -1;
3273 char header[4];
3274 DATA_BLOB header_blob;
3275
3276 _smb_setlen(header,nread);
3277 header_blob = data_blob_const(header, 4);
3278
3279 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3280 &header_blob, startpos,
3281 nread);
3282 if (sendfile_read == -1) {
3283 /* Returning ENOSYS means no data at all was sent.
3284 * Do this as a normal read. */
3285 if (errno == ENOSYS) {
3286 goto normal_readbraw;
3287 }
3288
3289 /*
3290 * Special hack for broken Linux with no working sendfile. If we
3291 * return EINTR we sent the header but not the rest of the data.
3292 * Fake this up by doing read/write calls.
3293 */
3294 if (errno == EINTR) {
3295 /* Ensure we don't do this again. */
3296 set_use_sendfile(SNUM(conn), False);
3297 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3298
3299 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3300 DEBUG(0,("send_file_readbraw: "
3301 "fake_sendfile failed for "
3302 "file %s (%s).\n",
3303 fsp_str_dbg(fsp),
3304 strerror(errno)));
3305 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3306 }
3307 return;
3308 }
3309
3310 DEBUG(0,("send_file_readbraw: sendfile failed for "
3311 "file %s (%s). Terminating\n",
3312 fsp_str_dbg(fsp), strerror(errno)));
3313 exit_server_cleanly("send_file_readbraw sendfile failed");
3314 } else if (sendfile_read == 0) {
3315 /*
3316 * Some sendfile implementations return 0 to indicate
3317 * that there was a short read, but nothing was
3318 * actually written to the socket. In this case,
3319 * fallback to the normal read path so the header gets
3320 * the correct byte count.
3321 */
3322 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3323 "bytes falling back to the normal read: "
3324 "%s\n", fsp_str_dbg(fsp)));
3325 goto normal_readbraw;
3326 }
3327
3328 /* Deal with possible short send. */
3329 if (sendfile_read != 4+nread) {
3330 ret = sendfile_short_send(xconn, fsp,
3331 sendfile_read, 4, nread);
3332 if (ret == -1) {
3333 fail_readraw();
3334 }
3335 }
3336 return;
3337 }
3338
3339 normal_readbraw:
3340
3341 outbuf = talloc_array(NULL, char, nread+4);
3342 if (!outbuf) {
3343 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3344 (unsigned)(nread+4)));
3345 reply_readbraw_error(xconn);
3346 return;
3347 }
3348
3349 if (nread > 0) {
3350 ret = read_file(fsp,outbuf+4,startpos,nread);
3351 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3352 if (ret < mincount)
3353 ret = 0;
3354 #else
3355 if (ret < nread)
3356 ret = 0;
3357 #endif
3358 }
3359
3360 _smb_setlen(outbuf,ret);
3361 if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3362 int saved_errno = errno;
3363 /*
3364 * Try and give an error message saying what
3365 * client failed.
3366 */
3367 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3368 smbXsrv_connection_dbg(xconn),
3369 strerror(saved_errno)));
3370 errno = saved_errno;
3371
3372 fail_readraw();
3373 }
3374
3375 TALLOC_FREE(outbuf);
3376 }
3377
3378 /****************************************************************************
3379 Reply to a readbraw (core+ protocol).
3380 ****************************************************************************/
3381
3382 void reply_readbraw(struct smb_request *req)
3383 {
3384 connection_struct *conn = req->conn;
3385 struct smbXsrv_connection *xconn = req->xconn;
3386 ssize_t maxcount,mincount;
3387 size_t nread = 0;
3388 off_t startpos;
3389 files_struct *fsp;
3390 struct lock_struct lock;
3391 off_t size = 0;
3392
3393 START_PROFILE(SMBreadbraw);
3394
3395 if (srv_is_signing_active(xconn) || req->encrypted) {
3396 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3397 "raw reads/writes are disallowed.");
3398 }
3399
3400 if (req->wct < 8) {
3401 reply_readbraw_error(xconn);
3402 END_PROFILE(SMBreadbraw);
3403 return;
3404 }
3405
3406 if (xconn->smb1.echo_handler.trusted_fde) {
3407 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3408 "'async smb echo handler = yes'\n"));
3409 reply_readbraw_error(xconn);
3410 END_PROFILE(SMBreadbraw);
3411 return;
3412 }
3413
3414 /*
3415 * Special check if an oplock break has been issued
3416 * and the readraw request croses on the wire, we must
3417 * return a zero length response here.
3418 */
3419
3420 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3421
3422 /*
3423 * We have to do a check_fsp by hand here, as
3424 * we must always return 4 zero bytes on error,
3425 * not a NTSTATUS.
3426 */
3427
3428 if (!fsp || !conn || conn != fsp->conn ||
3429 req->vuid != fsp->vuid ||
3430 fsp->is_directory || fsp->fh->fd == -1) {
3431 /*
3432 * fsp could be NULL here so use the value from the packet. JRA.
3433 */
3434 DEBUG(3,("reply_readbraw: fnum %d not valid "
3435 "- cache prime?\n",
3436 (int)SVAL(req->vwv+0, 0)));
3437 reply_readbraw_error(xconn);
3438 END_PROFILE(SMBreadbraw);
3439 return;
3440 }
3441
3442 /* Do a "by hand" version of CHECK_READ. */
3443 if (!(fsp->can_read ||
3444 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3445 (fsp->access_mask & FILE_EXECUTE)))) {
3446 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3447 (int)SVAL(req->vwv+0, 0)));
3448 reply_readbraw_error(xconn);
3449 END_PROFILE(SMBreadbraw);
3450 return;
3451 }
3452
3453 flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3454
3455 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3456 if(req->wct == 10) {
3457 /*
3458 * This is a large offset (64 bit) read.
3459 */
3460
3461 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3462
3463 if(startpos < 0) {
3464 DEBUG(0,("reply_readbraw: negative 64 bit "
3465 "readraw offset (%.0f) !\n",
3466 (double)startpos ));
3467 reply_readbraw_error(xconn);
3468 END_PROFILE(SMBreadbraw);
3469 return;
3470 }
3471 }
3472
3473 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3474 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3475
3476 /* ensure we don't overrun the packet size */
3477 maxcount = MIN(65535,maxcount);
3478
3479 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3480 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3481 &lock);
3482
3483 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3484 reply_readbraw_error(xconn);
3485 END_PROFILE(SMBreadbraw);
3486 return;
3487 }
3488
3489 if (fsp_stat(fsp) == 0) {
3490 size = fsp->fsp_name->st.st_ex_size;
3491 }
3492
3493 if (startpos >= size) {
3494 nread = 0;
3495 } else {
3496 nread = MIN(maxcount,(size - startpos));
3497 }
3498
3499 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3500 if (nread < mincount)
3501 nread = 0;
3502 #endif
3503
3504 DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3505 "min=%lu nread=%lu\n",
3506 fsp_fnum_dbg(fsp), (double)startpos,
3507 (unsigned long)maxcount,
3508 (unsigned long)mincount,
3509 (unsigned long)nread ) );
3510
3511 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3512
3513 DEBUG(5,("reply_readbraw finished\n"));
3514
3515 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3516
3517 END_PROFILE(SMBreadbraw);
3518 return;
3519 }
3520
3521 #undef DBGC_CLASS
3522 #define DBGC_CLASS DBGC_LOCKING
3523
3524 /****************************************************************************
3525 Reply to a lockread (core+ protocol).
3526 ****************************************************************************/
3527
3528 void reply_lockread(struct smb_request *req)
3529 {
3530 connection_struct *conn = req->conn;
3531 ssize_t nread = -1;
3532 char *data;
3533 off_t startpos;
3534 size_t numtoread;
3535 size_t maxtoread;
3536 NTSTATUS status;
3537 files_struct *fsp;
3538 struct byte_range_lock *br_lck = NULL;
3539 char *p = NULL;
3540 struct smbXsrv_connection *xconn = req->xconn;
3541
3542 START_PROFILE(SMBlockread);
3543
3544 if (req->wct < 5) {
3545 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3546 END_PROFILE(SMBlockread);
3547 return;
3548 }
3549
3550 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3551
3552 if (!check_fsp(conn, req, fsp)) {
3553 END_PROFILE(SMBlockread);
3554 return;
3555 }
3556
3557 if (!CHECK_READ(fsp,req)) {
3558 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3559 END_PROFILE(SMBlockread);
3560 return;
3561 }
3562
3563 numtoread = SVAL(req->vwv+1, 0);
3564 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3565
3566 /*
3567 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3568 * protocol request that predates the read/write lock concept.
3569 * Thus instead of asking for a read lock here we need to ask
3570 * for a write lock. JRA.
3571 * Note that the requested lock size is unaffected by max_send.
3572 */
3573
3574 br_lck = do_lock(req->sconn->msg_ctx,
3575 fsp,
3576 (uint64_t)req->smbpid,
3577 (uint64_t)numtoread,
3578 (uint64_t)startpos,
3579 WRITE_LOCK,
3580 WINDOWS_LOCK,
3581 False, /* Non-blocking lock. */
3582 &status,
3583 NULL);
3584 TALLOC_FREE(br_lck);
3585
3586 if (NT_STATUS_V(status)) {
3587 reply_nterror(req, status);
3588 END_PROFILE(SMBlockread);
3589 return;
3590 }
3591
3592 /*
3593 * However the requested READ size IS affected by max_send. Insanity.... JRA.
3594 */
3595 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3596
3597 if (numtoread > maxtoread) {
3598 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3599 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3600 (unsigned int)numtoread, (unsigned int)maxtoread,
3601 (unsigned int)xconn->smb1.sessions.max_send));
3602 numtoread = maxtoread;
3603 }
3604
3605 reply_outbuf(req, 5, numtoread + 3);
3606
3607 data = smb_buf(req->outbuf) + 3;
3608
3609 nread = read_file(fsp,data,startpos,numtoread);
3610
3611 if (nread < 0) {
3612 reply_nterror(req, map_nt_error_from_unix(errno));
3613 END_PROFILE(SMBlockread);
3614 return;
3615 }
3616
3617 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3618
3619 SSVAL(req->outbuf,smb_vwv0,nread);
3620 SSVAL(req->outbuf,smb_vwv5,nread+3);
3621 p = smb_buf(req->outbuf);
3622 SCVAL(p,0,0); /* pad byte. */
3623 SSVAL(p,1,nread);
3624
3625 DEBUG(3,("lockread %s num=%d nread=%d\n",
3626 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3627
3628 END_PROFILE(SMBlockread);
3629 return;
3630 }
3631
3632 #undef DBGC_CLASS
3633 #define DBGC_CLASS DBGC_ALL
3634
3635 /****************************************************************************
3636 Reply to a read.
3637 ****************************************************************************/
3638
3639 void reply_read(struct smb_request *req)
3640 {
3641 connection_struct *conn = req->conn;
3642 size_t numtoread;
3643 size_t maxtoread;
3644 ssize_t nread = 0;
3645 char *data;
3646 off_t startpos;
3647 files_struct *fsp;
3648 struct lock_struct lock;
3649 struct smbXsrv_connection *xconn = req->xconn;
3650
3651 START_PROFILE(SMBread);
3652
3653 if (req->wct < 3) {
3654 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3655 END_PROFILE(SMBread);
3656 return;
3657 }
3658
3659 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3660
3661 if (!check_fsp(conn, req, fsp)) {
3662 END_PROFILE(SMBread);
3663 return;
3664 }
3665
3666 if (!CHECK_READ(fsp,req)) {
3667 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3668 END_PROFILE(SMBread);
3669 return;
3670 }
3671
3672 numtoread = SVAL(req->vwv+1, 0);
3673 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3674
3675 /*
3676 * The requested read size cannot be greater than max_send. JRA.
3677 */
3678 maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3679
3680 if (numtoread > maxtoread) {
3681 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3682 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3683 (unsigned int)numtoread, (unsigned int)maxtoread,
3684 (unsigned int)xconn->smb1.sessions.max_send));
3685 numtoread = maxtoread;
3686 }
3687
3688 reply_outbuf(req, 5, numtoread+3);
3689
3690 data = smb_buf(req->outbuf) + 3;
3691
3692 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3693 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3694 &lock);
3695
3696 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3697 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3698 END_PROFILE(SMBread);
3699 return;
3700 }
3701
3702 if (numtoread > 0)
3703 nread = read_file(fsp,data,startpos,numtoread);
3704
3705 if (nread < 0) {
3706 reply_nterror(req, map_nt_error_from_unix(errno));
3707 goto strict_unlock;
3708 }
3709
3710 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3711
3712 SSVAL(req->outbuf,smb_vwv0,nread);
3713 SSVAL(req->outbuf,smb_vwv5,nread+3);
3714 SCVAL(smb_buf(req->outbuf),0,1);
3715 SSVAL(smb_buf(req->outbuf),1,nread);
3716
3717 DEBUG(3, ("read %s num=%d nread=%d\n",
3718 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3719
3720 strict_unlock:
3721 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3722
3723 END_PROFILE(SMBread);
3724 return;
3725 }
3726
3727 /****************************************************************************
3728 Setup readX header.
3729 ****************************************************************************/
3730
3731 static int setup_readX_header(struct smb_request *req, char *outbuf,
3732 size_t smb_maxcnt)
3733 {
3734 int outsize;
3735
3736 outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
3737 False);
3738
3739 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3740
3741 SCVAL(outbuf,smb_vwv0,0xFF);
3742 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3743 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3744 SSVAL(outbuf,smb_vwv6,
3745 (smb_wct - 4) /* offset from smb header to wct */
3746 + 1 /* the wct field */
3747 + 12 * sizeof(uint16_t) /* vwv */
3748 + 2 /* the buflen field */
3749 + 1); /* padding byte */
3750 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3751 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3752 SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
3753 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3754 _smb_setlen_large(outbuf,
3755 smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
3756 return outsize;
3757 }
3758
3759 /****************************************************************************
3760 Reply to a read and X - possibly using sendfile.
3761 ****************************************************************************/
3762
3763 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3764 files_struct *fsp, off_t startpos,
3765 size_t smb_maxcnt)
3766 {
3767 struct smbXsrv_connection *xconn = req->xconn;
3768 ssize_t nread = -1;
3769 struct lock_struct lock;
3770 int saved_errno = 0;
3771
3772 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3773 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3774 &lock);
3775
3776 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3777 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3778 return;
3779 }
3780
3781 /*
3782 * We can only use sendfile on a non-chained packet
3783 * but we can use on a non-oplocked file. tridge proved this
3784 * on a train in Germany :-). JRA.
3785 */
3786
3787 if (!req_is_in_chain(req) &&
3788 !req->encrypted &&
3789 (fsp->base_fsp == NULL) &&
3790 (fsp->wcp == NULL) &&
3791 lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3792 uint8 headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
3793 DATA_BLOB header;
3794
3795 if(fsp_stat(fsp) == -1) {
3796 reply_nterror(req, map_nt_error_from_unix(errno));
3797 goto strict_unlock;
3798 }
3799
3800 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3801 (startpos > fsp->fsp_name->st.st_ex_size) ||
3802 (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3803 /*
3804 * We already know that we would do a short read, so don't
3805 * try the sendfile() path.
3806 */
3807 goto nosendfile_read;
3808 }
3809
3810 /*
3811 * Set up the packet header before send. We
3812 * assume here the sendfile will work (get the
3813 * correct amount of data).
3814 */
3815
3816 header = data_blob_const(headerbuf, sizeof(headerbuf));
3817
3818 construct_reply_common_req(req, (char *)headerbuf);
3819 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3820
3821 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
3822 startpos, smb_maxcnt);
3823 if (nread == -1) {
3824 saved_errno = errno;
3825
3826 /* Returning ENOSYS means no data at all was sent.
3827 Do this as a normal read. */
3828 if (errno == ENOSYS) {
3829 goto normal_read;
3830 }
3831
3832 /*
3833 * Special hack for broken Linux with no working sendfile. If we
3834 * return EINTR we sent the header but not the rest of the data.
3835 * Fake this up by doing read/write calls.
3836 */
3837
3838 if (errno == EINTR) {
3839 /* Ensure we don't do this again. */
3840 set_use_sendfile(SNUM(conn), False);
3841 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3842 nread = fake_sendfile(xconn, fsp, startpos,
3843 smb_maxcnt);
3844 if (nread == -1) {
3845 saved_errno = errno;
3846 DEBUG(0,("send_file_readX: "
3847 "fake_sendfile failed for "
3848 "file %s (%s) for client %s. "
3849 "Terminating\n",
3850 fsp_str_dbg(fsp),
3851 smbXsrv_connection_dbg(xconn),
3852 strerror(saved_errno)));
3853 errno = saved_errno;
3854 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3855 }
3856 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3857 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3858 /* No outbuf here means successful sendfile. */
3859 goto strict_unlock;
3860 }
3861
3862 DEBUG(0,("send_file_readX: sendfile failed for file "
3863 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3864 strerror(errno)));
3865 exit_server_cleanly("send_file_readX sendfile failed");
3866 } else if (nread == 0) {
3867 /*
3868 * Some sendfile implementations return 0 to indicate
3869 * that there was a short read, but nothing was
3870 * actually written to the socket. In this case,
3871 * fallback to the normal read path so the header gets
3872 * the correct byte count.
3873 */
3874 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3875 "falling back to the normal read: %s\n",
3876 fsp_str_dbg(fsp)));
3877 goto normal_read;
3878 }
3879
3880 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3881 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3882
3883 /* Deal with possible short send. */
3884 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3885 ssize_t ret;
3886
3887 ret = sendfile_short_send(xconn, fsp, nread,
3888 sizeof(headerbuf), smb_maxcnt);
3889 if (ret == -1) {
3890 const char *r;
3891 r = "send_file_readX: sendfile_short_send failed";
3892 DEBUG(0,("%s for file %s (%s).\n",
3893 r, fsp_str_dbg(fsp), strerror(errno)));
3894 exit_server_cleanly(r);
3895 }
3896 }
3897 /* No outbuf here means successful sendfile. */
3898 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3899 SMB_PERFCOUNT_END(&req->pcd);
3900 goto strict_unlock;
3901 }
3902
3903 normal_read:
3904
3905 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3906 uint8 headerbuf[smb_size + 2*12 + 1 /* padding byte */];
3907 ssize_t ret;
3908
3909 construct_reply_common_req(req, (char *)headerbuf);
3910 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3911
3912 /* Send out the header. */
3913 ret = write_data(xconn->transport.sock, (char *)headerbuf,
3914 sizeof(headerbuf));
3915 if (ret != sizeof(headerbuf)) {
3916 saved_errno = errno;
3917 /*
3918 * Try and give an error message saying what
3919 * client failed.
3920 */
3921 DEBUG(0,("send_file_readX: write_data failed for file "
3922 "%s (%s) for client %s. Terminating\n",
3923 fsp_str_dbg(fsp),
3924 smbXsrv_connection_dbg(xconn),
3925 strerror(saved_errno)));
3926 errno = saved_errno;
3927 exit_server_cleanly("send_file_readX sendfile failed");
3928 }
3929 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
3930 if (nread == -1) {
3931 saved_errno = errno;
3932 DEBUG(0,("send_file_readX: fake_sendfile failed for file "
3933 "%s (%s) for client %s. Terminating\n",
3934 fsp_str_dbg(fsp),
3935 smbXsrv_connection_dbg(xconn),
3936 strerror(saved_errno)));
3937 errno = saved_errno;
3938 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3939 }
3940 goto strict_unlock;
3941 }
3942
3943 nosendfile_read:
3944
3945 reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
3946 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3947 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
3948
3949 nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
3950 startpos, smb_maxcnt);
3951 saved_errno = errno;
3952
3953 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3954
3955 if (nread < 0) {
3956 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3957 return;
3958 }
3959
3960 setup_readX_header(req, (char *)req->outbuf, nread);
3961
3962 DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3963 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3964 return;
3965
3966 strict_unlock:
3967 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3968 TALLOC_FREE(req->outbuf);
3969 return;
3970 }
3971
3972 /****************************************************************************
3973 Work out how much space we have for a read return.
3974 ****************************************************************************/
3975
3976 static size_t calc_max_read_pdu(const struct smb_request *req)
3977 {
3978 struct smbXsrv_connection *xconn = req->xconn;
3979
3980 if (xconn->protocol < PROTOCOL_NT1) {
3981 return xconn->smb1.sessions.max_send;
3982 }
3983
3984 if (!lp_large_readwrite()) {
3985 return xconn->smb1.sessions.max_send;
3986 }
3987
3988 if (req_is_in_chain(req)) {
3989 return xconn->smb1.sessions.max_send;
3990 }
3991
3992 if (req->encrypted) {
3993 /*
3994 * Don't take encrypted traffic up to the
3995 * limit. There are padding considerations
3996 * that make that tricky.
3997 */
3998 return xconn->smb1.sessions.max_send;
3999 }
4000
4001 if (srv_is_signing_active(xconn)) {
4002 return 0x1FFFF;
4003 }
4004
4005 if (!lp_unix_extensions()) {
4006 return 0x1FFFF;
4007 }
4008
4009 /*
4010 * We can do ultra-large POSIX reads.
4011 */
4012 return 0xFFFFFF;
4013 }
4014
4015 /****************************************************************************
4016 Calculate how big a read can be. Copes with all clients. It's always
4017 safe to return a short read - Windows does this.
4018 ****************************************************************************/
4019
4020 static size_t calc_read_size(const struct smb_request *req,
4021 size_t upper_size,
4022 size_t lower_size)
4023 {
4024 struct smbXsrv_connection *xconn = req->xconn;
4025 size_t max_pdu = calc_max_read_pdu(req);
4026 size_t total_size = 0;
4027 size_t hdr_len = MIN_SMB_SIZE + VWV(12);
4028 size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
4029
4030 /*
4031 * Windows explicitly ignores upper size of 0xFFFF.
4032 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4033 * We must do the same as these will never fit even in
4034 * an extended size NetBIOS packet.
4035 */
4036 if (upper_size == 0xFFFF) {
4037 upper_size = 0;
4038 }
4039
4040 if (xconn->protocol < PROTOCOL_NT1) {
4041 upper_size = 0;
4042 }
4043
4044 total_size = ((upper_size<<16) | lower_size);
4045
4046 /*
4047 * LARGE_READX test shows it's always safe to return
4048 * a short read. Windows does so.
4049 */
4050 return MIN(total_size, max_len);
4051 }
4052
4053 /****************************************************************************
4054 Reply to a read and X.
4055 ****************************************************************************/
4056
4057 void reply_read_and_X(struct smb_request *req)
4058 {
4059 connection_struct *conn = req->conn;
4060 files_struct *fsp;
4061 off_t startpos;
4062 size_t smb_maxcnt;
4063 size_t upper_size;
4064 bool big_readX = False;
4065 #if 0
4066 size_t smb_mincnt = SVAL(req->vwv+6, 0);
4067 #endif
4068
4069 START_PROFILE(SMBreadX);
4070
4071 if ((req->wct != 10) && (req->wct != 12)) {
4072 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4073 return;
4074 }
4075
4076 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4077 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4078 smb_maxcnt = SVAL(req->vwv+5, 0);
4079
4080 /* If it's an IPC, pass off the pipe handler. */
4081 if (IS_IPC(conn)) {
4082 reply_pipe_read_and_X(req);
4083 END_PROFILE(SMBreadX);
4084 return;
4085 }
4086
4087 if (!check_fsp(conn, req, fsp)) {
4088 END_PROFILE(SMBreadX);
4089 return;
4090 }
4091
4092 if (!CHECK_READ(fsp,req)) {
4093 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4094 END_PROFILE(SMBreadX);
4095 return;
4096 }
4097
4098 upper_size = SVAL(req->vwv+7, 0);
4099 smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4100 if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4101 /*
4102 * This is a heuristic to avoid keeping large
4103 * outgoing buffers around over long-lived aio
4104 * requests.
4105 */
4106 big_readX = True;
4107 }
4108
4109 if (req->wct == 12) {
4110 /*
4111 * This is a large offset (64 bit) read.
4112 */
4113 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4114
4115 }
4116
4117 if (!big_readX) {
4118 NTSTATUS status = schedule_aio_read_and_X(conn,
4119 req,
4120 fsp,
4121 startpos,
4122 smb_maxcnt);
4123 if (NT_STATUS_IS_OK(status)) {
4124 /* Read scheduled - we're done. */
4125 goto out;
4126 }
4127 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4128 /* Real error - report to client. */
4129 END_PROFILE(SMBreadX);
4130 reply_nterror(req, status);
4131 return;
4132 }
4133 /* NT_STATUS_RETRY - fall back to sync read. */
4134 }
4135
4136 smbd_lock_socket(req->xconn);
4137 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4138 smbd_unlock_socket(req->xconn);
4139
4140 out:
4141 END_PROFILE(SMBreadX);
4142 return;
4143 }
4144
4145 /****************************************************************************
4146 Error replies to writebraw must have smb_wct == 1. Fix this up.
4147 ****************************************************************************/
4148
4149 void error_to_writebrawerr(struct smb_request *req)
4150 {
4151 uint8 *old_outbuf = req->outbuf;
4152
4153 reply_outbuf(req, 1, 0);
4154
4155 memcpy(req->outbuf, old_outbuf, smb_size);
4156 TALLOC_FREE(old_outbuf);
4157 }
4158
4159 /****************************************************************************
4160 Read 4 bytes of a smb packet and return the smb length of the packet.
4161 Store the result in the buffer. This version of the function will
4162 never return a session keepalive (length of zero).
4163 Timeout is in milliseconds.
4164 ****************************************************************************/
4165
4166 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4167 size_t *len)
4168 {
4169 uint8_t msgtype = NBSSkeepalive;
4170
4171 while (msgtype == NBSSkeepalive) {
4172 NTSTATUS status;
4173
4174 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4175 len);
4176 if (!NT_STATUS_IS_OK(status)) {
4177 char addr[INET6_ADDRSTRLEN];
4178 /* Try and give an error message
4179 * saying what client failed. */
4180 DEBUG(0, ("read_fd_with_timeout failed for "
4181 "client %s read error = %s.\n",
4182 get_peer_addr(fd,addr,sizeof(addr)),
4183 nt_errstr(status)));
4184 return status;
4185 }
4186
4187 msgtype = CVAL(inbuf, 0);
4188 }
4189
4190 DEBUG(10,("read_smb_length: got smb length of %lu\n",
4191 (unsigned long)len));
4192
4193 return NT_STATUS_OK;
4194 }
4195
4196 /****************************************************************************
4197 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4198 ****************************************************************************/
4199
4200 void reply_writebraw(struct smb_request *req)
4201 {
4202 connection_struct *conn = req->conn;
4203 struct smbXsrv_connection *xconn = req->xconn;
4204 char *buf = NULL;
4205 ssize_t nwritten=0;
4206 ssize_t total_written=0;
4207 size_t numtowrite=0;
4208 size_t tcount;
4209 off_t startpos;
4210 const char *data=NULL;
4211 bool write_through;
4212 files_struct *fsp;
4213 struct lock_struct lock;
4214 NTSTATUS status;
4215
4216 START_PROFILE(SMBwritebraw);
4217
4218 /*
4219 * If we ever reply with an error, it must have the SMB command
4220 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4221 * we're finished.
4222 */
4223 SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4224
4225 if (srv_is_signing_active(xconn)) {
4226 END_PROFILE(SMBwritebraw);
4227 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4228 "raw reads/writes are disallowed.");
4229 }
4230
4231 if (req->wct < 12) {
4232 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4233 error_to_writebrawerr(req);
4234 END_PROFILE(SMBwritebraw);
4235 return;
4236 }
4237
4238 if (xconn->smb1.echo_handler.trusted_fde) {
4239 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4240 "'async smb echo handler = yes'\n"));
4241 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4242 error_to_writebrawerr(req);
4243 END_PROFILE(SMBwritebraw);
4244 return;
4245 }
4246
4247 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4248 if (!check_fsp(conn, req, fsp)) {
4249 error_to_writebrawerr(req);
4250 END_PROFILE(SMBwritebraw);
4251 return;
4252 }
4253
4254 if (!CHECK_WRITE(fsp)) {
4255 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4256 error_to_writebrawerr(req);
4257 END_PROFILE(SMBwritebraw);
4258 return;
4259 }
4260
4261 tcount = IVAL(req->vwv+1, 0);
4262 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4263 write_through = BITSETW(req->vwv+7,0);
4264
4265 /* We have to deal with slightly different formats depending
4266 on whether we are using the core+ or lanman1.0 protocol */
4267
4268 if(get_Protocol() <= PROTOCOL_COREPLUS) {
4269 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4270 data = smb_buf_const(req->inbuf);
4271 } else {
4272 numtowrite = SVAL(req->vwv+10, 0);
4273 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4274 }
4275
4276 /* Ensure we don't write bytes past the end of this packet. */
4277 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4278 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4279 error_to_writebrawerr(req);
4280 END_PROFILE(SMBwritebraw);
4281 return;
4282 }
4283
4284 if (!fsp->print_file) {
4285 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4286 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4287 &lock);
4288
4289 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4290 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4291 error_to_writebrawerr(req);
4292 END_PROFILE(SMBwritebraw);
4293 return;
4294 }
4295 }
4296
4297 if (numtowrite>0) {
4298 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4299 }
4300
4301 DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4302 "wrote=%d sync=%d\n",
4303 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4304 (int)nwritten, (int)write_through));
4305
4306 if (nwritten < (ssize_t)numtowrite) {
4307 reply_nterror(req, NT_STATUS_DISK_FULL);
4308 error_to_writebrawerr(req);
4309 goto strict_unlock;
4310 }
4311
4312 total_written = nwritten;
4313
4314 /* Allocate a buffer of 64k + length. */
4315 buf = talloc_array(NULL, char, 65540);
4316 if (!buf) {
4317 reply_nterror(req, NT_STATUS_NO_MEMORY);
4318 error_to_writebrawerr(req);
4319 goto strict_unlock;
4320 }
4321
4322 /* Return a SMBwritebraw message to the redirector to tell
4323 * it to send more bytes */
4324
4325 memcpy(buf, req->inbuf, smb_size);
4326 srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4327 SCVAL(buf,smb_com,SMBwritebraw);
4328 SSVALS(buf,smb_vwv0,0xFFFF);
4329 show_msg(buf);
4330 if (!srv_send_smb(req->xconn,
4331 buf,
4332 false, 0, /* no signing */
4333 IS_CONN_ENCRYPTED(conn),
4334 &req->pcd)) {
4335 exit_server_cleanly("reply_writebraw: srv_send_smb "
4336 "failed.");
4337 }
4338
4339 /* Now read the raw data into the buffer and write it */
4340 status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4341 &numtowrite);
4342 if (!NT_STATUS_IS_OK(status)) {
4343 exit_server_cleanly("secondary writebraw failed");
4344 }
4345
4346 /* Set up outbuf to return the correct size */
4347 reply_outbuf(req, 1, 0);
4348
4349 if (numtowrite != 0) {
4350
4351 if (numtowrite > 0xFFFF) {
4352 DEBUG(0,("reply_writebraw: Oversize secondary write "
4353 "raw requested (%u). Terminating\n",
4354 (unsigned int)numtowrite ));
4355 exit_server_cleanly("secondary writebraw failed");
4356 }
4357
4358 if (tcount > nwritten+numtowrite) {
4359 DEBUG(3,("reply_writebraw: Client overestimated the "
4360 "write %d %d %d\n",
4361 (int)tcount,(int)nwritten,(int)numtowrite));
4362 }
4363
4364 status = read_data(xconn->transport.sock, buf+4, numtowrite);
4365
4366 if (!NT_STATUS_IS_OK(status)) {
4367 /* Try and give an error message
4368 * saying what client failed. */
4369 DEBUG(0, ("reply_writebraw: Oversize secondary write "
4370 "raw read failed (%s) for client %s. "
4371 "Terminating\n", nt_errstr(status),
4372 smbXsrv_connection_dbg(xconn)));
4373 exit_server_cleanly("secondary writebraw failed");
4374 }
4375
4376 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4377 if (nwritten == -1) {
4378 TALLOC_FREE(buf);
4379 reply_nterror(req, map_nt_error_from_unix(errno));
4380 error_to_writebrawerr(req);
4381 goto strict_unlock;
4382 }
4383
4384 if (nwritten < (ssize_t)numtowrite) {
4385 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4386 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4387 }
4388
4389 if (nwritten > 0) {
4390 total_written += nwritten;
4391 }
4392 }
4393
4394 TALLOC_FREE(buf);
4395 SSVAL(req->outbuf,smb_vwv0,total_written);
4396
4397 status = sync_file(conn, fsp, write_through);
4398 if (!NT_STATUS_IS_OK(status)) {
4399 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4400 fsp_str_dbg(fsp), nt_errstr(status)));
4401 reply_nterror(req, status);
4402 error_to_writebrawerr(req);
4403 goto strict_unlock;
4404 }
4405
4406 DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4407 "wrote=%d\n",
4408 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4409 (int)total_written));
4410
4411 if (!fsp->print_file) {
4412 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4413 }
4414
4415 /* We won't return a status if write through is not selected - this
4416 * follows what WfWg does */
4417 END_PROFILE(SMBwritebraw);
4418
4419 if (!write_through && total_written==tcount) {
4420
4421 #if RABBIT_PELLET_FIX
4422 /*
4423 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4424 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4425 * JRA.
4426 */
4427 if (!send_keepalive(xconn->transport.sock)) {
4428 exit_server_cleanly("reply_writebraw: send of "
4429 "keepalive failed");
4430 }
4431 #endif
4432 TALLOC_FREE(req->outbuf);
4433 }
4434 return;
4435
4436 strict_unlock:
4437 if (!fsp->print_file) {
4438 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4439 }
4440
4441 END_PROFILE(SMBwritebraw);
4442 return;
4443 }
4444
4445 #undef DBGC_CLASS
4446 #define DBGC_CLASS DBGC_LOCKING
4447
4448 /****************************************************************************
4449 Reply to a writeunlock (core+).
4450 ****************************************************************************/
4451
4452 void reply_writeunlock(struct smb_request *req)
4453 {
4454 connection_struct *conn = req->conn;
4455 ssize_t nwritten = -1;
4456 size_t numtowrite;
4457 off_t startpos;
4458 const char *data;
4459 NTSTATUS status = NT_STATUS_OK;
4460 files_struct *fsp;
4461 struct lock_struct lock;
4462 int saved_errno = 0;
4463
4464 START_PROFILE(SMBwriteunlock);
4465
4466 if (req->wct < 5) {
4467 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4468 END_PROFILE(SMBwriteunlock);
4469 return;
4470 }
4471
4472 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4473
4474 if (!check_fsp(conn, req, fsp)) {
4475 END_PROFILE(SMBwriteunlock);
4476 return;
4477 }
4478
4479 if (!CHECK_WRITE(fsp)) {
4480 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4481 END_PROFILE(SMBwriteunlock);
4482 return;
4483 }
4484
4485 numtowrite = SVAL(req->vwv+1, 0);
4486 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4487 data = (const char *)req->buf + 3;
4488
4489 if (!fsp->print_file && numtowrite > 0) {
4490 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4491 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4492 &lock);
4493
4494 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4495 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4496 END_PROFILE(SMBwriteunlock);
4497 return;
4498 }
4499 }
4500
4501 /* The special X/Open SMB protocol handling of
4502 zero length writes is *NOT* done for
4503 this call */
4504 if(numtowrite == 0) {
4505 nwritten = 0;
4506 } else {
4507 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4508 saved_errno = errno;
4509 }
4510
4511 status = sync_file(conn, fsp, False /* write through */);
4512 if (!NT_STATUS_IS_OK(status)) {
4513 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4514 fsp_str_dbg(fsp), nt_errstr(status)));
4515 reply_nterror(req, status);
4516 goto strict_unlock;
4517 }
4518
4519 if(nwritten < 0) {
4520 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4521 goto strict_unlock;
4522 }
4523
4524 if((nwritten < numtowrite) && (numtowrite != 0)) {
4525 reply_nterror(req, NT_STATUS_DISK_FULL);
4526 goto strict_unlock;
4527 }
4528
4529 if (numtowrite && !fsp->print_file) {
4530 status = do_unlock(req->sconn->msg_ctx,
4531 fsp,
4532 (uint64_t)req->smbpid,
4533 (uint64_t)numtowrite,
4534 (uint64_t)startpos,
4535 WINDOWS_LOCK);
4536
4537 if (NT_STATUS_V(status)) {
4538 reply_nterror(req, status);
4539 goto strict_unlock;
4540 }
4541 }
4542
4543 reply_outbuf(req, 1, 0);
4544
4545 SSVAL(req->outbuf,smb_vwv0,nwritten);
4546
4547 DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4548 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4549
4550 strict_unlock:
4551 if (numtowrite && !fsp->print_file) {
4552 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4553 }
4554
4555 END_PROFILE(SMBwriteunlock);
4556 return;
4557 }
4558
4559 #undef DBGC_CLASS
4560 #define DBGC_CLASS DBGC_ALL
4561
4562 /****************************************************************************
4563 Reply to a write.
4564 ****************************************************************************/
4565
4566 void reply_write(struct smb_request *req)
4567 {
4568 connection_struct *conn = req->conn;
4569 size_t numtowrite;
4570 ssize_t nwritten = -1;
4571 off_t startpos;
4572 const char *data;
4573 files_struct *fsp;
4574 struct lock_struct lock;
4575 NTSTATUS status;
4576 int saved_errno = 0;
4577
4578 START_PROFILE(SMBwrite);
4579
4580 if (req->wct < 5) {
4581 END_PROFILE(SMBwrite);
4582 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4583 return;
4584 }
4585
4586 /* If it's an IPC, pass off the pipe handler. */
4587 if (IS_IPC(conn)) {
4588 reply_pipe_write(req);
4589 END_PROFILE(SMBwrite);
4590 return;
4591 }
4592
4593 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4594
4595 if (!check_fsp(conn, req, fsp)) {
4596 END_PROFILE(SMBwrite);
4597 return;
4598 }
4599
4600 if (!CHECK_WRITE(fsp)) {
4601 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4602 END_PROFILE(SMBwrite);
4603 return;
4604 }
4605
4606 numtowrite = SVAL(req->vwv+1, 0);
4607 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4608 data = (const char *)req->buf + 3;
4609
4610 if (!fsp->print_file) {
4611 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4612 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4613 &lock);
4614
4615 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4616 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4617 END_PROFILE(SMBwrite);
4618 return;
4619 }
4620 }
4621
4622 /*
4623 * X/Open SMB protocol says that if smb_vwv1 is
4624 * zero then the file size should be extended or
4625 * truncated to the size given in smb_vwv[2-3].
4626 */
4627
4628 if(numtowrite == 0) {
4629 /*
4630 * This is actually an allocate call, and set EOF. JRA.
4631 */
4632 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4633 if (nwritten < 0) {
4634 reply_nterror(req, NT_STATUS_DISK_FULL);
4635 goto strict_unlock;
4636 }
4637 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4638 if (nwritten < 0) {
4639 reply_nterror(req, NT_STATUS_DISK_FULL);
4640 goto strict_unlock;
4641 }
4642 trigger_write_time_update_immediate(fsp);
4643 } else {
4644 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4645 }
4646
4647 status = sync_file(conn, fsp, False);
4648 if (!NT_STATUS_IS_OK(status)) {
4649 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4650 fsp_str_dbg(fsp), nt_errstr(status)));
4651 reply_nterror(req, status);
4652 goto strict_unlock;
4653 }
4654
4655 if(nwritten < 0) {
4656 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4657 goto strict_unlock;
4658 }
4659
4660 if((nwritten == 0) && (numtowrite != 0)) {
4661 reply_nterror(req, NT_STATUS_DISK_FULL);
4662 goto strict_unlock;
4663 }
4664
4665 reply_outbuf(req, 1, 0);
4666
4667 SSVAL(req->outbuf,smb_vwv0,nwritten);
4668
4669 if (nwritten < (ssize_t)numtowrite) {
4670 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4671 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4672 }
4673
4674 DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4675
4676 strict_unlock:
4677 if (!fsp->print_file) {
4678 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4679 }
4680
4681 END_PROFILE(SMBwrite);
4682 return;
4683 }
4684
4685 /****************************************************************************
4686 Ensure a buffer is a valid writeX for recvfile purposes.
4687 ****************************************************************************/
4688
4689 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4690 (2*14) + /* word count (including bcc) */ \
4691 1 /* pad byte */)
4692
4693 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4694 const uint8_t *inbuf)
4695 {
4696 size_t numtowrite;
4697 unsigned int doff = 0;
4698 size_t len = smb_len_large(inbuf);
4699 uint16_t fnum;
4700 struct smbXsrv_open *op = NULL;
4701 struct files_struct *fsp = NULL;
4702 NTSTATUS status;
4703
4704 if (is_encrypted_packet(inbuf)) {
4705 /* Can't do this on encrypted
4706 * connections. */
4707 return false;
4708 }
4709
4710 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4711 return false;
4712 }
4713
4714 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4715 CVAL(inbuf,smb_wct) != 14) {
4716 DEBUG(10,("is_valid_writeX_buffer: chained or "
4717 "invalid word length.\n"));
4718 return false;
4719 }
4720
4721 fnum = SVAL(inbuf, smb_vwv2);
4722 status = smb1srv_open_lookup(xconn,
4723 fnum,
4724 0, /* now */
4725 &op);
4726 if (!NT_STATUS_IS_OK(status)) {
4727 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4728 return false;
4729 }
4730 fsp = op->compat;
4731 if (fsp == NULL) {
4732 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4733 return false;
4734 }
4735 if (fsp->conn == NULL) {
4736 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4737 return false;
4738 }
4739
4740 if (IS_IPC(fsp->conn)) {
4741 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4742 return false;
4743 }
4744 if (IS_PRINT(fsp->conn)) {
4745 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4746 return false;
4747 }
4748 doff = SVAL(inbuf,smb_vwv11);
4749
4750 numtowrite = SVAL(inbuf,smb_vwv10);
4751
4752 if (len > doff && len - doff > 0xFFFF) {
4753 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4754 }
4755
4756 if (numtowrite == 0) {
4757 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4758 return false;
4759 }
4760
4761 /* Ensure the sizes match up. */
4762 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4763 /* no pad byte...old smbclient :-( */
4764 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4765 (unsigned int)doff,
4766 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4767 return false;
4768 }
4769
4770 if (len - doff != numtowrite) {
4771 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4772 "len = %u, doff = %u, numtowrite = %u\n",
4773 (unsigned int)len,
4774 (unsigned int)doff,
4775 (unsigned int)numtowrite ));
4776 return false;
4777 }
4778
4779 DEBUG(10,("is_valid_writeX_buffer: true "
4780 "len = %u, doff = %u, numtowrite = %u\n",
4781 (unsigned int)len,
4782 (unsigned int)doff,
4783 (unsigned int)numtowrite ));
4784
4785 return true;
4786 }
4787
4788 /****************************************************************************
4789 Reply to a write and X.
4790 ****************************************************************************/
4791
4792 void reply_write_and_X(struct smb_request *req)
4793 {
4794 connection_struct *conn = req->conn;
4795 struct smbXsrv_connection *xconn = req->xconn;
4796 files_struct *fsp;
4797 struct lock_struct lock;
4798 off_t startpos;
4799 size_t numtowrite;
4800 bool write_through;
4801 ssize_t nwritten;
4802 unsigned int smb_doff;
4803 unsigned int smblen;
4804 const char *data;
4805 NTSTATUS status;
4806 int saved_errno = 0;
4807
4808 START_PROFILE(SMBwriteX);
4809
4810 if ((req->wct != 12) && (req->wct != 14)) {
4811 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4812 goto out;
4813 }
4814
4815 numtowrite = SVAL(req->vwv+10, 0);
4816 smb_doff = SVAL(req->vwv+11, 0);
4817 smblen = smb_len(req->inbuf);
4818
4819 if (req->unread_bytes > 0xFFFF ||
4820 (smblen > smb_doff &&
4821 smblen - smb_doff > 0xFFFF)) {
4822 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4823 }
4824
4825 if (req->unread_bytes) {
4826 /* Can't do a recvfile write on IPC$ */
4827 if (IS_IPC(conn)) {
4828 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4829 goto out;
4830 }
4831 if (numtowrite != req->unread_bytes) {
4832 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4833 goto out;
4834 }
4835 } else {
4836 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4837 smb_doff + numtowrite > smblen) {
4838 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4839 goto out;
4840 }
4841 }
4842
4843 /* If it's an IPC, pass off the pipe handler. */
4844 if (IS_IPC(conn)) {
4845 if (req->unread_bytes) {
4846 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4847 goto out;
4848 }
4849 reply_pipe_write_and_X(req);
4850 goto out;
4851 }
4852
4853 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4854 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4855 write_through = BITSETW(req->vwv+7,0);
4856
4857 if (!check_fsp(conn, req, fsp)) {
4858 goto out;
4859 }
4860
4861 if (!CHECK_WRITE(fsp)) {
4862 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4863 goto out;
4864 }
4865
4866 data = smb_base(req->inbuf) + smb_doff;
4867
4868 if(req->wct == 14) {
4869 /*
4870 * This is a large offset (64 bit) write.
4871 */
4872 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4873
4874 }
4875
4876 /* X/Open SMB protocol says that, unlike SMBwrite
4877 if the length is zero then NO truncation is
4878 done, just a write of zero. To truncate a file,
4879 use SMBwrite. */
4880
4881 if(numtowrite == 0) {
4882 nwritten = 0;
4883 } else {
4884 if (req->unread_bytes == 0) {
4885 status = schedule_aio_write_and_X(conn,
4886 req,
4887 fsp,
4888 data,
4889 startpos,
4890 numtowrite);
4891
4892 if (NT_STATUS_IS_OK(status)) {
4893 /* write scheduled - we're done. */
4894 goto out;
4895 }
4896 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4897 /* Real error - report to client. */
4898 reply_nterror(req, status);
4899 goto out;
4900 }
4901 /* NT_STATUS_RETRY - fall through to sync write. */
4902 }
4903
4904 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4905 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4906 &lock);
4907
4908 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4909 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4910 goto out;
4911 }
4912
4913 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4914 saved_errno = errno;
4915
4916 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4917 }
4918
4919 if(nwritten < 0) {
4920 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4921 goto out;
4922 }
4923
4924 if((nwritten == 0) && (numtowrite != 0)) {
4925 reply_nterror(req, NT_STATUS_DISK_FULL);
4926 goto out;
4927 }
4928
4929 reply_outbuf(req, 6, 0);
4930 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4931 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
4932 SSVAL(req->outbuf,smb_vwv2,nwritten);
4933 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4934
4935 DEBUG(3,("writeX %s num=%d wrote=%d\n",
4936 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4937
4938 status = sync_file(conn, fsp, write_through);
4939 if (!NT_STATUS_IS_OK(status)) {
4940 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4941 fsp_str_dbg(fsp), nt_errstr(status)));
4942 reply_nterror(req, status);
4943 goto out;
4944 }
4945
4946 END_PROFILE(SMBwriteX);
4947 return;
4948
4949 out:
4950 if (req->unread_bytes) {
4951 /* writeX failed. drain socket. */
4952 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
4953 req->unread_bytes) {
4954 smb_panic("failed to drain pending bytes");
4955 }
4956 req->unread_bytes = 0;
4957 }
4958
4959 END_PROFILE(SMBwriteX);
4960 return;
4961 }
4962
4963 /****************************************************************************
4964 Reply to a lseek.
4965 ****************************************************************************/
4966
4967 void reply_lseek(struct smb_request *req)
4968 {
4969 connection_struct *conn = req->conn;
4970 off_t startpos;
4971 off_t res= -1;
4972 int mode,umode;
4973 files_struct *fsp;
4974
4975 START_PROFILE(SMBlseek);
4976
4977 if (req->wct < 4) {
4978 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4979 END_PROFILE(SMBlseek);
4980 return;
4981 }
4982
4983 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4984
4985 if (!check_fsp(conn, req, fsp)) {
4986 return;
4987 }
4988
4989 flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4990
4991 mode = SVAL(req->vwv+1, 0) & 3;
4992 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4993 startpos = (off_t)IVALS(req->vwv+2, 0);
4994
4995 switch (mode) {
4996 case 0:
4997 umode = SEEK_SET;
4998 res = startpos;
4999 break;
5000 case 1:
5001 umode = SEEK_CUR;
5002 res = fsp->fh->pos + startpos;
5003 break;
5004 case 2:
5005 umode = SEEK_END;
5006 break;
5007 default:
5008 umode = SEEK_SET;
5009 res = startpos;
5010 break;
5011 }
5012
5013 if (umode == SEEK_END) {
5014 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
5015 if(errno == EINVAL) {
5016 off_t current_pos = startpos;
5017
5018 if(fsp_stat(fsp) == -1) {
5019 reply_nterror(req,
5020 map_nt_error_from_unix(errno));
5021 END_PROFILE(SMBlseek);
5022 return;
5023 }
5024
5025 current_pos += fsp->fsp_name->st.st_ex_size;
5026 if(current_pos < 0)
5027 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
5028 }
5029 }
5030
5031 if(res == -1) {
5032 reply_nterror(req, map_nt_error_from_unix(errno));
5033 END_PROFILE(SMBlseek);
5034 return;
5035 }
5036 }
5037
5038 fsp->fh->pos = res;
5039
5040 reply_outbuf(req, 2, 0);
5041 SIVAL(req->outbuf,smb_vwv0,res);
5042
5043 DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
5044 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
5045
5046 END_PROFILE(SMBlseek);
5047 return;
5048 }
5049
5050 /****************************************************************************
5051 Reply to a flush.
5052 ****************************************************************************/
5053
5054 void reply_flush(struct smb_request *req)
5055 {
5056 connection_struct *conn = req->conn;
5057 uint16 fnum;
5058 files_struct *fsp;
5059
5060 START_PROFILE(SMBflush);
5061
5062 if (req->wct < 1) {
5063 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5064 return;
5065 }
5066
5067 fnum = SVAL(req->vwv+0, 0);
5068 fsp = file_fsp(req, fnum);
5069
5070 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5071 return;
5072 }
5073
5074 if (!fsp) {
5075 file_sync_all(conn);
5076 } else {
5077 NTSTATUS status = sync_file(conn, fsp, True);
5078 if (!NT_STATUS_IS_OK(status)) {
5079 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5080 fsp_str_dbg(fsp), nt_errstr(status)));
5081 reply_nterror(req, status);
5082 END_PROFILE(SMBflush);
5083 return;
5084 }
5085 }
5086
5087 reply_outbuf(req, 0, 0);
5088
5089 DEBUG(3,("flush\n"));
5090 END_PROFILE(SMBflush);
5091 return;
5092 }
5093
5094 /****************************************************************************
5095 Reply to a exit.
5096 conn POINTER CAN BE NULL HERE !
5097 ****************************************************************************/
5098
5099 void reply_exit(struct smb_request *req)
5100 {
5101 START_PROFILE(SMBexit);
5102
5103 file_close_pid(req->sconn, req->smbpid, req->vuid);
5104
5105 reply_outbuf(req, 0, 0);
5106
5107 DEBUG(3,("exit\n"));
5108
5109 END_PROFILE(SMBexit);
5110 return;
5111 }
5112
5113 struct reply_close_state {
5114 files_struct *fsp;
5115 struct smb_request *smbreq;
5116 };
5117
5118 static void do_smb1_close(struct tevent_req *req);
5119
5120 void reply_close(struct smb_request *req)
5121 {
5122 connection_struct *conn = req->conn;
5123 NTSTATUS status = NT_STATUS_OK;
5124 files_struct *fsp = NULL;
5125 START_PROFILE(SMBclose);
5126
5127 if (req->wct < 3) {
5128 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5129 END_PROFILE(SMBclose);
5130 return;
5131 }
5132
5133 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5134
5135 /*
5136 * We can only use check_fsp if we know it's not a directory.
5137 */
5138
5139 if (!check_fsp_open(conn, req, fsp)) {
5140 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5141 END_PROFILE(SMBclose);
5142 return;
5143 }
5144
5145 DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5146 fsp->is_directory ? "directory" : "file",
5147 fsp->fh->fd, fsp_fnum_dbg(fsp),
5148 conn->num_files_open));
5149
5150 if (!fsp->is_directory) {
5151 time_t t;
5152
5153 /*
5154 * Take care of any time sent in the close.
5155 */
5156
5157 t = srv_make_unix_date3(req->vwv+1);
5158 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5159 }
5160
5161 if (fsp->num_aio_requests != 0) {
5162
5163 struct reply_close_state *state;
5164
5165 DEBUG(10, ("closing with aio %u requests pending\n",
5166 fsp->num_aio_requests));
5167
5168 /*
5169 * We depend on the aio_extra destructor to take care of this
5170 * close request once fsp->num_aio_request drops to 0.
5171 */
5172
5173 fsp->deferred_close = tevent_wait_send(
5174 fsp, fsp->conn->sconn->ev_ctx);
5175 if (fsp->deferred_close == NULL) {
5176 status = NT_STATUS_NO_MEMORY;
5177 goto done;
5178 }
5179
5180 state = talloc(fsp, struct reply_close_state);
5181 if (state == NULL) {
5182 TALLOC_FREE(fsp->deferred_close);
5183 status = NT_STATUS_NO_MEMORY;
5184 goto done;
5185 }
5186 state->fsp = fsp;
5187 state->smbreq = talloc_move(fsp, &req);
5188 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5189 state);
5190 END_PROFILE(SMBclose);
5191 return;
5192 }
5193
5194 /*
5195 * close_file() returns the unix errno if an error was detected on
5196 * close - normally this is due to a disk full error. If not then it
5197 * was probably an I/O error.
5198 */
5199
5200 status = close_file(req, fsp, NORMAL_CLOSE);
5201 done:
5202 if (!NT_STATUS_IS_OK(status)) {
5203 reply_nterror(req, status);
5204 END_PROFILE(SMBclose);
5205 return;
5206 }
5207
5208 reply_outbuf(req, 0, 0);
5209 END_PROFILE(SMBclose);
5210 return;
5211 }
5212
5213 static void do_smb1_close(struct tevent_req *req)
5214 {
5215 struct reply_close_state *state = tevent_req_callback_data(
5216 req, struct reply_close_state);
5217 struct smb_request *smbreq;
5218 NTSTATUS status;
5219 int ret;
5220
5221 ret = tevent_wait_recv(req);
5222 TALLOC_FREE(req);
5223 if (ret != 0) {
5224 DEBUG(10, ("tevent_wait_recv returned %s\n",
5225 strerror(ret)));
5226 /*
5227 * Continue anyway, this should never happen
5228 */
5229 }
5230
5231 /*
5232 * fsp->smb2_close_request right now is a talloc grandchild of
5233 * fsp. When we close_file(fsp), it would go with it. No chance to
5234 * reply...
5235 */
5236 smbreq = talloc_move(talloc_tos(), &state->smbreq);
5237
5238 status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5239 if (NT_STATUS_IS_OK(status)) {
5240 reply_outbuf(smbreq, 0, 0);
5241 } else {
5242 reply_nterror(smbreq, status);
5243 }
5244 if (!srv_send_smb(smbreq->xconn,
5245 (char *)smbreq->outbuf,
5246 true,
5247 smbreq->seqnum+1,
5248 IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5249 NULL)) {
5250 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5251 "failed.");
5252 }
5253 TALLOC_FREE(smbreq);
5254 }
5255
5256 /****************************************************************************
5257 Reply to a writeclose (Core+ protocol).
5258 ****************************************************************************/
5259
5260 void reply_writeclose(struct smb_request *req)
5261 {
5262 connection_struct *conn = req->conn;
5263 size_t numtowrite;
5264 ssize_t nwritten = -1;
5265 NTSTATUS close_status = NT_STATUS_OK;
5266 off_t startpos;
5267 const char *data;
5268 struct timespec mtime;
5269 files_struct *fsp;
5270 struct lock_struct lock;
5271
5272 START_PROFILE(SMBwriteclose);
5273
5274 if (req->wct < 6) {
5275 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5276 END_PROFILE(SMBwriteclose);
5277 return;
5278 }
5279
5280 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5281
5282 if (!check_fsp(conn, req, fsp)) {
5283 END_PROFILE(SMBwriteclose);
5284 return;
5285 }
5286 if (!CHECK_WRITE(fsp)) {
5287 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5288 END_PROFILE(SMBwriteclose);
5289 return;
5290 }
5291
5292 numtowrite = SVAL(req->vwv+1, 0);
5293 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5294 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5295 data = (const char *)req->buf + 1;
5296
5297 if (fsp->print_file == NULL) {
5298 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5299 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5300 &lock);
5301
5302 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5303 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5304 END_PROFILE(SMBwriteclose);
5305 return;
5306 }
5307 }
5308
5309 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5310
5311 if (fsp->print_file == NULL) {
5312 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5313 }
5314
5315 set_close_write_time(fsp, mtime);
5316
5317 /*
5318 * More insanity. W2K only closes the file if writelen > 0.
5319 * JRA.
5320 */
5321
5322 DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5323 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5324 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5325
5326 if (numtowrite) {
5327 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5328 "file %s\n", fsp_str_dbg(fsp)));
5329 close_status = close_file(req, fsp, NORMAL_CLOSE);
5330 fsp = NULL;
5331 }
5332
5333 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5334 reply_nterror(req, NT_STATUS_DISK_FULL);
5335 goto out;
5336 }
5337
5338 if(!NT_STATUS_IS_OK(close_status)) {
5339 reply_nterror(req, close_status);
5340 goto out;
5341 }
5342
5343 reply_outbuf(req, 1, 0);
5344
5345 SSVAL(req->outbuf,smb_vwv0,nwritten);
5346
5347 out:
5348
5349 END_PROFILE(SMBwriteclose);
5350 return;
5351 }
5352
5353 #undef DBGC_CLASS
5354 #define DBGC_CLASS DBGC_LOCKING
5355
5356 /****************************************************************************
5357 Reply to a lock.
5358 ****************************************************************************/
5359
5360 void reply_lock(struct smb_request *req)
5361 {
5362 connection_struct *conn = req->conn;
5363 uint64_t count,offset;
5364 NTSTATUS status;
5365 files_struct *fsp;
5366 struct byte_range_lock *br_lck = NULL;
5367
5368 START_PROFILE(SMBlock);
5369
5370 if (req->wct < 5) {
5371 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5372 END_PROFILE(SMBlock);
5373 return;
5374 }
5375
5376 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5377
5378 if (!check_fsp(conn, req, fsp)) {
5379 END_PROFILE(SMBlock);
5380 return;
5381 }
5382
5383 count = (uint64_t)IVAL(req->vwv+1, 0);
5384 offset = (uint64_t)IVAL(req->vwv+3, 0);
5385
5386 DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5387 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5388
5389 br_lck = do_lock(req->sconn->msg_ctx,
5390 fsp,
5391 (uint64_t)req->smbpid,
5392 count,
5393 offset,
5394 WRITE_LOCK,
5395 WINDOWS_LOCK,
5396 False, /* Non-blocking lock. */
5397 &status,
5398 NULL);
5399
5400 TALLOC_FREE(br_lck);
5401
5402 if (NT_STATUS_V(status)) {
5403 reply_nterror(req, status);
5404 END_PROFILE(SMBlock);
5405 return;
5406 }
5407
5408 reply_outbuf(req, 0, 0);
5409
5410 END_PROFILE(SMBlock);
5411 return;
5412 }
5413
5414 /****************************************************************************
5415 Reply to a unlock.
5416 ****************************************************************************/
5417
5418 void reply_unlock(struct smb_request *req)
5419 {
5420 connection_struct *conn = req->conn;
5421 uint64_t count,offset;
5422 NTSTATUS status;
5423 files_struct *fsp;
5424
5425 START_PROFILE(SMBunlock);
5426
5427 if (req->wct < 5) {
5428 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5429 END_PROFILE(SMBunlock);
5430 return;
5431 }
5432
5433 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5434
5435 if (!check_fsp(conn, req, fsp)) {
5436 END_PROFILE(SMBunlock);
5437 return;
5438 }
5439
5440 count = (uint64_t)IVAL(req->vwv+1, 0);
5441 offset = (uint64_t)IVAL(req->vwv+3, 0);
5442
5443 status = do_unlock(req->sconn->msg_ctx,
5444 fsp,
5445 (uint64_t)req->smbpid,
5446 count,
5447 offset,
5448 WINDOWS_LOCK);
5449
5450 if (NT_STATUS_V(status)) {
5451 reply_nterror(req, status);
5452 END_PROFILE(SMBunlock);
5453 return;
5454 }
5455
5456 DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5457 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5458
5459 reply_outbuf(req, 0, 0);
5460
5461 END_PROFILE(SMBunlock);
5462 return;
5463 }
5464
5465 #undef DBGC_CLASS
5466 #define DBGC_CLASS DBGC_ALL
5467
5468 /****************************************************************************
5469 Reply to a tdis.
5470 conn POINTER CAN BE NULL HERE !
5471 ****************************************************************************/
5472
5473 void reply_tdis(struct smb_request *req)
5474 {
5475 NTSTATUS status;
5476 connection_struct *conn = req->conn;
5477 struct smbXsrv_tcon *tcon;
5478
5479 START_PROFILE(SMBtdis);
5480
5481 if (!conn) {
5482 DEBUG(4,("Invalid connection in tdis\n"));
5483 reply_force_doserror(req, ERRSRV, ERRinvnid);
5484 END_PROFILE(SMBtdis);
5485 return;
5486 }
5487
5488 tcon = conn->tcon;
5489 req->conn = NULL;
5490
5491 /*
5492 * TODO: cancel all outstanding requests on the tcon
5493 */
5494 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5495 if (!NT_STATUS_IS_OK(status)) {
5496 DEBUG(0, ("reply_tdis: "
5497 "smbXsrv_tcon_disconnect() failed: %s\n",
5498 nt_errstr(status)));
5499 /*
5500 * If we hit this case, there is something completely
5501 * wrong, so we better disconnect the transport connection.
5502 */
5503 END_PROFILE(SMBtdis);
5504 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5505 return;
5506 }
5507
5508 TALLOC_FREE(tcon);
5509
5510 reply_outbuf(req, 0, 0);
5511 END_PROFILE(SMBtdis);
5512 return;
5513 }
5514
5515 /****************************************************************************
5516 Reply to a echo.
5517 conn POINTER CAN BE NULL HERE !
5518 ****************************************************************************/
5519
5520 void reply_echo(struct smb_request *req)
5521 {
5522 connection_struct *conn = req->conn;
5523 struct smb_perfcount_data local_pcd;
5524 struct smb_perfcount_data *cur_pcd;
5525 int smb_reverb;
5526 int seq_num;
5527
5528 START_PROFILE(SMBecho);
5529
5530 smb_init_perfcount_data(&local_pcd);
5531
5532 if (req->wct < 1) {
5533 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5534 END_PROFILE(SMBecho);
5535 return;
5536 }
5537
5538 smb_reverb = SVAL(req->vwv+0, 0);
5539
5540 reply_outbuf(req, 1, req->buflen);
5541
5542 /* copy any incoming data back out */
5543 if (req->buflen > 0) {
5544 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5545 }
5546
5547 if (smb_reverb > 100) {
5548 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5549 smb_reverb = 100;
5550 }
5551
5552 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5553
5554 /* this makes sure we catch the request pcd */
5555 if (seq_num == smb_reverb) {
5556 cur_pcd = &req->pcd;
5557 } else {
5558 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5559 cur_pcd = &local_pcd;
5560 }
5561
5562 SSVAL(req->outbuf,smb_vwv0,seq_num);
5563
5564 show_msg((char *)req->outbuf);
5565 if (!srv_send_smb(req->xconn,
5566 (char *)req->outbuf,
5567 true, req->seqnum+1,
5568 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5569 cur_pcd))
5570 exit_server_cleanly("reply_echo: srv_send_smb failed.");
5571 }
5572
5573 DEBUG(3,("echo %d times\n", smb_reverb));
5574
5575 TALLOC_FREE(req->outbuf);
5576
5577 END_PROFILE(SMBecho);
5578 return;
5579 }
5580
5581 /****************************************************************************
5582 Reply to a printopen.
5583 ****************************************************************************/
5584
5585 void reply_printopen(struct smb_request *req)
5586 {
5587 connection_struct *conn = req->conn;
5588 files_struct *fsp;
5589 NTSTATUS status;
5590
5591 START_PROFILE(SMBsplopen);
5592
5593 if (req->wct < 2) {
5594 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5595 END_PROFILE(SMBsplopen);
5596 return;
5597 }
5598
5599 if (!CAN_PRINT(conn)) {
5600 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5601 END_PROFILE(SMBsplopen);
5602 return;
5603 }
5604
5605 status = file_new(req, conn, &fsp);
5606 if(!NT_STATUS_IS_OK(status)) {
5607 reply_nterror(req, status);
5608 END_PROFILE(SMBsplopen);
5609 return;
5610 }
5611
5612 /* Open for exclusive use, write only. */
5613 status = print_spool_open(fsp, NULL, req->vuid);
5614
5615 if (!NT_STATUS_IS_OK(status)) {
5616 file_free(req, fsp);
5617 reply_nterror(req, status);
5618 END_PROFILE(SMBsplopen);
5619 return;
5620 }
5621
5622 reply_outbuf(req, 1, 0);
5623 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5624
5625 DEBUG(3,("openprint fd=%d %s\n",
5626 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5627
5628 END_PROFILE(SMBsplopen);
5629 return;
5630 }
5631
5632 /****************************************************************************
5633 Reply to a printclose.
5634 ****************************************************************************/
5635
5636 void reply_printclose(struct smb_request *req)
5637 {
5638 connection_struct *conn = req->conn;
5639 files_struct *fsp;
5640 NTSTATUS status;
5641
5642 START_PROFILE(SMBsplclose);
5643
5644 if (req->wct < 1) {
5645 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5646 END_PROFILE(SMBsplclose);
5647 return;
5648 }
5649
5650 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5651
5652 if (!check_fsp(conn, req, fsp)) {
5653 END_PROFILE(SMBsplclose);
5654 return;
5655 }
5656
5657 if (!CAN_PRINT(conn)) {
5658 reply_force_doserror(req, ERRSRV, ERRerror);
5659 END_PROFILE(SMBsplclose);
5660 return;
5661 }
5662
5663 DEBUG(3,("printclose fd=%d %s\n",
5664 fsp->fh->fd, fsp_fnum_dbg(fsp)));
5665
5666 status = close_file(req, fsp, NORMAL_CLOSE);
5667
5668 if(!NT_STATUS_IS_OK(status)) {
5669 reply_nterror(req, status);
5670 END_PROFILE(SMBsplclose);
5671 return;
5672 }
5673
5674 reply_outbuf(req, 0, 0);
5675
5676 END_PROFILE(SMBsplclose);
5677 return;
5678 }
5679
5680 /****************************************************************************
5681 Reply to a printqueue.
5682 ****************************************************************************/
5683
5684 void reply_printqueue(struct smb_request *req)
5685 {
5686 connection_struct *conn = req->conn;
5687 int max_count;
5688 int start_index;
5689
5690 START_PROFILE(SMBsplretq);
5691
5692 if (req->wct < 2) {
5693 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5694 END_PROFILE(SMBsplretq);
5695 return;
5696 }
5697
5698 max_count = SVAL(req->vwv+0, 0);
5699 start_index = SVAL(req->vwv+1, 0);
5700
5701 /* we used to allow the client to get the cnum wrong, but that
5702 is really quite gross and only worked when there was only
5703 one printer - I think we should now only accept it if they
5704 get it right (tridge) */
5705 if (!CAN_PRINT(conn)) {
5706 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5707 END_PROFILE(SMBsplretq);
5708 return;
5709 }
5710
5711 reply_outbuf(req, 2, 3);
5712 SSVAL(req->outbuf,smb_vwv0,0);
5713 SSVAL(req->outbuf,smb_vwv1,0);
5714 SCVAL(smb_buf(req->outbuf),0,1);
5715 SSVAL(smb_buf(req->outbuf),1,0);
5716
5717 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5718 start_index, max_count));
5719
5720 {
5721 TALLOC_CTX *mem_ctx = talloc_tos();
5722 NTSTATUS status;
5723 WERROR werr;
5724 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5725 struct rpc_pipe_client *cli = NULL;
5726 struct dcerpc_binding_handle *b = NULL;
5727 struct policy_handle handle;
5728 struct spoolss_DevmodeContainer devmode_ctr;
5729 union spoolss_JobInfo *info;
5730 uint32_t count;
5731 uint32_t num_to_get;
5732 uint32_t first;
5733 uint32_t i;
5734
5735 ZERO_STRUCT(handle);
5736
5737 status = rpc_pipe_open_interface(conn,
5738 &ndr_table_spoolss,
5739 conn->session_info,
5740 conn->sconn->remote_address,
5741 conn->sconn->msg_ctx,
5742 &cli);
5743 if (!NT_STATUS_IS_OK(status)) {
5744 DEBUG(0, ("reply_printqueue: "
5745 "could not connect to spoolss: %s\n",
5746 nt_errstr(status)));
5747 reply_nterror(req, status);
5748 goto out;
5749 }
5750 b = cli->binding_handle;
5751
5752 ZERO_STRUCT(devmode_ctr);
5753
5754 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5755 sharename,
5756 NULL, devmode_ctr,
5757 SEC_FLAG_MAXIMUM_ALLOWED,
5758 &handle,
5759 &werr);
5760 if (!NT_STATUS_IS_OK(status)) {
5761 reply_nterror(req, status);
5762 goto out;
5763 }
5764 if (!W_ERROR_IS_OK(werr)) {
5765 reply_nterror(req, werror_to_ntstatus(werr));
5766 goto out;
5767 }
5768
5769 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5770 &handle,
5771 0, /* firstjob */
5772 0xff, /* numjobs */
5773 2, /* level */
5774 0, /* offered */
5775 &count,
5776 &info);
5777 if (!W_ERROR_IS_OK(werr)) {
5778 reply_nterror(req, werror_to_ntstatus(werr));
5779 goto out;
5780 }
5781
5782 if (max_count > 0) {
5783 first = start_index;
5784 } else {
5785 first = start_index + max_count + 1;
5786 }
5787
5788 if (first >= count) {
5789 num_to_get = first;
5790 } else {
5791 num_to_get = first + MIN(ABS(max_count), count - first);
5792 }
5793
5794 for (i = first; i < num_to_get; i++) {
5795 char blob[28];
5796 char *p = blob;
5797 time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5798 int qstatus;
5799 size_t len = 0;
5800 uint16_t qrapjobid = pjobid_to_rap(sharename,
5801 info[i].info2.job_id);
5802
5803 if (info[i].info2.status == JOB_STATUS_PRINTING) {
5804 qstatus = 2;
5805 } else {
5806 qstatus = 3;
5807 }
5808
5809 srv_put_dos_date2(p, 0, qtime);
5810 SCVAL(p, 4, qstatus);
5811 SSVAL(p, 5, qrapjobid);
5812 SIVAL(p, 7, info[i].info2.size);
5813 SCVAL(p, 11, 0);
5814 status = srvstr_push(blob, req->flags2, p+12,
5815 info[i].info2.notify_name, 16, STR_ASCII, &len);
5816 if (!NT_STATUS_IS_OK(status)) {
5817 reply_nterror(req, status);
5818 goto out;
5819 }
5820 if (message_push_blob(
5821 &req->outbuf,
5822 data_blob_const(
5823 blob, sizeof(blob))) == -1) {
5824 reply_nterror(req, NT_STATUS_NO_MEMORY);
5825 goto out;
5826 }
5827 }
5828
5829 if (count > 0) {
5830 SSVAL(req->outbuf,smb_vwv0,count);
5831 SSVAL(req->outbuf,smb_vwv1,
5832 (max_count>0?first+count:first-1));
5833 SCVAL(smb_buf(req->outbuf),0,1);
5834 SSVAL(smb_buf(req->outbuf),1,28*count);
5835 }
5836
5837
5838 DEBUG(3, ("%u entries returned in queue\n",
5839 (unsigned)count));
5840
5841 out:
5842 if (b && is_valid_policy_hnd(&handle)) {
5843 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5844 }
5845
5846 }
5847
5848 END_PROFILE(SMBsplretq);
5849 return;
5850 }
5851
5852 /****************************************************************************
5853 Reply to a printwrite.
5854 ****************************************************************************/
5855
5856 void reply_printwrite(struct smb_request *req)
5857 {
5858 connection_struct *conn = req->conn;
5859 int numtowrite;
5860 const char *data;
5861 files_struct *fsp;
5862
5863 START_PROFILE(SMBsplwr);
5864
5865 if (req->wct < 1) {
5866 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5867 END_PROFILE(SMBsplwr);
5868 return;
5869 }
5870
5871 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5872
5873 if (!check_fsp(conn, req, fsp)) {
5874 END_PROFILE(SMBsplwr);
5875 return;
5876 }
5877
5878 if (!fsp->print_file) {
5879 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5880 END_PROFILE(SMBsplwr);
5881 return;
5882 }
5883
5884 if (!CHECK_WRITE(fsp)) {
5885 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5886 END_PROFILE(SMBsplwr);
5887 return;
5888 }
5889
5890 numtowrite = SVAL(req->buf, 1);
5891
5892 if (req->buflen < numtowrite + 3) {
5893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5894 END_PROFILE(SMBsplwr);
5895 return;
5896 }
5897
5898 data = (const char *)req->buf + 3;
5899
5900 if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5901 reply_nterror(req, map_nt_error_from_unix(errno));
5902 END_PROFILE(SMBsplwr);
5903 return;
5904 }
5905
5906 DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5907
5908 END_PROFILE(SMBsplwr);
5909 return;
5910 }
5911
5912 /****************************************************************************
5913 Reply to a mkdir.
5914 ****************************************************************************/
5915
5916 void reply_mkdir(struct smb_request *req)
5917 {
5918 connection_struct *conn = req->conn;
5919 struct smb_filename *smb_dname = NULL;
5920 char *directory = NULL;
5921 NTSTATUS status;
5922 TALLOC_CTX *ctx = talloc_tos();
5923
5924 START_PROFILE(SMBmkdir);
5925
5926 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5927 STR_TERMINATE, &status);
5928 if (!NT_STATUS_IS_OK(status)) {
5929 reply_nterror(req, status);
5930 goto out;
5931 }
5932
5933 status = filename_convert(ctx, conn,
5934 req->flags2 & FLAGS2_DFS_PATHNAMES,
5935 directory,
5936 UCF_PREP_CREATEFILE,
5937 NULL,
5938 &smb_dname);
5939 if (!NT_STATUS_IS_OK(status)) {
5940 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5941 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5942 ERRSRV, ERRbadpath);
5943 goto out;
5944 }
5945 reply_nterror(req, status);
5946 goto out;
5947 }
5948
5949 status = create_directory(conn, req, smb_dname);
5950
5951 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5952
5953 if (!NT_STATUS_IS_OK(status)) {
5954
5955 if (!use_nt_status()
5956 && NT_STATUS_EQUAL(status,
5957 NT_STATUS_OBJECT_NAME_COLLISION)) {
5958 /*
5959 * Yes, in the DOS error code case we get a
5960 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5961 * samba4 torture test.
5962 */
5963 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5964 }
5965
5966 reply_nterror(req, status);
5967 goto out;
5968 }
5969
5970 reply_outbuf(req, 0, 0);
5971
5972 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5973 out:
5974 TALLOC_FREE(smb_dname);
5975 END_PROFILE(SMBmkdir);
5976 return;
5977 }
5978
5979 /****************************************************************************
5980 Reply to a rmdir.
5981 ****************************************************************************/
5982
5983 void reply_rmdir(struct smb_request *req)
5984 {
5985 connection_struct *conn = req->conn;
5986 struct smb_filename *smb_dname = NULL;
5987 char *directory = NULL;
5988 NTSTATUS status;
5989 TALLOC_CTX *ctx = talloc_tos();
5990 files_struct *fsp = NULL;
5991 int info = 0;
5992 struct smbd_server_connection *sconn = req->sconn;
5993
5994 START_PROFILE(SMBrmdir);
5995
5996 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5997 STR_TERMINATE, &status);
5998 if (!NT_STATUS_IS_OK(status)) {
5999 reply_nterror(req, status);
6000 goto out;
6001 }
6002
6003 status = filename_convert(ctx, conn,
6004 req->flags2 & FLAGS2_DFS_PATHNAMES,
6005 directory,
6006 0,
6007 NULL,
6008 &smb_dname);
6009 if (!NT_STATUS_IS_OK(status)) {
6010 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6011 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6012 ERRSRV, ERRbadpath);
6013 goto out;
6014 }
6015 reply_nterror(req, status);
6016 goto out;
6017 }
6018
6019 if (is_ntfs_stream_smb_fname(smb_dname)) {
6020 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
6021 goto out;
6022 }
6023
6024 status = SMB_VFS_CREATE_FILE(
6025 conn, /* conn */
6026 req, /* req */
6027 0, /* root_dir_fid */
6028 smb_dname, /* fname */
6029 DELETE_ACCESS, /* access_mask */
6030 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
6031 FILE_SHARE_DELETE),
6032 FILE_OPEN, /* create_disposition*/
6033 FILE_DIRECTORY_FILE, /* create_options */
6034 FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
6035 0, /* oplock_request */
6036 NULL, /* lease */
6037 0, /* allocation_size */
6038 0, /* private_flags */
6039 NULL, /* sd */
6040 NULL, /* ea_list */
6041 &fsp, /* result */
6042 &info); /* pinfo */
6043
6044 if (!NT_STATUS_IS_OK(status)) {
6045 if (open_was_deferred(req->xconn, req->mid)) {
6046 /* We have re-scheduled this call. */
6047 goto out;
6048 }
6049 reply_nterror(req, status);
6050 goto out;
6051 }
6052
6053 status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
6054 if (!NT_STATUS_IS_OK(status)) {
6055 close_file(req, fsp, ERROR_CLOSE);
6056 reply_nterror(req, status);
6057 goto out;
6058 }
6059
6060 if (!set_delete_on_close(fsp, true,
6061 conn->session_info->security_token,
6062 conn->session_info->unix_token)) {
6063 close_file(req, fsp, ERROR_CLOSE);
6064 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6065 goto out;
6066 }
6067
6068 status = close_file(req, fsp, NORMAL_CLOSE);
6069 if (!NT_STATUS_IS_OK(status)) {
6070 reply_nterror(req, status);
6071 } else {
6072 reply_outbuf(req, 0, 0);
6073 }
6074
6075 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6076
6077 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6078 out:
6079 TALLOC_FREE(smb_dname);
6080 END_PROFILE(SMBrmdir);
6081 return;
6082 }
6083
6084 /*******************************************************************
6085 Resolve wildcards in a filename rename.
6086 ********************************************************************/
6087
6088 static bool resolve_wildcards(TALLOC_CTX *ctx,
6089 const char *name1,
6090 const char *name2,
6091 char **pp_newname)
6092 {
6093 char *name2_copy = NULL;
6094 char *root1 = NULL;
6095 char *root2 = NULL;
6096 char *ext1 = NULL;
6097 char *ext2 = NULL;
6098 char *p,*p2, *pname1, *pname2;
6099
6100 name2_copy = talloc_strdup(ctx, name2);
6101 if (!name2_copy) {
6102 return False;
6103 }
6104
6105 pname1 = strrchr_m(name1,'/');
6106 pname2 = strrchr_m(name2_copy,'/');
6107
6108 if (!pname1 || !pname2) {
6109 return False;
6110 }
6111
6112 /* Truncate the copy of name2 at the last '/' */
6113 *pname2 = '\0';
6114
6115 /* Now go past the '/' */
6116 pname1++;
6117 pname2++;
6118
6119 root1 = talloc_strdup(ctx, pname1);
6120 root2 = talloc_strdup(ctx, pname2);
6121
6122 if (!root1 || !root2) {
6123 return False;
6124 }
6125
6126 p = strrchr_m(root1,'.');
6127 if (p) {
6128 *p = 0;
6129 ext1 = talloc_strdup(ctx, p+1);
6130 } else {
6131 ext1 = talloc_strdup(ctx, "");
6132 }
6133 p = strrchr_m(root2,'.');
6134 if (p) {
6135 *p = 0;
6136 ext2 = talloc_strdup(ctx, p+1);
6137 } else {
6138 ext2 = talloc_strdup(ctx, "");
6139 }
6140
6141 if (!ext1 || !ext2) {
6142 return False;
6143 }
6144
6145 p = root1;
6146 p2 = root2;
6147 while (*p2) {
6148 if (*p2 == '?') {
6149 /* Hmmm. Should this be mb-aware ? */
6150 *p2 = *p;
6151 p2++;
6152 } else if (*p2 == '*') {
6153 *p2 = '\0';
6154 root2 = talloc_asprintf(ctx, "%s%s",
6155 root2,
6156 p);
6157 if (!root2) {
6158 return False;
6159 }
6160 break;
6161 } else {
6162 p2++;
6163 }
6164 if (*p) {
6165 p++;
6166 }
6167 }
6168
6169 p = ext1;
6170 p2 = ext2;
6171 while (*p2) {
6172 if (*p2 == '?') {
6173 /* Hmmm. Should this be mb-aware ? */
6174 *p2 = *p;
6175 p2++;
6176 } else if (*p2 == '*') {
6177 *p2 = '\0';
6178 ext2 = talloc_asprintf(ctx, "%s%s",
6179 ext2,
6180 p);
6181 if (!ext2) {
6182 return False;
6183 }
6184 break;
6185 } else {
6186 p2++;
6187 }
6188 if (*p) {
6189 p++;
6190 }
6191 }
6192
6193 if (*ext2) {
6194 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6195 name2_copy,
6196 root2,
6197 ext2);
6198 } else {
6199 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6200 name2_copy,
6201 root2);
6202 }
6203
6204 if (!*pp_newname) {
6205 return False;
6206 }
6207
6208 return True;
6209 }
6210
6211 /****************************************************************************
6212 Ensure open files have their names updated. Updated to notify other smbd's
6213 asynchronously.
6214 ****************************************************************************/
6215
6216 static void rename_open_files(connection_struct *conn,
6217 struct share_mode_lock *lck,
6218 struct file_id id,
6219 uint32_t orig_name_hash,
6220 const struct smb_filename *smb_fname_dst)
6221 {
6222 files_struct *fsp;
6223 bool did_rename = False;
6224 NTSTATUS status;
6225 uint32_t new_name_hash = 0;
6226
6227 for(fsp = file_find_di_first(conn->sconn, id); fsp;
6228 fsp = file_find_di_next(fsp)) {
6229 /* fsp_name is a relative path under the fsp. To change this for other
6230 sharepaths we need to manipulate relative paths. */
6231 /* TODO - create the absolute path and manipulate the newname
6232 relative to the sharepath. */
6233 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6234 continue;
6235 }
6236 if (fsp->name_hash != orig_name_hash) {
6237 continue;
6238 }
6239 DEBUG(10, ("rename_open_files: renaming file %s "
6240 "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6241 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6242 smb_fname_str_dbg(smb_fname_dst)));
6243
6244 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6245 if (NT_STATUS_IS_OK(status)) {
6246 did_rename = True;
6247 new_name_hash = fsp->name_hash;
6248 }
6249 }
6250
6251 if (!did_rename) {
6252 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6253 "for %s\n", file_id_string_tos(&id),
6254 smb_fname_str_dbg(smb_fname_dst)));
6255 }
6256
6257 /* Send messages to all smbd's (not ourself) that the name has changed. */
6258 rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6259 orig_name_hash, new_name_hash,
6260 smb_fname_dst);
6261
6262 }
6263
6264 /****************************************************************************
6265 We need to check if the source path is a parent directory of the destination
6266 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6267 refuse the rename with a sharing violation. Under UNIX the above call can
6268 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6269 probably need to check that the client is a Windows one before disallowing
6270 this as a UNIX client (one with UNIX extensions) can know the source is a
6271 symlink and make this decision intelligently. Found by an excellent bug
6272 report from <AndyLiebman@aol.com>.
6273 ****************************************************************************/
6274
6275 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6276 const struct smb_filename *smb_fname_dst)
6277 {
6278 const char *psrc = smb_fname_src->base_name;
6279 const char *pdst = smb_fname_dst->base_name;
6280 size_t slen;
6281
6282 if (psrc[0] == '.' && psrc[1] == '/') {
6283 psrc += 2;
6284 }
6285 if (pdst[0] == '.' && pdst[1] == '/') {
6286 pdst += 2;
6287 }
6288 if ((slen = strlen(psrc)) > strlen(pdst)) {
6289 return False;
6290 }
6291 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6292 }
6293
6294 /*
6295 * Do the notify calls from a rename
6296 */
6297
6298 static void notify_rename(connection_struct *conn, bool is_dir,
6299 const struct smb_filename *smb_fname_src,
6300 const struct smb_filename *smb_fname_dst)
6301 {
6302 char *parent_dir_src = NULL;
6303 char *parent_dir_dst = NULL;
6304 uint32 mask;
6305
6306 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6307 : FILE_NOTIFY_CHANGE_FILE_NAME;
6308
6309 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6310 &parent_dir_src, NULL) ||
6311 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6312 &parent_dir_dst, NULL)) {
6313 goto out;
6314 }
6315
6316 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6317 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6318 smb_fname_src->base_name);
6319 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6320 smb_fname_dst->base_name);
6321 }
6322 else {
6323 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6324 smb_fname_src->base_name);
6325 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6326 smb_fname_dst->base_name);
6327 }
6328
6329 /* this is a strange one. w2k3 gives an additional event for
6330 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6331 files, but not directories */
6332 if (!is_dir) {
6333 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6334 FILE_NOTIFY_CHANGE_ATTRIBUTES
6335 |FILE_NOTIFY_CHANGE_CREATION,
6336 smb_fname_dst->base_name);
6337 }
6338 out:
6339 TALLOC_FREE(parent_dir_src);
6340 TALLOC_FREE(parent_dir_dst);
6341 }
6342
6343 /****************************************************************************
6344 Returns an error if the parent directory for a filename is open in an
6345 incompatible way.
6346 ****************************************************************************/
6347
6348 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6349 const struct smb_filename *smb_fname_dst_in)
6350 {
6351 char *parent_dir = NULL;
6352 struct smb_filename smb_fname_parent;
6353 struct file_id id;
6354 files_struct *fsp = NULL;
6355 int ret;
6356
6357 if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6358 &parent_dir, NULL)) {
6359 return NT_STATUS_NO_MEMORY;
6360 }
6361 ZERO_STRUCT(smb_fname_parent);
6362 smb_fname_parent.base_name = parent_dir;
6363
6364 ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6365 if (ret == -1) {
6366 return map_nt_error_from_unix(errno);
6367 }
6368
6369 /*
6370 * We're only checking on this smbd here, mostly good
6371 * enough.. and will pass tests.
6372 */
6373
6374 id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6375 for (fsp = file_find_di_first(conn->sconn, id); fsp;
6376 fsp = file_find_di_next(fsp)) {
6377 if (fsp->access_mask & DELETE_ACCESS) {
6378 return NT_STATUS_SHARING_VIOLATION;
6379 }
6380 }
6381 return NT_STATUS_OK;
6382 }
6383
6384 /****************************************************************************
6385 Rename an open file - given an fsp.
6386 ****************************************************************************/
6387
6388 NTSTATUS rename_internals_fsp(connection_struct *conn,
6389 files_struct *fsp,
6390 const struct smb_filename *smb_fname_dst_in,
6391 uint32 attrs,
6392 bool replace_if_exists)
6393 {
6394 TALLOC_CTX *ctx = talloc_tos();
6395 struct smb_filename *smb_fname_dst = NULL;
6396 NTSTATUS status = NT_STATUS_OK;
6397 struct share_mode_lock *lck = NULL;
6398 bool dst_exists, old_is_stream, new_is_stream;
6399
6400 status = check_name(conn, smb_fname_dst_in->base_name);
6401 if (!NT_STATUS_IS_OK(status)) {
6402 return status;
6403 }
6404
6405 status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6406 if (!NT_STATUS_IS_OK(status)) {
6407 return status;
6408 }
6409
6410 /* Make a copy of the dst smb_fname structs */
6411
6412 smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6413 if (smb_fname_dst == NULL) {
6414 status = NT_STATUS_NO_MEMORY;
6415 goto out;
6416 }
6417
6418 /*
6419 * Check for special case with case preserving and not
6420 * case sensitive. If the old last component differs from the original
6421 * last component only by case, then we should allow
6422 * the rename (user is trying to change the case of the
6423 * filename).
6424 */
6425 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6426 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6427 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6428 char *last_slash;
6429 char *fname_dst_lcomp_base_mod = NULL;
6430 struct smb_filename *smb_fname_orig_lcomp = NULL;
6431
6432 /*
6433 * Get the last component of the destination name.
6434 */
6435 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6436 if (last_slash) {
6437 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6438 } else {
6439 fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6440 }
6441 if (!fname_dst_lcomp_base_mod) {
6442 status = NT_STATUS_NO_MEMORY;
6443 goto out;
6444 }
6445
6446 /*
6447 * Create an smb_filename struct using the original last
6448 * component of the destination.
6449 */
6450 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6451 ctx, smb_fname_dst->original_lcomp, NULL);
6452 if (smb_fname_orig_lcomp == NULL) {
6453 status = NT_STATUS_NO_MEMORY;
6454 TALLOC_FREE(fname_dst_lcomp_base_mod);
6455 goto out;
6456 }
6457
6458 /* If the base names only differ by case, use original. */
6459 if(!strcsequal(fname_dst_lcomp_base_mod,
6460 smb_fname_orig_lcomp->base_name)) {
6461 char *tmp;
6462 /*
6463 * Replace the modified last component with the
6464 * original.
6465 */
6466 if (last_slash) {
6467 *last_slash = '\0'; /* Truncate at the '/' */
6468 tmp = talloc_asprintf(smb_fname_dst,
6469 "%s/%s",
6470 smb_fname_dst->base_name,
6471 smb_fname_orig_lcomp->base_name);
6472 } else {
6473 tmp = talloc_asprintf(smb_fname_dst,
6474 "%s",
6475 smb_fname_orig_lcomp->base_name);
6476 }
6477 if (tmp == NULL) {
6478 status = NT_STATUS_NO_MEMORY;
6479 TALLOC_FREE(fname_dst_lcomp_base_mod);
6480 TALLOC_FREE(smb_fname_orig_lcomp);
6481 goto out;
6482 }
6483 TALLOC_FREE(smb_fname_dst->base_name);
6484 smb_fname_dst->base_name = tmp;
6485 }
6486
6487 /* If the stream_names only differ by case, use original. */
6488 if(!strcsequal(smb_fname_dst->stream_name,
6489 smb_fname_orig_lcomp->stream_name)) {
6490 char *tmp = NULL;
6491 /* Use the original stream. */
6492 tmp = talloc_strdup(smb_fname_dst,
6493 smb_fname_orig_lcomp->stream_name);
6494 if (tmp == NULL) {
6495 status = NT_STATUS_NO_MEMORY;
6496 TALLOC_FREE(fname_dst_lcomp_base_mod);
6497 TALLOC_FREE(smb_fname_orig_lcomp);
6498 goto out;
6499 }
6500 TALLOC_FREE(smb_fname_dst->stream_name);
6501 smb_fname_dst->stream_name = tmp;
6502 }
6503 TALLOC_FREE(fname_dst_lcomp_base_mod);
6504 TALLOC_FREE(smb_fname_orig_lcomp);
6505 }
6506
6507 /*
6508 * If the src and dest names are identical - including case,
6509 * don't do the rename, just return success.
6510 */
6511
6512 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6513 strcsequal(fsp->fsp_name->stream_name,
6514 smb_fname_dst->stream_name)) {
6515 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6516 "- returning success\n",
6517 smb_fname_str_dbg(smb_fname_dst)));
6518 status = NT_STATUS_OK;
6519 goto out;
6520 }
6521
6522 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6523 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6524
6525 /* Return the correct error code if both names aren't streams. */
6526 if (!old_is_stream && new_is_stream) {
6527 status = NT_STATUS_OBJECT_NAME_INVALID;
6528 goto out;
6529 }
6530
6531 if (old_is_stream && !new_is_stream) {
6532 status = NT_STATUS_INVALID_PARAMETER;
6533 goto out;
6534 }
6535
6536 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6537
6538 if(!replace_if_exists && dst_exists) {
6539 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6540 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6541 smb_fname_str_dbg(smb_fname_dst)));
6542 status = NT_STATUS_OBJECT_NAME_COLLISION;
6543 goto out;
6544 }
6545
6546 if (dst_exists) {
6547 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6548 &smb_fname_dst->st);
6549 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6550 fileid);
6551 /* The file can be open when renaming a stream */
6552 if (dst_fsp && !new_is_stream) {
6553 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6554 status = NT_STATUS_ACCESS_DENIED;
6555 goto out;
6556 }
6557 }
6558
6559 /* Ensure we have a valid stat struct for the source. */
6560 status = vfs_stat_fsp(fsp);
6561 if (!NT_STATUS_IS_OK(status)) {
6562 goto out;
6563 }
6564
6565 status = can_rename(conn, fsp, attrs);
6566
6567 if (!NT_STATUS_IS_OK(status)) {
6568 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6569 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6570 smb_fname_str_dbg(smb_fname_dst)));
6571 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6572 status = NT_STATUS_ACCESS_DENIED;
6573 goto out;
6574 }
6575
6576 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6577 status = NT_STATUS_ACCESS_DENIED;
6578 }
6579
6580 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6581
6582 /*
6583 * We have the file open ourselves, so not being able to get the
6584 * corresponding share mode lock is a fatal error.
6585 */
6586
6587 SMB_ASSERT(lck != NULL);
6588
6589 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6590 uint32 create_options = fsp->fh->private_options;
6591
6592 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6593 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6594 smb_fname_str_dbg(smb_fname_dst)));
6595
6596 if (!fsp->is_directory &&
6597 !lp_posix_pathnames() &&
6598 (lp_map_archive(SNUM(conn)) ||
6599 lp_store_dos_attributes(SNUM(conn)))) {
6600 /* We must set the archive bit on the newly
6601 renamed file. */
6602 if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6603 uint32_t old_dosmode = dos_mode(conn,
6604 smb_fname_dst);
6605 file_set_dosmode(conn,
6606 smb_fname_dst,
6607 old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6608 NULL,
6609 true);
6610 }
6611 }
6612
6613 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6614 smb_fname_dst);
6615
6616 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6617 smb_fname_dst);
6618
6619 /*
6620 * A rename acts as a new file create w.r.t. allowing an initial delete
6621 * on close, probably because in Windows there is a new handle to the
6622 * new file. If initial delete on close was requested but not
6623 * originally set, we need to set it here. This is probably not 100% correct,
6624 * but will work for the CIFSFS client which in non-posix mode
6625 * depends on these semantics. JRA.
6626 */
6627
6628 if (create_options & FILE_DELETE_ON_CLOSE) {
6629 status = can_set_delete_on_close(fsp, 0);
6630
6631 if (NT_STATUS_IS_OK(status)) {
6632 /* Note that here we set the *inital* delete on close flag,
6633 * not the regular one. The magic gets handled in close. */
6634 fsp->initial_delete_on_close = True;
6635 }
6636 }
6637 TALLOC_FREE(lck);
6638 status = NT_STATUS_OK;
6639 goto out;
6640 }
6641
6642 TALLOC_FREE(lck);
6643
6644 if (errno == ENOTDIR || errno == EISDIR) {
6645 status = NT_STATUS_OBJECT_NAME_COLLISION;
6646 } else {
6647 status = map_nt_error_from_unix(errno);
6648 }
6649
6650 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6651 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6652 smb_fname_str_dbg(smb_fname_dst)));
6653
6654 out:
6655 TALLOC_FREE(smb_fname_dst);
6656
6657 return status;
6658 }
6659
6660 /****************************************************************************
6661 The guts of the rename command, split out so it may be called by the NT SMB
6662 code.
6663 ****************************************************************************/
6664
6665 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6666 connection_struct *conn,
6667 struct smb_request *req,
6668 struct smb_filename *smb_fname_src,
6669 struct smb_filename *smb_fname_dst,
6670 uint32 attrs,
6671 bool replace_if_exists,
6672 bool src_has_wild,
6673 bool dest_has_wild,
6674 uint32_t access_mask)
6675 {
6676 char *fname_src_dir = NULL;
6677 char *fname_src_mask = NULL;
6678 int count=0;
6679 NTSTATUS status = NT_STATUS_OK;
6680 struct smb_Dir *dir_hnd = NULL;
6681 const char *dname = NULL;
6682 char *talloced = NULL;
6683 long offset = 0;
6684 int create_options = 0;
6685 bool posix_pathnames = lp_posix_pathnames();
6686 int rc;
6687
6688 /*
6689 * Split the old name into directory and last component
6690 * strings. Note that unix_convert may have stripped off a
6691 * leading ./ from both name and newname if the rename is
6692 * at the root of the share. We need to make sure either both
6693 * name and newname contain a / character or neither of them do
6694 * as this is checked in resolve_wildcards().
6695 */
6696
6697 /* Split up the directory from the filename/mask. */
6698 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6699 &fname_src_dir, &fname_src_mask);
6700 if (!NT_STATUS_IS_OK(status)) {
6701 status = NT_STATUS_NO_MEMORY;
6702 goto out;
6703 }
6704
6705 /*
6706 * We should only check the mangled cache
6707 * here if unix_convert failed. This means
6708 * that the path in 'mask' doesn't exist
6709 * on the file system and so we need to look
6710 * for a possible mangle. This patch from
6711 * Tine Smukavec <valentin.smukavec@hermes.si>.
6712 */
6713
6714 if (!VALID_STAT(smb_fname_src->st) &&
6715 mangle_is_mangled(fname_src_mask, conn->params)) {
6716 char *new_mask = NULL;
6717 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6718 conn->params);
6719 if (new_mask) {
6720 TALLOC_FREE(fname_src_mask);
6721 fname_src_mask = new_mask;
6722 }
6723 }
6724
6725 if (!src_has_wild) {
6726 files_struct *fsp;
6727
6728 /*
6729 * Only one file needs to be renamed. Append the mask back
6730 * onto the directory.
6731 */
6732 TALLOC_FREE(smb_fname_src->base_name);
6733 if (ISDOT(fname_src_dir)) {
6734 /* Ensure we use canonical names on open. */
6735 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6736 "%s",
6737 fname_src_mask);
6738 } else {
6739 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6740 "%s/%s",
6741 fname_src_dir,
6742 fname_src_mask);
6743 }
6744 if (!smb_fname_src->base_name) {
6745 status = NT_STATUS_NO_MEMORY;
6746 goto out;
6747 }
6748
6749 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6750 "case_preserve = %d, short case preserve = %d, "
6751 "directory = %s, newname = %s, "
6752 "last_component_dest = %s\n",
6753 conn->case_sensitive, conn->case_preserve,
6754 conn->short_case_preserve,
6755 smb_fname_str_dbg(smb_fname_src),
6756 smb_fname_str_dbg(smb_fname_dst),
6757 smb_fname_dst->original_lcomp));
6758
6759 /* The dest name still may have wildcards. */
6760 if (dest_has_wild) {
6761 char *fname_dst_mod = NULL;
6762 if (!resolve_wildcards(smb_fname_dst,
6763 smb_fname_src->base_name,
6764 smb_fname_dst->base_name,
6765 &fname_dst_mod)) {
6766 DEBUG(6, ("rename_internals: resolve_wildcards "
6767 "%s %s failed\n",
6768 smb_fname_src->base_name,
6769 smb_fname_dst->base_name));
6770 status = NT_STATUS_NO_MEMORY;
6771 goto out;
6772 }
6773 TALLOC_FREE(smb_fname_dst->base_name);
6774 smb_fname_dst->base_name = fname_dst_mod;
6775 }
6776
6777 ZERO_STRUCT(smb_fname_src->st);
6778 if (posix_pathnames) {
6779 rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6780 } else {
6781 rc = SMB_VFS_STAT(conn, smb_fname_src);
6782 }
6783 if (rc == -1) {
6784 status = map_nt_error_from_unix_common(errno);
6785 goto out;
6786 }
6787
6788 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6789 create_options |= FILE_DIRECTORY_FILE;
6790 }
6791
6792 status = SMB_VFS_CREATE_FILE(
6793 conn, /* conn */
6794 req, /* req */
6795 0, /* root_dir_fid */
6796 smb_fname_src, /* fname */
6797 access_mask, /* access_mask */
6798 (FILE_SHARE_READ | /* share_access */
6799 FILE_SHARE_WRITE),
6800 FILE_OPEN, /* create_disposition*/
6801 create_options, /* create_options */
6802 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6803 0, /* oplock_request */
6804 NULL, /* lease */
6805 0, /* allocation_size */
6806 0, /* private_flags */
6807 NULL, /* sd */
6808 NULL, /* ea_list */
6809 &fsp, /* result */
6810 NULL); /* pinfo */
6811
6812 if (!NT_STATUS_IS_OK(status)) {
6813 DEBUG(3, ("Could not open rename source %s: %s\n",
6814 smb_fname_str_dbg(smb_fname_src),
6815 nt_errstr(status)));
6816 goto out;
6817 }
6818
6819 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6820 attrs, replace_if_exists);
6821
6822 close_file(req, fsp, NORMAL_CLOSE);
6823
6824 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6825 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6826 smb_fname_str_dbg(smb_fname_dst)));
6827
6828 goto out;
6829 }
6830
6831 /*
6832 * Wildcards - process each file that matches.
6833 */
6834 if (strequal(fname_src_mask, "????????.???")) {
6835 TALLOC_FREE(fname_src_mask);
6836 fname_src_mask = talloc_strdup(ctx, "*");
6837 if (!fname_src_mask) {
6838 status = NT_STATUS_NO_MEMORY;
6839 goto out;
6840 }
6841 }
6842
6843 status = check_name(conn, fname_src_dir);
6844 if (!NT_STATUS_IS_OK(status)) {
6845 goto out;
6846 }
6847
6848 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6849 attrs);
6850 if (dir_hnd == NULL) {
6851 status = map_nt_error_from_unix(errno);
6852 goto out;
6853 }
6854
6855 status = NT_STATUS_NO_SUCH_FILE;
6856 /*
6857 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6858 * - gentest fix. JRA
6859 */
6860
6861 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6862 &talloced))) {
6863 files_struct *fsp = NULL;
6864 char *destname = NULL;
6865 bool sysdir_entry = False;
6866
6867 /* Quick check for "." and ".." */
6868 if (ISDOT(dname) || ISDOTDOT(dname)) {
6869 if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6870 sysdir_entry = True;
6871 } else {
6872 TALLOC_FREE(talloced);
6873 continue;
6874 }
6875 }
6876
6877 if (!is_visible_file(conn, fname_src_dir, dname,
6878 &smb_fname_src->st, false)) {
6879 TALLOC_FREE(talloced);
6880 continue;
6881 }
6882
6883 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6884 TALLOC_FREE(talloced);
6885 continue;
6886 }
6887
6888 if (sysdir_entry) {
6889 status = NT_STATUS_OBJECT_NAME_INVALID;
6890 break;
6891 }
6892
6893 TALLOC_FREE(smb_fname_src->base_name);
6894 if (ISDOT(fname_src_dir)) {
6895 /* Ensure we use canonical names on open. */
6896 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6897 "%s",
6898 dname);
6899 } else {
6900 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6901 "%s/%s",
6902 fname_src_dir,
6903 dname);
6904 }
6905 if (!smb_fname_src->base_name) {
6906 status = NT_STATUS_NO_MEMORY;
6907 goto out;
6908 }
6909
6910 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6911 smb_fname_dst->base_name,
6912 &destname)) {
6913 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6914 smb_fname_src->base_name, destname));
6915 TALLOC_FREE(talloced);
6916 continue;
6917 }
6918 if (!destname) {
6919 status = NT_STATUS_NO_MEMORY;
6920 goto out;
6921 }
6922
6923 TALLOC_FREE(smb_fname_dst->base_name);
6924 smb_fname_dst->base_name = destname;
6925
6926 ZERO_STRUCT(smb_fname_src->st);
6927 if (posix_pathnames) {
6928 SMB_VFS_LSTAT(conn, smb_fname_src);
6929 } else {
6930 SMB_VFS_STAT(conn, smb_fname_src);
6931 }
6932
6933 create_options = 0;
6934
6935 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6936 create_options |= FILE_DIRECTORY_FILE;
6937 }
6938
6939 status = SMB_VFS_CREATE_FILE(
6940 conn, /* conn */
6941 req, /* req */
6942 0, /* root_dir_fid */
6943 smb_fname_src, /* fname */
6944 access_mask, /* access_mask */
6945 (FILE_SHARE_READ | /* share_access */
6946 FILE_SHARE_WRITE),
6947 FILE_OPEN, /* create_disposition*/
6948 create_options, /* create_options */
6949 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6950 0, /* oplock_request */
6951 NULL, /* lease */
6952 0, /* allocation_size */
6953 0, /* private_flags */
6954 NULL, /* sd */
6955 NULL, /* ea_list */
6956 &fsp, /* result */
6957 NULL); /* pinfo */
6958
6959 if (!NT_STATUS_IS_OK(status)) {
6960 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6961 "returned %s rename %s -> %s\n",
6962 nt_errstr(status),
6963 smb_fname_str_dbg(smb_fname_src),
6964 smb_fname_str_dbg(smb_fname_dst)));
6965 break;
6966 }
6967
6968 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6969 dname);
6970 if (!smb_fname_dst->original_lcomp) {
6971 status = NT_STATUS_NO_MEMORY;
6972 goto out;
6973 }
6974
6975 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6976 attrs, replace_if_exists);
6977
6978 close_file(req, fsp, NORMAL_CLOSE);
6979
6980 if (!NT_STATUS_IS_OK(status)) {
6981 DEBUG(3, ("rename_internals_fsp returned %s for "
6982 "rename %s -> %s\n", nt_errstr(status),
6983 smb_fname_str_dbg(smb_fname_src),
6984 smb_fname_str_dbg(smb_fname_dst)));
6985 break;
6986 }
6987
6988 count++;
6989
6990 DEBUG(3,("rename_internals: doing rename on %s -> "
6991 "%s\n", smb_fname_str_dbg(smb_fname_src),
6992 smb_fname_str_dbg(smb_fname_src)));
6993 TALLOC_FREE(talloced);
6994 }
6995 TALLOC_FREE(dir_hnd);
6996
6997 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6998 status = map_nt_error_from_unix(errno);
6999 }
7000
7001 out:
7002 TALLOC_FREE(talloced);
7003 TALLOC_FREE(fname_src_dir);
7004 TALLOC_FREE(fname_src_mask);
7005 return status;
7006 }
7007
7008 /****************************************************************************
7009 Reply to a mv.
7010 ****************************************************************************/
7011
7012 void reply_mv(struct smb_request *req)
7013 {
7014 connection_struct *conn = req->conn;
7015 char *name = NULL;
7016 char *newname = NULL;
7017 const char *p;
7018 uint32 attrs;
7019 NTSTATUS status;
7020 bool src_has_wcard = False;
7021 bool dest_has_wcard = False;
7022 TALLOC_CTX *ctx = talloc_tos();
7023 struct smb_filename *smb_fname_src = NULL;
7024 struct smb_filename *smb_fname_dst = NULL;
7025 uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
7026 uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
7027 bool stream_rename = false;
7028
7029 START_PROFILE(SMBmv);
7030
7031 if (req->wct < 1) {
7032 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7033 goto out;
7034 }
7035
7036 attrs = SVAL(req->vwv+0, 0);
7037
7038 p = (const char *)req->buf + 1;
7039 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
7040 &status, &src_has_wcard);
7041 if (!NT_STATUS_IS_OK(status)) {
7042 reply_nterror(req, status);
7043 goto out;
7044 }
7045 p++;
7046 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
7047 &status, &dest_has_wcard);
7048 if (!NT_STATUS_IS_OK(status)) {
7049 reply_nterror(req, status);
7050 goto out;
7051 }
7052
7053 if (!lp_posix_pathnames()) {
7054 /* The newname must begin with a ':' if the
7055 name contains a ':'. */
7056 if (strchr_m(name, ':')) {
7057 if (newname[0] != ':') {
7058 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7059 goto out;
7060 }
7061 stream_rename = true;
7062 }
7063 }
7064
7065 status = filename_convert(ctx,
7066 conn,
7067 req->flags2 & FLAGS2_DFS_PATHNAMES,
7068 name,
7069 src_ucf_flags,
7070 &src_has_wcard,
7071 &smb_fname_src);
7072
7073 if (!NT_STATUS_IS_OK(status)) {
7074 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7075 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7076 ERRSRV, ERRbadpath);
7077 goto out;
7078 }
7079 reply_nterror(req, status);
7080 goto out;
7081 }
7082
7083 status = filename_convert(ctx,
7084 conn,
7085 req->flags2 & FLAGS2_DFS_PATHNAMES,
7086 newname,
7087 dst_ucf_flags,
7088 &dest_has_wcard,
7089 &smb_fname_dst);
7090
7091 if (!NT_STATUS_IS_OK(status)) {
7092 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7093 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7094 ERRSRV, ERRbadpath);
7095 goto out;
7096 }
7097 reply_nterror(req, status);
7098 goto out;
7099 }
7100
7101 if (stream_rename) {
7102 /* smb_fname_dst->base_name must be the same as
7103 smb_fname_src->base_name. */
7104 TALLOC_FREE(smb_fname_dst->base_name);
7105 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7106 smb_fname_src->base_name);
7107 if (!smb_fname_dst->base_name) {
7108 reply_nterror(req, NT_STATUS_NO_MEMORY);
7109 goto out;
7110 }
7111 }
7112
7113 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7114 smb_fname_str_dbg(smb_fname_dst)));
7115
7116 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7117 attrs, False, src_has_wcard, dest_has_wcard,
7118 DELETE_ACCESS);
7119 if (!NT_STATUS_IS_OK(status)) {
7120 if (open_was_deferred(req->xconn, req->mid)) {
7121 /* We have re-scheduled this call. */
7122 goto out;
7123 }
7124 reply_nterror(req, status);
7125 goto out;
7126 }
7127
7128 reply_outbuf(req, 0, 0);
7129 out:
7130 TALLOC_FREE(smb_fname_src);
7131 TALLOC_FREE(smb_fname_dst);
7132 END_PROFILE(SMBmv);
7133 return;
7134 }
7135
7136 /*******************************************************************
7137 Copy a file as part of a reply_copy.
7138 ******************************************************************/
7139
7140 /*
7141 * TODO: check error codes on all callers
7142 */
7143
7144 NTSTATUS copy_file(TALLOC_CTX *ctx,
7145 connection_struct *conn,
7146 struct smb_filename *smb_fname_src,
7147 struct smb_filename *smb_fname_dst,
7148 int ofun,
7149 int count,
7150 bool target_is_directory)
7151 {
7152 struct smb_filename *smb_fname_dst_tmp = NULL;
7153 off_t ret=-1;
7154 files_struct *fsp1,*fsp2;
7155 uint32 dosattrs;
7156 uint32 new_create_disposition;
7157 NTSTATUS status;
7158
7159
7160 smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7161 if (smb_fname_dst_tmp == NULL) {
7162 return NT_STATUS_NO_MEMORY;
7163 }
7164
7165 /*
7166 * If the target is a directory, extract the last component from the
7167 * src filename and append it to the dst filename
7168 */
7169 if (target_is_directory) {
7170 const char *p;
7171
7172 /* dest/target can't be a stream if it's a directory. */
7173 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7174
7175 p = strrchr_m(smb_fname_src->base_name,'/');
7176 if (p) {
7177 p++;
7178 } else {
7179 p = smb_fname_src->base_name;
7180 }
7181 smb_fname_dst_tmp->base_name =
7182 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7183 p);
7184 if (!smb_fname_dst_tmp->base_name) {
7185 status = NT_STATUS_NO_MEMORY;
7186 goto out;
7187 }
7188 }
7189
7190 status = vfs_file_exist(conn, smb_fname_src);
7191 if (!NT_STATUS_IS_OK(status)) {
7192 goto out;
7193 }
7194
7195 if (!target_is_directory && count) {
7196 new_create_disposition = FILE_OPEN;
7197 } else {
7198 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7199 0, ofun,
7200 NULL, NULL,
7201 &new_create_disposition,
7202 NULL,
7203 NULL)) {
7204 status = NT_STATUS_INVALID_PARAMETER;
7205 goto out;
7206 }
7207 }
7208
7209 /* Open the src file for reading. */
7210 status = SMB_VFS_CREATE_FILE(
7211 conn, /* conn */
7212 NULL, /* req */
7213 0, /* root_dir_fid */
7214 smb_fname_src, /* fname */
7215 FILE_GENERIC_READ, /* access_mask */
7216 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7217 FILE_OPEN, /* create_disposition*/
7218 0, /* create_options */
7219 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
7220 INTERNAL_OPEN_ONLY, /* oplock_request */
7221 NULL, /* lease */
7222 0, /* allocation_size */
7223 0, /* private_flags */
7224 NULL, /* sd */
7225 NULL, /* ea_list */
7226 &fsp1, /* result */
7227 NULL); /* psbuf */
7228
7229 if (!NT_STATUS_IS_OK(status)) {
7230 goto out;
7231 }
7232
7233 dosattrs = dos_mode(conn, smb_fname_src);
7234
7235 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7236 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7237 }
7238
7239 /* Open the dst file for writing. */
7240 status = SMB_VFS_CREATE_FILE(
7241 conn, /* conn */
7242 NULL, /* req */
7243 0, /* root_dir_fid */
7244 smb_fname_dst, /* fname */
7245 FILE_GENERIC_WRITE, /* access_mask */
7246 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
7247 new_create_disposition, /* create_disposition*/
7248 0, /* create_options */
7249 dosattrs, /* file_attributes */
7250 INTERNAL_OPEN_ONLY, /* oplock_request */
7251 NULL, /* lease */
7252 0, /* allocation_size */
7253 0, /* private_flags */
7254 NULL, /* sd */
7255 NULL, /* ea_list */
7256 &fsp2, /* result */
7257 NULL); /* psbuf */
7258
7259 if (!NT_STATUS_IS_OK(status)) {
7260 close_file(NULL, fsp1, ERROR_CLOSE);
7261 goto out;
7262 }
7263
7264 if (ofun & OPENX_FILE_EXISTS_OPEN) {
7265 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7266 if (ret == -1) {
7267 DEBUG(0, ("error - vfs lseek returned error %s\n",
7268 strerror(errno)));
7269 status = map_nt_error_from_unix(errno);
7270 close_file(NULL, fsp1, ERROR_CLOSE);
7271 close_file(NULL, fsp2, ERROR_CLOSE);
7272 goto out;
7273 }
7274 }
7275
7276 /* Do the actual copy. */
7277 if (smb_fname_src->st.st_ex_size) {
7278 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7279 } else {
7280 ret = 0;
7281 }
7282
7283 close_file(NULL, fsp1, NORMAL_CLOSE);
7284
7285 /* Ensure the modtime is set correctly on the destination file. */
7286 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7287
7288 /*
7289 * As we are opening fsp1 read-only we only expect
7290 * an error on close on fsp2 if we are out of space.
7291 * Thus we don't look at the error return from the
7292 * close of fsp1.
7293 */
7294 status = close_file(NULL, fsp2, NORMAL_CLOSE);
7295
7296 if (!NT_STATUS_IS_OK(status)) {
7297 goto out;
7298 }
7299
7300 if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7301 status = NT_STATUS_DISK_FULL;
7302 goto out;
7303 }
7304
7305 status = NT_STATUS_OK;
7306
7307 out:
7308 TALLOC_FREE(smb_fname_dst_tmp);
7309 return status;
7310 }
7311
7312 /****************************************************************************
7313 Reply to a file copy.
7314 ****************************************************************************/
7315
7316 void reply_copy(struct smb_request *req)
7317 {
7318 connection_struct *conn = req->conn;
7319 struct smb_filename *smb_fname_src = NULL;
7320 struct smb_filename *smb_fname_dst = NULL;
7321 char *fname_src = NULL;
7322 char *fname_dst = NULL;
7323 char *fname_src_mask = NULL;
7324 char *fname_src_dir = NULL;
7325 const char *p;
7326 int count=0;
7327 int error = ERRnoaccess;
7328 int tid2;
7329 int ofun;
7330 int flags;
7331 bool target_is_directory=False;
7332 bool source_has_wild = False;
7333 bool dest_has_wild = False;
7334 NTSTATUS status;
7335 TALLOC_CTX *ctx = talloc_tos();
7336
7337 START_PROFILE(SMBcopy);
7338
7339 if (req->wct < 3) {
7340 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7341 goto out;
7342 }
7343
7344 tid2 = SVAL(req->vwv+0, 0);
7345 ofun = SVAL(req->vwv+1, 0);
7346 flags = SVAL(req->vwv+2, 0);
7347
7348 p = (const char *)req->buf;
7349 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7350 &status, &source_has_wild);
7351 if (!NT_STATUS_IS_OK(status)) {
7352 reply_nterror(req, status);
7353 goto out;
7354 }
7355 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7356 &status, &dest_has_wild);
7357 if (!NT_STATUS_IS_OK(status)) {
7358 reply_nterror(req, status);
7359 goto out;
7360 }
7361
7362 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7363
7364 if (tid2 != conn->cnum) {
7365 /* can't currently handle inter share copies XXXX */
7366 DEBUG(3,("Rejecting inter-share copy\n"));
7367 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7368 goto out;
7369 }
7370
7371 status = filename_convert(ctx, conn,
7372 req->flags2 & FLAGS2_DFS_PATHNAMES,
7373 fname_src,
7374 UCF_COND_ALLOW_WCARD_LCOMP,
7375 &source_has_wild,
7376 &smb_fname_src);
7377 if (!NT_STATUS_IS_OK(status)) {
7378 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7379 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7380 ERRSRV, ERRbadpath);
7381 goto out;
7382 }
7383 reply_nterror(req, status);
7384 goto out;
7385 }
7386
7387 status = filename_convert(ctx, conn,
7388 req->flags2 & FLAGS2_DFS_PATHNAMES,
7389 fname_dst,
7390 UCF_COND_ALLOW_WCARD_LCOMP,
7391 &dest_has_wild,
7392 &smb_fname_dst);
7393 if (!NT_STATUS_IS_OK(status)) {
7394 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7395 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7396 ERRSRV, ERRbadpath);
7397 goto out;
7398 }
7399 reply_nterror(req, status);
7400 goto out;
7401 }
7402
7403 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7404
7405 if ((flags&1) && target_is_directory) {
7406 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7407 goto out;
7408 }
7409
7410 if ((flags&2) && !target_is_directory) {
7411 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7412 goto out;
7413 }
7414
7415 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7416 /* wants a tree copy! XXXX */
7417 DEBUG(3,("Rejecting tree copy\n"));
7418 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7419 goto out;
7420 }
7421
7422 /* Split up the directory from the filename/mask. */
7423 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7424 &fname_src_dir, &fname_src_mask);
7425 if (!NT_STATUS_IS_OK(status)) {
7426 reply_nterror(req, NT_STATUS_NO_MEMORY);
7427 goto out;
7428 }
7429
7430 /*
7431 * We should only check the mangled cache
7432 * here if unix_convert failed. This means
7433 * that the path in 'mask' doesn't exist
7434 * on the file system and so we need to look
7435 * for a possible mangle. This patch from
7436 * Tine Smukavec <valentin.smukavec@hermes.si>.
7437 */
7438 if (!VALID_STAT(smb_fname_src->st) &&
7439 mangle_is_mangled(fname_src_mask, conn->params)) {
7440 char *new_mask = NULL;
7441 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7442 &new_mask, conn->params);
7443
7444 /* Use demangled name if one was successfully found. */
7445 if (new_mask) {
7446 TALLOC_FREE(fname_src_mask);
7447 fname_src_mask = new_mask;
7448 }
7449 }
7450
7451 if (!source_has_wild) {
7452
7453 /*
7454 * Only one file needs to be copied. Append the mask back onto
7455 * the directory.
7456 */
7457 TALLOC_FREE(smb_fname_src->base_name);
7458 if (ISDOT(fname_src_dir)) {
7459 /* Ensure we use canonical names on open. */
7460 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7461 "%s",
7462 fname_src_mask);
7463 } else {
7464 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7465 "%s/%s",
7466 fname_src_dir,
7467 fname_src_mask);
7468 }
7469 if (!smb_fname_src->base_name) {
7470 reply_nterror(req, NT_STATUS_NO_MEMORY);
7471 goto out;
7472 }
7473
7474 if (dest_has_wild) {
7475 char *fname_dst_mod = NULL;
7476 if (!resolve_wildcards(smb_fname_dst,
7477 smb_fname_src->base_name,
7478 smb_fname_dst->base_name,
7479 &fname_dst_mod)) {
7480 reply_nterror(req, NT_STATUS_NO_MEMORY);
7481 goto out;
7482 }
7483 TALLOC_FREE(smb_fname_dst->base_name);
7484 smb_fname_dst->base_name = fname_dst_mod;
7485 }
7486
7487 status = check_name(conn, smb_fname_src->base_name);
7488 if (!NT_STATUS_IS_OK(status)) {
7489 reply_nterror(req, status);
7490 goto out;
7491 }
7492
7493 status = check_name(conn, smb_fname_dst->base_name);
7494 if (!NT_STATUS_IS_OK(status)) {
7495 reply_nterror(req, status);
7496 goto out;
7497 }
7498
7499 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7500 ofun, count, target_is_directory);
7501
7502 if(!NT_STATUS_IS_OK(status)) {
7503 reply_nterror(req, status);
7504 goto out;
7505 } else {
7506 count++;
7507 }
7508 } else {
7509 struct smb_Dir *dir_hnd = NULL;
7510 const char *dname = NULL;
7511 char *talloced = NULL;
7512 long offset = 0;
7513
7514 /*
7515 * There is a wildcard that requires us to actually read the
7516 * src dir and copy each file matching the mask to the dst.
7517 * Right now streams won't be copied, but this could
7518 * presumably be added with a nested loop for reach dir entry.
7519 */
7520 SMB_ASSERT(!smb_fname_src->stream_name);
7521 SMB_ASSERT(!smb_fname_dst->stream_name);
7522
7523 smb_fname_src->stream_name = NULL;
7524 smb_fname_dst->stream_name = NULL;
7525
7526 if (strequal(fname_src_mask,"????????.???")) {
7527 TALLOC_FREE(fname_src_mask);
7528 fname_src_mask = talloc_strdup(ctx, "*");
7529 if (!fname_src_mask) {
7530 reply_nterror(req, NT_STATUS_NO_MEMORY);
7531 goto out;
7532 }
7533 }
7534
7535 status = check_name(conn, fname_src_dir);
7536 if (!NT_STATUS_IS_OK(status)) {
7537 reply_nterror(req, status);
7538 goto out;
7539 }
7540
7541 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7542 if (dir_hnd == NULL) {
7543 status = map_nt_error_from_unix(errno);
7544 reply_nterror(req, status);
7545 goto out;
7546 }
7547
7548 error = ERRbadfile;
7549
7550 /* Iterate over the src dir copying each entry to the dst. */
7551 while ((dname = ReadDirName(dir_hnd, &offset,
7552 &smb_fname_src->st, &talloced))) {
7553 char *destname = NULL;
7554
7555 if (ISDOT(dname) || ISDOTDOT(dname)) {
7556 TALLOC_FREE(talloced);
7557 continue;
7558 }
7559
7560 if (!is_visible_file(conn, fname_src_dir, dname,
7561 &smb_fname_src->st, false)) {
7562 TALLOC_FREE(talloced);
7563 continue;
7564 }
7565
7566 if(!mask_match(dname, fname_src_mask,
7567 conn->case_sensitive)) {
7568 TALLOC_FREE(talloced);
7569 continue;
7570 }
7571
7572 error = ERRnoaccess;
7573
7574 /* Get the src smb_fname struct setup. */
7575 TALLOC_FREE(smb_fname_src->base_name);
7576 if (ISDOT(fname_src_dir)) {
7577 /* Ensure we use canonical names on open. */
7578 smb_fname_src->base_name =
7579 talloc_asprintf(smb_fname_src, "%s",
7580 dname);
7581 } else {
7582 smb_fname_src->base_name =
7583 talloc_asprintf(smb_fname_src, "%s/%s",
7584 fname_src_dir, dname);
7585 }
7586
7587 if (!smb_fname_src->base_name) {
7588 TALLOC_FREE(dir_hnd);
7589 TALLOC_FREE(talloced);
7590 reply_nterror(req, NT_STATUS_NO_MEMORY);
7591 goto out;
7592 }
7593
7594 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7595 smb_fname_dst->base_name,
7596 &destname)) {
7597 TALLOC_FREE(talloced);
7598 continue;
7599 }
7600 if (!destname) {
7601 TALLOC_FREE(dir_hnd);
7602 TALLOC_FREE(talloced);
7603 reply_nterror(req, NT_STATUS_NO_MEMORY);
7604 goto out;
7605 }
7606
7607 TALLOC_FREE(smb_fname_dst->base_name);
7608 smb_fname_dst->base_name = destname;
7609
7610 status = check_name(conn, smb_fname_src->base_name);
7611 if (!NT_STATUS_IS_OK(status)) {
7612 TALLOC_FREE(dir_hnd);
7613 TALLOC_FREE(talloced);
7614 reply_nterror(req, status);
7615 goto out;
7616 }
7617
7618 status = check_name(conn, smb_fname_dst->base_name);
7619 if (!NT_STATUS_IS_OK(status)) {
7620 TALLOC_FREE(dir_hnd);
7621 TALLOC_FREE(talloced);
7622 reply_nterror(req, status);
7623 goto out;
7624 }
7625
7626 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7627 smb_fname_src->base_name,
7628 smb_fname_dst->base_name));
7629
7630 status = copy_file(ctx, conn, smb_fname_src,
7631 smb_fname_dst, ofun, count,
7632 target_is_directory);
7633 if (NT_STATUS_IS_OK(status)) {
7634 count++;
7635 }
7636
7637 TALLOC_FREE(talloced);
7638 }
7639 TALLOC_FREE(dir_hnd);
7640 }
7641
7642 if (count == 0) {
7643 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7644 goto out;
7645 }
7646
7647 reply_outbuf(req, 1, 0);
7648 SSVAL(req->outbuf,smb_vwv0,count);
7649 out:
7650 TALLOC_FREE(smb_fname_src);
7651 TALLOC_FREE(smb_fname_dst);
7652 TALLOC_FREE(fname_src);
7653 TALLOC_FREE(fname_dst);
7654 TALLOC_FREE(fname_src_mask);
7655 TALLOC_FREE(fname_src_dir);
7656
7657 END_PROFILE(SMBcopy);
7658 return;
7659 }
7660
7661 #undef DBGC_CLASS
7662 #define DBGC_CLASS DBGC_LOCKING
7663
7664 /****************************************************************************
7665 Get a lock pid, dealing with large count requests.
7666 ****************************************************************************/
7667
7668 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7669 bool large_file_format)
7670 {
7671 if(!large_file_format)
7672 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7673 else
7674 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7675 }
7676
7677 /****************************************************************************
7678 Get a lock count, dealing with large count requests.
7679 ****************************************************************************/
7680
7681 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7682 bool large_file_format)
7683 {
7684 uint64_t count = 0;
7685
7686 if(!large_file_format) {
7687 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7688 } else {
7689 /*
7690 * No BVAL, this is reversed!
7691 */
7692 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7693 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7694 }
7695
7696 return count;
7697 }
7698
7699 /****************************************************************************
7700 Get a lock offset, dealing with large offset requests.
7701 ****************************************************************************/
7702
7703 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7704 bool large_file_format)
7705 {
7706 uint64_t offset = 0;
7707
7708 if(!large_file_format) {
7709 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7710 } else {
7711 /*
7712 * No BVAL, this is reversed!
7713 */
7714 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7715 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7716 }
7717
7718 return offset;
7719 }
7720
7721 NTSTATUS smbd_do_locking(struct smb_request *req,
7722 files_struct *fsp,
7723 uint8_t type,
7724 int32_t timeout,
7725 uint16_t num_locks,
7726 struct smbd_lock_element *locks,
7727 bool *async)
7728 {
7729 connection_struct *conn = req->conn;
7730 int i;
7731 NTSTATUS status = NT_STATUS_OK;
7732
7733 *async = false;
7734
7735 /* Setup the timeout in seconds. */
7736
7737 if (!lp_blocking_locks(SNUM(conn))) {
7738 timeout = 0;
7739 }
7740
7741 for(i = 0; i < (int)num_locks; i++) {
7742 struct smbd_lock_element *e = &locks[i];
7743
7744 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7745 "%llu, file %s timeout = %d\n",
7746 (double)e->offset,
7747 (double)e->count,
7748 (unsigned long long)e->smblctx,
7749 fsp_str_dbg(fsp),
7750 (int)timeout));
7751
7752 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7753 struct blocking_lock_record *blr = NULL;
7754
7755 if (num_locks > 1) {
7756 /*
7757 * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7758 * if the lock vector contains one entry. When given multiple cancel
7759 * requests in a single PDU we expect the server to return an
7760 * error. Windows servers seem to accept the request but only
7761 * cancel the first lock.
7762 * JRA - Do what Windows does (tm) :-).
7763 */
7764
7765 #if 0
7766 /* MS-CIFS (2.2.4.32.1) behavior. */
7767 return NT_STATUS_DOS(ERRDOS,
7768 ERRcancelviolation);
7769 #else
7770 /* Windows behavior. */
7771 if (i != 0) {
7772 DEBUG(10,("smbd_do_locking: ignoring subsequent "
7773 "cancel request\n"));
7774 continue;
7775 }
7776 #endif
7777 }
7778
7779 if (lp_blocking_locks(SNUM(conn))) {
7780
7781 /* Schedule a message to ourselves to
7782 remove the blocking lock record and
7783 return the right error. */
7784
7785 blr = blocking_lock_cancel_smb1(fsp,
7786 e->smblctx,
7787 e->offset,
7788 e->count,
7789 WINDOWS_LOCK,
7790 type,
7791 NT_STATUS_FILE_LOCK_CONFLICT);
7792 if (blr == NULL) {
7793 return NT_STATUS_DOS(
7794 ERRDOS,
7795 ERRcancelviolation);
7796 }
7797 }
7798 /* Remove a matching pending lock. */
7799 status = do_lock_cancel(fsp,
7800 e->smblctx,
7801 e->count,
7802 e->offset,
7803 WINDOWS_LOCK);
7804 } else {
7805 bool blocking_lock = timeout ? true : false;
7806 bool defer_lock = false;
7807 struct byte_range_lock *br_lck;
7808 uint64_t block_smblctx;
7809
7810 br_lck = do_lock(req->sconn->msg_ctx,
7811 fsp,
7812 e->smblctx,
7813 e->count,
7814 e->offset,
7815 e->brltype,
7816 WINDOWS_LOCK,
7817 blocking_lock,
7818 &status,
7819 &block_smblctx);
7820
7821 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7822 /* Windows internal resolution for blocking locks seems
7823 to be about 200ms... Don't wait for less than that. JRA. */
7824 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7825 timeout = lp_lock_spin_time();
7826 }
7827 defer_lock = true;
7828 }
7829
7830 /* If a lock sent with timeout of zero would fail, and
7831 * this lock has been requested multiple times,
7832 * according to brl_lock_failed() we convert this
7833 * request to a blocking lock with a timeout of between
7834 * 150 - 300 milliseconds.
7835 *
7836 * If lp_lock_spin_time() has been set to 0, we skip
7837 * this blocking retry and fail immediately.
7838 *
7839 * Replacement for do_lock_spin(). JRA. */
7840
7841 if (!req->sconn->using_smb2 &&
7842 br_lck && lp_blocking_locks(SNUM(conn)) &&
7843 lp_lock_spin_time() && !blocking_lock &&
7844 NT_STATUS_EQUAL((status),
7845 NT_STATUS_FILE_LOCK_CONFLICT))
7846 {
7847 defer_lock = true;
7848 timeout = lp_lock_spin_time();
7849 }
7850
7851 if (br_lck && defer_lock) {
7852 /*
7853 * A blocking lock was requested. Package up
7854 * this smb into a queued request and push it
7855 * onto the blocking lock queue.
7856 */
7857 if(push_blocking_lock_request(br_lck,
7858 req,
7859 fsp,
7860 timeout,
7861 i,
7862 e->smblctx,
7863 e->brltype,
7864 WINDOWS_LOCK,
7865 e->offset,
7866 e->count,
7867 block_smblctx)) {
7868 TALLOC_FREE(br_lck);
7869 *async = true;
7870 return NT_STATUS_OK;
7871 }
7872 }
7873
7874 TALLOC_FREE(br_lck);
7875 }
7876
7877 if (!NT_STATUS_IS_OK(status)) {
7878 break;
7879 }
7880 }
7881
7882 /* If any of the above locks failed, then we must unlock
7883 all of the previous locks (X/Open spec). */
7884
7885 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7886
7887 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7888 i = -1; /* we want to skip the for loop */
7889 }
7890
7891 /*
7892 * Ensure we don't do a remove on the lock that just failed,
7893 * as under POSIX rules, if we have a lock already there, we
7894 * will delete it (and we shouldn't) .....
7895 */
7896 for(i--; i >= 0; i--) {
7897 struct smbd_lock_element *e = &locks[i];
7898
7899 do_unlock(req->sconn->msg_ctx,
7900 fsp,
7901 e->smblctx,
7902 e->count,
7903 e->offset,
7904 WINDOWS_LOCK);
7905 }
7906 return status;
7907 }
7908
7909 DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
7910 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
7911
7912 return NT_STATUS_OK;
7913 }
7914
7915 NTSTATUS smbd_do_unlocking(struct smb_request *req,
7916 files_struct *fsp,
7917 uint16_t num_ulocks,
7918 struct smbd_lock_element *ulocks)
7919 {
7920 int i;
7921
7922 for(i = 0; i < (int)num_ulocks; i++) {
7923 struct smbd_lock_element *e = &ulocks[i];
7924 NTSTATUS status;
7925
7926 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
7927 "pid %u, file %s\n", __func__,
7928 (double)e->offset,
7929 (double)e->count,
7930 (unsigned int)e->smblctx,
7931 fsp_str_dbg(fsp)));
7932
7933 if (e->brltype != UNLOCK_LOCK) {
7934 /* this can only happen with SMB2 */
7935 return NT_STATUS_INVALID_PARAMETER;
7936 }
7937
7938 status = do_unlock(req->sconn->msg_ctx,
7939 fsp,
7940 e->smblctx,
7941 e->count,
7942 e->offset,
7943 WINDOWS_LOCK);
7944
7945 DEBUG(10, ("%s: unlock returned %s\n", __func__,
7946 nt_errstr(status)));
7947
7948 if (!NT_STATUS_IS_OK(status)) {
7949 return status;
7950 }
7951 }
7952
7953 DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
7954 num_ulocks));
7955
7956 return NT_STATUS_OK;
7957 }
7958
7959 /****************************************************************************
7960 Reply to a lockingX request.
7961 ****************************************************************************/
7962
7963 void reply_lockingX(struct smb_request *req)
7964 {
7965 connection_struct *conn = req->conn;
7966 files_struct *fsp;
7967 unsigned char locktype;
7968 unsigned char oplocklevel;
7969 uint16 num_ulocks;
7970 uint16 num_locks;
7971 int32 lock_timeout;
7972 int i;
7973 const uint8_t *data;
7974 bool large_file_format;
7975 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7976 struct smbd_lock_element *ulocks;
7977 struct smbd_lock_element *locks;
7978 bool async = false;
7979
7980 START_PROFILE(SMBlockingX);
7981
7982 if (req->wct < 8) {
7983 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7984 END_PROFILE(SMBlockingX);
7985 return;
7986 }
7987
7988 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7989 locktype = CVAL(req->vwv+3, 0);
7990 oplocklevel = CVAL(req->vwv+3, 1);
7991 num_ulocks = SVAL(req->vwv+6, 0);
7992 num_locks = SVAL(req->vwv+7, 0);
7993 lock_timeout = IVAL(req->vwv+4, 0);
7994 large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
7995
7996 if (!check_fsp(conn, req, fsp)) {
7997 END_PROFILE(SMBlockingX);
7998 return;
7999 }
8000
8001 data = req->buf;
8002
8003 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
8004 /* we don't support these - and CANCEL_LOCK makes w2k
8005 and XP reboot so I don't really want to be
8006 compatible! (tridge) */
8007 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
8008 END_PROFILE(SMBlockingX);
8009 return;
8010 }
8011
8012 /* Check if this is an oplock break on a file
8013 we have granted an oplock on.
8014 */
8015 if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
8016 /* Client can insist on breaking to none. */
8017 bool break_to_none = (oplocklevel == 0);
8018 bool result;
8019
8020 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
8021 "for %s\n", (unsigned int)oplocklevel,
8022 fsp_fnum_dbg(fsp)));
8023
8024 /*
8025 * Make sure we have granted an exclusive or batch oplock on
8026 * this file.
8027 */
8028
8029 if (fsp->oplock_type == 0) {
8030
8031 /* The Samba4 nbench simulator doesn't understand
8032 the difference between break to level2 and break
8033 to none from level2 - it sends oplock break
8034 replies in both cases. Don't keep logging an error
8035 message here - just ignore it. JRA. */
8036
8037 DEBUG(5,("reply_lockingX: Error : oplock break from "
8038 "client for %s (oplock=%d) and no "
8039 "oplock granted on this file (%s).\n",
8040 fsp_fnum_dbg(fsp), fsp->oplock_type,
8041 fsp_str_dbg(fsp)));
8042
8043 /* if this is a pure oplock break request then don't
8044 * send a reply */
8045 if (num_locks == 0 && num_ulocks == 0) {
8046 END_PROFILE(SMBlockingX);
8047 return;
8048 } else {
8049 END_PROFILE(SMBlockingX);
8050 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8051 return;
8052 }
8053 }
8054
8055 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8056 (break_to_none)) {
8057 result = remove_oplock(fsp);
8058 } else {
8059 result = downgrade_oplock(fsp);
8060 }
8061
8062 if (!result) {
8063 DEBUG(0, ("reply_lockingX: error in removing "
8064 "oplock on file %s\n", fsp_str_dbg(fsp)));
8065 /* Hmmm. Is this panic justified? */
8066 smb_panic("internal tdb error");
8067 }
8068
8069 /* if this is a pure oplock break request then don't send a
8070 * reply */
8071 if (num_locks == 0 && num_ulocks == 0) {
8072 /* Sanity check - ensure a pure oplock break is not a
8073 chained request. */
8074 if (CVAL(req->vwv+0, 0) != 0xff) {
8075 DEBUG(0,("reply_lockingX: Error : pure oplock "
8076 "break is a chained %d request !\n",
8077 (unsigned int)CVAL(req->vwv+0, 0)));
8078 }
8079 END_PROFILE(SMBlockingX);
8080 return;
8081 }
8082 }
8083
8084 if (req->buflen <
8085 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8086 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8087 END_PROFILE(SMBlockingX);
8088 return;
8089 }
8090
8091 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8092 if (ulocks == NULL) {
8093 reply_nterror(req, NT_STATUS_NO_MEMORY);
8094 END_PROFILE(SMBlockingX);
8095 return;
8096 }
8097
8098 locks = talloc_array(req, struct smbd_lock_element, num_locks);
8099 if (locks == NULL) {
8100 reply_nterror(req, NT_STATUS_NO_MEMORY);
8101 END_PROFILE(SMBlockingX);
8102 return;
8103 }
8104
8105 /* Data now points at the beginning of the list
8106 of smb_unlkrng structs */
8107 for(i = 0; i < (int)num_ulocks; i++) {
8108 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8109 ulocks[i].count = get_lock_count(data, i, large_file_format);
8110 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8111 ulocks[i].brltype = UNLOCK_LOCK;
8112 }
8113
8114 /* Now do any requested locks */
8115 data += ((large_file_format ? 20 : 10)*num_ulocks);
8116
8117 /* Data now points at the beginning of the list
8118 of smb_lkrng structs */
8119
8120 for(i = 0; i < (int)num_locks; i++) {
8121 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8122 locks[i].count = get_lock_count(data, i, large_file_format);
8123 locks[i].offset = get_lock_offset(data, i, large_file_format);
8124
8125 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8126 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8127 locks[i].brltype = PENDING_READ_LOCK;
8128 } else {
8129 locks[i].brltype = READ_LOCK;
8130 }
8131 } else {
8132 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8133 locks[i].brltype = PENDING_WRITE_LOCK;
8134 } else {
8135 locks[i].brltype = WRITE_LOCK;
8136 }
8137 }
8138 }
8139
8140 status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8141 if (!NT_STATUS_IS_OK(status)) {
8142 END_PROFILE(SMBlockingX);
8143 reply_nterror(req, status);
8144 return;
8145 }
8146
8147 status = smbd_do_locking(req, fsp,
8148 locktype, lock_timeout,
8149 num_locks, locks,
8150 &async);
8151 if (!NT_STATUS_IS_OK(status)) {
8152 END_PROFILE(SMBlockingX);
8153 reply_nterror(req, status);
8154 return;
8155 }
8156 if (async) {
8157 END_PROFILE(SMBlockingX);
8158 return;
8159 }
8160
8161 reply_outbuf(req, 2, 0);
8162 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8163 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
8164
8165 DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8166 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8167
8168 END_PROFILE(SMBlockingX);
8169 }
8170
8171 #undef DBGC_CLASS
8172 #define DBGC_CLASS DBGC_ALL
8173
8174 /****************************************************************************
8175 Reply to a SMBreadbmpx (read block multiplex) request.
8176 Always reply with an error, if someone has a platform really needs this,
8177 please contact vl@samba.org
8178 ****************************************************************************/
8179
8180 void reply_readbmpx(struct smb_request *req)
8181 {
8182 START_PROFILE(SMBreadBmpx);
8183 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8184 END_PROFILE(SMBreadBmpx);
8185 return;
8186 }
8187
8188 /****************************************************************************
8189 Reply to a SMBreadbs (read block multiplex secondary) request.
8190 Always reply with an error, if someone has a platform really needs this,
8191 please contact vl@samba.org
8192 ****************************************************************************/
8193
8194 void reply_readbs(struct smb_request *req)
8195 {
8196 START_PROFILE(SMBreadBs);
8197 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8198 END_PROFILE(SMBreadBs);
8199 return;
8200 }
8201
8202 /****************************************************************************
8203 Reply to a SMBsetattrE.
8204 ****************************************************************************/
8205
8206 void reply_setattrE(struct smb_request *req)
8207 {
8208 connection_struct *conn = req->conn;
8209 struct smb_file_time ft;
8210 files_struct *fsp;
8211 NTSTATUS status;
8212
8213 START_PROFILE(SMBsetattrE);
8214 ZERO_STRUCT(ft);
8215
8216 if (req->wct < 7) {
8217 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8218 goto out;
8219 }
8220
8221 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8222
8223 if(!fsp || (fsp->conn != conn)) {
8224 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8225 goto out;
8226 }
8227
8228 /*
8229 * Convert the DOS times into unix times.
8230 */
8231
8232 ft.atime = convert_time_t_to_timespec(
8233 srv_make_unix_date2(req->vwv+3));
8234 ft.mtime = convert_time_t_to_timespec(
8235 srv_make_unix_date2(req->vwv+5));
8236 ft.create_time = convert_time_t_to_timespec(
8237 srv_make_unix_date2(req->vwv+1));
8238
8239 reply_outbuf(req, 0, 0);
8240
8241 /*
8242 * Patch from Ray Frush <frush@engr.colostate.edu>
8243 * Sometimes times are sent as zero - ignore them.
8244 */
8245
8246 /* Ensure we have a valid stat struct for the source. */
8247 status = vfs_stat_fsp(fsp);
8248 if (!NT_STATUS_IS_OK(status)) {
8249 reply_nterror(req, status);
8250 goto out;
8251 }
8252
8253 if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8254 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8255 goto out;
8256 }
8257
8258 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8259 if (!NT_STATUS_IS_OK(status)) {
8260 reply_nterror(req, status);
8261 goto out;
8262 }
8263
8264 DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8265 " createtime=%u\n",
8266 fsp_fnum_dbg(fsp),
8267 (unsigned int)ft.atime.tv_sec,
8268 (unsigned int)ft.mtime.tv_sec,
8269 (unsigned int)ft.create_time.tv_sec
8270 ));
8271 out:
8272 END_PROFILE(SMBsetattrE);
8273 return;
8274 }
8275
8276
8277 /* Back from the dead for OS/2..... JRA. */
8278
8279 /****************************************************************************
8280 Reply to a SMBwritebmpx (write block multiplex primary) request.
8281 Always reply with an error, if someone has a platform really needs this,
8282 please contact vl@samba.org
8283 ****************************************************************************/
8284
8285 void reply_writebmpx(struct smb_request *req)
8286 {
8287 START_PROFILE(SMBwriteBmpx);
8288 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8289 END_PROFILE(SMBwriteBmpx);
8290 return;
8291 }
8292
8293 /****************************************************************************
8294 Reply to a SMBwritebs (write block multiplex secondary) request.
8295 Always reply with an error, if someone has a platform really needs this,
8296 please contact vl@samba.org
8297 ****************************************************************************/
8298
8299 void reply_writebs(struct smb_request *req)
8300 {
8301 START_PROFILE(SMBwriteBs);
8302 reply_force_doserror(req, ERRSRV, ERRuseSTD);
8303 END_PROFILE(SMBwriteBs);
8304 return;
8305 }
8306
8307 /****************************************************************************
8308 Reply to a SMBgetattrE.
8309 ****************************************************************************/
8310
8311 void reply_getattrE(struct smb_request *req)
8312 {
8313 connection_struct *conn = req->conn;
8314 int mode;
8315 files_struct *fsp;
8316 struct timespec create_ts;
8317
8318 START_PROFILE(SMBgetattrE);
8319
8320 if (req->wct < 1) {
8321 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8322 END_PROFILE(SMBgetattrE);
8323 return;
8324 }
8325
8326 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8327
8328 if(!fsp || (fsp->conn != conn)) {
8329 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8330 END_PROFILE(SMBgetattrE);
8331 return;
8332 }
8333
8334 /* Do an fstat on this file */
8335 if(fsp_stat(fsp)) {
8336 reply_nterror(req, map_nt_error_from_unix(errno));
8337 END_PROFILE(SMBgetattrE);
8338 return;
8339 }
8340
8341 mode = dos_mode(conn, fsp->fsp_name);
8342
8343 /*
8344 * Convert the times into dos times. Set create
8345 * date to be last modify date as UNIX doesn't save
8346 * this.
8347 */
8348
8349 reply_outbuf(req, 11, 0);
8350
8351 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8352 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8353 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8354 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8355 /* Should we check pending modtime here ? JRA */
8356 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8357 convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8358
8359 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8360 SIVAL(req->outbuf, smb_vwv6, 0);
8361 SIVAL(req->outbuf, smb_vwv8, 0);
8362 } else {
8363 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8364 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8365 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8366 }
8367 SSVAL(req->outbuf,smb_vwv10, mode);
8368
8369 DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8370
8371 END_PROFILE(SMBgetattrE);
8372 return;
8373 }
Samba GIT mirror