?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Remove a bunch of direct inbuf references by adding "buf" to smb_request
[Samba.git] / source3 / smbd / reply.c
bloba9c489cef4742a9e701b18918195b56cfd3e2fa8
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28
29 /* look in server.c for some explanation of these variables */
30 extern enum protocol_types Protocol;
31 extern int max_recv;
32 extern uint32 global_client_caps;
33
34 extern bool global_encrypted_passwords_negotiated;
35
36 /****************************************************************************
37 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
38 path or anything including wildcards.
39 We're assuming here that '/' is not the second byte in any multibyte char
40 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
41 set.
42 ****************************************************************************/
43
44 /* Custom version for processing POSIX paths. */
45 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
46
47 static NTSTATUS check_path_syntax_internal(char *path,
48 bool posix_path,
49 bool *p_last_component_contains_wcard)
50 {
51 char *d = path;
52 const char *s = path;
53 NTSTATUS ret = NT_STATUS_OK;
54 bool start_of_name_component = True;
55
56 *p_last_component_contains_wcard = False;
57
58 while (*s) {
59 if (IS_PATH_SEP(*s,posix_path)) {
60 /*
61 * Safe to assume is not the second part of a mb char
62 * as this is handled below.
63 */
64 /* Eat multiple '/' or '\\' */
65 while (IS_PATH_SEP(*s,posix_path)) {
66 s++;
67 }
68 if ((d != path) && (*s != '\0')) {
69 /* We only care about non-leading or trailing '/' or '\\' */
70 *d++ = '/';
71 }
72
73 start_of_name_component = True;
74 /* New component. */
75 *p_last_component_contains_wcard = False;
76 continue;
77 }
78
79 if (start_of_name_component) {
80 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
81 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
82
83 /*
84 * No mb char starts with '.' so we're safe checking the directory separator here.
85 */
86
87 /* If we just added a '/' - delete it */
88 if ((d > path) && (*(d-1) == '/')) {
89 *(d-1) = '\0';
90 d--;
91 }
92
93 /* Are we at the start ? Can't go back further if so. */
94 if (d <= path) {
95 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
96 break;
97 }
98 /* Go back one level... */
99 /* We know this is safe as '/' cannot be part of a mb sequence. */
100 /* NOTE - if this assumption is invalid we are not in good shape... */
101 /* Decrement d first as d points to the *next* char to write into. */
102 for (d--; d > path; d--) {
103 if (*d == '/')
104 break;
105 }
106 s += 2; /* Else go past the .. */
107 /* We're still at the start of a name component, just the previous one. */
108 continue;
109
110 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
111 if (posix_path) {
112 /* Eat the '.' */
113 s++;
114 continue;
115 }
116 }
117
118 }
119
120 if (!(*s & 0x80)) {
121 if (!posix_path) {
122 if (*s <= 0x1f) {
123 return NT_STATUS_OBJECT_NAME_INVALID;
124 }
125 switch (*s) {
126 case '*':
127 case '?':
128 case '<':
129 case '>':
130 case '"':
131 *p_last_component_contains_wcard = True;
132 break;
133 default:
134 break;
135 }
136 }
137 *d++ = *s++;
138 } else {
139 size_t siz;
140 /* Get the size of the next MB character. */
141 next_codepoint(s,&siz);
142 switch(siz) {
143 case 5:
144 *d++ = *s++;
145 /*fall through*/
146 case 4:
147 *d++ = *s++;
148 /*fall through*/
149 case 3:
150 *d++ = *s++;
151 /*fall through*/
152 case 2:
153 *d++ = *s++;
154 /*fall through*/
155 case 1:
156 *d++ = *s++;
157 break;
158 default:
159 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
160 *d = '\0';
161 return NT_STATUS_INVALID_PARAMETER;
162 }
163 }
164 start_of_name_component = False;
165 }
166
167 *d = '\0';
168
169 return ret;
170 }
171
172 /****************************************************************************
173 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
174 No wildcards allowed.
175 ****************************************************************************/
176
177 NTSTATUS check_path_syntax(char *path)
178 {
179 bool ignore;
180 return check_path_syntax_internal(path, False, &ignore);
181 }
182
183 /****************************************************************************
184 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
185 Wildcards allowed - p_contains_wcard returns true if the last component contained
186 a wildcard.
187 ****************************************************************************/
188
189 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
190 {
191 return check_path_syntax_internal(path, False, p_contains_wcard);
192 }
193
194 /****************************************************************************
195 Check the path for a POSIX client.
196 We're assuming here that '/' is not the second byte in any multibyte char
197 set (a safe assumption).
198 ****************************************************************************/
199
200 NTSTATUS check_path_syntax_posix(char *path)
201 {
202 bool ignore;
203 return check_path_syntax_internal(path, True, &ignore);
204 }
205
206 /****************************************************************************
207 Pull a string and check the path allowing a wilcard - provide for error return.
208 ****************************************************************************/
209
210 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
211 const char *inbuf,
212 uint16 smb_flags2,
213 char **pp_dest,
214 const char *src,
215 size_t src_len,
216 int flags,
217 NTSTATUS *err,
218 bool *contains_wcard)
219 {
220 size_t ret;
221
222 *pp_dest = NULL;
223
224 if (src_len == 0) {
225 ret = srvstr_pull_buf_talloc(ctx,
226 inbuf,
227 smb_flags2,
228 pp_dest,
229 src,
230 flags);
231 } else {
232 ret = srvstr_pull_talloc(ctx,
233 inbuf,
234 smb_flags2,
235 pp_dest,
236 src,
237 src_len,
238 flags);
239 }
240
241 if (!*pp_dest) {
242 *err = NT_STATUS_INVALID_PARAMETER;
243 return ret;
244 }
245
246 *contains_wcard = False;
247
248 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
249 /*
250 * For a DFS path the function parse_dfs_path()
251 * will do the path processing, just make a copy.
252 */
253 *err = NT_STATUS_OK;
254 return ret;
255 }
256
257 if (lp_posix_pathnames()) {
258 *err = check_path_syntax_posix(*pp_dest);
259 } else {
260 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
261 }
262
263 return ret;
264 }
265
266 /****************************************************************************
267 Pull a string and check the path - provide for error return.
268 ****************************************************************************/
269
270 size_t srvstr_get_path(TALLOC_CTX *ctx,
271 const char *inbuf,
272 uint16 smb_flags2,
273 char **pp_dest,
274 const char *src,
275 size_t src_len,
276 int flags,
277 NTSTATUS *err)
278 {
279 size_t ret;
280
281 *pp_dest = NULL;
282
283 if (src_len == 0) {
284 ret = srvstr_pull_buf_talloc(ctx,
285 inbuf,
286 smb_flags2,
287 pp_dest,
288 src,
289 flags);
290 } else {
291 ret = srvstr_pull_talloc(ctx,
292 inbuf,
293 smb_flags2,
294 pp_dest,
295 src,
296 src_len,
297 flags);
298 }
299
300 if (!*pp_dest) {
301 *err = NT_STATUS_INVALID_PARAMETER;
302 return ret;
303 }
304
305 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
306 /*
307 * For a DFS path the function parse_dfs_path()
308 * will do the path processing, just make a copy.
309 */
310 *err = NT_STATUS_OK;
311 return ret;
312 }
313
314 if (lp_posix_pathnames()) {
315 *err = check_path_syntax_posix(*pp_dest);
316 } else {
317 *err = check_path_syntax(*pp_dest);
318 }
319
320 return ret;
321 }
322
323 /****************************************************************************
324 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
325 ****************************************************************************/
326
327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
328 files_struct *fsp)
329 {
330 if (!(fsp) || !(conn)) {
331 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
332 return False;
333 }
334 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
335 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
336 return False;
337 }
338 return True;
339 }
340
341 /****************************************************************************
342 Check if we have a correct fsp pointing to a file.
343 ****************************************************************************/
344
345 bool check_fsp(connection_struct *conn, struct smb_request *req,
346 files_struct *fsp)
347 {
348 if (!check_fsp_open(conn, req, fsp)) {
349 return False;
350 }
351 if ((fsp)->is_directory) {
352 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
353 return False;
354 }
355 if ((fsp)->fh->fd == -1) {
356 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
357 return False;
358 }
359 (fsp)->num_smb_operations++;
360 return True;
361 }
362
363 /****************************************************************************
364 Check if we have a correct fsp pointing to a quota fake file. Replacement for
365 the CHECK_NTQUOTA_HANDLE_OK macro.
366 ****************************************************************************/
367
368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
369 files_struct *fsp)
370 {
371 if (!check_fsp_open(conn, req, fsp)) {
372 return false;
373 }
374
375 if (fsp->is_directory) {
376 return false;
377 }
378
379 if (fsp->fake_file_handle == NULL) {
380 return false;
381 }
382
383 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
384 return false;
385 }
386
387 if (fsp->fake_file_handle->private_data == NULL) {
388 return false;
389 }
390
391 return true;
392 }
393
394 /****************************************************************************
395 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
396 ****************************************************************************/
397
398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
399 files_struct *fsp)
400 {
401 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
402 && (req->vuid == (fsp)->vuid)) {
403 return True;
404 }
405
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return False;
408 }
409
410 /****************************************************************************
411 Reply to a (netbios-level) special message.
412 ****************************************************************************/
413
414 void reply_special(char *inbuf)
415 {
416 int msg_type = CVAL(inbuf,0);
417 int msg_flags = CVAL(inbuf,1);
418 fstring name1,name2;
419 char name_type = 0;
420
421 /*
422 * We only really use 4 bytes of the outbuf, but for the smb_setlen
423 * calculation & friends (srv_send_smb uses that) we need the full smb
424 * header.
425 */
426 char outbuf[smb_size];
427
428 static bool already_got_session = False;
429
430 *name1 = *name2 = 0;
431
432 memset(outbuf, '\0', sizeof(outbuf));
433
434 smb_setlen(outbuf,0);
435
436 switch (msg_type) {
437 case 0x81: /* session request */
438
439 if (already_got_session) {
440 exit_server_cleanly("multiple session request not permitted");
441 }
442
443 SCVAL(outbuf,0,0x82);
444 SCVAL(outbuf,3,0);
445 if (name_len(inbuf+4) > 50 ||
446 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
447 DEBUG(0,("Invalid name length in session request\n"));
448 return;
449 }
450 name_extract(inbuf,4,name1);
451 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
452 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
453 name1,name2));
454
455 set_local_machine_name(name1, True);
456 set_remote_machine_name(name2, True);
457
458 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
459 get_local_machine_name(), get_remote_machine_name(),
460 name_type));
461
462 if (name_type == 'R') {
463 /* We are being asked for a pathworks session ---
464 no thanks! */
465 SCVAL(outbuf, 0,0x83);
466 break;
467 }
468
469 /* only add the client's machine name to the list
470 of possibly valid usernames if we are operating
471 in share mode security */
472 if (lp_security() == SEC_SHARE) {
473 add_session_user(get_remote_machine_name());
474 }
475
476 reload_services(True);
477 reopen_logs();
478
479 already_got_session = True;
480 break;
481
482 case 0x89: /* session keepalive request
483 (some old clients produce this?) */
484 SCVAL(outbuf,0,SMBkeepalive);
485 SCVAL(outbuf,3,0);
486 break;
487
488 case 0x82: /* positive session response */
489 case 0x83: /* negative session response */
490 case 0x84: /* retarget session response */
491 DEBUG(0,("Unexpected session response\n"));
492 break;
493
494 case SMBkeepalive: /* session keepalive */
495 default:
496 return;
497 }
498
499 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
500 msg_type, msg_flags));
501
502 srv_send_smb(smbd_server_fd(), outbuf, false);
503 return;
504 }
505
506 /****************************************************************************
507 Reply to a tcon.
508 conn POINTER CAN BE NULL HERE !
509 ****************************************************************************/
510
511 void reply_tcon(struct smb_request *req)
512 {
513 connection_struct *conn = req->conn;
514 const char *service;
515 char *service_buf = NULL;
516 char *password = NULL;
517 char *dev = NULL;
518 int pwlen=0;
519 NTSTATUS nt_status;
520 const char *p;
521 DATA_BLOB password_blob;
522 TALLOC_CTX *ctx = talloc_tos();
523
524 START_PROFILE(SMBtcon);
525
526 if (req->buflen < 4) {
527 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
528 END_PROFILE(SMBtcon);
529 return;
530 }
531
532 p = (const char *)req->buf + 1;
533 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
534 &service_buf, p, STR_TERMINATE) + 1;
535 pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
536 &password, p, STR_TERMINATE) + 1;
537 p += pwlen;
538 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
539 &dev, p, STR_TERMINATE) + 1;
540
541 if (service_buf == NULL || password == NULL || dev == NULL) {
542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
543 END_PROFILE(SMBtcon);
544 return;
545 }
546 p = strrchr_m(service_buf,'\\');
547 if (p) {
548 service = p+1;
549 } else {
550 service = service_buf;
551 }
552
553 password_blob = data_blob(password, pwlen+1);
554
555 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
556 req->conn = conn;
557
558 data_blob_clear_free(&password_blob);
559
560 if (!conn) {
561 reply_nterror(req, nt_status);
562 END_PROFILE(SMBtcon);
563 return;
564 }
565
566 reply_outbuf(req, 2, 0);
567 SSVAL(req->outbuf,smb_vwv0,max_recv);
568 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
569 SSVAL(req->outbuf,smb_tid,conn->cnum);
570
571 DEBUG(3,("tcon service=%s cnum=%d\n",
572 service, conn->cnum));
573
574 END_PROFILE(SMBtcon);
575 return;
576 }
577
578 /****************************************************************************
579 Reply to a tcon and X.
580 conn POINTER CAN BE NULL HERE !
581 ****************************************************************************/
582
583 void reply_tcon_and_X(struct smb_request *req)
584 {
585 connection_struct *conn = req->conn;
586 const char *service = NULL;
587 DATA_BLOB password;
588 TALLOC_CTX *ctx = talloc_tos();
589 /* what the cleint thinks the device is */
590 char *client_devicetype = NULL;
591 /* what the server tells the client the share represents */
592 const char *server_devicetype;
593 NTSTATUS nt_status;
594 int passlen;
595 char *path = NULL;
596 const char *p, *q;
597 uint16 tcon_flags;
598
599 START_PROFILE(SMBtconX);
600
601 if (req->wct < 4) {
602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
603 END_PROFILE(SMBtconX);
604 return;
605 }
606
607 passlen = SVAL(req->inbuf,smb_vwv3);
608 tcon_flags = SVAL(req->inbuf,smb_vwv2);
609
610 /* we might have to close an old one */
611 if ((tcon_flags & 0x1) && conn) {
612 close_cnum(conn,req->vuid);
613 req->conn = NULL;
614 conn = NULL;
615 }
616
617 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
618 reply_doserror(req, ERRDOS, ERRbuftoosmall);
619 END_PROFILE(SMBtconX);
620 return;
621 }
622
623 if (global_encrypted_passwords_negotiated) {
624 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
625 if (lp_security() == SEC_SHARE) {
626 /*
627 * Security = share always has a pad byte
628 * after the password.
629 */
630 p = (const char *)req->buf + passlen + 1;
631 } else {
632 p = (const char *)req->buf + passlen;
633 }
634 } else {
635 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
636 /* Ensure correct termination */
637 password.data[passlen]=0;
638 p = (const char *)req->buf + passlen + 1;
639 }
640
641 p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
642 STR_TERMINATE);
643
644 if (path == NULL) {
645 data_blob_clear_free(&password);
646 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
647 END_PROFILE(SMBtconX);
648 return;
649 }
650
651 /*
652 * the service name can be either: \\server\share
653 * or share directly like on the DELL PowerVault 705
654 */
655 if (*path=='\\') {
656 q = strchr_m(path+2,'\\');
657 if (!q) {
658 data_blob_clear_free(&password);
659 reply_doserror(req, ERRDOS, ERRnosuchshare);
660 END_PROFILE(SMBtconX);
661 return;
662 }
663 service = q+1;
664 } else {
665 service = path;
666 }
667
668 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
669 &client_devicetype, p,
670 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
671
672 if (client_devicetype == NULL) {
673 data_blob_clear_free(&password);
674 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
675 END_PROFILE(SMBtconX);
676 return;
677 }
678
679 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
680
681 conn = make_connection(service, password, client_devicetype,
682 req->vuid, &nt_status);
683 req->conn =conn;
684
685 data_blob_clear_free(&password);
686
687 if (!conn) {
688 reply_nterror(req, nt_status);
689 END_PROFILE(SMBtconX);
690 return;
691 }
692
693 if ( IS_IPC(conn) )
694 server_devicetype = "IPC";
695 else if ( IS_PRINT(conn) )
696 server_devicetype = "LPT1:";
697 else
698 server_devicetype = "A:";
699
700 if (Protocol < PROTOCOL_NT1) {
701 reply_outbuf(req, 2, 0);
702 if (message_push_string(&req->outbuf, server_devicetype,
703 STR_TERMINATE|STR_ASCII) == -1) {
704 reply_nterror(req, NT_STATUS_NO_MEMORY);
705 END_PROFILE(SMBtconX);
706 return;
707 }
708 } else {
709 /* NT sets the fstype of IPC$ to the null string */
710 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
711
712 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
713 /* Return permissions. */
714 uint32 perm1 = 0;
715 uint32 perm2 = 0;
716
717 reply_outbuf(req, 7, 0);
718
719 if (IS_IPC(conn)) {
720 perm1 = FILE_ALL_ACCESS;
721 perm2 = FILE_ALL_ACCESS;
722 } else {
723 perm1 = CAN_WRITE(conn) ?
724 SHARE_ALL_ACCESS :
725 SHARE_READ_ONLY;
726 }
727
728 SIVAL(req->outbuf, smb_vwv3, perm1);
729 SIVAL(req->outbuf, smb_vwv5, perm2);
730 } else {
731 reply_outbuf(req, 3, 0);
732 }
733
734 if ((message_push_string(&req->outbuf, server_devicetype,
735 STR_TERMINATE|STR_ASCII) == -1)
736 || (message_push_string(&req->outbuf, fstype,
737 STR_TERMINATE) == -1)) {
738 reply_nterror(req, NT_STATUS_NO_MEMORY);
739 END_PROFILE(SMBtconX);
740 return;
741 }
742
743 /* what does setting this bit do? It is set by NT4 and
744 may affect the ability to autorun mounted cdroms */
745 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
746 (lp_csc_policy(SNUM(conn)) << 2));
747
748 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
749 DEBUG(2,("Serving %s as a Dfs root\n",
750 lp_servicename(SNUM(conn)) ));
751 SSVAL(req->outbuf, smb_vwv2,
752 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
753 }
754 }
755
756
757 DEBUG(3,("tconX service=%s \n",
758 service));
759
760 /* set the incoming and outgoing tid to the just created one */
761 SSVAL(req->inbuf,smb_tid,conn->cnum);
762 SSVAL(req->outbuf,smb_tid,conn->cnum);
763
764 END_PROFILE(SMBtconX);
765
766 chain_reply(req);
767 return;
768 }
769
770 /****************************************************************************
771 Reply to an unknown type.
772 ****************************************************************************/
773
774 void reply_unknown_new(struct smb_request *req, uint8 type)
775 {
776 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
777 smb_fn_name(type), type, type));
778 reply_doserror(req, ERRSRV, ERRunknownsmb);
779 return;
780 }
781
782 /****************************************************************************
783 Reply to an ioctl.
784 conn POINTER CAN BE NULL HERE !
785 ****************************************************************************/
786
787 void reply_ioctl(struct smb_request *req)
788 {
789 connection_struct *conn = req->conn;
790 uint16 device;
791 uint16 function;
792 uint32 ioctl_code;
793 int replysize;
794 char *p;
795
796 START_PROFILE(SMBioctl);
797
798 if (req->wct < 3) {
799 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
800 END_PROFILE(SMBioctl);
801 return;
802 }
803
804 device = SVAL(req->inbuf,smb_vwv1);
805 function = SVAL(req->inbuf,smb_vwv2);
806 ioctl_code = (device << 16) + function;
807
808 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
809
810 switch (ioctl_code) {
811 case IOCTL_QUERY_JOB_INFO:
812 replysize = 32;
813 break;
814 default:
815 reply_doserror(req, ERRSRV, ERRnosupport);
816 END_PROFILE(SMBioctl);
817 return;
818 }
819
820 reply_outbuf(req, 8, replysize+1);
821 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
822 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
823 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
824 p = smb_buf(req->outbuf);
825 memset(p, '\0', replysize+1); /* valgrind-safe. */
826 p += 1; /* Allow for alignment */
827
828 switch (ioctl_code) {
829 case IOCTL_QUERY_JOB_INFO:
830 {
831 files_struct *fsp = file_fsp(
832 req, SVAL(req->inbuf, smb_vwv0));
833 if (!fsp) {
834 reply_doserror(req, ERRDOS, ERRbadfid);
835 END_PROFILE(SMBioctl);
836 return;
837 }
838 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
839 srvstr_push((char *)req->outbuf, req->flags2, p+2,
840 global_myname(), 15,
841 STR_TERMINATE|STR_ASCII);
842 if (conn) {
843 srvstr_push((char *)req->outbuf, req->flags2,
844 p+18, lp_servicename(SNUM(conn)),
845 13, STR_TERMINATE|STR_ASCII);
846 } else {
847 memset(p+18, 0, 13);
848 }
849 break;
850 }
851 }
852
853 END_PROFILE(SMBioctl);
854 return;
855 }
856
857 /****************************************************************************
858 Strange checkpath NTSTATUS mapping.
859 ****************************************************************************/
860
861 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
862 {
863 /* Strange DOS error code semantics only for checkpath... */
864 if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
865 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
866 /* We need to map to ERRbadpath */
867 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
868 }
869 }
870 return status;
871 }
872
873 /****************************************************************************
874 Reply to a checkpath.
875 ****************************************************************************/
876
877 void reply_checkpath(struct smb_request *req)
878 {
879 connection_struct *conn = req->conn;
880 char *name = NULL;
881 SMB_STRUCT_STAT sbuf;
882 NTSTATUS status;
883 TALLOC_CTX *ctx = talloc_tos();
884
885 START_PROFILE(SMBcheckpath);
886
887 srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
888 (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
889 if (!NT_STATUS_IS_OK(status)) {
890 status = map_checkpath_error((char *)req->inbuf, status);
891 reply_nterror(req, status);
892 END_PROFILE(SMBcheckpath);
893 return;
894 }
895
896 status = resolve_dfspath(ctx, conn,
897 req->flags2 & FLAGS2_DFS_PATHNAMES,
898 name,
899 &name);
900 if (!NT_STATUS_IS_OK(status)) {
901 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
902 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
903 ERRSRV, ERRbadpath);
904 END_PROFILE(SMBcheckpath);
905 return;
906 }
907 goto path_err;
908 }
909
910 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
911
912 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
913 if (!NT_STATUS_IS_OK(status)) {
914 goto path_err;
915 }
916
917 status = check_name(conn, name);
918 if (!NT_STATUS_IS_OK(status)) {
919 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
920 goto path_err;
921 }
922
923 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
924 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
925 status = map_nt_error_from_unix(errno);
926 goto path_err;
927 }
928
929 if (!S_ISDIR(sbuf.st_mode)) {
930 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
931 ERRDOS, ERRbadpath);
932 END_PROFILE(SMBcheckpath);
933 return;
934 }
935
936 reply_outbuf(req, 0, 0);
937
938 END_PROFILE(SMBcheckpath);
939 return;
940
941 path_err:
942
943 END_PROFILE(SMBcheckpath);
944
945 /* We special case this - as when a Windows machine
946 is parsing a path is steps through the components
947 one at a time - if a component fails it expects
948 ERRbadpath, not ERRbadfile.
949 */
950 status = map_checkpath_error((char *)req->inbuf, status);
951 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
952 /*
953 * Windows returns different error codes if
954 * the parent directory is valid but not the
955 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
956 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
957 * if the path is invalid.
958 */
959 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
960 ERRDOS, ERRbadpath);
961 return;
962 }
963
964 reply_nterror(req, status);
965 }
966
967 /****************************************************************************
968 Reply to a getatr.
969 ****************************************************************************/
970
971 void reply_getatr(struct smb_request *req)
972 {
973 connection_struct *conn = req->conn;
974 char *fname = NULL;
975 SMB_STRUCT_STAT sbuf;
976 int mode=0;
977 SMB_OFF_T size=0;
978 time_t mtime=0;
979 const char *p;
980 NTSTATUS status;
981 TALLOC_CTX *ctx = talloc_tos();
982
983 START_PROFILE(SMBgetatr);
984
985 p = (const char *)req->buf + 1;
986 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
987 0, STR_TERMINATE, &status);
988 if (!NT_STATUS_IS_OK(status)) {
989 reply_nterror(req, status);
990 END_PROFILE(SMBgetatr);
991 return;
992 }
993
994 status = resolve_dfspath(ctx, conn,
995 req->flags2 & FLAGS2_DFS_PATHNAMES,
996 fname,
997 &fname);
998 if (!NT_STATUS_IS_OK(status)) {
999 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1000 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1001 ERRSRV, ERRbadpath);
1002 END_PROFILE(SMBgetatr);
1003 return;
1004 }
1005 reply_nterror(req, status);
1006 END_PROFILE(SMBgetatr);
1007 return;
1008 }
1009
1010 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1011 under WfWg - weird! */
1012 if (*fname == '\0') {
1013 mode = aHIDDEN | aDIR;
1014 if (!CAN_WRITE(conn)) {
1015 mode |= aRONLY;
1016 }
1017 size = 0;
1018 mtime = 0;
1019 } else {
1020 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1021 if (!NT_STATUS_IS_OK(status)) {
1022 reply_nterror(req, status);
1023 END_PROFILE(SMBgetatr);
1024 return;
1025 }
1026 status = check_name(conn, fname);
1027 if (!NT_STATUS_IS_OK(status)) {
1028 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1029 reply_nterror(req, status);
1030 END_PROFILE(SMBgetatr);
1031 return;
1032 }
1033 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1034 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1035 reply_unixerror(req, ERRDOS,ERRbadfile);
1036 END_PROFILE(SMBgetatr);
1037 return;
1038 }
1039
1040 mode = dos_mode(conn,fname,&sbuf);
1041 size = sbuf.st_size;
1042 mtime = sbuf.st_mtime;
1043 if (mode & aDIR) {
1044 size = 0;
1045 }
1046 }
1047
1048 reply_outbuf(req, 10, 0);
1049
1050 SSVAL(req->outbuf,smb_vwv0,mode);
1051 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1052 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1053 } else {
1054 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1055 }
1056 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1057
1058 if (Protocol >= PROTOCOL_NT1) {
1059 SSVAL(req->outbuf, smb_flg2,
1060 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1061 }
1062
1063 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1064
1065 END_PROFILE(SMBgetatr);
1066 return;
1067 }
1068
1069 /****************************************************************************
1070 Reply to a setatr.
1071 ****************************************************************************/
1072
1073 void reply_setatr(struct smb_request *req)
1074 {
1075 struct timespec ts[2];
1076 connection_struct *conn = req->conn;
1077 char *fname = NULL;
1078 int mode;
1079 time_t mtime;
1080 SMB_STRUCT_STAT sbuf;
1081 const char *p;
1082 NTSTATUS status;
1083 TALLOC_CTX *ctx = talloc_tos();
1084
1085 START_PROFILE(SMBsetatr);
1086
1087 ZERO_STRUCT(ts);
1088
1089 if (req->wct < 2) {
1090 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1091 return;
1092 }
1093
1094 p = (const char *)req->buf + 1;
1095 p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1096 0, STR_TERMINATE, &status);
1097 if (!NT_STATUS_IS_OK(status)) {
1098 reply_nterror(req, status);
1099 END_PROFILE(SMBsetatr);
1100 return;
1101 }
1102
1103 status = resolve_dfspath(ctx, conn,
1104 req->flags2 & FLAGS2_DFS_PATHNAMES,
1105 fname,
1106 &fname);
1107 if (!NT_STATUS_IS_OK(status)) {
1108 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1109 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1110 ERRSRV, ERRbadpath);
1111 END_PROFILE(SMBsetatr);
1112 return;
1113 }
1114 reply_nterror(req, status);
1115 END_PROFILE(SMBsetatr);
1116 return;
1117 }
1118
1119 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1120 if (!NT_STATUS_IS_OK(status)) {
1121 reply_nterror(req, status);
1122 END_PROFILE(SMBsetatr);
1123 return;
1124 }
1125
1126 status = check_name(conn, fname);
1127 if (!NT_STATUS_IS_OK(status)) {
1128 reply_nterror(req, status);
1129 END_PROFILE(SMBsetatr);
1130 return;
1131 }
1132
1133 if (fname[0] == '.' && fname[1] == '\0') {
1134 /*
1135 * Not sure here is the right place to catch this
1136 * condition. Might be moved to somewhere else later -- vl
1137 */
1138 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1139 END_PROFILE(SMBsetatr);
1140 return;
1141 }
1142
1143 mode = SVAL(req->inbuf,smb_vwv0);
1144 mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1145
1146 ts[1] = convert_time_t_to_timespec(mtime);
1147 status = smb_set_file_time(conn, NULL, fname,
1148 &sbuf, ts, true);
1149 if (!NT_STATUS_IS_OK(status)) {
1150 reply_unixerror(req, ERRDOS, ERRnoaccess);
1151 END_PROFILE(SMBsetatr);
1152 return;
1153 }
1154
1155 if (mode != FILE_ATTRIBUTE_NORMAL) {
1156 if (VALID_STAT_OF_DIR(sbuf))
1157 mode |= aDIR;
1158 else
1159 mode &= ~aDIR;
1160
1161 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1162 reply_unixerror(req, ERRDOS, ERRnoaccess);
1163 END_PROFILE(SMBsetatr);
1164 return;
1165 }
1166 }
1167
1168 reply_outbuf(req, 0, 0);
1169
1170 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1171
1172 END_PROFILE(SMBsetatr);
1173 return;
1174 }
1175
1176 /****************************************************************************
1177 Reply to a dskattr.
1178 ****************************************************************************/
1179
1180 void reply_dskattr(struct smb_request *req)
1181 {
1182 connection_struct *conn = req->conn;
1183 uint64_t dfree,dsize,bsize;
1184 START_PROFILE(SMBdskattr);
1185
1186 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1187 reply_unixerror(req, ERRHRD, ERRgeneral);
1188 END_PROFILE(SMBdskattr);
1189 return;
1190 }
1191
1192 reply_outbuf(req, 5, 0);
1193
1194 if (Protocol <= PROTOCOL_LANMAN2) {
1195 double total_space, free_space;
1196 /* we need to scale this to a number that DOS6 can handle. We
1197 use floating point so we can handle large drives on systems
1198 that don't have 64 bit integers
1199
1200 we end up displaying a maximum of 2G to DOS systems
1201 */
1202 total_space = dsize * (double)bsize;
1203 free_space = dfree * (double)bsize;
1204
1205 dsize = (uint64_t)((total_space+63*512) / (64*512));
1206 dfree = (uint64_t)((free_space+63*512) / (64*512));
1207
1208 if (dsize > 0xFFFF) dsize = 0xFFFF;
1209 if (dfree > 0xFFFF) dfree = 0xFFFF;
1210
1211 SSVAL(req->outbuf,smb_vwv0,dsize);
1212 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1213 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1214 SSVAL(req->outbuf,smb_vwv3,dfree);
1215 } else {
1216 SSVAL(req->outbuf,smb_vwv0,dsize);
1217 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1218 SSVAL(req->outbuf,smb_vwv2,512);
1219 SSVAL(req->outbuf,smb_vwv3,dfree);
1220 }
1221
1222 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1223
1224 END_PROFILE(SMBdskattr);
1225 return;
1226 }
1227
1228 /****************************************************************************
1229 Reply to a search.
1230 Can be called from SMBsearch, SMBffirst or SMBfunique.
1231 ****************************************************************************/
1232
1233 void reply_search(struct smb_request *req)
1234 {
1235 connection_struct *conn = req->conn;
1236 const char *mask = NULL;
1237 char *directory = NULL;
1238 char *fname = NULL;
1239 SMB_OFF_T size;
1240 uint32 mode;
1241 time_t date;
1242 uint32 dirtype;
1243 unsigned int numentries = 0;
1244 unsigned int maxentries = 0;
1245 bool finished = False;
1246 const char *p;
1247 int status_len;
1248 char *path = NULL;
1249 char status[21];
1250 int dptr_num= -1;
1251 bool check_descend = False;
1252 bool expect_close = False;
1253 NTSTATUS nt_status;
1254 bool mask_contains_wcard = False;
1255 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1256 TALLOC_CTX *ctx = talloc_tos();
1257 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1258
1259 START_PROFILE(SMBsearch);
1260
1261 if (req->wct < 2) {
1262 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1263 END_PROFILE(SMBsearch);
1264 return;
1265 }
1266
1267 if (lp_posix_pathnames()) {
1268 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1269 END_PROFILE(SMBsearch);
1270 return;
1271 }
1272
1273 /* If we were called as SMBffirst then we must expect close. */
1274 if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1275 expect_close = True;
1276 }
1277
1278 reply_outbuf(req, 1, 3);
1279 maxentries = SVAL(req->inbuf,smb_vwv0);
1280 dirtype = SVAL(req->inbuf,smb_vwv1);
1281 p = (const char *)req->buf + 1;
1282 p += srvstr_get_path_wcard(ctx,
1283 (char *)req->inbuf,
1284 req->flags2,
1285 &path,
1286 p,
1287 0,
1288 STR_TERMINATE,
1289 &nt_status,
1290 &mask_contains_wcard);
1291 if (!NT_STATUS_IS_OK(nt_status)) {
1292 reply_nterror(req, nt_status);
1293 END_PROFILE(SMBsearch);
1294 return;
1295 }
1296
1297 nt_status = resolve_dfspath_wcard(ctx, conn,
1298 req->flags2 & FLAGS2_DFS_PATHNAMES,
1299 path,
1300 &path,
1301 &mask_contains_wcard);
1302 if (!NT_STATUS_IS_OK(nt_status)) {
1303 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1304 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1305 ERRSRV, ERRbadpath);
1306 END_PROFILE(SMBsearch);
1307 return;
1308 }
1309 reply_nterror(req, nt_status);
1310 END_PROFILE(SMBsearch);
1311 return;
1312 }
1313
1314 p++;
1315 status_len = SVAL(p, 0);
1316 p += 2;
1317
1318 /* dirtype &= ~aDIR; */
1319
1320 if (status_len == 0) {
1321 SMB_STRUCT_STAT sbuf;
1322
1323 nt_status = unix_convert(ctx, conn, path, True,
1324 &directory, NULL, &sbuf);
1325 if (!NT_STATUS_IS_OK(nt_status)) {
1326 reply_nterror(req, nt_status);
1327 END_PROFILE(SMBsearch);
1328 return;
1329 }
1330
1331 nt_status = check_name(conn, directory);
1332 if (!NT_STATUS_IS_OK(nt_status)) {
1333 reply_nterror(req, nt_status);
1334 END_PROFILE(SMBsearch);
1335 return;
1336 }
1337
1338 p = strrchr_m(directory,'/');
1339 if ((p != NULL) && (*directory != '/')) {
1340 mask = p + 1;
1341 directory = talloc_strndup(ctx, directory,
1342 PTR_DIFF(p, directory));
1343 } else {
1344 mask = directory;
1345 directory = talloc_strdup(ctx,".");
1346 }
1347
1348 if (!directory) {
1349 reply_nterror(req, NT_STATUS_NO_MEMORY);
1350 END_PROFILE(SMBsearch);
1351 return;
1352 }
1353
1354 memset((char *)status,'\0',21);
1355 SCVAL(status,0,(dirtype & 0x1F));
1356
1357 nt_status = dptr_create(conn,
1358 directory,
1359 True,
1360 expect_close,
1361 req->smbpid,
1362 mask,
1363 mask_contains_wcard,
1364 dirtype,
1365 &conn->dirptr);
1366 if (!NT_STATUS_IS_OK(nt_status)) {
1367 reply_nterror(req, nt_status);
1368 END_PROFILE(SMBsearch);
1369 return;
1370 }
1371 dptr_num = dptr_dnum(conn->dirptr);
1372 } else {
1373 int status_dirtype;
1374
1375 memcpy(status,p,21);
1376 status_dirtype = CVAL(status,0) & 0x1F;
1377 if (status_dirtype != (dirtype & 0x1F)) {
1378 dirtype = status_dirtype;
1379 }
1380
1381 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1382 if (!conn->dirptr) {
1383 goto SearchEmpty;
1384 }
1385 string_set(&conn->dirpath,dptr_path(dptr_num));
1386 mask = dptr_wcard(dptr_num);
1387 if (!mask) {
1388 goto SearchEmpty;
1389 }
1390 /*
1391 * For a 'continue' search we have no string. So
1392 * check from the initial saved string.
1393 */
1394 mask_contains_wcard = ms_has_wild(mask);
1395 dirtype = dptr_attr(dptr_num);
1396 }
1397
1398 DEBUG(4,("dptr_num is %d\n",dptr_num));
1399
1400 if ((dirtype&0x1F) == aVOLID) {
1401 char buf[DIR_STRUCT_SIZE];
1402 memcpy(buf,status,21);
1403 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1404 0,aVOLID,0,!allow_long_path_components)) {
1405 reply_nterror(req, NT_STATUS_NO_MEMORY);
1406 END_PROFILE(SMBsearch);
1407 return;
1408 }
1409 dptr_fill(buf+12,dptr_num);
1410 if (dptr_zero(buf+12) && (status_len==0)) {
1411 numentries = 1;
1412 } else {
1413 numentries = 0;
1414 }
1415 if (message_push_blob(&req->outbuf,
1416 data_blob_const(buf, sizeof(buf)))
1417 == -1) {
1418 reply_nterror(req, NT_STATUS_NO_MEMORY);
1419 END_PROFILE(SMBsearch);
1420 return;
1421 }
1422 } else {
1423 unsigned int i;
1424 maxentries = MIN(
1425 maxentries,
1426 ((BUFFER_SIZE -
1427 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1428 /DIR_STRUCT_SIZE));
1429
1430 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1431 conn->dirpath,lp_dontdescend(SNUM(conn))));
1432 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1433 check_descend = True;
1434 }
1435
1436 for (i=numentries;(i<maxentries) && !finished;i++) {
1437 finished = !get_dir_entry(ctx,
1438 conn,
1439 mask,
1440 dirtype,
1441 &fname,
1442 &size,
1443 &mode,
1444 &date,
1445 check_descend,
1446 ask_sharemode);
1447 if (!finished) {
1448 char buf[DIR_STRUCT_SIZE];
1449 memcpy(buf,status,21);
1450 if (!make_dir_struct(ctx,
1451 buf,
1452 mask,
1453 fname,
1454 size,
1455 mode,
1456 date,
1457 !allow_long_path_components)) {
1458 reply_nterror(req, NT_STATUS_NO_MEMORY);
1459 END_PROFILE(SMBsearch);
1460 return;
1461 }
1462 if (!dptr_fill(buf+12,dptr_num)) {
1463 break;
1464 }
1465 if (message_push_blob(&req->outbuf,
1466 data_blob_const(buf, sizeof(buf)))
1467 == -1) {
1468 reply_nterror(req, NT_STATUS_NO_MEMORY);
1469 END_PROFILE(SMBsearch);
1470 return;
1471 }
1472 numentries++;
1473 }
1474 }
1475 }
1476
1477 SearchEmpty:
1478
1479 /* If we were called as SMBffirst with smb_search_id == NULL
1480 and no entries were found then return error and close dirptr
1481 (X/Open spec) */
1482
1483 if (numentries == 0) {
1484 dptr_close(&dptr_num);
1485 } else if(expect_close && status_len == 0) {
1486 /* Close the dptr - we know it's gone */
1487 dptr_close(&dptr_num);
1488 }
1489
1490 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1491 if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1492 dptr_close(&dptr_num);
1493 }
1494
1495 if ((numentries == 0) && !mask_contains_wcard) {
1496 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1497 END_PROFILE(SMBsearch);
1498 return;
1499 }
1500
1501 SSVAL(req->outbuf,smb_vwv0,numentries);
1502 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1503 SCVAL(smb_buf(req->outbuf),0,5);
1504 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1505
1506 /* The replies here are never long name. */
1507 SSVAL(req->outbuf, smb_flg2,
1508 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1509 if (!allow_long_path_components) {
1510 SSVAL(req->outbuf, smb_flg2,
1511 SVAL(req->outbuf, smb_flg2)
1512 & (~FLAGS2_LONG_PATH_COMPONENTS));
1513 }
1514
1515 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1516 SSVAL(req->outbuf, smb_flg2,
1517 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1518
1519 if (!directory) {
1520 directory = dptr_path(dptr_num);
1521 }
1522
1523 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1524 smb_fn_name(CVAL(req->inbuf,smb_com)),
1525 mask,
1526 directory ? directory : "./",
1527 dirtype,
1528 numentries,
1529 maxentries ));
1530
1531 END_PROFILE(SMBsearch);
1532 return;
1533 }
1534
1535 /****************************************************************************
1536 Reply to a fclose (stop directory search).
1537 ****************************************************************************/
1538
1539 void reply_fclose(struct smb_request *req)
1540 {
1541 int status_len;
1542 char status[21];
1543 int dptr_num= -2;
1544 const char *p;
1545 char *path = NULL;
1546 NTSTATUS err;
1547 bool path_contains_wcard = False;
1548 TALLOC_CTX *ctx = talloc_tos();
1549
1550 START_PROFILE(SMBfclose);
1551
1552 if (lp_posix_pathnames()) {
1553 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1554 END_PROFILE(SMBfclose);
1555 return;
1556 }
1557
1558 p = (const char *)req->buf + 1;
1559 p += srvstr_get_path_wcard(ctx,
1560 (char *)req->inbuf,
1561 req->flags2,
1562 &path,
1563 p,
1564 0,
1565 STR_TERMINATE,
1566 &err,
1567 &path_contains_wcard);
1568 if (!NT_STATUS_IS_OK(err)) {
1569 reply_nterror(req, err);
1570 END_PROFILE(SMBfclose);
1571 return;
1572 }
1573 p++;
1574 status_len = SVAL(p,0);
1575 p += 2;
1576
1577 if (status_len == 0) {
1578 reply_doserror(req, ERRSRV, ERRsrverror);
1579 END_PROFILE(SMBfclose);
1580 return;
1581 }
1582
1583 memcpy(status,p,21);
1584
1585 if(dptr_fetch(status+12,&dptr_num)) {
1586 /* Close the dptr - we know it's gone */
1587 dptr_close(&dptr_num);
1588 }
1589
1590 reply_outbuf(req, 1, 0);
1591 SSVAL(req->outbuf,smb_vwv0,0);
1592
1593 DEBUG(3,("search close\n"));
1594
1595 END_PROFILE(SMBfclose);
1596 return;
1597 }
1598
1599 /****************************************************************************
1600 Reply to an open.
1601 ****************************************************************************/
1602
1603 void reply_open(struct smb_request *req)
1604 {
1605 connection_struct *conn = req->conn;
1606 char *fname = NULL;
1607 uint32 fattr=0;
1608 SMB_OFF_T size = 0;
1609 time_t mtime=0;
1610 int info;
1611 SMB_STRUCT_STAT sbuf;
1612 files_struct *fsp;
1613 int oplock_request;
1614 int deny_mode;
1615 uint32 dos_attr;
1616 uint32 access_mask;
1617 uint32 share_mode;
1618 uint32 create_disposition;
1619 uint32 create_options = 0;
1620 NTSTATUS status;
1621 TALLOC_CTX *ctx = talloc_tos();
1622
1623 START_PROFILE(SMBopen);
1624
1625 if (req->wct < 2) {
1626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1627 END_PROFILE(SMBopen);
1628 return;
1629 }
1630
1631 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1632 deny_mode = SVAL(req->inbuf,smb_vwv0);
1633 dos_attr = SVAL(req->inbuf,smb_vwv1);
1634
1635 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1636 (const char *)req->buf+1, 0, STR_TERMINATE, &status);
1637 if (!NT_STATUS_IS_OK(status)) {
1638 reply_nterror(req, status);
1639 END_PROFILE(SMBopen);
1640 return;
1641 }
1642
1643 if (!map_open_params_to_ntcreate(
1644 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1645 &share_mode, &create_disposition, &create_options)) {
1646 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1647 END_PROFILE(SMBopen);
1648 return;
1649 }
1650
1651 status = create_file(conn, /* conn */
1652 req, /* req */
1653 0, /* root_dir_fid */
1654 fname, /* fname */
1655 access_mask, /* access_mask */
1656 share_mode, /* share_access */
1657 create_disposition, /* create_disposition*/
1658 create_options, /* create_options */
1659 dos_attr, /* file_attributes */
1660 oplock_request, /* oplock_request */
1661 0, /* allocation_size */
1662 NULL, /* sd */
1663 NULL, /* ea_list */
1664 &fsp, /* result */
1665 &info, /* pinfo */
1666 &sbuf); /* psbuf */
1667
1668 if (!NT_STATUS_IS_OK(status)) {
1669 if (open_was_deferred(req->mid)) {
1670 /* We have re-scheduled this call. */
1671 END_PROFILE(SMBopen);
1672 return;
1673 }
1674 reply_openerror(req, status);
1675 END_PROFILE(SMBopen);
1676 return;
1677 }
1678
1679 size = sbuf.st_size;
1680 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1681 mtime = sbuf.st_mtime;
1682
1683 if (fattr & aDIR) {
1684 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1685 close_file(req, fsp, ERROR_CLOSE);
1686 reply_doserror(req, ERRDOS,ERRnoaccess);
1687 END_PROFILE(SMBopen);
1688 return;
1689 }
1690
1691 reply_outbuf(req, 7, 0);
1692 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1693 SSVAL(req->outbuf,smb_vwv1,fattr);
1694 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1695 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1696 } else {
1697 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1698 }
1699 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1700 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1701
1702 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1703 SCVAL(req->outbuf,smb_flg,
1704 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1705 }
1706
1707 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1708 SCVAL(req->outbuf,smb_flg,
1709 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1710 }
1711 END_PROFILE(SMBopen);
1712 return;
1713 }
1714
1715 /****************************************************************************
1716 Reply to an open and X.
1717 ****************************************************************************/
1718
1719 void reply_open_and_X(struct smb_request *req)
1720 {
1721 connection_struct *conn = req->conn;
1722 char *fname = NULL;
1723 uint16 open_flags;
1724 int deny_mode;
1725 uint32 smb_attr;
1726 /* Breakout the oplock request bits so we can set the
1727 reply bits separately. */
1728 int ex_oplock_request;
1729 int core_oplock_request;
1730 int oplock_request;
1731 #if 0
1732 int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1733 uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1734 #endif
1735 int smb_ofun;
1736 uint32 fattr=0;
1737 int mtime=0;
1738 SMB_STRUCT_STAT sbuf;
1739 int smb_action = 0;
1740 files_struct *fsp;
1741 NTSTATUS status;
1742 uint64_t allocation_size;
1743 ssize_t retval = -1;
1744 uint32 access_mask;
1745 uint32 share_mode;
1746 uint32 create_disposition;
1747 uint32 create_options = 0;
1748 TALLOC_CTX *ctx = talloc_tos();
1749
1750 START_PROFILE(SMBopenX);
1751
1752 if (req->wct < 15) {
1753 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1754 END_PROFILE(SMBopenX);
1755 return;
1756 }
1757
1758 open_flags = SVAL(req->inbuf,smb_vwv2);
1759 deny_mode = SVAL(req->inbuf,smb_vwv3);
1760 smb_attr = SVAL(req->inbuf,smb_vwv5);
1761 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1762 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1763 oplock_request = ex_oplock_request | core_oplock_request;
1764 smb_ofun = SVAL(req->inbuf,smb_vwv8);
1765 allocation_size = (uint64_t)IVAL(req->inbuf,smb_vwv9);
1766
1767 /* If it's an IPC, pass off the pipe handler. */
1768 if (IS_IPC(conn)) {
1769 if (lp_nt_pipe_support()) {
1770 reply_open_pipe_and_X(conn, req);
1771 } else {
1772 reply_doserror(req, ERRSRV, ERRaccess);
1773 }
1774 END_PROFILE(SMBopenX);
1775 return;
1776 }
1777
1778 /* XXXX we need to handle passed times, sattr and flags */
1779 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1780 (const char *)req->buf, 0, STR_TERMINATE, &status);
1781 if (!NT_STATUS_IS_OK(status)) {
1782 reply_nterror(req, status);
1783 END_PROFILE(SMBopenX);
1784 return;
1785 }
1786
1787 if (!map_open_params_to_ntcreate(
1788 fname, deny_mode, smb_ofun, &access_mask,
1789 &share_mode, &create_disposition, &create_options)) {
1790 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1791 END_PROFILE(SMBopenX);
1792 return;
1793 }
1794
1795 status = create_file(conn, /* conn */
1796 req, /* req */
1797 0, /* root_dir_fid */
1798 fname, /* fname */
1799 access_mask, /* access_mask */
1800 share_mode, /* share_access */
1801 create_disposition, /* create_disposition*/
1802 create_options, /* create_options */
1803 smb_attr, /* file_attributes */
1804 oplock_request, /* oplock_request */
1805 0, /* allocation_size */
1806 NULL, /* sd */
1807 NULL, /* ea_list */
1808 &fsp, /* result */
1809 &smb_action, /* pinfo */
1810 &sbuf); /* psbuf */
1811
1812 if (!NT_STATUS_IS_OK(status)) {
1813 END_PROFILE(SMBopenX);
1814 if (open_was_deferred(req->mid)) {
1815 /* We have re-scheduled this call. */
1816 return;
1817 }
1818 reply_openerror(req, status);
1819 return;
1820 }
1821
1822 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1823 if the file is truncated or created. */
1824 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1825 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1826 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1827 close_file(req, fsp, ERROR_CLOSE);
1828 reply_nterror(req, NT_STATUS_DISK_FULL);
1829 END_PROFILE(SMBopenX);
1830 return;
1831 }
1832 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1833 if (retval < 0) {
1834 close_file(req, fsp, ERROR_CLOSE);
1835 reply_nterror(req, NT_STATUS_DISK_FULL);
1836 END_PROFILE(SMBopenX);
1837 return;
1838 }
1839 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1840 }
1841
1842 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1843 mtime = sbuf.st_mtime;
1844 if (fattr & aDIR) {
1845 close_file(req, fsp, ERROR_CLOSE);
1846 reply_doserror(req, ERRDOS, ERRnoaccess);
1847 END_PROFILE(SMBopenX);
1848 return;
1849 }
1850
1851 /* If the caller set the extended oplock request bit
1852 and we granted one (by whatever means) - set the
1853 correct bit for extended oplock reply.
1854 */
1855
1856 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1857 smb_action |= EXTENDED_OPLOCK_GRANTED;
1858 }
1859
1860 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1861 smb_action |= EXTENDED_OPLOCK_GRANTED;
1862 }
1863
1864 /* If the caller set the core oplock request bit
1865 and we granted one (by whatever means) - set the
1866 correct bit for core oplock reply.
1867 */
1868
1869 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1870 reply_outbuf(req, 19, 0);
1871 } else {
1872 reply_outbuf(req, 15, 0);
1873 }
1874
1875 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1876 SCVAL(req->outbuf, smb_flg,
1877 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1878 }
1879
1880 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1881 SCVAL(req->outbuf, smb_flg,
1882 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1883 }
1884
1885 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1886 SSVAL(req->outbuf,smb_vwv3,fattr);
1887 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1888 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1889 } else {
1890 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1891 }
1892 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1893 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1894 SSVAL(req->outbuf,smb_vwv11,smb_action);
1895
1896 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1897 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1898 }
1899
1900 END_PROFILE(SMBopenX);
1901 chain_reply(req);
1902 return;
1903 }
1904
1905 /****************************************************************************
1906 Reply to a SMBulogoffX.
1907 ****************************************************************************/
1908
1909 void reply_ulogoffX(struct smb_request *req)
1910 {
1911 user_struct *vuser;
1912
1913 START_PROFILE(SMBulogoffX);
1914
1915 vuser = get_valid_user_struct(req->vuid);
1916
1917 if(vuser == NULL) {
1918 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1919 req->vuid));
1920 }
1921
1922 /* in user level security we are supposed to close any files
1923 open by this user */
1924 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1925 file_close_user(req->vuid);
1926 }
1927
1928 invalidate_vuid(req->vuid);
1929
1930 reply_outbuf(req, 2, 0);
1931
1932 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1933
1934 END_PROFILE(SMBulogoffX);
1935 chain_reply(req);
1936 }
1937
1938 /****************************************************************************
1939 Reply to a mknew or a create.
1940 ****************************************************************************/
1941
1942 void reply_mknew(struct smb_request *req)
1943 {
1944 connection_struct *conn = req->conn;
1945 char *fname = NULL;
1946 int com;
1947 uint32 fattr = 0;
1948 struct timespec ts[2];
1949 files_struct *fsp;
1950 int oplock_request = 0;
1951 SMB_STRUCT_STAT sbuf;
1952 NTSTATUS status;
1953 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1954 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1955 uint32 create_disposition;
1956 uint32 create_options = 0;
1957 TALLOC_CTX *ctx = talloc_tos();
1958
1959 START_PROFILE(SMBcreate);
1960
1961 if (req->wct < 3) {
1962 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1963 END_PROFILE(SMBcreate);
1964 return;
1965 }
1966
1967 fattr = SVAL(req->inbuf,smb_vwv0);
1968 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1969 com = SVAL(req->inbuf,smb_com);
1970
1971 ts[1] =convert_time_t_to_timespec(
1972 srv_make_unix_date3(req->inbuf + smb_vwv1));
1973 /* mtime. */
1974
1975 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1976 (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
1977 if (!NT_STATUS_IS_OK(status)) {
1978 reply_nterror(req, status);
1979 END_PROFILE(SMBcreate);
1980 return;
1981 }
1982
1983 if (fattr & aVOLID) {
1984 DEBUG(0,("Attempt to create file (%s) with volid set - "
1985 "please report this\n", fname));
1986 }
1987
1988 if(com == SMBmknew) {
1989 /* We should fail if file exists. */
1990 create_disposition = FILE_CREATE;
1991 } else {
1992 /* Create if file doesn't exist, truncate if it does. */
1993 create_disposition = FILE_OVERWRITE_IF;
1994 }
1995
1996 status = create_file(conn, /* conn */
1997 req, /* req */
1998 0, /* root_dir_fid */
1999 fname, /* fname */
2000 access_mask, /* access_mask */
2001 share_mode, /* share_access */
2002 create_disposition, /* create_disposition*/
2003 create_options, /* create_options */
2004 fattr, /* file_attributes */
2005 oplock_request, /* oplock_request */
2006 0, /* allocation_size */
2007 NULL, /* sd */
2008 NULL, /* ea_list */
2009 &fsp, /* result */
2010 NULL, /* pinfo */
2011 &sbuf); /* psbuf */
2012
2013 if (!NT_STATUS_IS_OK(status)) {
2014 END_PROFILE(SMBcreate);
2015 if (open_was_deferred(req->mid)) {
2016 /* We have re-scheduled this call. */
2017 return;
2018 }
2019 reply_openerror(req, status);
2020 return;
2021 }
2022
2023 ts[0] = get_atimespec(&sbuf); /* atime. */
2024 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, ts, true);
2025 if (!NT_STATUS_IS_OK(status)) {
2026 END_PROFILE(SMBcreate);
2027 reply_openerror(req, status);
2028 return;
2029 }
2030
2031 reply_outbuf(req, 1, 0);
2032 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2033
2034 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2035 SCVAL(req->outbuf,smb_flg,
2036 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2037 }
2038
2039 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2040 SCVAL(req->outbuf,smb_flg,
2041 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2042 }
2043
2044 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2045 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2046 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2047
2048 END_PROFILE(SMBcreate);
2049 return;
2050 }
2051
2052 /****************************************************************************
2053 Reply to a create temporary file.
2054 ****************************************************************************/
2055
2056 void reply_ctemp(struct smb_request *req)
2057 {
2058 connection_struct *conn = req->conn;
2059 char *fname = NULL;
2060 uint32 fattr;
2061 files_struct *fsp;
2062 int oplock_request;
2063 int tmpfd;
2064 SMB_STRUCT_STAT sbuf;
2065 char *s;
2066 NTSTATUS status;
2067 TALLOC_CTX *ctx = talloc_tos();
2068
2069 START_PROFILE(SMBctemp);
2070
2071 if (req->wct < 3) {
2072 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2073 END_PROFILE(SMBctemp);
2074 return;
2075 }
2076
2077 fattr = SVAL(req->inbuf,smb_vwv0);
2078 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2079
2080 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2081 (const char *)req->buf+1, 0, STR_TERMINATE, &status);
2082 if (!NT_STATUS_IS_OK(status)) {
2083 reply_nterror(req, status);
2084 END_PROFILE(SMBctemp);
2085 return;
2086 }
2087 if (*fname) {
2088 fname = talloc_asprintf(ctx,
2089 "%s/TMXXXXXX",
2090 fname);
2091 } else {
2092 fname = talloc_strdup(ctx, "TMXXXXXX");
2093 }
2094
2095 if (!fname) {
2096 reply_nterror(req, NT_STATUS_NO_MEMORY);
2097 END_PROFILE(SMBctemp);
2098 return;
2099 }
2100
2101 status = resolve_dfspath(ctx, conn,
2102 req->flags2 & FLAGS2_DFS_PATHNAMES,
2103 fname,
2104 &fname);
2105 if (!NT_STATUS_IS_OK(status)) {
2106 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2107 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2108 ERRSRV, ERRbadpath);
2109 END_PROFILE(SMBctemp);
2110 return;
2111 }
2112 reply_nterror(req, status);
2113 END_PROFILE(SMBctemp);
2114 return;
2115 }
2116
2117 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 reply_nterror(req, status);
2120 END_PROFILE(SMBctemp);
2121 return;
2122 }
2123
2124 status = check_name(conn, fname);
2125 if (!NT_STATUS_IS_OK(status)) {
2126 reply_nterror(req, status);
2127 END_PROFILE(SMBctemp);
2128 return;
2129 }
2130
2131 tmpfd = smb_mkstemp(fname);
2132 if (tmpfd == -1) {
2133 reply_unixerror(req, ERRDOS, ERRnoaccess);
2134 END_PROFILE(SMBctemp);
2135 return;
2136 }
2137
2138 SMB_VFS_STAT(conn,fname,&sbuf);
2139
2140 /* We should fail if file does not exist. */
2141 status = open_file_ntcreate(conn, req, fname, &sbuf,
2142 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2143 FILE_SHARE_READ|FILE_SHARE_WRITE,
2144 FILE_OPEN,
2145 0,
2146 fattr,
2147 oplock_request,
2148 NULL, &fsp);
2149
2150 /* close fd from smb_mkstemp() */
2151 close(tmpfd);
2152
2153 if (!NT_STATUS_IS_OK(status)) {
2154 if (open_was_deferred(req->mid)) {
2155 /* We have re-scheduled this call. */
2156 END_PROFILE(SMBctemp);
2157 return;
2158 }
2159 reply_openerror(req, status);
2160 END_PROFILE(SMBctemp);
2161 return;
2162 }
2163
2164 reply_outbuf(req, 1, 0);
2165 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2166
2167 /* the returned filename is relative to the directory */
2168 s = strrchr_m(fsp->fsp_name, '/');
2169 if (!s) {
2170 s = fsp->fsp_name;
2171 } else {
2172 s++;
2173 }
2174
2175 #if 0
2176 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2177 thing in the byte section. JRA */
2178 SSVALS(p, 0, -1); /* what is this? not in spec */
2179 #endif
2180 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2181 == -1) {
2182 reply_nterror(req, NT_STATUS_NO_MEMORY);
2183 END_PROFILE(SMBctemp);
2184 return;
2185 }
2186
2187 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2188 SCVAL(req->outbuf, smb_flg,
2189 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2190 }
2191
2192 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2193 SCVAL(req->outbuf, smb_flg,
2194 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2195 }
2196
2197 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2198 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2199 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2200
2201 END_PROFILE(SMBctemp);
2202 return;
2203 }
2204
2205 /*******************************************************************
2206 Check if a user is allowed to rename a file.
2207 ********************************************************************/
2208
2209 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2210 uint16 dirtype, SMB_STRUCT_STAT *pst)
2211 {
2212 uint32 fmode;
2213
2214 if (!CAN_WRITE(conn)) {
2215 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2216 }
2217
2218 fmode = dos_mode(conn, fsp->fsp_name, pst);
2219 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2220 return NT_STATUS_NO_SUCH_FILE;
2221 }
2222
2223 if (S_ISDIR(pst->st_mode)) {
2224 return NT_STATUS_OK;
2225 }
2226
2227 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2228 return NT_STATUS_OK;
2229 }
2230
2231 return NT_STATUS_ACCESS_DENIED;
2232 }
2233
2234 /*******************************************************************
2235 * unlink a file with all relevant access checks
2236 *******************************************************************/
2237
2238 static NTSTATUS do_unlink(connection_struct *conn,
2239 struct smb_request *req,
2240 const char *fname,
2241 uint32 dirtype)
2242 {
2243 SMB_STRUCT_STAT sbuf;
2244 uint32 fattr;
2245 files_struct *fsp;
2246 uint32 dirtype_orig = dirtype;
2247 NTSTATUS status;
2248
2249 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2250
2251 if (!CAN_WRITE(conn)) {
2252 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2253 }
2254
2255 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2256 return map_nt_error_from_unix(errno);
2257 }
2258
2259 fattr = dos_mode(conn,fname,&sbuf);
2260
2261 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2262 dirtype = aDIR|aARCH|aRONLY;
2263 }
2264
2265 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2266 if (!dirtype) {
2267 return NT_STATUS_NO_SUCH_FILE;
2268 }
2269
2270 if (!dir_check_ftype(conn, fattr, dirtype)) {
2271 if (fattr & aDIR) {
2272 return NT_STATUS_FILE_IS_A_DIRECTORY;
2273 }
2274 return NT_STATUS_NO_SUCH_FILE;
2275 }
2276
2277 if (dirtype_orig & 0x8000) {
2278 /* These will never be set for POSIX. */
2279 return NT_STATUS_NO_SUCH_FILE;
2280 }
2281
2282 #if 0
2283 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2284 return NT_STATUS_FILE_IS_A_DIRECTORY;
2285 }
2286
2287 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2288 return NT_STATUS_NO_SUCH_FILE;
2289 }
2290
2291 if (dirtype & 0xFF00) {
2292 /* These will never be set for POSIX. */
2293 return NT_STATUS_NO_SUCH_FILE;
2294 }
2295
2296 dirtype &= 0xFF;
2297 if (!dirtype) {
2298 return NT_STATUS_NO_SUCH_FILE;
2299 }
2300
2301 /* Can't delete a directory. */
2302 if (fattr & aDIR) {
2303 return NT_STATUS_FILE_IS_A_DIRECTORY;
2304 }
2305 #endif
2306
2307 #if 0 /* JRATEST */
2308 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2309 return NT_STATUS_OBJECT_NAME_INVALID;
2310 #endif /* JRATEST */
2311
2312 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2313
2314 On a Windows share, a file with read-only dosmode can be opened with
2315 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2316 fails with NT_STATUS_CANNOT_DELETE error.
2317
2318 This semantic causes a problem that a user can not
2319 rename a file with read-only dosmode on a Samba share
2320 from a Windows command prompt (i.e. cmd.exe, but can rename
2321 from Windows Explorer).
2322 */
2323
2324 if (!lp_delete_readonly(SNUM(conn))) {
2325 if (fattr & aRONLY) {
2326 return NT_STATUS_CANNOT_DELETE;
2327 }
2328 }
2329
2330 /* On open checks the open itself will check the share mode, so
2331 don't do it here as we'll get it wrong. */
2332
2333 status = create_file_unixpath
2334 (conn, /* conn */
2335 req, /* req */
2336 fname, /* fname */
2337 DELETE_ACCESS, /* access_mask */
2338 FILE_SHARE_NONE, /* share_access */
2339 FILE_OPEN, /* create_disposition*/
2340 FILE_NON_DIRECTORY_FILE, /* create_options */
2341 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2342 0, /* oplock_request */
2343 0, /* allocation_size */
2344 NULL, /* sd */
2345 NULL, /* ea_list */
2346 &fsp, /* result */
2347 NULL, /* pinfo */
2348 &sbuf); /* psbuf */
2349
2350 if (!NT_STATUS_IS_OK(status)) {
2351 DEBUG(10, ("create_file_unixpath failed: %s\n",
2352 nt_errstr(status)));
2353 return status;
2354 }
2355
2356 /* The set is across all open files on this dev/inode pair. */
2357 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2358 close_file(req, fsp, NORMAL_CLOSE);
2359 return NT_STATUS_ACCESS_DENIED;
2360 }
2361
2362 return close_file(req, fsp, NORMAL_CLOSE);
2363 }
2364
2365 /****************************************************************************
2366 The guts of the unlink command, split out so it may be called by the NT SMB
2367 code.
2368 ****************************************************************************/
2369
2370 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2371 uint32 dirtype, const char *name_in, bool has_wild)
2372 {
2373 const char *directory = NULL;
2374 char *mask = NULL;
2375 char *name = NULL;
2376 char *p = NULL;
2377 int count=0;
2378 NTSTATUS status = NT_STATUS_OK;
2379 SMB_STRUCT_STAT sbuf;
2380 TALLOC_CTX *ctx = talloc_tos();
2381
2382 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2383 if (!NT_STATUS_IS_OK(status)) {
2384 return status;
2385 }
2386
2387 p = strrchr_m(name,'/');
2388 if (!p) {
2389 directory = talloc_strdup(ctx, ".");
2390 if (!directory) {
2391 return NT_STATUS_NO_MEMORY;
2392 }
2393 mask = name;
2394 } else {
2395 *p = 0;
2396 directory = name;
2397 mask = p+1;
2398 }
2399
2400 /*
2401 * We should only check the mangled cache
2402 * here if unix_convert failed. This means
2403 * that the path in 'mask' doesn't exist
2404 * on the file system and so we need to look
2405 * for a possible mangle. This patch from
2406 * Tine Smukavec <valentin.smukavec@hermes.si>.
2407 */
2408
2409 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2410 char *new_mask = NULL;
2411 mangle_lookup_name_from_8_3(ctx,
2412 mask,
2413 &new_mask,
2414 conn->params );
2415 if (new_mask) {
2416 mask = new_mask;
2417 }
2418 }
2419
2420 if (!has_wild) {
2421 directory = talloc_asprintf(ctx,
2422 "%s/%s",
2423 directory,
2424 mask);
2425 if (!directory) {
2426 return NT_STATUS_NO_MEMORY;
2427 }
2428 if (dirtype == 0) {
2429 dirtype = FILE_ATTRIBUTE_NORMAL;
2430 }
2431
2432 status = check_name(conn, directory);
2433 if (!NT_STATUS_IS_OK(status)) {
2434 return status;
2435 }
2436
2437 status = do_unlink(conn, req, directory, dirtype);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 return status;
2440 }
2441
2442 count++;
2443 } else {
2444 struct smb_Dir *dir_hnd = NULL;
2445 long offset = 0;
2446 const char *dname;
2447
2448 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2449 return NT_STATUS_OBJECT_NAME_INVALID;
2450 }
2451
2452 if (strequal(mask,"????????.???")) {
2453 mask[0] = '*';
2454 mask[1] = '\0';
2455 }
2456
2457 status = check_name(conn, directory);
2458 if (!NT_STATUS_IS_OK(status)) {
2459 return status;
2460 }
2461
2462 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2463 dirtype);
2464 if (dir_hnd == NULL) {
2465 return map_nt_error_from_unix(errno);
2466 }
2467
2468 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2469 the pattern matches against the long name, otherwise the short name
2470 We don't implement this yet XXXX
2471 */
2472
2473 status = NT_STATUS_NO_SUCH_FILE;
2474
2475 while ((dname = ReadDirName(dir_hnd, &offset))) {
2476 SMB_STRUCT_STAT st;
2477 char *fname = NULL;
2478
2479 if (!is_visible_file(conn, directory, dname, &st, True)) {
2480 continue;
2481 }
2482
2483 /* Quick check for "." and ".." */
2484 if (ISDOT(dname) || ISDOTDOT(dname)) {
2485 continue;
2486 }
2487
2488 if(!mask_match(dname, mask, conn->case_sensitive)) {
2489 continue;
2490 }
2491
2492 fname = talloc_asprintf(ctx, "%s/%s",
2493 directory,
2494 dname);
2495 if (!fname) {
2496 return NT_STATUS_NO_MEMORY;
2497 }
2498
2499 status = check_name(conn, fname);
2500 if (!NT_STATUS_IS_OK(status)) {
2501 TALLOC_FREE(dir_hnd);
2502 return status;
2503 }
2504
2505 status = do_unlink(conn, req, fname, dirtype);
2506 if (!NT_STATUS_IS_OK(status)) {
2507 TALLOC_FREE(fname);
2508 continue;
2509 }
2510
2511 count++;
2512 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2513 fname));
2514
2515 TALLOC_FREE(fname);
2516 }
2517 TALLOC_FREE(dir_hnd);
2518 }
2519
2520 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2521 status = map_nt_error_from_unix(errno);
2522 }
2523
2524 return status;
2525 }
2526
2527 /****************************************************************************
2528 Reply to a unlink
2529 ****************************************************************************/
2530
2531 void reply_unlink(struct smb_request *req)
2532 {
2533 connection_struct *conn = req->conn;
2534 char *name = NULL;
2535 uint32 dirtype;
2536 NTSTATUS status;
2537 bool path_contains_wcard = False;
2538 TALLOC_CTX *ctx = talloc_tos();
2539
2540 START_PROFILE(SMBunlink);
2541
2542 if (req->wct < 1) {
2543 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2544 END_PROFILE(SMBunlink);
2545 return;
2546 }
2547
2548 dirtype = SVAL(req->inbuf,smb_vwv0);
2549
2550 srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2551 (const char *)req->buf + 1, 0, STR_TERMINATE,
2552 &status, &path_contains_wcard);
2553 if (!NT_STATUS_IS_OK(status)) {
2554 reply_nterror(req, status);
2555 END_PROFILE(SMBunlink);
2556 return;
2557 }
2558
2559 status = resolve_dfspath_wcard(ctx, conn,
2560 req->flags2 & FLAGS2_DFS_PATHNAMES,
2561 name,
2562 &name,
2563 &path_contains_wcard);
2564 if (!NT_STATUS_IS_OK(status)) {
2565 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2566 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2567 ERRSRV, ERRbadpath);
2568 END_PROFILE(SMBunlink);
2569 return;
2570 }
2571 reply_nterror(req, status);
2572 END_PROFILE(SMBunlink);
2573 return;
2574 }
2575
2576 DEBUG(3,("reply_unlink : %s\n",name));
2577
2578 status = unlink_internals(conn, req, dirtype, name,
2579 path_contains_wcard);
2580 if (!NT_STATUS_IS_OK(status)) {
2581 if (open_was_deferred(req->mid)) {
2582 /* We have re-scheduled this call. */
2583 END_PROFILE(SMBunlink);
2584 return;
2585 }
2586 reply_nterror(req, status);
2587 END_PROFILE(SMBunlink);
2588 return;
2589 }
2590
2591 reply_outbuf(req, 0, 0);
2592 END_PROFILE(SMBunlink);
2593
2594 return;
2595 }
2596
2597 /****************************************************************************
2598 Fail for readbraw.
2599 ****************************************************************************/
2600
2601 static void fail_readraw(void)
2602 {
2603 const char *errstr = talloc_asprintf(talloc_tos(),
2604 "FAIL ! reply_readbraw: socket write fail (%s)",
2605 strerror(errno));
2606 if (!errstr) {
2607 errstr = "";
2608 }
2609 exit_server_cleanly(errstr);
2610 }
2611
2612 /****************************************************************************
2613 Fake (read/write) sendfile. Returns -1 on read or write fail.
2614 ****************************************************************************/
2615
2616 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2617 size_t nread)
2618 {
2619 size_t bufsize;
2620 size_t tosend = nread;
2621 char *buf;
2622
2623 if (nread == 0) {
2624 return 0;
2625 }
2626
2627 bufsize = MIN(nread, 65536);
2628
2629 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2630 return -1;
2631 }
2632
2633 while (tosend > 0) {
2634 ssize_t ret;
2635 size_t cur_read;
2636
2637 if (tosend > bufsize) {
2638 cur_read = bufsize;
2639 } else {
2640 cur_read = tosend;
2641 }
2642 ret = read_file(fsp,buf,startpos,cur_read);
2643 if (ret == -1) {
2644 SAFE_FREE(buf);
2645 return -1;
2646 }
2647
2648 /* If we had a short read, fill with zeros. */
2649 if (ret < cur_read) {
2650 memset(buf, '\0', cur_read - ret);
2651 }
2652
2653 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2654 SAFE_FREE(buf);
2655 return -1;
2656 }
2657 tosend -= cur_read;
2658 startpos += cur_read;
2659 }
2660
2661 SAFE_FREE(buf);
2662 return (ssize_t)nread;
2663 }
2664
2665 /****************************************************************************
2666 Return a readbraw error (4 bytes of zero).
2667 ****************************************************************************/
2668
2669 static void reply_readbraw_error(void)
2670 {
2671 char header[4];
2672 SIVAL(header,0,0);
2673 if (write_data(smbd_server_fd(),header,4) != 4) {
2674 fail_readraw();
2675 }
2676 }
2677
2678 /****************************************************************************
2679 Use sendfile in readbraw.
2680 ****************************************************************************/
2681
2682 void send_file_readbraw(connection_struct *conn,
2683 files_struct *fsp,
2684 SMB_OFF_T startpos,
2685 size_t nread,
2686 ssize_t mincount)
2687 {
2688 char *outbuf = NULL;
2689 ssize_t ret=0;
2690
2691 #if defined(WITH_SENDFILE)
2692 /*
2693 * We can only use sendfile on a non-chained packet
2694 * but we can use on a non-oplocked file. tridge proved this
2695 * on a train in Germany :-). JRA.
2696 * reply_readbraw has already checked the length.
2697 */
2698
2699 if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2700 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2701 char header[4];
2702 DATA_BLOB header_blob;
2703
2704 _smb_setlen(header,nread);
2705 header_blob = data_blob_const(header, 4);
2706
2707 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2708 &header_blob, startpos, nread) == -1) {
2709 /* Returning ENOSYS means no data at all was sent.
2710 * Do this as a normal read. */
2711 if (errno == ENOSYS) {
2712 goto normal_readbraw;
2713 }
2714
2715 /*
2716 * Special hack for broken Linux with no working sendfile. If we
2717 * return EINTR we sent the header but not the rest of the data.
2718 * Fake this up by doing read/write calls.
2719 */
2720 if (errno == EINTR) {
2721 /* Ensure we don't do this again. */
2722 set_use_sendfile(SNUM(conn), False);
2723 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2724
2725 if (fake_sendfile(fsp, startpos, nread) == -1) {
2726 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2727 fsp->fsp_name, strerror(errno) ));
2728 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2729 }
2730 return;
2731 }
2732
2733 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2734 fsp->fsp_name, strerror(errno) ));
2735 exit_server_cleanly("send_file_readbraw sendfile failed");
2736 }
2737
2738 return;
2739 }
2740 #endif
2741
2742 normal_readbraw:
2743
2744 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2745 if (!outbuf) {
2746 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2747 (unsigned)(nread+4)));
2748 reply_readbraw_error();
2749 return;
2750 }
2751
2752 if (nread > 0) {
2753 ret = read_file(fsp,outbuf+4,startpos,nread);
2754 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2755 if (ret < mincount)
2756 ret = 0;
2757 #else
2758 if (ret < nread)
2759 ret = 0;
2760 #endif
2761 }
2762
2763 _smb_setlen(outbuf,ret);
2764 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2765 fail_readraw();
2766
2767 TALLOC_FREE(outbuf);
2768 }
2769
2770 /****************************************************************************
2771 Reply to a readbraw (core+ protocol).
2772 ****************************************************************************/
2773
2774 void reply_readbraw(struct smb_request *req)
2775 {
2776 connection_struct *conn = req->conn;
2777 ssize_t maxcount,mincount;
2778 size_t nread = 0;
2779 SMB_OFF_T startpos;
2780 files_struct *fsp;
2781 SMB_STRUCT_STAT st;
2782 SMB_OFF_T size = 0;
2783
2784 START_PROFILE(SMBreadbraw);
2785
2786 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2787 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2788 "raw reads/writes are disallowed.");
2789 }
2790
2791 if (req->wct < 8) {
2792 reply_readbraw_error();
2793 END_PROFILE(SMBreadbraw);
2794 return;
2795 }
2796
2797 /*
2798 * Special check if an oplock break has been issued
2799 * and the readraw request croses on the wire, we must
2800 * return a zero length response here.
2801 */
2802
2803 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
2804
2805 /*
2806 * We have to do a check_fsp by hand here, as
2807 * we must always return 4 zero bytes on error,
2808 * not a NTSTATUS.
2809 */
2810
2811 if (!fsp || !conn || conn != fsp->conn ||
2812 req->vuid != fsp->vuid ||
2813 fsp->is_directory || fsp->fh->fd == -1) {
2814 /*
2815 * fsp could be NULL here so use the value from the packet. JRA.
2816 */
2817 DEBUG(3,("reply_readbraw: fnum %d not valid "
2818 "- cache prime?\n",
2819 (int)SVAL(req->inbuf,smb_vwv0)));
2820 reply_readbraw_error();
2821 END_PROFILE(SMBreadbraw);
2822 return;
2823 }
2824
2825 /* Do a "by hand" version of CHECK_READ. */
2826 if (!(fsp->can_read ||
2827 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2828 (fsp->access_mask & FILE_EXECUTE)))) {
2829 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2830 (int)SVAL(req->inbuf,smb_vwv0)));
2831 reply_readbraw_error();
2832 END_PROFILE(SMBreadbraw);
2833 return;
2834 }
2835
2836 flush_write_cache(fsp, READRAW_FLUSH);
2837
2838 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2839 if(req->wct == 10) {
2840 /*
2841 * This is a large offset (64 bit) read.
2842 */
2843 #ifdef LARGE_SMB_OFF_T
2844
2845 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2846
2847 #else /* !LARGE_SMB_OFF_T */
2848
2849 /*
2850 * Ensure we haven't been sent a >32 bit offset.
2851 */
2852
2853 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2854 DEBUG(0,("reply_readbraw: large offset "
2855 "(%x << 32) used and we don't support "
2856 "64 bit offsets.\n",
2857 (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2858 reply_readbraw_error();
2859 END_PROFILE(SMBreadbraw);
2860 return;
2861 }
2862
2863 #endif /* LARGE_SMB_OFF_T */
2864
2865 if(startpos < 0) {
2866 DEBUG(0,("reply_readbraw: negative 64 bit "
2867 "readraw offset (%.0f) !\n",
2868 (double)startpos ));
2869 reply_readbraw_error();
2870 END_PROFILE(SMBreadbraw);
2871 return;
2872 }
2873 }
2874
2875 maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2876 mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2877
2878 /* ensure we don't overrun the packet size */
2879 maxcount = MIN(65535,maxcount);
2880
2881 if (is_locked(fsp,(uint32)req->smbpid,
2882 (uint64_t)maxcount,
2883 (uint64_t)startpos,
2884 READ_LOCK)) {
2885 reply_readbraw_error();
2886 END_PROFILE(SMBreadbraw);
2887 return;
2888 }
2889
2890 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2891 size = st.st_size;
2892 }
2893
2894 if (startpos >= size) {
2895 nread = 0;
2896 } else {
2897 nread = MIN(maxcount,(size - startpos));
2898 }
2899
2900 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2901 if (nread < mincount)
2902 nread = 0;
2903 #endif
2904
2905 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2906 "min=%lu nread=%lu\n",
2907 fsp->fnum, (double)startpos,
2908 (unsigned long)maxcount,
2909 (unsigned long)mincount,
2910 (unsigned long)nread ) );
2911
2912 send_file_readbraw(conn, fsp, startpos, nread, mincount);
2913
2914 DEBUG(5,("reply_readbraw finished\n"));
2915 END_PROFILE(SMBreadbraw);
2916 }
2917
2918 #undef DBGC_CLASS
2919 #define DBGC_CLASS DBGC_LOCKING
2920
2921 /****************************************************************************
2922 Reply to a lockread (core+ protocol).
2923 ****************************************************************************/
2924
2925 void reply_lockread(struct smb_request *req)
2926 {
2927 connection_struct *conn = req->conn;
2928 ssize_t nread = -1;
2929 char *data;
2930 SMB_OFF_T startpos;
2931 size_t numtoread;
2932 NTSTATUS status;
2933 files_struct *fsp;
2934 struct byte_range_lock *br_lck = NULL;
2935 char *p = NULL;
2936
2937 START_PROFILE(SMBlockread);
2938
2939 if (req->wct < 5) {
2940 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2941 END_PROFILE(SMBlockread);
2942 return;
2943 }
2944
2945 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
2946
2947 if (!check_fsp(conn, req, fsp)) {
2948 END_PROFILE(SMBlockread);
2949 return;
2950 }
2951
2952 if (!CHECK_READ(fsp,req->inbuf)) {
2953 reply_doserror(req, ERRDOS, ERRbadaccess);
2954 END_PROFILE(SMBlockread);
2955 return;
2956 }
2957
2958 release_level_2_oplocks_on_change(fsp);
2959
2960 numtoread = SVAL(req->inbuf,smb_vwv1);
2961 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
2962
2963 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
2964
2965 reply_outbuf(req, 5, numtoread + 3);
2966
2967 data = smb_buf(req->outbuf) + 3;
2968
2969 /*
2970 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2971 * protocol request that predates the read/write lock concept.
2972 * Thus instead of asking for a read lock here we need to ask
2973 * for a write lock. JRA.
2974 * Note that the requested lock size is unaffected by max_recv.
2975 */
2976
2977 br_lck = do_lock(smbd_messaging_context(),
2978 fsp,
2979 req->smbpid,
2980 (uint64_t)numtoread,
2981 (uint64_t)startpos,
2982 WRITE_LOCK,
2983 WINDOWS_LOCK,
2984 False, /* Non-blocking lock. */
2985 &status,
2986 NULL);
2987 TALLOC_FREE(br_lck);
2988
2989 if (NT_STATUS_V(status)) {
2990 reply_nterror(req, status);
2991 END_PROFILE(SMBlockread);
2992 return;
2993 }
2994
2995 /*
2996 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2997 */
2998
2999 if (numtoread > max_recv) {
3000 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3001 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3002 (unsigned int)numtoread, (unsigned int)max_recv ));
3003 numtoread = MIN(numtoread,max_recv);
3004 }
3005 nread = read_file(fsp,data,startpos,numtoread);
3006
3007 if (nread < 0) {
3008 reply_unixerror(req, ERRDOS, ERRnoaccess);
3009 END_PROFILE(SMBlockread);
3010 return;
3011 }
3012
3013 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3014
3015 SSVAL(req->outbuf,smb_vwv0,nread);
3016 SSVAL(req->outbuf,smb_vwv5,nread+3);
3017 p = smb_buf(req->outbuf);
3018 SCVAL(p,0,0); /* pad byte. */
3019 SSVAL(p,1,nread);
3020
3021 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3022 fsp->fnum, (int)numtoread, (int)nread));
3023
3024 END_PROFILE(SMBlockread);
3025 return;
3026 }
3027
3028 #undef DBGC_CLASS
3029 #define DBGC_CLASS DBGC_ALL
3030
3031 /****************************************************************************
3032 Reply to a read.
3033 ****************************************************************************/
3034
3035 void reply_read(struct smb_request *req)
3036 {
3037 connection_struct *conn = req->conn;
3038 size_t numtoread;
3039 ssize_t nread = 0;
3040 char *data;
3041 SMB_OFF_T startpos;
3042 int outsize = 0;
3043 files_struct *fsp;
3044
3045 START_PROFILE(SMBread);
3046
3047 if (req->wct < 3) {
3048 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3049 END_PROFILE(SMBread);
3050 return;
3051 }
3052
3053 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
3054
3055 if (!check_fsp(conn, req, fsp)) {
3056 END_PROFILE(SMBread);
3057 return;
3058 }
3059
3060 if (!CHECK_READ(fsp,req->inbuf)) {
3061 reply_doserror(req, ERRDOS, ERRbadaccess);
3062 END_PROFILE(SMBread);
3063 return;
3064 }
3065
3066 numtoread = SVAL(req->inbuf,smb_vwv1);
3067 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3068
3069 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3070
3071 /*
3072 * The requested read size cannot be greater than max_recv. JRA.
3073 */
3074 if (numtoread > max_recv) {
3075 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3076 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3077 (unsigned int)numtoread, (unsigned int)max_recv ));
3078 numtoread = MIN(numtoread,max_recv);
3079 }
3080
3081 reply_outbuf(req, 5, numtoread+3);
3082
3083 data = smb_buf(req->outbuf) + 3;
3084
3085 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtoread,
3086 (uint64_t)startpos, READ_LOCK)) {
3087 reply_doserror(req, ERRDOS,ERRlock);
3088 END_PROFILE(SMBread);
3089 return;
3090 }
3091
3092 if (numtoread > 0)
3093 nread = read_file(fsp,data,startpos,numtoread);
3094
3095 if (nread < 0) {
3096 reply_unixerror(req, ERRDOS,ERRnoaccess);
3097 END_PROFILE(SMBread);
3098 return;
3099 }
3100
3101 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3102
3103 SSVAL(req->outbuf,smb_vwv0,nread);
3104 SSVAL(req->outbuf,smb_vwv5,nread+3);
3105 SCVAL(smb_buf(req->outbuf),0,1);
3106 SSVAL(smb_buf(req->outbuf),1,nread);
3107
3108 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3109 fsp->fnum, (int)numtoread, (int)nread ) );
3110
3111 END_PROFILE(SMBread);
3112 return;
3113 }
3114
3115 /****************************************************************************
3116 Setup readX header.
3117 ****************************************************************************/
3118
3119 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3120 {
3121 int outsize;
3122 char *data;
3123
3124 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3125 data = smb_buf(outbuf);
3126
3127 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3128
3129 SCVAL(outbuf,smb_vwv0,0xFF);
3130 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3131 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3132 SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3133 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3134 SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3135 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3136 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3137 return outsize;
3138 }
3139
3140 /****************************************************************************
3141 Reply to a read and X - possibly using sendfile.
3142 ****************************************************************************/
3143
3144 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3145 files_struct *fsp, SMB_OFF_T startpos,
3146 size_t smb_maxcnt)
3147 {
3148 SMB_STRUCT_STAT sbuf;
3149 ssize_t nread = -1;
3150
3151 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3152 reply_unixerror(req, ERRDOS, ERRnoaccess);
3153 return;
3154 }
3155
3156 if (startpos > sbuf.st_size) {
3157 smb_maxcnt = 0;
3158 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3159 smb_maxcnt = (sbuf.st_size - startpos);
3160 }
3161
3162 if (smb_maxcnt == 0) {
3163 goto normal_read;
3164 }
3165
3166 #if defined(WITH_SENDFILE)
3167 /*
3168 * We can only use sendfile on a non-chained packet
3169 * but we can use on a non-oplocked file. tridge proved this
3170 * on a train in Germany :-). JRA.
3171 */
3172
3173 if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3174 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3175 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3176 uint8 headerbuf[smb_size + 12 * 2];
3177 DATA_BLOB header;
3178
3179 /*
3180 * Set up the packet header before send. We
3181 * assume here the sendfile will work (get the
3182 * correct amount of data).
3183 */
3184
3185 header = data_blob_const(headerbuf, sizeof(headerbuf));
3186
3187 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3188 setup_readX_header((char *)headerbuf, smb_maxcnt);
3189
3190 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3191 /* Returning ENOSYS or EINVAL means no data at all was sent.
3192 Do this as a normal read. */
3193 if (errno == ENOSYS || errno == EINVAL) {
3194 goto normal_read;
3195 }
3196
3197 /*
3198 * Special hack for broken Linux with no working sendfile. If we
3199 * return EINTR we sent the header but not the rest of the data.
3200 * Fake this up by doing read/write calls.
3201 */
3202
3203 if (errno == EINTR) {
3204 /* Ensure we don't do this again. */
3205 set_use_sendfile(SNUM(conn), False);
3206 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3207 nread = fake_sendfile(fsp, startpos,
3208 smb_maxcnt);
3209 if (nread == -1) {
3210 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3211 fsp->fsp_name, strerror(errno) ));
3212 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3213 }
3214 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3215 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3216 /* No outbuf here means successful sendfile. */
3217 TALLOC_FREE(req->outbuf);
3218 return;
3219 }
3220
3221 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3222 fsp->fsp_name, strerror(errno) ));
3223 exit_server_cleanly("send_file_readX sendfile failed");
3224 }
3225
3226 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3227 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3228 /* No outbuf here means successful sendfile. */
3229 TALLOC_FREE(req->outbuf);
3230 return;
3231 }
3232 #endif
3233
3234 normal_read:
3235
3236 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3237 uint8 headerbuf[smb_size + 2*12];
3238
3239 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3240 setup_readX_header((char *)headerbuf, smb_maxcnt);
3241
3242 /* Send out the header. */
3243 if (write_data(smbd_server_fd(), (char *)headerbuf,
3244 sizeof(headerbuf)) != sizeof(headerbuf)) {
3245 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3246 fsp->fsp_name, strerror(errno) ));
3247 exit_server_cleanly("send_file_readX sendfile failed");
3248 }
3249 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3250 if (nread == -1) {
3251 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3252 fsp->fsp_name, strerror(errno) ));
3253 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3254 }
3255 TALLOC_FREE(req->outbuf);
3256 return;
3257 }
3258
3259 reply_outbuf(req, 12, smb_maxcnt);
3260
3261 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3262 if (nread < 0) {
3263 reply_unixerror(req, ERRDOS, ERRnoaccess);
3264 return;
3265 }
3266
3267 setup_readX_header((char *)req->outbuf, nread);
3268
3269 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3270 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3271
3272 chain_reply(req);
3273 }
3274
3275 /****************************************************************************
3276 Reply to a read and X.
3277 ****************************************************************************/
3278
3279 void reply_read_and_X(struct smb_request *req)
3280 {
3281 connection_struct *conn = req->conn;
3282 files_struct *fsp;
3283 SMB_OFF_T startpos;
3284 size_t smb_maxcnt;
3285 bool big_readX = False;
3286 #if 0
3287 size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3288 #endif
3289
3290 START_PROFILE(SMBreadX);
3291
3292 if ((req->wct != 10) && (req->wct != 12)) {
3293 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3294 return;
3295 }
3296
3297 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
3298 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3299 smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3300
3301 /* If it's an IPC, pass off the pipe handler. */
3302 if (IS_IPC(conn)) {
3303 reply_pipe_read_and_X(req);
3304 END_PROFILE(SMBreadX);
3305 return;
3306 }
3307
3308 if (!check_fsp(conn, req, fsp)) {
3309 END_PROFILE(SMBreadX);
3310 return;
3311 }
3312
3313 if (!CHECK_READ(fsp,req->inbuf)) {
3314 reply_doserror(req, ERRDOS,ERRbadaccess);
3315 END_PROFILE(SMBreadX);
3316 return;
3317 }
3318
3319 if (global_client_caps & CAP_LARGE_READX) {
3320 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3321 smb_maxcnt |= (upper_size<<16);
3322 if (upper_size > 1) {
3323 /* Can't do this on a chained packet. */
3324 if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3325 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3326 END_PROFILE(SMBreadX);
3327 return;
3328 }
3329 /* We currently don't do this on signed or sealed data. */
3330 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3331 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3332 END_PROFILE(SMBreadX);
3333 return;
3334 }
3335 /* Is there room in the reply for this data ? */
3336 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3337 reply_nterror(req,
3338 NT_STATUS_INVALID_PARAMETER);
3339 END_PROFILE(SMBreadX);
3340 return;
3341 }
3342 big_readX = True;
3343 }
3344 }
3345
3346 if (req->wct == 12) {
3347 #ifdef LARGE_SMB_OFF_T
3348 /*
3349 * This is a large offset (64 bit) read.
3350 */
3351 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3352
3353 #else /* !LARGE_SMB_OFF_T */
3354
3355 /*
3356 * Ensure we haven't been sent a >32 bit offset.
3357 */
3358
3359 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3360 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3361 "used and we don't support 64 bit offsets.\n",
3362 (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3363 END_PROFILE(SMBreadX);
3364 reply_doserror(req, ERRDOS, ERRbadaccess);
3365 return;
3366 }
3367
3368 #endif /* LARGE_SMB_OFF_T */
3369
3370 }
3371
3372 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)smb_maxcnt,
3373 (uint64_t)startpos, READ_LOCK)) {
3374 END_PROFILE(SMBreadX);
3375 reply_doserror(req, ERRDOS, ERRlock);
3376 return;
3377 }
3378
3379 if (!big_readX &&
3380 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3381 END_PROFILE(SMBreadX);
3382 return;
3383 }
3384
3385 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3386
3387 END_PROFILE(SMBreadX);
3388 return;
3389 }
3390
3391 /****************************************************************************
3392 Error replies to writebraw must have smb_wct == 1. Fix this up.
3393 ****************************************************************************/
3394
3395 void error_to_writebrawerr(struct smb_request *req)
3396 {
3397 uint8 *old_outbuf = req->outbuf;
3398
3399 reply_outbuf(req, 1, 0);
3400
3401 memcpy(req->outbuf, old_outbuf, smb_size);
3402 TALLOC_FREE(old_outbuf);
3403 }
3404
3405 /****************************************************************************
3406 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3407 ****************************************************************************/
3408
3409 void reply_writebraw(struct smb_request *req)
3410 {
3411 connection_struct *conn = req->conn;
3412 char *buf = NULL;
3413 ssize_t nwritten=0;
3414 ssize_t total_written=0;
3415 size_t numtowrite=0;
3416 size_t tcount;
3417 SMB_OFF_T startpos;
3418 char *data=NULL;
3419 bool write_through;
3420 files_struct *fsp;
3421 NTSTATUS status;
3422
3423 START_PROFILE(SMBwritebraw);
3424
3425 /*
3426 * If we ever reply with an error, it must have the SMB command
3427 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3428 * we're finished.
3429 */
3430 SCVAL(req->inbuf,smb_com,SMBwritec);
3431
3432 if (srv_is_signing_active()) {
3433 END_PROFILE(SMBwritebraw);
3434 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3435 "raw reads/writes are disallowed.");
3436 }
3437
3438 if (req->wct < 12) {
3439 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3440 error_to_writebrawerr(req);
3441 END_PROFILE(SMBwritebraw);
3442 return;
3443 }
3444
3445 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
3446 if (!check_fsp(conn, req, fsp)) {
3447 error_to_writebrawerr(req);
3448 END_PROFILE(SMBwritebraw);
3449 return;
3450 }
3451
3452 if (!CHECK_WRITE(fsp)) {
3453 reply_doserror(req, ERRDOS, ERRbadaccess);
3454 error_to_writebrawerr(req);
3455 END_PROFILE(SMBwritebraw);
3456 return;
3457 }
3458
3459 tcount = IVAL(req->inbuf,smb_vwv1);
3460 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3461 write_through = BITSETW(req->inbuf+smb_vwv7,0);
3462
3463 /* We have to deal with slightly different formats depending
3464 on whether we are using the core+ or lanman1.0 protocol */
3465
3466 if(Protocol <= PROTOCOL_COREPLUS) {
3467 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3468 data = smb_buf(req->inbuf);
3469 } else {
3470 numtowrite = SVAL(req->inbuf,smb_vwv10);
3471 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3472 }
3473
3474 /* Ensure we don't write bytes past the end of this packet. */
3475 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3476 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3477 error_to_writebrawerr(req);
3478 END_PROFILE(SMBwritebraw);
3479 return;
3480 }
3481
3482 if (is_locked(fsp,(uint32)req->smbpid,(uint64_t)tcount,
3483 (uint64_t)startpos, WRITE_LOCK)) {
3484 reply_doserror(req, ERRDOS, ERRlock);
3485 error_to_writebrawerr(req);
3486 END_PROFILE(SMBwritebraw);
3487 return;
3488 }
3489
3490 if (numtowrite>0) {
3491 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3492 }
3493
3494 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3495 "wrote=%d sync=%d\n",
3496 fsp->fnum, (double)startpos, (int)numtowrite,
3497 (int)nwritten, (int)write_through));
3498
3499 if (nwritten < (ssize_t)numtowrite) {
3500 reply_unixerror(req, ERRHRD, ERRdiskfull);
3501 error_to_writebrawerr(req);
3502 END_PROFILE(SMBwritebraw);
3503 return;
3504 }
3505
3506 total_written = nwritten;
3507
3508 /* Allocate a buffer of 64k + length. */
3509 buf = TALLOC_ARRAY(NULL, char, 65540);
3510 if (!buf) {
3511 reply_doserror(req, ERRDOS, ERRnomem);
3512 error_to_writebrawerr(req);
3513 END_PROFILE(SMBwritebraw);
3514 return;
3515 }
3516
3517 /* Return a SMBwritebraw message to the redirector to tell
3518 * it to send more bytes */
3519
3520 memcpy(buf, req->inbuf, smb_size);
3521 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3522 SCVAL(buf,smb_com,SMBwritebraw);
3523 SSVALS(buf,smb_vwv0,0xFFFF);
3524 show_msg(buf);
3525 if (!srv_send_smb(smbd_server_fd(),
3526 buf,
3527 IS_CONN_ENCRYPTED(conn))) {
3528 exit_server_cleanly("reply_writebraw: srv_send_smb "
3529 "failed.");
3530 }
3531
3532 /* Now read the raw data into the buffer and write it */
3533 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3534 &numtowrite);
3535 if (!NT_STATUS_IS_OK(status)) {
3536 exit_server_cleanly("secondary writebraw failed");
3537 }
3538
3539 /* Set up outbuf to return the correct size */
3540 reply_outbuf(req, 1, 0);
3541
3542 if (numtowrite != 0) {
3543
3544 if (numtowrite > 0xFFFF) {
3545 DEBUG(0,("reply_writebraw: Oversize secondary write "
3546 "raw requested (%u). Terminating\n",
3547 (unsigned int)numtowrite ));
3548 exit_server_cleanly("secondary writebraw failed");
3549 }
3550
3551 if (tcount > nwritten+numtowrite) {
3552 DEBUG(3,("reply_writebraw: Client overestimated the "
3553 "write %d %d %d\n",
3554 (int)tcount,(int)nwritten,(int)numtowrite));
3555 }
3556
3557 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3558
3559 if (!NT_STATUS_IS_OK(status)) {
3560 DEBUG(0,("reply_writebraw: Oversize secondary write "
3561 "raw read failed (%s). Terminating\n",
3562 nt_errstr(status)));
3563 exit_server_cleanly("secondary writebraw failed");
3564 }
3565
3566 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3567 if (nwritten == -1) {
3568 TALLOC_FREE(buf);
3569 reply_unixerror(req, ERRHRD, ERRdiskfull);
3570 error_to_writebrawerr(req);
3571 END_PROFILE(SMBwritebraw);
3572 return;
3573 }
3574
3575 if (nwritten < (ssize_t)numtowrite) {
3576 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3577 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3578 }
3579
3580 if (nwritten > 0) {
3581 total_written += nwritten;
3582 }
3583 }
3584
3585 TALLOC_FREE(buf);
3586 SSVAL(req->outbuf,smb_vwv0,total_written);
3587
3588 status = sync_file(conn, fsp, write_through);
3589 if (!NT_STATUS_IS_OK(status)) {
3590 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3591 fsp->fsp_name, nt_errstr(status) ));
3592 reply_nterror(req, status);
3593 error_to_writebrawerr(req);
3594 END_PROFILE(SMBwritebraw);
3595 return;
3596 }
3597
3598 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3599 "wrote=%d\n",
3600 fsp->fnum, (double)startpos, (int)numtowrite,
3601 (int)total_written));
3602
3603 /* We won't return a status if write through is not selected - this
3604 * follows what WfWg does */
3605 END_PROFILE(SMBwritebraw);
3606
3607 if (!write_through && total_written==tcount) {
3608
3609 #if RABBIT_PELLET_FIX
3610 /*
3611 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3612 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3613 * JRA.
3614 */
3615 if (!send_keepalive(smbd_server_fd())) {
3616 exit_server_cleanly("reply_writebraw: send of "
3617 "keepalive failed");
3618 }
3619 #endif
3620 TALLOC_FREE(req->outbuf);
3621 }
3622 return;
3623 }
3624
3625 #undef DBGC_CLASS
3626 #define DBGC_CLASS DBGC_LOCKING
3627
3628 /****************************************************************************
3629 Reply to a writeunlock (core+).
3630 ****************************************************************************/
3631
3632 void reply_writeunlock(struct smb_request *req)
3633 {
3634 connection_struct *conn = req->conn;
3635 ssize_t nwritten = -1;
3636 size_t numtowrite;
3637 SMB_OFF_T startpos;
3638 const char *data;
3639 NTSTATUS status = NT_STATUS_OK;
3640 files_struct *fsp;
3641
3642 START_PROFILE(SMBwriteunlock);
3643
3644 if (req->wct < 5) {
3645 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3646 END_PROFILE(SMBwriteunlock);
3647 return;
3648 }
3649
3650 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
3651
3652 if (!check_fsp(conn, req, fsp)) {
3653 END_PROFILE(SMBwriteunlock);
3654 return;
3655 }
3656
3657 if (!CHECK_WRITE(fsp)) {
3658 reply_doserror(req, ERRDOS,ERRbadaccess);
3659 END_PROFILE(SMBwriteunlock);
3660 return;
3661 }
3662
3663 numtowrite = SVAL(req->inbuf,smb_vwv1);
3664 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3665 data = (const char *)req->buf + 3;
3666
3667 if (numtowrite
3668 && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
3669 (uint64_t)startpos, WRITE_LOCK)) {
3670 reply_doserror(req, ERRDOS, ERRlock);
3671 END_PROFILE(SMBwriteunlock);
3672 return;
3673 }
3674
3675 /* The special X/Open SMB protocol handling of
3676 zero length writes is *NOT* done for
3677 this call */
3678 if(numtowrite == 0) {
3679 nwritten = 0;
3680 } else {
3681 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3682 }
3683
3684 status = sync_file(conn, fsp, False /* write through */);
3685 if (!NT_STATUS_IS_OK(status)) {
3686 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3687 fsp->fsp_name, nt_errstr(status) ));
3688 reply_nterror(req, status);
3689 END_PROFILE(SMBwriteunlock);
3690 return;
3691 }
3692
3693 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3694 reply_unixerror(req, ERRHRD, ERRdiskfull);
3695 END_PROFILE(SMBwriteunlock);
3696 return;
3697 }
3698
3699 if (numtowrite) {
3700 status = do_unlock(smbd_messaging_context(),
3701 fsp,
3702 req->smbpid,
3703 (uint64_t)numtowrite,
3704 (uint64_t)startpos,
3705 WINDOWS_LOCK);
3706
3707 if (NT_STATUS_V(status)) {
3708 reply_nterror(req, status);
3709 END_PROFILE(SMBwriteunlock);
3710 return;
3711 }
3712 }
3713
3714 reply_outbuf(req, 1, 0);
3715
3716 SSVAL(req->outbuf,smb_vwv0,nwritten);
3717
3718 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3719 fsp->fnum, (int)numtowrite, (int)nwritten));
3720
3721 END_PROFILE(SMBwriteunlock);
3722 return;
3723 }
3724
3725 #undef DBGC_CLASS
3726 #define DBGC_CLASS DBGC_ALL
3727
3728 /****************************************************************************
3729 Reply to a write.
3730 ****************************************************************************/
3731
3732 void reply_write(struct smb_request *req)
3733 {
3734 connection_struct *conn = req->conn;
3735 size_t numtowrite;
3736 ssize_t nwritten = -1;
3737 SMB_OFF_T startpos;
3738 const char *data;
3739 files_struct *fsp;
3740 NTSTATUS status;
3741
3742 START_PROFILE(SMBwrite);
3743
3744 if (req->wct < 5) {
3745 END_PROFILE(SMBwrite);
3746 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3747 return;
3748 }
3749
3750 /* If it's an IPC, pass off the pipe handler. */
3751 if (IS_IPC(conn)) {
3752 reply_pipe_write(req);
3753 END_PROFILE(SMBwrite);
3754 return;
3755 }
3756
3757 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
3758
3759 if (!check_fsp(conn, req, fsp)) {
3760 END_PROFILE(SMBwrite);
3761 return;
3762 }
3763
3764 if (!CHECK_WRITE(fsp)) {
3765 reply_doserror(req, ERRDOS, ERRbadaccess);
3766 END_PROFILE(SMBwrite);
3767 return;
3768 }
3769
3770 numtowrite = SVAL(req->inbuf,smb_vwv1);
3771 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3772 data = (const char *)req->buf + 3;
3773
3774 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
3775 (uint64_t)startpos, WRITE_LOCK)) {
3776 reply_doserror(req, ERRDOS, ERRlock);
3777 END_PROFILE(SMBwrite);
3778 return;
3779 }
3780
3781 /*
3782 * X/Open SMB protocol says that if smb_vwv1 is
3783 * zero then the file size should be extended or
3784 * truncated to the size given in smb_vwv[2-3].
3785 */
3786
3787 if(numtowrite == 0) {
3788 /*
3789 * This is actually an allocate call, and set EOF. JRA.
3790 */
3791 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3792 if (nwritten < 0) {
3793 reply_nterror(req, NT_STATUS_DISK_FULL);
3794 END_PROFILE(SMBwrite);
3795 return;
3796 }
3797 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3798 if (nwritten < 0) {
3799 reply_nterror(req, NT_STATUS_DISK_FULL);
3800 END_PROFILE(SMBwrite);
3801 return;
3802 }
3803 trigger_write_time_update_immediate(fsp);
3804 } else {
3805 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3806 }
3807
3808 status = sync_file(conn, fsp, False);
3809 if (!NT_STATUS_IS_OK(status)) {
3810 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3811 fsp->fsp_name, nt_errstr(status) ));
3812 reply_nterror(req, status);
3813 END_PROFILE(SMBwrite);
3814 return;
3815 }
3816
3817 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3818 reply_unixerror(req, ERRHRD, ERRdiskfull);
3819 END_PROFILE(SMBwrite);
3820 return;
3821 }
3822
3823 reply_outbuf(req, 1, 0);
3824
3825 SSVAL(req->outbuf,smb_vwv0,nwritten);
3826
3827 if (nwritten < (ssize_t)numtowrite) {
3828 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3829 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3830 }
3831
3832 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3833
3834 END_PROFILE(SMBwrite);
3835 return;
3836 }
3837
3838 /****************************************************************************
3839 Ensure a buffer is a valid writeX for recvfile purposes.
3840 ****************************************************************************/
3841
3842 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3843 (2*14) + /* word count (including bcc) */ \
3844 1 /* pad byte */)
3845
3846 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3847 {
3848 size_t numtowrite;
3849 connection_struct *conn = NULL;
3850 unsigned int doff = 0;
3851 size_t len = smb_len_large(inbuf);
3852
3853 if (is_encrypted_packet(inbuf)) {
3854 /* Can't do this on encrypted
3855 * connections. */
3856 return false;
3857 }
3858
3859 if (CVAL(inbuf,smb_com) != SMBwriteX) {
3860 return false;
3861 }
3862
3863 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3864 CVAL(inbuf,smb_wct) != 14) {
3865 DEBUG(10,("is_valid_writeX_buffer: chained or "
3866 "invalid word length.\n"));
3867 return false;
3868 }
3869
3870 conn = conn_find(SVAL(inbuf, smb_tid));
3871 if (conn == NULL) {
3872 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3873 return false;
3874 }
3875 if (IS_IPC(conn)) {
3876 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3877 return false;
3878 }
3879 doff = SVAL(inbuf,smb_vwv11);
3880
3881 numtowrite = SVAL(inbuf,smb_vwv10);
3882
3883 if (len > doff && len - doff > 0xFFFF) {
3884 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3885 }
3886
3887 if (numtowrite == 0) {
3888 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3889 return false;
3890 }
3891
3892 /* Ensure the sizes match up. */
3893 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3894 /* no pad byte...old smbclient :-( */
3895 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3896 (unsigned int)doff,
3897 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3898 return false;
3899 }
3900
3901 if (len - doff != numtowrite) {
3902 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3903 "len = %u, doff = %u, numtowrite = %u\n",
3904 (unsigned int)len,
3905 (unsigned int)doff,
3906 (unsigned int)numtowrite ));
3907 return false;
3908 }
3909
3910 DEBUG(10,("is_valid_writeX_buffer: true "
3911 "len = %u, doff = %u, numtowrite = %u\n",
3912 (unsigned int)len,
3913 (unsigned int)doff,
3914 (unsigned int)numtowrite ));
3915
3916 return true;
3917 }
3918
3919 /****************************************************************************
3920 Reply to a write and X.
3921 ****************************************************************************/
3922
3923 void reply_write_and_X(struct smb_request *req)
3924 {
3925 connection_struct *conn = req->conn;
3926 files_struct *fsp;
3927 SMB_OFF_T startpos;
3928 size_t numtowrite;
3929 bool write_through;
3930 ssize_t nwritten;
3931 unsigned int smb_doff;
3932 unsigned int smblen;
3933 char *data;
3934 NTSTATUS status;
3935
3936 START_PROFILE(SMBwriteX);
3937
3938 if ((req->wct != 12) && (req->wct != 14)) {
3939 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3940 END_PROFILE(SMBwriteX);
3941 return;
3942 }
3943
3944 numtowrite = SVAL(req->inbuf,smb_vwv10);
3945 smb_doff = SVAL(req->inbuf,smb_vwv11);
3946 smblen = smb_len(req->inbuf);
3947
3948 if (req->unread_bytes > 0xFFFF ||
3949 (smblen > smb_doff &&
3950 smblen - smb_doff > 0xFFFF)) {
3951 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
3952 }
3953
3954 if (req->unread_bytes) {
3955 /* Can't do a recvfile write on IPC$ */
3956 if (IS_IPC(conn)) {
3957 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3958 END_PROFILE(SMBwriteX);
3959 return;
3960 }
3961 if (numtowrite != req->unread_bytes) {
3962 reply_doserror(req, ERRDOS, ERRbadmem);
3963 END_PROFILE(SMBwriteX);
3964 return;
3965 }
3966 } else {
3967 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
3968 smb_doff + numtowrite > smblen) {
3969 reply_doserror(req, ERRDOS, ERRbadmem);
3970 END_PROFILE(SMBwriteX);
3971 return;
3972 }
3973 }
3974
3975 /* If it's an IPC, pass off the pipe handler. */
3976 if (IS_IPC(conn)) {
3977 if (req->unread_bytes) {
3978 reply_doserror(req, ERRDOS, ERRbadmem);
3979 END_PROFILE(SMBwriteX);
3980 return;
3981 }
3982 reply_pipe_write_and_X(req);
3983 END_PROFILE(SMBwriteX);
3984 return;
3985 }
3986
3987 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
3988 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3989 write_through = BITSETW(req->inbuf+smb_vwv7,0);
3990
3991 if (!check_fsp(conn, req, fsp)) {
3992 END_PROFILE(SMBwriteX);
3993 return;
3994 }
3995
3996 if (!CHECK_WRITE(fsp)) {
3997 reply_doserror(req, ERRDOS, ERRbadaccess);
3998 END_PROFILE(SMBwriteX);
3999 return;
4000 }
4001
4002 data = smb_base(req->inbuf) + smb_doff;
4003
4004 if(req->wct == 14) {
4005 #ifdef LARGE_SMB_OFF_T
4006 /*
4007 * This is a large offset (64 bit) write.
4008 */
4009 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
4010
4011 #else /* !LARGE_SMB_OFF_T */
4012
4013 /*
4014 * Ensure we haven't been sent a >32 bit offset.
4015 */
4016
4017 if(IVAL(req->inbuf,smb_vwv12) != 0) {
4018 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4019 "used and we don't support 64 bit offsets.\n",
4020 (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
4021 reply_doserror(req, ERRDOS, ERRbadaccess);
4022 END_PROFILE(SMBwriteX);
4023 return;
4024 }
4025
4026 #endif /* LARGE_SMB_OFF_T */
4027 }
4028
4029 if (is_locked(fsp,(uint32)req->smbpid,
4030 (uint64_t)numtowrite,
4031 (uint64_t)startpos, WRITE_LOCK)) {
4032 reply_doserror(req, ERRDOS, ERRlock);
4033 END_PROFILE(SMBwriteX);
4034 return;
4035 }
4036
4037 /* X/Open SMB protocol says that, unlike SMBwrite
4038 if the length is zero then NO truncation is
4039 done, just a write of zero. To truncate a file,
4040 use SMBwrite. */
4041
4042 if(numtowrite == 0) {
4043 nwritten = 0;
4044 } else {
4045
4046 if ((req->unread_bytes == 0) &&
4047 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4048 numtowrite)) {
4049 END_PROFILE(SMBwriteX);
4050 return;
4051 }
4052
4053 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4054 }
4055
4056 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4057 reply_unixerror(req, ERRHRD, ERRdiskfull);
4058 END_PROFILE(SMBwriteX);
4059 return;
4060 }
4061
4062 reply_outbuf(req, 6, 0);
4063 SSVAL(req->outbuf,smb_vwv2,nwritten);
4064 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4065
4066 if (nwritten < (ssize_t)numtowrite) {
4067 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4068 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4069 }
4070
4071 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4072 fsp->fnum, (int)numtowrite, (int)nwritten));
4073
4074 status = sync_file(conn, fsp, write_through);
4075 if (!NT_STATUS_IS_OK(status)) {
4076 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4077 fsp->fsp_name, nt_errstr(status) ));
4078 reply_nterror(req, status);
4079 END_PROFILE(SMBwriteX);
4080 return;
4081 }
4082
4083 END_PROFILE(SMBwriteX);
4084 chain_reply(req);
4085 return;
4086 }
4087
4088 /****************************************************************************
4089 Reply to a lseek.
4090 ****************************************************************************/
4091
4092 void reply_lseek(struct smb_request *req)
4093 {
4094 connection_struct *conn = req->conn;
4095 SMB_OFF_T startpos;
4096 SMB_OFF_T res= -1;
4097 int mode,umode;
4098 files_struct *fsp;
4099
4100 START_PROFILE(SMBlseek);
4101
4102 if (req->wct < 4) {
4103 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4104 END_PROFILE(SMBlseek);
4105 return;
4106 }
4107
4108 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4109
4110 if (!check_fsp(conn, req, fsp)) {
4111 return;
4112 }
4113
4114 flush_write_cache(fsp, SEEK_FLUSH);
4115
4116 mode = SVAL(req->inbuf,smb_vwv1) & 3;
4117 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4118 startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4119
4120 switch (mode) {
4121 case 0:
4122 umode = SEEK_SET;
4123 res = startpos;
4124 break;
4125 case 1:
4126 umode = SEEK_CUR;
4127 res = fsp->fh->pos + startpos;
4128 break;
4129 case 2:
4130 umode = SEEK_END;
4131 break;
4132 default:
4133 umode = SEEK_SET;
4134 res = startpos;
4135 break;
4136 }
4137
4138 if (umode == SEEK_END) {
4139 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4140 if(errno == EINVAL) {
4141 SMB_OFF_T current_pos = startpos;
4142 SMB_STRUCT_STAT sbuf;
4143
4144 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4145 reply_unixerror(req, ERRDOS,
4146 ERRnoaccess);
4147 END_PROFILE(SMBlseek);
4148 return;
4149 }
4150
4151 current_pos += sbuf.st_size;
4152 if(current_pos < 0)
4153 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4154 }
4155 }
4156
4157 if(res == -1) {
4158 reply_unixerror(req, ERRDOS, ERRnoaccess);
4159 END_PROFILE(SMBlseek);
4160 return;
4161 }
4162 }
4163
4164 fsp->fh->pos = res;
4165
4166 reply_outbuf(req, 2, 0);
4167 SIVAL(req->outbuf,smb_vwv0,res);
4168
4169 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4170 fsp->fnum, (double)startpos, (double)res, mode));
4171
4172 END_PROFILE(SMBlseek);
4173 return;
4174 }
4175
4176 /****************************************************************************
4177 Reply to a flush.
4178 ****************************************************************************/
4179
4180 void reply_flush(struct smb_request *req)
4181 {
4182 connection_struct *conn = req->conn;
4183 uint16 fnum;
4184 files_struct *fsp;
4185
4186 START_PROFILE(SMBflush);
4187
4188 if (req->wct < 1) {
4189 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4190 return;
4191 }
4192
4193 fnum = SVAL(req->inbuf,smb_vwv0);
4194 fsp = file_fsp(req, fnum);
4195
4196 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4197 return;
4198 }
4199
4200 if (!fsp) {
4201 file_sync_all(conn);
4202 } else {
4203 NTSTATUS status = sync_file(conn, fsp, True);
4204 if (!NT_STATUS_IS_OK(status)) {
4205 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4206 fsp->fsp_name, nt_errstr(status) ));
4207 reply_nterror(req, status);
4208 END_PROFILE(SMBflush);
4209 return;
4210 }
4211 }
4212
4213 reply_outbuf(req, 0, 0);
4214
4215 DEBUG(3,("flush\n"));
4216 END_PROFILE(SMBflush);
4217 return;
4218 }
4219
4220 /****************************************************************************
4221 Reply to a exit.
4222 conn POINTER CAN BE NULL HERE !
4223 ****************************************************************************/
4224
4225 void reply_exit(struct smb_request *req)
4226 {
4227 START_PROFILE(SMBexit);
4228
4229 file_close_pid(req->smbpid, req->vuid);
4230
4231 reply_outbuf(req, 0, 0);
4232
4233 DEBUG(3,("exit\n"));
4234
4235 END_PROFILE(SMBexit);
4236 return;
4237 }
4238
4239 /****************************************************************************
4240 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4241 ****************************************************************************/
4242
4243 void reply_close(struct smb_request *req)
4244 {
4245 connection_struct *conn = req->conn;
4246 NTSTATUS status = NT_STATUS_OK;
4247 files_struct *fsp = NULL;
4248 START_PROFILE(SMBclose);
4249
4250 if (req->wct < 3) {
4251 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4252 END_PROFILE(SMBclose);
4253 return;
4254 }
4255
4256 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4257
4258 /*
4259 * We can only use check_fsp if we know it's not a directory.
4260 */
4261
4262 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4263 reply_doserror(req, ERRDOS, ERRbadfid);
4264 END_PROFILE(SMBclose);
4265 return;
4266 }
4267
4268 if(fsp->is_directory) {
4269 /*
4270 * Special case - close NT SMB directory handle.
4271 */
4272 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4273 status = close_file(req, fsp, NORMAL_CLOSE);
4274 } else {
4275 time_t t;
4276 /*
4277 * Close ordinary file.
4278 */
4279
4280 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4281 fsp->fh->fd, fsp->fnum,
4282 conn->num_files_open));
4283
4284 /*
4285 * Take care of any time sent in the close.
4286 */
4287
4288 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4289 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4290
4291 /*
4292 * close_file() returns the unix errno if an error
4293 * was detected on close - normally this is due to
4294 * a disk full error. If not then it was probably an I/O error.
4295 */
4296
4297 status = close_file(req, fsp, NORMAL_CLOSE);
4298 }
4299
4300 if (!NT_STATUS_IS_OK(status)) {
4301 reply_nterror(req, status);
4302 END_PROFILE(SMBclose);
4303 return;
4304 }
4305
4306 reply_outbuf(req, 0, 0);
4307 END_PROFILE(SMBclose);
4308 return;
4309 }
4310
4311 /****************************************************************************
4312 Reply to a writeclose (Core+ protocol).
4313 ****************************************************************************/
4314
4315 void reply_writeclose(struct smb_request *req)
4316 {
4317 connection_struct *conn = req->conn;
4318 size_t numtowrite;
4319 ssize_t nwritten = -1;
4320 NTSTATUS close_status = NT_STATUS_OK;
4321 SMB_OFF_T startpos;
4322 const char *data;
4323 struct timespec mtime;
4324 files_struct *fsp;
4325
4326 START_PROFILE(SMBwriteclose);
4327
4328 if (req->wct < 6) {
4329 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4330 END_PROFILE(SMBwriteclose);
4331 return;
4332 }
4333
4334 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4335
4336 if (!check_fsp(conn, req, fsp)) {
4337 END_PROFILE(SMBwriteclose);
4338 return;
4339 }
4340 if (!CHECK_WRITE(fsp)) {
4341 reply_doserror(req, ERRDOS,ERRbadaccess);
4342 END_PROFILE(SMBwriteclose);
4343 return;
4344 }
4345
4346 numtowrite = SVAL(req->inbuf,smb_vwv1);
4347 startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4348 mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4349 req->inbuf+smb_vwv4));
4350 data = (const char *)req->buf + 1;
4351
4352 if (numtowrite
4353 && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
4354 (uint64_t)startpos, WRITE_LOCK)) {
4355 reply_doserror(req, ERRDOS,ERRlock);
4356 END_PROFILE(SMBwriteclose);
4357 return;
4358 }
4359
4360 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4361
4362 set_close_write_time(fsp, mtime);
4363
4364 /*
4365 * More insanity. W2K only closes the file if writelen > 0.
4366 * JRA.
4367 */
4368
4369 if (numtowrite) {
4370 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4371 fsp->fsp_name ));
4372 close_status = close_file(req, fsp, NORMAL_CLOSE);
4373 }
4374
4375 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4376 fsp->fnum, (int)numtowrite, (int)nwritten,
4377 conn->num_files_open));
4378
4379 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4380 reply_doserror(req, ERRHRD, ERRdiskfull);
4381 END_PROFILE(SMBwriteclose);
4382 return;
4383 }
4384
4385 if(!NT_STATUS_IS_OK(close_status)) {
4386 reply_nterror(req, close_status);
4387 END_PROFILE(SMBwriteclose);
4388 return;
4389 }
4390
4391 reply_outbuf(req, 1, 0);
4392
4393 SSVAL(req->outbuf,smb_vwv0,nwritten);
4394 END_PROFILE(SMBwriteclose);
4395 return;
4396 }
4397
4398 #undef DBGC_CLASS
4399 #define DBGC_CLASS DBGC_LOCKING
4400
4401 /****************************************************************************
4402 Reply to a lock.
4403 ****************************************************************************/
4404
4405 void reply_lock(struct smb_request *req)
4406 {
4407 connection_struct *conn = req->conn;
4408 uint64_t count,offset;
4409 NTSTATUS status;
4410 files_struct *fsp;
4411 struct byte_range_lock *br_lck = NULL;
4412
4413 START_PROFILE(SMBlock);
4414
4415 if (req->wct < 5) {
4416 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4417 END_PROFILE(SMBlock);
4418 return;
4419 }
4420
4421 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4422
4423 if (!check_fsp(conn, req, fsp)) {
4424 END_PROFILE(SMBlock);
4425 return;
4426 }
4427
4428 release_level_2_oplocks_on_change(fsp);
4429
4430 count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
4431 offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
4432
4433 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4434 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4435
4436 br_lck = do_lock(smbd_messaging_context(),
4437 fsp,
4438 req->smbpid,
4439 count,
4440 offset,
4441 WRITE_LOCK,
4442 WINDOWS_LOCK,
4443 False, /* Non-blocking lock. */
4444 &status,
4445 NULL);
4446
4447 TALLOC_FREE(br_lck);
4448
4449 if (NT_STATUS_V(status)) {
4450 reply_nterror(req, status);
4451 END_PROFILE(SMBlock);
4452 return;
4453 }
4454
4455 reply_outbuf(req, 0, 0);
4456
4457 END_PROFILE(SMBlock);
4458 return;
4459 }
4460
4461 /****************************************************************************
4462 Reply to a unlock.
4463 ****************************************************************************/
4464
4465 void reply_unlock(struct smb_request *req)
4466 {
4467 connection_struct *conn = req->conn;
4468 uint64_t count,offset;
4469 NTSTATUS status;
4470 files_struct *fsp;
4471
4472 START_PROFILE(SMBunlock);
4473
4474 if (req->wct < 5) {
4475 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4476 END_PROFILE(SMBunlock);
4477 return;
4478 }
4479
4480 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4481
4482 if (!check_fsp(conn, req, fsp)) {
4483 END_PROFILE(SMBunlock);
4484 return;
4485 }
4486
4487 count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
4488 offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
4489
4490 status = do_unlock(smbd_messaging_context(),
4491 fsp,
4492 req->smbpid,
4493 count,
4494 offset,
4495 WINDOWS_LOCK);
4496
4497 if (NT_STATUS_V(status)) {
4498 reply_nterror(req, status);
4499 END_PROFILE(SMBunlock);
4500 return;
4501 }
4502
4503 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4504 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4505
4506 reply_outbuf(req, 0, 0);
4507
4508 END_PROFILE(SMBunlock);
4509 return;
4510 }
4511
4512 #undef DBGC_CLASS
4513 #define DBGC_CLASS DBGC_ALL
4514
4515 /****************************************************************************
4516 Reply to a tdis.
4517 conn POINTER CAN BE NULL HERE !
4518 ****************************************************************************/
4519
4520 void reply_tdis(struct smb_request *req)
4521 {
4522 connection_struct *conn = req->conn;
4523 START_PROFILE(SMBtdis);
4524
4525 if (!conn) {
4526 DEBUG(4,("Invalid connection in tdis\n"));
4527 reply_doserror(req, ERRSRV, ERRinvnid);
4528 END_PROFILE(SMBtdis);
4529 return;
4530 }
4531
4532 conn->used = False;
4533
4534 close_cnum(conn,req->vuid);
4535 req->conn = NULL;
4536
4537 reply_outbuf(req, 0, 0);
4538 END_PROFILE(SMBtdis);
4539 return;
4540 }
4541
4542 /****************************************************************************
4543 Reply to a echo.
4544 conn POINTER CAN BE NULL HERE !
4545 ****************************************************************************/
4546
4547 void reply_echo(struct smb_request *req)
4548 {
4549 connection_struct *conn = req->conn;
4550 int smb_reverb;
4551 int seq_num;
4552
4553 START_PROFILE(SMBecho);
4554
4555 if (req->wct < 1) {
4556 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4557 END_PROFILE(SMBecho);
4558 return;
4559 }
4560
4561 smb_reverb = SVAL(req->inbuf,smb_vwv0);
4562
4563 reply_outbuf(req, 1, req->buflen);
4564
4565 /* copy any incoming data back out */
4566 if (req->buflen > 0) {
4567 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4568 }
4569
4570 if (smb_reverb > 100) {
4571 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4572 smb_reverb = 100;
4573 }
4574
4575 for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4576 SSVAL(req->outbuf,smb_vwv0,seq_num);
4577
4578 show_msg((char *)req->outbuf);
4579 if (!srv_send_smb(smbd_server_fd(),
4580 (char *)req->outbuf,
4581 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4582 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4583 }
4584
4585 DEBUG(3,("echo %d times\n", smb_reverb));
4586
4587 TALLOC_FREE(req->outbuf);
4588
4589 END_PROFILE(SMBecho);
4590 return;
4591 }
4592
4593 /****************************************************************************
4594 Reply to a printopen.
4595 ****************************************************************************/
4596
4597 void reply_printopen(struct smb_request *req)
4598 {
4599 connection_struct *conn = req->conn;
4600 files_struct *fsp;
4601 NTSTATUS status;
4602
4603 START_PROFILE(SMBsplopen);
4604
4605 if (req->wct < 2) {
4606 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4607 END_PROFILE(SMBsplopen);
4608 return;
4609 }
4610
4611 if (!CAN_PRINT(conn)) {
4612 reply_doserror(req, ERRDOS, ERRnoaccess);
4613 END_PROFILE(SMBsplopen);
4614 return;
4615 }
4616
4617 /* Open for exclusive use, write only. */
4618 status = print_fsp_open(req, conn, NULL, req->vuid, &fsp);
4619
4620 if (!NT_STATUS_IS_OK(status)) {
4621 reply_nterror(req, status);
4622 END_PROFILE(SMBsplopen);
4623 return;
4624 }
4625
4626 reply_outbuf(req, 1, 0);
4627 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4628
4629 DEBUG(3,("openprint fd=%d fnum=%d\n",
4630 fsp->fh->fd, fsp->fnum));
4631
4632 END_PROFILE(SMBsplopen);
4633 return;
4634 }
4635
4636 /****************************************************************************
4637 Reply to a printclose.
4638 ****************************************************************************/
4639
4640 void reply_printclose(struct smb_request *req)
4641 {
4642 connection_struct *conn = req->conn;
4643 files_struct *fsp;
4644 NTSTATUS status;
4645
4646 START_PROFILE(SMBsplclose);
4647
4648 if (req->wct < 1) {
4649 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4650 END_PROFILE(SMBsplclose);
4651 return;
4652 }
4653
4654 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4655
4656 if (!check_fsp(conn, req, fsp)) {
4657 END_PROFILE(SMBsplclose);
4658 return;
4659 }
4660
4661 if (!CAN_PRINT(conn)) {
4662 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4663 END_PROFILE(SMBsplclose);
4664 return;
4665 }
4666
4667 DEBUG(3,("printclose fd=%d fnum=%d\n",
4668 fsp->fh->fd,fsp->fnum));
4669
4670 status = close_file(req, fsp, NORMAL_CLOSE);
4671
4672 if(!NT_STATUS_IS_OK(status)) {
4673 reply_nterror(req, status);
4674 END_PROFILE(SMBsplclose);
4675 return;
4676 }
4677
4678 reply_outbuf(req, 0, 0);
4679
4680 END_PROFILE(SMBsplclose);
4681 return;
4682 }
4683
4684 /****************************************************************************
4685 Reply to a printqueue.
4686 ****************************************************************************/
4687
4688 void reply_printqueue(struct smb_request *req)
4689 {
4690 connection_struct *conn = req->conn;
4691 int max_count;
4692 int start_index;
4693
4694 START_PROFILE(SMBsplretq);
4695
4696 if (req->wct < 2) {
4697 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4698 END_PROFILE(SMBsplretq);
4699 return;
4700 }
4701
4702 max_count = SVAL(req->inbuf,smb_vwv0);
4703 start_index = SVAL(req->inbuf,smb_vwv1);
4704
4705 /* we used to allow the client to get the cnum wrong, but that
4706 is really quite gross and only worked when there was only
4707 one printer - I think we should now only accept it if they
4708 get it right (tridge) */
4709 if (!CAN_PRINT(conn)) {
4710 reply_doserror(req, ERRDOS, ERRnoaccess);
4711 END_PROFILE(SMBsplretq);
4712 return;
4713 }
4714
4715 reply_outbuf(req, 2, 3);
4716 SSVAL(req->outbuf,smb_vwv0,0);
4717 SSVAL(req->outbuf,smb_vwv1,0);
4718 SCVAL(smb_buf(req->outbuf),0,1);
4719 SSVAL(smb_buf(req->outbuf),1,0);
4720
4721 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4722 start_index, max_count));
4723
4724 {
4725 print_queue_struct *queue = NULL;
4726 print_status_struct status;
4727 int count = print_queue_status(SNUM(conn), &queue, &status);
4728 int num_to_get = ABS(max_count);
4729 int first = (max_count>0?start_index:start_index+max_count+1);
4730 int i;
4731
4732 if (first >= count)
4733 num_to_get = 0;
4734 else
4735 num_to_get = MIN(num_to_get,count-first);
4736
4737
4738 for (i=first;i<first+num_to_get;i++) {
4739 char blob[28];
4740 char *p = blob;
4741
4742 srv_put_dos_date2(p,0,queue[i].time);
4743 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4744 SSVAL(p,5, queue[i].job);
4745 SIVAL(p,7,queue[i].size);
4746 SCVAL(p,11,0);
4747 srvstr_push(blob, req->flags2, p+12,
4748 queue[i].fs_user, 16, STR_ASCII);
4749
4750 if (message_push_blob(
4751 &req->outbuf,
4752 data_blob_const(
4753 blob, sizeof(blob))) == -1) {
4754 reply_nterror(req, NT_STATUS_NO_MEMORY);
4755 END_PROFILE(SMBsplretq);
4756 return;
4757 }
4758 }
4759
4760 if (count > 0) {
4761 SSVAL(req->outbuf,smb_vwv0,count);
4762 SSVAL(req->outbuf,smb_vwv1,
4763 (max_count>0?first+count:first-1));
4764 SCVAL(smb_buf(req->outbuf),0,1);
4765 SSVAL(smb_buf(req->outbuf),1,28*count);
4766 }
4767
4768 SAFE_FREE(queue);
4769
4770 DEBUG(3,("%d entries returned in queue\n",count));
4771 }
4772
4773 END_PROFILE(SMBsplretq);
4774 return;
4775 }
4776
4777 /****************************************************************************
4778 Reply to a printwrite.
4779 ****************************************************************************/
4780
4781 void reply_printwrite(struct smb_request *req)
4782 {
4783 connection_struct *conn = req->conn;
4784 int numtowrite;
4785 const char *data;
4786 files_struct *fsp;
4787
4788 START_PROFILE(SMBsplwr);
4789
4790 if (req->wct < 1) {
4791 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4792 END_PROFILE(SMBsplwr);
4793 return;
4794 }
4795
4796 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
4797
4798 if (!check_fsp(conn, req, fsp)) {
4799 END_PROFILE(SMBsplwr);
4800 return;
4801 }
4802
4803 if (!CAN_PRINT(conn)) {
4804 reply_doserror(req, ERRDOS, ERRnoaccess);
4805 END_PROFILE(SMBsplwr);
4806 return;
4807 }
4808
4809 if (!CHECK_WRITE(fsp)) {
4810 reply_doserror(req, ERRDOS, ERRbadaccess);
4811 END_PROFILE(SMBsplwr);
4812 return;
4813 }
4814
4815 numtowrite = SVAL(req->buf, 1);
4816
4817 if (req->buflen < numtowrite + 3) {
4818 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4819 END_PROFILE(SMBsplwr);
4820 return;
4821 }
4822
4823 data = (const char *)req->buf + 3;
4824
4825 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4826 reply_unixerror(req, ERRHRD, ERRdiskfull);
4827 END_PROFILE(SMBsplwr);
4828 return;
4829 }
4830
4831 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4832
4833 END_PROFILE(SMBsplwr);
4834 return;
4835 }
4836
4837 /****************************************************************************
4838 Reply to a mkdir.
4839 ****************************************************************************/
4840
4841 void reply_mkdir(struct smb_request *req)
4842 {
4843 connection_struct *conn = req->conn;
4844 char *directory = NULL;
4845 NTSTATUS status;
4846 SMB_STRUCT_STAT sbuf;
4847 TALLOC_CTX *ctx = talloc_tos();
4848
4849 START_PROFILE(SMBmkdir);
4850
4851 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4852 (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
4853 if (!NT_STATUS_IS_OK(status)) {
4854 reply_nterror(req, status);
4855 END_PROFILE(SMBmkdir);
4856 return;
4857 }
4858
4859 status = resolve_dfspath(ctx, conn,
4860 req->flags2 & FLAGS2_DFS_PATHNAMES,
4861 directory,
4862 &directory);
4863 if (!NT_STATUS_IS_OK(status)) {
4864 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4865 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4866 ERRSRV, ERRbadpath);
4867 END_PROFILE(SMBmkdir);
4868 return;
4869 }
4870 reply_nterror(req, status);
4871 END_PROFILE(SMBmkdir);
4872 return;
4873 }
4874
4875 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4876 if (!NT_STATUS_IS_OK(status)) {
4877 reply_nterror(req, status);
4878 END_PROFILE(SMBmkdir);
4879 return;
4880 }
4881
4882 status = check_name(conn, directory);
4883 if (!NT_STATUS_IS_OK(status)) {
4884 reply_nterror(req, status);
4885 END_PROFILE(SMBmkdir);
4886 return;
4887 }
4888
4889 status = create_directory(conn, req, directory);
4890
4891 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4892
4893 if (!NT_STATUS_IS_OK(status)) {
4894
4895 if (!use_nt_status()
4896 && NT_STATUS_EQUAL(status,
4897 NT_STATUS_OBJECT_NAME_COLLISION)) {
4898 /*
4899 * Yes, in the DOS error code case we get a
4900 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4901 * samba4 torture test.
4902 */
4903 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4904 }
4905
4906 reply_nterror(req, status);
4907 END_PROFILE(SMBmkdir);
4908 return;
4909 }
4910
4911 reply_outbuf(req, 0, 0);
4912
4913 DEBUG( 3, ( "mkdir %s\n", directory ) );
4914
4915 END_PROFILE(SMBmkdir);
4916 return;
4917 }
4918
4919 /****************************************************************************
4920 Static function used by reply_rmdir to delete an entire directory
4921 tree recursively. Return True on ok, False on fail.
4922 ****************************************************************************/
4923
4924 static bool recursive_rmdir(TALLOC_CTX *ctx,
4925 connection_struct *conn,
4926 char *directory)
4927 {
4928 const char *dname = NULL;
4929 bool ret = True;
4930 long offset = 0;
4931 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
4932 NULL, 0);
4933
4934 if(dir_hnd == NULL)
4935 return False;
4936
4937 while((dname = ReadDirName(dir_hnd, &offset))) {
4938 char *fullname = NULL;
4939 SMB_STRUCT_STAT st;
4940
4941 if (ISDOT(dname) || ISDOTDOT(dname)) {
4942 continue;
4943 }
4944
4945 if (!is_visible_file(conn, directory, dname, &st, False)) {
4946 continue;
4947 }
4948
4949 /* Construct the full name. */
4950 fullname = talloc_asprintf(ctx,
4951 "%s/%s",
4952 directory,
4953 dname);
4954 if (!fullname) {
4955 errno = ENOMEM;
4956 ret = False;
4957 break;
4958 }
4959
4960 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
4961 ret = False;
4962 break;
4963 }
4964
4965 if(st.st_mode & S_IFDIR) {
4966 if(!recursive_rmdir(ctx, conn, fullname)) {
4967 ret = False;
4968 break;
4969 }
4970 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
4971 ret = False;
4972 break;
4973 }
4974 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
4975 ret = False;
4976 break;
4977 }
4978 TALLOC_FREE(fullname);
4979 }
4980 TALLOC_FREE(dir_hnd);
4981 return ret;
4982 }
4983
4984 /****************************************************************************
4985 The internals of the rmdir code - called elsewhere.
4986 ****************************************************************************/
4987
4988 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
4989 connection_struct *conn,
4990 const char *directory)
4991 {
4992 int ret;
4993 SMB_STRUCT_STAT st;
4994
4995 /* Might be a symlink. */
4996 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
4997 return map_nt_error_from_unix(errno);
4998 }
4999
5000 if (S_ISLNK(st.st_mode)) {
5001 /* Is what it points to a directory ? */
5002 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5003 return map_nt_error_from_unix(errno);
5004 }
5005 if (!(S_ISDIR(st.st_mode))) {
5006 return NT_STATUS_NOT_A_DIRECTORY;
5007 }
5008 ret = SMB_VFS_UNLINK(conn,directory);
5009 } else {
5010 ret = SMB_VFS_RMDIR(conn,directory);
5011 }
5012 if (ret == 0) {
5013 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5014 FILE_NOTIFY_CHANGE_DIR_NAME,
5015 directory);
5016 return NT_STATUS_OK;
5017 }
5018
5019 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5020 /*
5021 * Check to see if the only thing in this directory are
5022 * vetoed files/directories. If so then delete them and
5023 * retry. If we fail to delete any of them (and we *don't*
5024 * do a recursive delete) then fail the rmdir.
5025 */
5026 const char *dname;
5027 long dirpos = 0;
5028 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5029 directory, NULL, 0);
5030
5031 if(dir_hnd == NULL) {
5032 errno = ENOTEMPTY;
5033 goto err;
5034 }
5035
5036 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5037 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5038 continue;
5039 if (!is_visible_file(conn, directory, dname, &st, False))
5040 continue;
5041 if(!IS_VETO_PATH(conn, dname)) {
5042 TALLOC_FREE(dir_hnd);
5043 errno = ENOTEMPTY;
5044 goto err;
5045 }
5046 }
5047
5048 /* We only have veto files/directories. Recursive delete. */
5049
5050 RewindDir(dir_hnd,&dirpos);
5051 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5052 char *fullname = NULL;
5053
5054 if (ISDOT(dname) || ISDOTDOT(dname)) {
5055 continue;
5056 }
5057 if (!is_visible_file(conn, directory, dname, &st, False)) {
5058 continue;
5059 }
5060
5061 fullname = talloc_asprintf(ctx,
5062 "%s/%s",
5063 directory,
5064 dname);
5065
5066 if(!fullname) {
5067 errno = ENOMEM;
5068 break;
5069 }
5070
5071 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5072 break;
5073 }
5074 if(st.st_mode & S_IFDIR) {
5075 if(lp_recursive_veto_delete(SNUM(conn))) {
5076 if(!recursive_rmdir(ctx, conn, fullname))
5077 break;
5078 }
5079 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5080 break;
5081 }
5082 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5083 break;
5084 }
5085 TALLOC_FREE(fullname);
5086 }
5087 TALLOC_FREE(dir_hnd);
5088 /* Retry the rmdir */
5089 ret = SMB_VFS_RMDIR(conn,directory);
5090 }
5091
5092 err:
5093
5094 if (ret != 0) {
5095 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5096 "%s\n", directory,strerror(errno)));
5097 return map_nt_error_from_unix(errno);
5098 }
5099
5100 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5101 FILE_NOTIFY_CHANGE_DIR_NAME,
5102 directory);
5103
5104 return NT_STATUS_OK;
5105 }
5106
5107 /****************************************************************************
5108 Reply to a rmdir.
5109 ****************************************************************************/
5110
5111 void reply_rmdir(struct smb_request *req)
5112 {
5113 connection_struct *conn = req->conn;
5114 char *directory = NULL;
5115 SMB_STRUCT_STAT sbuf;
5116 NTSTATUS status;
5117 TALLOC_CTX *ctx = talloc_tos();
5118
5119 START_PROFILE(SMBrmdir);
5120
5121 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5122 (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
5123 if (!NT_STATUS_IS_OK(status)) {
5124 reply_nterror(req, status);
5125 END_PROFILE(SMBrmdir);
5126 return;
5127 }
5128
5129 status = resolve_dfspath(ctx, conn,
5130 req->flags2 & FLAGS2_DFS_PATHNAMES,
5131 directory,
5132 &directory);
5133 if (!NT_STATUS_IS_OK(status)) {
5134 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5135 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5136 ERRSRV, ERRbadpath);
5137 END_PROFILE(SMBrmdir);
5138 return;
5139 }
5140 reply_nterror(req, status);
5141 END_PROFILE(SMBrmdir);
5142 return;
5143 }
5144
5145 status = unix_convert(ctx, conn, directory, False, &directory,
5146 NULL, &sbuf);
5147 if (!NT_STATUS_IS_OK(status)) {
5148 reply_nterror(req, status);
5149 END_PROFILE(SMBrmdir);
5150 return;
5151 }
5152
5153 status = check_name(conn, directory);
5154 if (!NT_STATUS_IS_OK(status)) {
5155 reply_nterror(req, status);
5156 END_PROFILE(SMBrmdir);
5157 return;
5158 }
5159
5160 dptr_closepath(directory, req->smbpid);
5161 status = rmdir_internals(ctx, conn, directory);
5162 if (!NT_STATUS_IS_OK(status)) {
5163 reply_nterror(req, status);
5164 END_PROFILE(SMBrmdir);
5165 return;
5166 }
5167
5168 reply_outbuf(req, 0, 0);
5169
5170 DEBUG( 3, ( "rmdir %s\n", directory ) );
5171
5172 END_PROFILE(SMBrmdir);
5173 return;
5174 }
5175
5176 /*******************************************************************
5177 Resolve wildcards in a filename rename.
5178 ********************************************************************/
5179
5180 static bool resolve_wildcards(TALLOC_CTX *ctx,
5181 const char *name1,
5182 const char *name2,
5183 char **pp_newname)
5184 {
5185 char *name2_copy = NULL;
5186 char *root1 = NULL;
5187 char *root2 = NULL;
5188 char *ext1 = NULL;
5189 char *ext2 = NULL;
5190 char *p,*p2, *pname1, *pname2;
5191
5192 name2_copy = talloc_strdup(ctx, name2);
5193 if (!name2_copy) {
5194 return False;
5195 }
5196
5197 pname1 = strrchr_m(name1,'/');
5198 pname2 = strrchr_m(name2_copy,'/');
5199
5200 if (!pname1 || !pname2) {
5201 return False;
5202 }
5203
5204 /* Truncate the copy of name2 at the last '/' */
5205 *pname2 = '\0';
5206
5207 /* Now go past the '/' */
5208 pname1++;
5209 pname2++;
5210
5211 root1 = talloc_strdup(ctx, pname1);
5212 root2 = talloc_strdup(ctx, pname2);
5213
5214 if (!root1 || !root2) {
5215 return False;
5216 }
5217
5218 p = strrchr_m(root1,'.');
5219 if (p) {
5220 *p = 0;
5221 ext1 = talloc_strdup(ctx, p+1);
5222 } else {
5223 ext1 = talloc_strdup(ctx, "");
5224 }
5225 p = strrchr_m(root2,'.');
5226 if (p) {
5227 *p = 0;
5228 ext2 = talloc_strdup(ctx, p+1);
5229 } else {
5230 ext2 = talloc_strdup(ctx, "");
5231 }
5232
5233 if (!ext1 || !ext2) {
5234 return False;
5235 }
5236
5237 p = root1;
5238 p2 = root2;
5239 while (*p2) {
5240 if (*p2 == '?') {
5241 /* Hmmm. Should this be mb-aware ? */
5242 *p2 = *p;
5243 p2++;
5244 } else if (*p2 == '*') {
5245 *p2 = '\0';
5246 root2 = talloc_asprintf(ctx, "%s%s",
5247 root2,
5248 p);
5249 if (!root2) {
5250 return False;
5251 }
5252 break;
5253 } else {
5254 p2++;
5255 }
5256 if (*p) {
5257 p++;
5258 }
5259 }
5260
5261 p = ext1;
5262 p2 = ext2;
5263 while (*p2) {
5264 if (*p2 == '?') {
5265 /* Hmmm. Should this be mb-aware ? */
5266 *p2 = *p;
5267 p2++;
5268 } else if (*p2 == '*') {
5269 *p2 = '\0';
5270 ext2 = talloc_asprintf(ctx, "%s%s",
5271 ext2,
5272 p);
5273 if (!ext2) {
5274 return False;
5275 }
5276 break;
5277 } else {
5278 p2++;
5279 }
5280 if (*p) {
5281 p++;
5282 }
5283 }
5284
5285 if (*ext2) {
5286 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5287 name2_copy,
5288 root2,
5289 ext2);
5290 } else {
5291 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5292 name2_copy,
5293 root2);
5294 }
5295
5296 if (!*pp_newname) {
5297 return False;
5298 }
5299
5300 return True;
5301 }
5302
5303 /****************************************************************************
5304 Ensure open files have their names updated. Updated to notify other smbd's
5305 asynchronously.
5306 ****************************************************************************/
5307
5308 static void rename_open_files(connection_struct *conn,
5309 struct share_mode_lock *lck,
5310 const char *newname)
5311 {
5312 files_struct *fsp;
5313 bool did_rename = False;
5314
5315 for(fsp = file_find_di_first(lck->id); fsp;
5316 fsp = file_find_di_next(fsp)) {
5317 /* fsp_name is a relative path under the fsp. To change this for other
5318 sharepaths we need to manipulate relative paths. */
5319 /* TODO - create the absolute path and manipulate the newname
5320 relative to the sharepath. */
5321 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5322 continue;
5323 }
5324 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5325 fsp->fnum, file_id_string_tos(&fsp->file_id),
5326 fsp->fsp_name, newname ));
5327 string_set(&fsp->fsp_name, newname);
5328 did_rename = True;
5329 }
5330
5331 if (!did_rename) {
5332 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5333 file_id_string_tos(&lck->id), newname ));
5334 }
5335
5336 /* Send messages to all smbd's (not ourself) that the name has changed. */
5337 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5338 newname);
5339 }
5340
5341 /****************************************************************************
5342 We need to check if the source path is a parent directory of the destination
5343 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5344 refuse the rename with a sharing violation. Under UNIX the above call can
5345 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5346 probably need to check that the client is a Windows one before disallowing
5347 this as a UNIX client (one with UNIX extensions) can know the source is a
5348 symlink and make this decision intelligently. Found by an excellent bug
5349 report from <AndyLiebman@aol.com>.
5350 ****************************************************************************/
5351
5352 static bool rename_path_prefix_equal(const char *src, const char *dest)
5353 {
5354 const char *psrc = src;
5355 const char *pdst = dest;
5356 size_t slen;
5357
5358 if (psrc[0] == '.' && psrc[1] == '/') {
5359 psrc += 2;
5360 }
5361 if (pdst[0] == '.' && pdst[1] == '/') {
5362 pdst += 2;
5363 }
5364 if ((slen = strlen(psrc)) > strlen(pdst)) {
5365 return False;
5366 }
5367 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5368 }
5369
5370 /*
5371 * Do the notify calls from a rename
5372 */
5373
5374 static void notify_rename(connection_struct *conn, bool is_dir,
5375 const char *oldpath, const char *newpath)
5376 {
5377 char *olddir, *newdir;
5378 const char *oldname, *newname;
5379 uint32 mask;
5380
5381 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5382 : FILE_NOTIFY_CHANGE_FILE_NAME;
5383
5384 if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5385 || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5386 TALLOC_FREE(olddir);
5387 return;
5388 }
5389
5390 if (strcmp(olddir, newdir) == 0) {
5391 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5392 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5393 }
5394 else {
5395 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5396 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5397 }
5398 TALLOC_FREE(olddir);
5399 TALLOC_FREE(newdir);
5400
5401 /* this is a strange one. w2k3 gives an additional event for
5402 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5403 files, but not directories */
5404 if (!is_dir) {
5405 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5406 FILE_NOTIFY_CHANGE_ATTRIBUTES
5407 |FILE_NOTIFY_CHANGE_CREATION,
5408 newpath);
5409 }
5410 }
5411
5412 /****************************************************************************
5413 Rename an open file - given an fsp.
5414 ****************************************************************************/
5415
5416 NTSTATUS rename_internals_fsp(connection_struct *conn,
5417 files_struct *fsp,
5418 char *newname,
5419 const char *newname_last_component,
5420 uint32 attrs,
5421 bool replace_if_exists)
5422 {
5423 TALLOC_CTX *ctx = talloc_tos();
5424 SMB_STRUCT_STAT sbuf, sbuf1;
5425 NTSTATUS status = NT_STATUS_OK;
5426 struct share_mode_lock *lck = NULL;
5427 bool dst_exists;
5428
5429 ZERO_STRUCT(sbuf);
5430
5431 status = check_name(conn, newname);
5432 if (!NT_STATUS_IS_OK(status)) {
5433 return status;
5434 }
5435
5436 /* Ensure newname contains a '/' */
5437 if(strrchr_m(newname,'/') == 0) {
5438 newname = talloc_asprintf(ctx,
5439 "./%s",
5440 newname);
5441 if (!newname) {
5442 return NT_STATUS_NO_MEMORY;
5443 }
5444 }
5445
5446 /*
5447 * Check for special case with case preserving and not
5448 * case sensitive. If the old last component differs from the original
5449 * last component only by case, then we should allow
5450 * the rename (user is trying to change the case of the
5451 * filename).
5452 */
5453
5454 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5455 strequal(newname, fsp->fsp_name)) {
5456 char *p;
5457 char *newname_modified_last_component = NULL;
5458
5459 /*
5460 * Get the last component of the modified name.
5461 * Note that we guarantee that newname contains a '/'
5462 * character above.
5463 */
5464 p = strrchr_m(newname,'/');
5465 newname_modified_last_component = talloc_strdup(ctx,
5466 p+1);
5467 if (!newname_modified_last_component) {
5468 return NT_STATUS_NO_MEMORY;
5469 }
5470
5471 if(strcsequal(newname_modified_last_component,
5472 newname_last_component) == False) {
5473 /*
5474 * Replace the modified last component with
5475 * the original.
5476 */
5477 *p = '\0'; /* Truncate at the '/' */
5478 newname = talloc_asprintf(ctx,
5479 "%s/%s",
5480 newname,
5481 newname_last_component);
5482 }
5483 }
5484
5485 /*
5486 * If the src and dest names are identical - including case,
5487 * don't do the rename, just return success.
5488 */
5489
5490 if (strcsequal(fsp->fsp_name, newname)) {
5491 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5492 newname));
5493 return NT_STATUS_OK;
5494 }
5495
5496 /*
5497 * Have vfs_object_exist also fill sbuf1
5498 */
5499 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5500
5501 if(!replace_if_exists && dst_exists) {
5502 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5503 fsp->fsp_name,newname));
5504 return NT_STATUS_OBJECT_NAME_COLLISION;
5505 }
5506
5507 if (dst_exists) {
5508 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5509 files_struct *dst_fsp = file_find_di_first(fileid);
5510 if (dst_fsp) {
5511 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5512 return NT_STATUS_ACCESS_DENIED;
5513 }
5514 }
5515
5516 /* Ensure we have a valid stat struct for the source. */
5517 if (fsp->fh->fd != -1) {
5518 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5519 return map_nt_error_from_unix(errno);
5520 }
5521 } else {
5522 if (SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf) == -1) {
5523 return map_nt_error_from_unix(errno);
5524 }
5525 }
5526
5527 status = can_rename(conn, fsp, attrs, &sbuf);
5528
5529 if (!NT_STATUS_IS_OK(status)) {
5530 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5531 nt_errstr(status), fsp->fsp_name,newname));
5532 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5533 status = NT_STATUS_ACCESS_DENIED;
5534 return status;
5535 }
5536
5537 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5538 return NT_STATUS_ACCESS_DENIED;
5539 }
5540
5541 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5542 NULL);
5543
5544 /*
5545 * We have the file open ourselves, so not being able to get the
5546 * corresponding share mode lock is a fatal error.
5547 */
5548
5549 SMB_ASSERT(lck != NULL);
5550
5551 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5552 uint32 create_options = fsp->fh->private_options;
5553
5554 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5555 fsp->fsp_name,newname));
5556
5557 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5558
5559 rename_open_files(conn, lck, newname);
5560
5561 /*
5562 * A rename acts as a new file create w.r.t. allowing an initial delete
5563 * on close, probably because in Windows there is a new handle to the
5564 * new file. If initial delete on close was requested but not
5565 * originally set, we need to set it here. This is probably not 100% correct,
5566 * but will work for the CIFSFS client which in non-posix mode
5567 * depends on these semantics. JRA.
5568 */
5569
5570 set_allow_initial_delete_on_close(lck, fsp, True);
5571
5572 if (create_options & FILE_DELETE_ON_CLOSE) {
5573 status = can_set_delete_on_close(fsp, True, 0);
5574
5575 if (NT_STATUS_IS_OK(status)) {
5576 /* Note that here we set the *inital* delete on close flag,
5577 * not the regular one. The magic gets handled in close. */
5578 fsp->initial_delete_on_close = True;
5579 }
5580 }
5581 TALLOC_FREE(lck);
5582 return NT_STATUS_OK;
5583 }
5584
5585 TALLOC_FREE(lck);
5586
5587 if (errno == ENOTDIR || errno == EISDIR) {
5588 status = NT_STATUS_OBJECT_NAME_COLLISION;
5589 } else {
5590 status = map_nt_error_from_unix(errno);
5591 }
5592
5593 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5594 nt_errstr(status), fsp->fsp_name,newname));
5595
5596 return status;
5597 }
5598
5599 /****************************************************************************
5600 The guts of the rename command, split out so it may be called by the NT SMB
5601 code.
5602 ****************************************************************************/
5603
5604 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5605 connection_struct *conn,
5606 struct smb_request *req,
5607 const char *name_in,
5608 const char *newname_in,
5609 uint32 attrs,
5610 bool replace_if_exists,
5611 bool src_has_wild,
5612 bool dest_has_wild,
5613 uint32_t access_mask)
5614 {
5615 char *directory = NULL;
5616 char *mask = NULL;
5617 char *last_component_src = NULL;
5618 char *last_component_dest = NULL;
5619 char *name = NULL;
5620 char *newname = NULL;
5621 char *p;
5622 int count=0;
5623 NTSTATUS status = NT_STATUS_OK;
5624 SMB_STRUCT_STAT sbuf1, sbuf2;
5625 struct smb_Dir *dir_hnd = NULL;
5626 const char *dname;
5627 long offset = 0;
5628
5629 ZERO_STRUCT(sbuf1);
5630 ZERO_STRUCT(sbuf2);
5631
5632 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5633 &last_component_src, &sbuf1);
5634 if (!NT_STATUS_IS_OK(status)) {
5635 return status;
5636 }
5637
5638 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5639 &last_component_dest, &sbuf2);
5640 if (!NT_STATUS_IS_OK(status)) {
5641 return status;
5642 }
5643
5644 /*
5645 * Split the old name into directory and last component
5646 * strings. Note that unix_convert may have stripped off a
5647 * leading ./ from both name and newname if the rename is
5648 * at the root of the share. We need to make sure either both
5649 * name and newname contain a / character or neither of them do
5650 * as this is checked in resolve_wildcards().
5651 */
5652
5653 p = strrchr_m(name,'/');
5654 if (!p) {
5655 directory = talloc_strdup(ctx, ".");
5656 if (!directory) {
5657 return NT_STATUS_NO_MEMORY;
5658 }
5659 mask = name;
5660 } else {
5661 *p = 0;
5662 directory = talloc_strdup(ctx, name);
5663 if (!directory) {
5664 return NT_STATUS_NO_MEMORY;
5665 }
5666 mask = p+1;
5667 *p = '/'; /* Replace needed for exceptional test below. */
5668 }
5669
5670 /*
5671 * We should only check the mangled cache
5672 * here if unix_convert failed. This means
5673 * that the path in 'mask' doesn't exist
5674 * on the file system and so we need to look
5675 * for a possible mangle. This patch from
5676 * Tine Smukavec <valentin.smukavec@hermes.si>.
5677 */
5678
5679 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5680 char *new_mask = NULL;
5681 mangle_lookup_name_from_8_3(ctx,
5682 mask,
5683 &new_mask,
5684 conn->params );
5685 if (new_mask) {
5686 mask = new_mask;
5687 }
5688 }
5689
5690 if (!src_has_wild) {
5691 files_struct *fsp;
5692
5693 /*
5694 * No wildcards - just process the one file.
5695 */
5696 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5697
5698 /* Add a terminating '/' to the directory name. */
5699 directory = talloc_asprintf_append(directory,
5700 "/%s",
5701 mask);
5702 if (!directory) {
5703 return NT_STATUS_NO_MEMORY;
5704 }
5705
5706 /* Ensure newname contains a '/' also */
5707 if(strrchr_m(newname,'/') == 0) {
5708 newname = talloc_asprintf(ctx,
5709 "./%s",
5710 newname);
5711 if (!newname) {
5712 return NT_STATUS_NO_MEMORY;
5713 }
5714 }
5715
5716 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5717 "case_preserve = %d, short case preserve = %d, "
5718 "directory = %s, newname = %s, "
5719 "last_component_dest = %s, is_8_3 = %d\n",
5720 conn->case_sensitive, conn->case_preserve,
5721 conn->short_case_preserve, directory,
5722 newname, last_component_dest, is_short_name));
5723
5724 /* The dest name still may have wildcards. */
5725 if (dest_has_wild) {
5726 char *mod_newname = NULL;
5727 if (!resolve_wildcards(ctx,
5728 directory,newname,&mod_newname)) {
5729 DEBUG(6, ("rename_internals: resolve_wildcards "
5730 "%s %s failed\n",
5731 directory,
5732 newname));
5733 return NT_STATUS_NO_MEMORY;
5734 }
5735 newname = mod_newname;
5736 }
5737
5738 ZERO_STRUCT(sbuf1);
5739 SMB_VFS_STAT(conn, directory, &sbuf1);
5740
5741 status = S_ISDIR(sbuf1.st_mode) ?
5742 open_directory(conn, req, directory, &sbuf1,
5743 access_mask,
5744 FILE_SHARE_READ|FILE_SHARE_WRITE,
5745 FILE_OPEN, 0, 0, NULL,
5746 &fsp)
5747 : open_file_ntcreate(conn, req, directory, &sbuf1,
5748 access_mask,
5749 FILE_SHARE_READ|FILE_SHARE_WRITE,
5750 FILE_OPEN, 0, 0, 0, NULL,
5751 &fsp);
5752
5753 if (!NT_STATUS_IS_OK(status)) {
5754 DEBUG(3, ("Could not open rename source %s: %s\n",
5755 directory, nt_errstr(status)));
5756 return status;
5757 }
5758
5759 status = rename_internals_fsp(conn, fsp, newname,
5760 last_component_dest,
5761 attrs, replace_if_exists);
5762
5763 close_file(req, fsp, NORMAL_CLOSE);
5764
5765 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5766 nt_errstr(status), directory,newname));
5767
5768 return status;
5769 }
5770
5771 /*
5772 * Wildcards - process each file that matches.
5773 */
5774 if (strequal(mask,"????????.???")) {
5775 mask[0] = '*';
5776 mask[1] = '\0';
5777 }
5778
5779 status = check_name(conn, directory);
5780 if (!NT_STATUS_IS_OK(status)) {
5781 return status;
5782 }
5783
5784 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5785 if (dir_hnd == NULL) {
5786 return map_nt_error_from_unix(errno);
5787 }
5788
5789 status = NT_STATUS_NO_SUCH_FILE;
5790 /*
5791 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5792 * - gentest fix. JRA
5793 */
5794
5795 while ((dname = ReadDirName(dir_hnd, &offset))) {
5796 files_struct *fsp = NULL;
5797 char *fname = NULL;
5798 char *destname = NULL;
5799 bool sysdir_entry = False;
5800
5801 /* Quick check for "." and ".." */
5802 if (ISDOT(dname) || ISDOTDOT(dname)) {
5803 if (attrs & aDIR) {
5804 sysdir_entry = True;
5805 } else {
5806 continue;
5807 }
5808 }
5809
5810 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5811 continue;
5812 }
5813
5814 if(!mask_match(dname, mask, conn->case_sensitive)) {
5815 continue;
5816 }
5817
5818 if (sysdir_entry) {
5819 status = NT_STATUS_OBJECT_NAME_INVALID;
5820 break;
5821 }
5822
5823 fname = talloc_asprintf(ctx,
5824 "%s/%s",
5825 directory,
5826 dname);
5827 if (!fname) {
5828 return NT_STATUS_NO_MEMORY;
5829 }
5830
5831 if (!resolve_wildcards(ctx,
5832 fname,newname,&destname)) {
5833 DEBUG(6, ("resolve_wildcards %s %s failed\n",
5834 fname, destname));
5835 TALLOC_FREE(fname);
5836 continue;
5837 }
5838 if (!destname) {
5839 return NT_STATUS_NO_MEMORY;
5840 }
5841
5842 ZERO_STRUCT(sbuf1);
5843 SMB_VFS_STAT(conn, fname, &sbuf1);
5844
5845 status = S_ISDIR(sbuf1.st_mode) ?
5846 open_directory(conn, req, fname, &sbuf1,
5847 access_mask,
5848 FILE_SHARE_READ|FILE_SHARE_WRITE,
5849 FILE_OPEN, 0, 0, NULL,
5850 &fsp)
5851 : open_file_ntcreate(conn, req, fname, &sbuf1,
5852 access_mask,
5853 FILE_SHARE_READ|FILE_SHARE_WRITE,
5854 FILE_OPEN, 0, 0, 0, NULL,
5855 &fsp);
5856
5857 if (!NT_STATUS_IS_OK(status)) {
5858 DEBUG(3,("rename_internals: open_file_ntcreate "
5859 "returned %s rename %s -> %s\n",
5860 nt_errstr(status), directory, newname));
5861 break;
5862 }
5863
5864 status = rename_internals_fsp(conn, fsp, destname, dname,
5865 attrs, replace_if_exists);
5866
5867 close_file(req, fsp, NORMAL_CLOSE);
5868
5869 if (!NT_STATUS_IS_OK(status)) {
5870 DEBUG(3, ("rename_internals_fsp returned %s for "
5871 "rename %s -> %s\n", nt_errstr(status),
5872 directory, newname));
5873 break;
5874 }
5875
5876 count++;
5877
5878 DEBUG(3,("rename_internals: doing rename on %s -> "
5879 "%s\n",fname,destname));
5880
5881 TALLOC_FREE(fname);
5882 TALLOC_FREE(destname);
5883 }
5884 TALLOC_FREE(dir_hnd);
5885
5886 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
5887 status = map_nt_error_from_unix(errno);
5888 }
5889
5890 return status;
5891 }
5892
5893 /****************************************************************************
5894 Reply to a mv.
5895 ****************************************************************************/
5896
5897 void reply_mv(struct smb_request *req)
5898 {
5899 connection_struct *conn = req->conn;
5900 char *name = NULL;
5901 char *newname = NULL;
5902 const char *p;
5903 uint32 attrs;
5904 NTSTATUS status;
5905 bool src_has_wcard = False;
5906 bool dest_has_wcard = False;
5907 TALLOC_CTX *ctx = talloc_tos();
5908
5909 START_PROFILE(SMBmv);
5910
5911 if (req->wct < 1) {
5912 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5913 END_PROFILE(SMBmv);
5914 return;
5915 }
5916
5917 attrs = SVAL(req->inbuf,smb_vwv0);
5918
5919 p = (const char *)req->buf + 1;
5920 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
5921 0, STR_TERMINATE, &status,
5922 &src_has_wcard);
5923 if (!NT_STATUS_IS_OK(status)) {
5924 reply_nterror(req, status);
5925 END_PROFILE(SMBmv);
5926 return;
5927 }
5928 p++;
5929 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
5930 0, STR_TERMINATE, &status,
5931 &dest_has_wcard);
5932 if (!NT_STATUS_IS_OK(status)) {
5933 reply_nterror(req, status);
5934 END_PROFILE(SMBmv);
5935 return;
5936 }
5937
5938 status = resolve_dfspath_wcard(ctx, conn,
5939 req->flags2 & FLAGS2_DFS_PATHNAMES,
5940 name,
5941 &name,
5942 &src_has_wcard);
5943 if (!NT_STATUS_IS_OK(status)) {
5944 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5945 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5946 ERRSRV, ERRbadpath);
5947 END_PROFILE(SMBmv);
5948 return;
5949 }
5950 reply_nterror(req, status);
5951 END_PROFILE(SMBmv);
5952 return;
5953 }
5954
5955 status = resolve_dfspath_wcard(ctx, conn,
5956 req->flags2 & FLAGS2_DFS_PATHNAMES,
5957 newname,
5958 &newname,
5959 &dest_has_wcard);
5960 if (!NT_STATUS_IS_OK(status)) {
5961 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5962 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5963 ERRSRV, ERRbadpath);
5964 END_PROFILE(SMBmv);
5965 return;
5966 }
5967 reply_nterror(req, status);
5968 END_PROFILE(SMBmv);
5969 return;
5970 }
5971
5972 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
5973
5974 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
5975 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
5976 if (!NT_STATUS_IS_OK(status)) {
5977 if (open_was_deferred(req->mid)) {
5978 /* We have re-scheduled this call. */
5979 END_PROFILE(SMBmv);
5980 return;
5981 }
5982 reply_nterror(req, status);
5983 END_PROFILE(SMBmv);
5984 return;
5985 }
5986
5987 reply_outbuf(req, 0, 0);
5988
5989 END_PROFILE(SMBmv);
5990 return;
5991 }
5992
5993 /*******************************************************************
5994 Copy a file as part of a reply_copy.
5995 ******************************************************************/
5996
5997 /*
5998 * TODO: check error codes on all callers
5999 */
6000
6001 NTSTATUS copy_file(TALLOC_CTX *ctx,
6002 connection_struct *conn,
6003 const char *src,
6004 const char *dest1,
6005 int ofun,
6006 int count,
6007 bool target_is_directory)
6008 {
6009 SMB_STRUCT_STAT src_sbuf, sbuf2;
6010 SMB_OFF_T ret=-1;
6011 files_struct *fsp1,*fsp2;
6012 char *dest = NULL;
6013 uint32 dosattrs;
6014 uint32 new_create_disposition;
6015 NTSTATUS status;
6016
6017 dest = talloc_strdup(ctx, dest1);
6018 if (!dest) {
6019 return NT_STATUS_NO_MEMORY;
6020 }
6021 if (target_is_directory) {
6022 const char *p = strrchr_m(src,'/');
6023 if (p) {
6024 p++;
6025 } else {
6026 p = src;
6027 }
6028 dest = talloc_asprintf_append(dest,
6029 "/%s",
6030 p);
6031 if (!dest) {
6032 return NT_STATUS_NO_MEMORY;
6033 }
6034 }
6035
6036 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6037 TALLOC_FREE(dest);
6038 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6039 }
6040
6041 if (!target_is_directory && count) {
6042 new_create_disposition = FILE_OPEN;
6043 } else {
6044 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6045 NULL, NULL, &new_create_disposition, NULL)) {
6046 TALLOC_FREE(dest);
6047 return NT_STATUS_INVALID_PARAMETER;
6048 }
6049 }
6050
6051 status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6052 FILE_GENERIC_READ,
6053 FILE_SHARE_READ|FILE_SHARE_WRITE,
6054 FILE_OPEN,
6055 0,
6056 FILE_ATTRIBUTE_NORMAL,
6057 INTERNAL_OPEN_ONLY,
6058 NULL, &fsp1);
6059
6060 if (!NT_STATUS_IS_OK(status)) {
6061 TALLOC_FREE(dest);
6062 return status;
6063 }
6064
6065 dosattrs = dos_mode(conn, src, &src_sbuf);
6066 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6067 ZERO_STRUCTP(&sbuf2);
6068 }
6069
6070 status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6071 FILE_GENERIC_WRITE,
6072 FILE_SHARE_READ|FILE_SHARE_WRITE,
6073 new_create_disposition,
6074 0,
6075 dosattrs,
6076 INTERNAL_OPEN_ONLY,
6077 NULL, &fsp2);
6078
6079 TALLOC_FREE(dest);
6080
6081 if (!NT_STATUS_IS_OK(status)) {
6082 close_file(NULL, fsp1, ERROR_CLOSE);
6083 return status;
6084 }
6085
6086 if ((ofun&3) == 1) {
6087 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6088 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6089 /*
6090 * Stop the copy from occurring.
6091 */
6092 ret = -1;
6093 src_sbuf.st_size = 0;
6094 }
6095 }
6096
6097 if (src_sbuf.st_size) {
6098 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6099 }
6100
6101 close_file(NULL, fsp1, NORMAL_CLOSE);
6102
6103 /* Ensure the modtime is set correctly on the destination file. */
6104 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6105
6106 /*
6107 * As we are opening fsp1 read-only we only expect
6108 * an error on close on fsp2 if we are out of space.
6109 * Thus we don't look at the error return from the
6110 * close of fsp1.
6111 */
6112 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6113
6114 if (!NT_STATUS_IS_OK(status)) {
6115 return status;
6116 }
6117
6118 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6119 return NT_STATUS_DISK_FULL;
6120 }
6121
6122 return NT_STATUS_OK;
6123 }
6124
6125 /****************************************************************************
6126 Reply to a file copy.
6127 ****************************************************************************/
6128
6129 void reply_copy(struct smb_request *req)
6130 {
6131 connection_struct *conn = req->conn;
6132 char *name = NULL;
6133 char *newname = NULL;
6134 char *directory = NULL;
6135 const char *mask = NULL;
6136 const char mask_star[] = "*";
6137 const char *p;
6138 int count=0;
6139 int error = ERRnoaccess;
6140 int err = 0;
6141 int tid2;
6142 int ofun;
6143 int flags;
6144 bool target_is_directory=False;
6145 bool source_has_wild = False;
6146 bool dest_has_wild = False;
6147 SMB_STRUCT_STAT sbuf1, sbuf2;
6148 NTSTATUS status;
6149 TALLOC_CTX *ctx = talloc_tos();
6150
6151 START_PROFILE(SMBcopy);
6152
6153 if (req->wct < 3) {
6154 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6155 END_PROFILE(SMBcopy);
6156 return;
6157 }
6158
6159 tid2 = SVAL(req->inbuf,smb_vwv0);
6160 ofun = SVAL(req->inbuf,smb_vwv1);
6161 flags = SVAL(req->inbuf,smb_vwv2);
6162
6163 p = (const char *)req->buf;
6164 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6165 0, STR_TERMINATE, &status,
6166 &source_has_wild);
6167 if (!NT_STATUS_IS_OK(status)) {
6168 reply_nterror(req, status);
6169 END_PROFILE(SMBcopy);
6170 return;
6171 }
6172 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6173 0, STR_TERMINATE, &status,
6174 &dest_has_wild);
6175 if (!NT_STATUS_IS_OK(status)) {
6176 reply_nterror(req, status);
6177 END_PROFILE(SMBcopy);
6178 return;
6179 }
6180
6181 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6182
6183 if (tid2 != conn->cnum) {
6184 /* can't currently handle inter share copies XXXX */
6185 DEBUG(3,("Rejecting inter-share copy\n"));
6186 reply_doserror(req, ERRSRV, ERRinvdevice);
6187 END_PROFILE(SMBcopy);
6188 return;
6189 }
6190
6191 status = resolve_dfspath_wcard(ctx, conn,
6192 req->flags2 & FLAGS2_DFS_PATHNAMES,
6193 name,
6194 &name,
6195 &source_has_wild);
6196 if (!NT_STATUS_IS_OK(status)) {
6197 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6198 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6199 ERRSRV, ERRbadpath);
6200 END_PROFILE(SMBcopy);
6201 return;
6202 }
6203 reply_nterror(req, status);
6204 END_PROFILE(SMBcopy);
6205 return;
6206 }
6207
6208 status = resolve_dfspath_wcard(ctx, conn,
6209 req->flags2 & FLAGS2_DFS_PATHNAMES,
6210 newname,
6211 &newname,
6212 &dest_has_wild);
6213 if (!NT_STATUS_IS_OK(status)) {
6214 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6215 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6216 ERRSRV, ERRbadpath);
6217 END_PROFILE(SMBcopy);
6218 return;
6219 }
6220 reply_nterror(req, status);
6221 END_PROFILE(SMBcopy);
6222 return;
6223 }
6224
6225 status = unix_convert(ctx, conn, name, source_has_wild,
6226 &name, NULL, &sbuf1);
6227 if (!NT_STATUS_IS_OK(status)) {
6228 reply_nterror(req, status);
6229 END_PROFILE(SMBcopy);
6230 return;
6231 }
6232
6233 status = unix_convert(ctx, conn, newname, dest_has_wild,
6234 &newname, NULL, &sbuf2);
6235 if (!NT_STATUS_IS_OK(status)) {
6236 reply_nterror(req, status);
6237 END_PROFILE(SMBcopy);
6238 return;
6239 }
6240
6241 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6242
6243 if ((flags&1) && target_is_directory) {
6244 reply_doserror(req, ERRDOS, ERRbadfile);
6245 END_PROFILE(SMBcopy);
6246 return;
6247 }
6248
6249 if ((flags&2) && !target_is_directory) {
6250 reply_doserror(req, ERRDOS, ERRbadpath);
6251 END_PROFILE(SMBcopy);
6252 return;
6253 }
6254
6255 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6256 /* wants a tree copy! XXXX */
6257 DEBUG(3,("Rejecting tree copy\n"));
6258 reply_doserror(req, ERRSRV, ERRerror);
6259 END_PROFILE(SMBcopy);
6260 return;
6261 }
6262
6263 p = strrchr_m(name,'/');
6264 if (p != NULL) {
6265 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6266 mask = p+1;
6267 } else {
6268 directory = talloc_strdup(ctx, "./");
6269 mask = name;
6270 }
6271
6272 if (!directory) {
6273 reply_nterror(req, NT_STATUS_NO_MEMORY);
6274 END_PROFILE(SMBcopy);
6275 return;
6276 }
6277
6278 /*
6279 * We should only check the mangled cache
6280 * here if unix_convert failed. This means
6281 * that the path in 'mask' doesn't exist
6282 * on the file system and so we need to look
6283 * for a possible mangle. This patch from
6284 * Tine Smukavec <valentin.smukavec@hermes.si>.
6285 */
6286
6287 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6288 char *new_mask = NULL;
6289 mangle_lookup_name_from_8_3(ctx,
6290 mask,
6291 &new_mask,
6292 conn->params );
6293 if (new_mask) {
6294 mask = new_mask;
6295 }
6296 }
6297
6298 if (!source_has_wild) {
6299 directory = talloc_asprintf_append(directory,
6300 "/%s",
6301 mask);
6302 if (dest_has_wild) {
6303 char *mod_newname = NULL;
6304 if (!resolve_wildcards(ctx,
6305 directory,newname,&mod_newname)) {
6306 reply_nterror(req, NT_STATUS_NO_MEMORY);
6307 END_PROFILE(SMBcopy);
6308 return;
6309 }
6310 newname = mod_newname;
6311 }
6312
6313 status = check_name(conn, directory);
6314 if (!NT_STATUS_IS_OK(status)) {
6315 reply_nterror(req, status);
6316 END_PROFILE(SMBcopy);
6317 return;
6318 }
6319
6320 status = check_name(conn, newname);
6321 if (!NT_STATUS_IS_OK(status)) {
6322 reply_nterror(req, status);
6323 END_PROFILE(SMBcopy);
6324 return;
6325 }
6326
6327 status = copy_file(ctx,conn,directory,newname,ofun,
6328 count,target_is_directory);
6329
6330 if(!NT_STATUS_IS_OK(status)) {
6331 reply_nterror(req, status);
6332 END_PROFILE(SMBcopy);
6333 return;
6334 } else {
6335 count++;
6336 }
6337 } else {
6338 struct smb_Dir *dir_hnd = NULL;
6339 const char *dname = NULL;
6340 long offset = 0;
6341
6342 if (strequal(mask,"????????.???")) {
6343 mask = mask_star;
6344 }
6345
6346 status = check_name(conn, directory);
6347 if (!NT_STATUS_IS_OK(status)) {
6348 reply_nterror(req, status);
6349 END_PROFILE(SMBcopy);
6350 return;
6351 }
6352
6353 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6354 if (dir_hnd == NULL) {
6355 status = map_nt_error_from_unix(errno);
6356 reply_nterror(req, status);
6357 END_PROFILE(SMBcopy);
6358 return;
6359 }
6360
6361 error = ERRbadfile;
6362
6363 while ((dname = ReadDirName(dir_hnd, &offset))) {
6364 char *destname = NULL;
6365 char *fname = NULL;
6366
6367 if (ISDOT(dname) || ISDOTDOT(dname)) {
6368 continue;
6369 }
6370
6371 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6372 continue;
6373 }
6374
6375 if(!mask_match(dname, mask, conn->case_sensitive)) {
6376 continue;
6377 }
6378
6379 error = ERRnoaccess;
6380 fname = talloc_asprintf(ctx,
6381 "%s/%s",
6382 directory,
6383 dname);
6384 if (!fname) {
6385 TALLOC_FREE(dir_hnd);
6386 reply_nterror(req, NT_STATUS_NO_MEMORY);
6387 END_PROFILE(SMBcopy);
6388 return;
6389 }
6390
6391 if (!resolve_wildcards(ctx,
6392 fname,newname,&destname)) {
6393 continue;
6394 }
6395 if (!destname) {
6396 TALLOC_FREE(dir_hnd);
6397 reply_nterror(req, NT_STATUS_NO_MEMORY);
6398 END_PROFILE(SMBcopy);
6399 return;
6400 }
6401
6402 status = check_name(conn, fname);
6403 if (!NT_STATUS_IS_OK(status)) {
6404 TALLOC_FREE(dir_hnd);
6405 reply_nterror(req, status);
6406 END_PROFILE(SMBcopy);
6407 return;
6408 }
6409
6410 status = check_name(conn, destname);
6411 if (!NT_STATUS_IS_OK(status)) {
6412 TALLOC_FREE(dir_hnd);
6413 reply_nterror(req, status);
6414 END_PROFILE(SMBcopy);
6415 return;
6416 }
6417
6418 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6419
6420 status = copy_file(ctx,conn,fname,destname,ofun,
6421 count,target_is_directory);
6422 if (NT_STATUS_IS_OK(status)) {
6423 count++;
6424 }
6425 TALLOC_FREE(fname);
6426 TALLOC_FREE(destname);
6427 }
6428 TALLOC_FREE(dir_hnd);
6429 }
6430
6431 if (count == 0) {
6432 if(err) {
6433 /* Error on close... */
6434 errno = err;
6435 reply_unixerror(req, ERRHRD, ERRgeneral);
6436 END_PROFILE(SMBcopy);
6437 return;
6438 }
6439
6440 reply_doserror(req, ERRDOS, error);
6441 END_PROFILE(SMBcopy);
6442 return;
6443 }
6444
6445 reply_outbuf(req, 1, 0);
6446 SSVAL(req->outbuf,smb_vwv0,count);
6447
6448 END_PROFILE(SMBcopy);
6449 return;
6450 }
6451
6452 #undef DBGC_CLASS
6453 #define DBGC_CLASS DBGC_LOCKING
6454
6455 /****************************************************************************
6456 Get a lock pid, dealing with large count requests.
6457 ****************************************************************************/
6458
6459 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6460 bool large_file_format)
6461 {
6462 if(!large_file_format)
6463 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6464 else
6465 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6466 }
6467
6468 /****************************************************************************
6469 Get a lock count, dealing with large count requests.
6470 ****************************************************************************/
6471
6472 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6473 bool large_file_format)
6474 {
6475 uint64_t count = 0;
6476
6477 if(!large_file_format) {
6478 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6479 } else {
6480
6481 #if defined(HAVE_LONGLONG)
6482 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6483 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6484 #else /* HAVE_LONGLONG */
6485
6486 /*
6487 * NT4.x seems to be broken in that it sends large file (64 bit)
6488 * lockingX calls even if the CAP_LARGE_FILES was *not*
6489 * negotiated. For boxes without large unsigned ints truncate the
6490 * lock count by dropping the top 32 bits.
6491 */
6492
6493 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6494 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6495 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6496 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6497 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6498 }
6499
6500 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6501 #endif /* HAVE_LONGLONG */
6502 }
6503
6504 return count;
6505 }
6506
6507 #if !defined(HAVE_LONGLONG)
6508 /****************************************************************************
6509 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6510 ****************************************************************************/
6511
6512 static uint32 map_lock_offset(uint32 high, uint32 low)
6513 {
6514 unsigned int i;
6515 uint32 mask = 0;
6516 uint32 highcopy = high;
6517
6518 /*
6519 * Try and find out how many significant bits there are in high.
6520 */
6521
6522 for(i = 0; highcopy; i++)
6523 highcopy >>= 1;
6524
6525 /*
6526 * We use 31 bits not 32 here as POSIX
6527 * lock offsets may not be negative.
6528 */
6529
6530 mask = (~0) << (31 - i);
6531
6532 if(low & mask)
6533 return 0; /* Fail. */
6534
6535 high <<= (31 - i);
6536
6537 return (high|low);
6538 }
6539 #endif /* !defined(HAVE_LONGLONG) */
6540
6541 /****************************************************************************
6542 Get a lock offset, dealing with large offset requests.
6543 ****************************************************************************/
6544
6545 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6546 bool large_file_format, bool *err)
6547 {
6548 uint64_t offset = 0;
6549
6550 *err = False;
6551
6552 if(!large_file_format) {
6553 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6554 } else {
6555
6556 #if defined(HAVE_LONGLONG)
6557 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6558 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6559 #else /* HAVE_LONGLONG */
6560
6561 /*
6562 * NT4.x seems to be broken in that it sends large file (64 bit)
6563 * lockingX calls even if the CAP_LARGE_FILES was *not*
6564 * negotiated. For boxes without large unsigned ints mangle the
6565 * lock offset by mapping the top 32 bits onto the lower 32.
6566 */
6567
6568 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6569 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6570 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6571 uint32 new_low = 0;
6572
6573 if((new_low = map_lock_offset(high, low)) == 0) {
6574 *err = True;
6575 return (uint64_t)-1;
6576 }
6577
6578 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6579 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6580 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6581 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6582 }
6583
6584 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6585 #endif /* HAVE_LONGLONG */
6586 }
6587
6588 return offset;
6589 }
6590
6591 /****************************************************************************
6592 Reply to a lockingX request.
6593 ****************************************************************************/
6594
6595 void reply_lockingX(struct smb_request *req)
6596 {
6597 connection_struct *conn = req->conn;
6598 files_struct *fsp;
6599 unsigned char locktype;
6600 unsigned char oplocklevel;
6601 uint16 num_ulocks;
6602 uint16 num_locks;
6603 uint64_t count = 0, offset = 0;
6604 uint32 lock_pid;
6605 int32 lock_timeout;
6606 int i;
6607 const uint8_t *data;
6608 bool large_file_format;
6609 bool err;
6610 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6611
6612 START_PROFILE(SMBlockingX);
6613
6614 if (req->wct < 8) {
6615 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6616 END_PROFILE(SMBlockingX);
6617 return;
6618 }
6619
6620 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
6621 locktype = CVAL(req->inbuf,smb_vwv3);
6622 oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6623 num_ulocks = SVAL(req->inbuf,smb_vwv6);
6624 num_locks = SVAL(req->inbuf,smb_vwv7);
6625 lock_timeout = IVAL(req->inbuf,smb_vwv4);
6626 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6627
6628 if (!check_fsp(conn, req, fsp)) {
6629 END_PROFILE(SMBlockingX);
6630 return;
6631 }
6632
6633 data = req->buf;
6634
6635 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6636 /* we don't support these - and CANCEL_LOCK makes w2k
6637 and XP reboot so I don't really want to be
6638 compatible! (tridge) */
6639 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6640 END_PROFILE(SMBlockingX);
6641 return;
6642 }
6643
6644 /* Check if this is an oplock break on a file
6645 we have granted an oplock on.
6646 */
6647 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6648 /* Client can insist on breaking to none. */
6649 bool break_to_none = (oplocklevel == 0);
6650 bool result;
6651
6652 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6653 "for fnum = %d\n", (unsigned int)oplocklevel,
6654 fsp->fnum ));
6655
6656 /*
6657 * Make sure we have granted an exclusive or batch oplock on
6658 * this file.
6659 */
6660
6661 if (fsp->oplock_type == 0) {
6662
6663 /* The Samba4 nbench simulator doesn't understand
6664 the difference between break to level2 and break
6665 to none from level2 - it sends oplock break
6666 replies in both cases. Don't keep logging an error
6667 message here - just ignore it. JRA. */
6668
6669 DEBUG(5,("reply_lockingX: Error : oplock break from "
6670 "client for fnum = %d (oplock=%d) and no "
6671 "oplock granted on this file (%s).\n",
6672 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6673
6674 /* if this is a pure oplock break request then don't
6675 * send a reply */
6676 if (num_locks == 0 && num_ulocks == 0) {
6677 END_PROFILE(SMBlockingX);
6678 return;
6679 } else {
6680 END_PROFILE(SMBlockingX);
6681 reply_doserror(req, ERRDOS, ERRlock);
6682 return;
6683 }
6684 }
6685
6686 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6687 (break_to_none)) {
6688 result = remove_oplock(fsp);
6689 } else {
6690 result = downgrade_oplock(fsp);
6691 }
6692
6693 if (!result) {
6694 DEBUG(0, ("reply_lockingX: error in removing "
6695 "oplock on file %s\n", fsp->fsp_name));
6696 /* Hmmm. Is this panic justified? */
6697 smb_panic("internal tdb error");
6698 }
6699
6700 reply_to_oplock_break_requests(fsp);
6701
6702 /* if this is a pure oplock break request then don't send a
6703 * reply */
6704 if (num_locks == 0 && num_ulocks == 0) {
6705 /* Sanity check - ensure a pure oplock break is not a
6706 chained request. */
6707 if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6708 DEBUG(0,("reply_lockingX: Error : pure oplock "
6709 "break is a chained %d request !\n",
6710 (unsigned int)CVAL(req->inbuf,
6711 smb_vwv0) ));
6712 END_PROFILE(SMBlockingX);
6713 return;
6714 }
6715 }
6716
6717 /*
6718 * We do this check *after* we have checked this is not a oplock break
6719 * response message. JRA.
6720 */
6721
6722 release_level_2_oplocks_on_change(fsp);
6723
6724 if (req->buflen <
6725 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6726 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6727 END_PROFILE(SMBlockingX);
6728 return;
6729 }
6730
6731 /* Data now points at the beginning of the list
6732 of smb_unlkrng structs */
6733 for(i = 0; i < (int)num_ulocks; i++) {
6734 lock_pid = get_lock_pid( data, i, large_file_format);
6735 count = get_lock_count( data, i, large_file_format);
6736 offset = get_lock_offset( data, i, large_file_format, &err);
6737
6738 /*
6739 * There is no error code marked "stupid client bug".... :-).
6740 */
6741 if(err) {
6742 END_PROFILE(SMBlockingX);
6743 reply_doserror(req, ERRDOS, ERRnoaccess);
6744 return;
6745 }
6746
6747 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6748 "pid %u, file %s\n", (double)offset, (double)count,
6749 (unsigned int)lock_pid, fsp->fsp_name ));
6750
6751 status = do_unlock(smbd_messaging_context(),
6752 fsp,
6753 lock_pid,
6754 count,
6755 offset,
6756 WINDOWS_LOCK);
6757
6758 if (NT_STATUS_V(status)) {
6759 END_PROFILE(SMBlockingX);
6760 reply_nterror(req, status);
6761 return;
6762 }
6763 }
6764
6765 /* Setup the timeout in seconds. */
6766
6767 if (!lp_blocking_locks(SNUM(conn))) {
6768 lock_timeout = 0;
6769 }
6770
6771 /* Now do any requested locks */
6772 data += ((large_file_format ? 20 : 10)*num_ulocks);
6773
6774 /* Data now points at the beginning of the list
6775 of smb_lkrng structs */
6776
6777 for(i = 0; i < (int)num_locks; i++) {
6778 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6779 READ_LOCK:WRITE_LOCK);
6780 lock_pid = get_lock_pid( data, i, large_file_format);
6781 count = get_lock_count( data, i, large_file_format);
6782 offset = get_lock_offset( data, i, large_file_format, &err);
6783
6784 /*
6785 * There is no error code marked "stupid client bug".... :-).
6786 */
6787 if(err) {
6788 END_PROFILE(SMBlockingX);
6789 reply_doserror(req, ERRDOS, ERRnoaccess);
6790 return;
6791 }
6792
6793 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6794 "%u, file %s timeout = %d\n", (double)offset,
6795 (double)count, (unsigned int)lock_pid,
6796 fsp->fsp_name, (int)lock_timeout ));
6797
6798 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6799 if (lp_blocking_locks(SNUM(conn))) {
6800
6801 /* Schedule a message to ourselves to
6802 remove the blocking lock record and
6803 return the right error. */
6804
6805 if (!blocking_lock_cancel(fsp,
6806 lock_pid,
6807 offset,
6808 count,
6809 WINDOWS_LOCK,
6810 locktype,
6811 NT_STATUS_FILE_LOCK_CONFLICT)) {
6812 END_PROFILE(SMBlockingX);
6813 reply_nterror(
6814 req,
6815 NT_STATUS_DOS(
6816 ERRDOS,
6817 ERRcancelviolation));
6818 return;
6819 }
6820 }
6821 /* Remove a matching pending lock. */
6822 status = do_lock_cancel(fsp,
6823 lock_pid,
6824 count,
6825 offset,
6826 WINDOWS_LOCK);
6827 } else {
6828 bool blocking_lock = lock_timeout ? True : False;
6829 bool defer_lock = False;
6830 struct byte_range_lock *br_lck;
6831 uint32 block_smbpid;
6832
6833 br_lck = do_lock(smbd_messaging_context(),
6834 fsp,
6835 lock_pid,
6836 count,
6837 offset,
6838 lock_type,
6839 WINDOWS_LOCK,
6840 blocking_lock,
6841 &status,
6842 &block_smbpid);
6843
6844 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6845 /* Windows internal resolution for blocking locks seems
6846 to be about 200ms... Don't wait for less than that. JRA. */
6847 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6848 lock_timeout = lp_lock_spin_time();
6849 }
6850 defer_lock = True;
6851 }
6852
6853 /* This heuristic seems to match W2K3 very well. If a
6854 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6855 it pretends we asked for a timeout of between 150 - 300 milliseconds as
6856 far as I can tell. Replacement for do_lock_spin(). JRA. */
6857
6858 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6859 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6860 defer_lock = True;
6861 lock_timeout = lp_lock_spin_time();
6862 }
6863
6864 if (br_lck && defer_lock) {
6865 /*
6866 * A blocking lock was requested. Package up
6867 * this smb into a queued request and push it
6868 * onto the blocking lock queue.
6869 */
6870 if(push_blocking_lock_request(br_lck,
6871 req,
6872 fsp,
6873 lock_timeout,
6874 i,
6875 lock_pid,
6876 lock_type,
6877 WINDOWS_LOCK,
6878 offset,
6879 count,
6880 block_smbpid)) {
6881 TALLOC_FREE(br_lck);
6882 END_PROFILE(SMBlockingX);
6883 return;
6884 }
6885 }
6886
6887 TALLOC_FREE(br_lck);
6888 }
6889
6890 if (NT_STATUS_V(status)) {
6891 END_PROFILE(SMBlockingX);
6892 reply_nterror(req, status);
6893 return;
6894 }
6895 }
6896
6897 /* If any of the above locks failed, then we must unlock
6898 all of the previous locks (X/Open spec). */
6899
6900 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
6901 (i != num_locks) &&
6902 (num_locks != 0)) {
6903 /*
6904 * Ensure we don't do a remove on the lock that just failed,
6905 * as under POSIX rules, if we have a lock already there, we
6906 * will delete it (and we shouldn't) .....
6907 */
6908 for(i--; i >= 0; i--) {
6909 lock_pid = get_lock_pid( data, i, large_file_format);
6910 count = get_lock_count( data, i, large_file_format);
6911 offset = get_lock_offset( data, i, large_file_format,
6912 &err);
6913
6914 /*
6915 * There is no error code marked "stupid client
6916 * bug".... :-).
6917 */
6918 if(err) {
6919 END_PROFILE(SMBlockingX);
6920 reply_doserror(req, ERRDOS, ERRnoaccess);
6921 return;
6922 }
6923
6924 do_unlock(smbd_messaging_context(),
6925 fsp,
6926 lock_pid,
6927 count,
6928 offset,
6929 WINDOWS_LOCK);
6930 }
6931 END_PROFILE(SMBlockingX);
6932 reply_nterror(req, status);
6933 return;
6934 }
6935
6936 reply_outbuf(req, 2, 0);
6937
6938 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
6939 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
6940
6941 END_PROFILE(SMBlockingX);
6942 chain_reply(req);
6943 }
6944
6945 #undef DBGC_CLASS
6946 #define DBGC_CLASS DBGC_ALL
6947
6948 /****************************************************************************
6949 Reply to a SMBreadbmpx (read block multiplex) request.
6950 Always reply with an error, if someone has a platform really needs this,
6951 please contact vl@samba.org
6952 ****************************************************************************/
6953
6954 void reply_readbmpx(struct smb_request *req)
6955 {
6956 START_PROFILE(SMBreadBmpx);
6957 reply_doserror(req, ERRSRV, ERRuseSTD);
6958 END_PROFILE(SMBreadBmpx);
6959 return;
6960 }
6961
6962 /****************************************************************************
6963 Reply to a SMBreadbs (read block multiplex secondary) request.
6964 Always reply with an error, if someone has a platform really needs this,
6965 please contact vl@samba.org
6966 ****************************************************************************/
6967
6968 void reply_readbs(struct smb_request *req)
6969 {
6970 START_PROFILE(SMBreadBs);
6971 reply_doserror(req, ERRSRV, ERRuseSTD);
6972 END_PROFILE(SMBreadBs);
6973 return;
6974 }
6975
6976 /****************************************************************************
6977 Reply to a SMBsetattrE.
6978 ****************************************************************************/
6979
6980 void reply_setattrE(struct smb_request *req)
6981 {
6982 connection_struct *conn = req->conn;
6983 struct timespec ts[2];
6984 files_struct *fsp;
6985 SMB_STRUCT_STAT sbuf;
6986 NTSTATUS status;
6987
6988 START_PROFILE(SMBsetattrE);
6989
6990 if (req->wct < 7) {
6991 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6992 END_PROFILE(SMBsetattrE);
6993 return;
6994 }
6995
6996 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
6997
6998 if(!fsp || (fsp->conn != conn)) {
6999 reply_doserror(req, ERRDOS, ERRbadfid);
7000 END_PROFILE(SMBsetattrE);
7001 return;
7002 }
7003
7004
7005 /*
7006 * Convert the DOS times into unix times. Ignore create
7007 * time as UNIX can't set this.
7008 */
7009
7010 ts[0] = convert_time_t_to_timespec(
7011 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7012 ts[1] = convert_time_t_to_timespec(
7013 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7014
7015 reply_outbuf(req, 0, 0);
7016
7017 /*
7018 * Patch from Ray Frush <frush@engr.colostate.edu>
7019 * Sometimes times are sent as zero - ignore them.
7020 */
7021
7022 /* Ensure we have a valid stat struct for the source. */
7023 if (fsp->fh->fd != -1) {
7024 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7025 status = map_nt_error_from_unix(errno);
7026 reply_nterror(req, status);
7027 END_PROFILE(SMBsetattrE);
7028 return;
7029 }
7030 } else {
7031 if (SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf) == -1) {
7032 status = map_nt_error_from_unix(errno);
7033 reply_nterror(req, status);
7034 END_PROFILE(SMBsetattrE);
7035 return;
7036 }
7037 }
7038
7039 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7040 &sbuf, ts, true);
7041 if (!NT_STATUS_IS_OK(status)) {
7042 reply_doserror(req, ERRDOS, ERRnoaccess);
7043 END_PROFILE(SMBsetattrE);
7044 return;
7045 }
7046
7047 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7048 fsp->fnum,
7049 (unsigned int)ts[0].tv_sec,
7050 (unsigned int)ts[1].tv_sec));
7051
7052 END_PROFILE(SMBsetattrE);
7053 return;
7054 }
7055
7056
7057 /* Back from the dead for OS/2..... JRA. */
7058
7059 /****************************************************************************
7060 Reply to a SMBwritebmpx (write block multiplex primary) request.
7061 Always reply with an error, if someone has a platform really needs this,
7062 please contact vl@samba.org
7063 ****************************************************************************/
7064
7065 void reply_writebmpx(struct smb_request *req)
7066 {
7067 START_PROFILE(SMBwriteBmpx);
7068 reply_doserror(req, ERRSRV, ERRuseSTD);
7069 END_PROFILE(SMBwriteBmpx);
7070 return;
7071 }
7072
7073 /****************************************************************************
7074 Reply to a SMBwritebs (write block multiplex secondary) request.
7075 Always reply with an error, if someone has a platform really needs this,
7076 please contact vl@samba.org
7077 ****************************************************************************/
7078
7079 void reply_writebs(struct smb_request *req)
7080 {
7081 START_PROFILE(SMBwriteBs);
7082 reply_doserror(req, ERRSRV, ERRuseSTD);
7083 END_PROFILE(SMBwriteBs);
7084 return;
7085 }
7086
7087 /****************************************************************************
7088 Reply to a SMBgetattrE.
7089 ****************************************************************************/
7090
7091 void reply_getattrE(struct smb_request *req)
7092 {
7093 connection_struct *conn = req->conn;
7094 SMB_STRUCT_STAT sbuf;
7095 int mode;
7096 files_struct *fsp;
7097 struct timespec create_ts;
7098
7099 START_PROFILE(SMBgetattrE);
7100
7101 if (req->wct < 1) {
7102 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7103 END_PROFILE(SMBgetattrE);
7104 return;
7105 }
7106
7107 fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
7108
7109 if(!fsp || (fsp->conn != conn)) {
7110 reply_doserror(req, ERRDOS, ERRbadfid);
7111 END_PROFILE(SMBgetattrE);
7112 return;
7113 }
7114
7115 /* Do an fstat on this file */
7116 if(fsp_stat(fsp, &sbuf)) {
7117 reply_unixerror(req, ERRDOS, ERRnoaccess);
7118 END_PROFILE(SMBgetattrE);
7119 return;
7120 }
7121
7122 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7123
7124 /*
7125 * Convert the times into dos times. Set create
7126 * date to be last modify date as UNIX doesn't save
7127 * this.
7128 */
7129
7130 reply_outbuf(req, 11, 0);
7131
7132 create_ts = get_create_timespec(&sbuf,
7133 lp_fake_dir_create_times(SNUM(conn)));
7134 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7135 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7136 /* Should we check pending modtime here ? JRA */
7137 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7138
7139 if (mode & aDIR) {
7140 SIVAL(req->outbuf, smb_vwv6, 0);
7141 SIVAL(req->outbuf, smb_vwv8, 0);
7142 } else {
7143 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7144 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7145 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7146 }
7147 SSVAL(req->outbuf,smb_vwv10, mode);
7148
7149 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7150
7151 END_PROFILE(SMBgetattrE);
7152 return;
7153 }
Samba GIT mirror