?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Final fix to make us pass NULL SD test in RAW-ACLs. Not sure if this is 100% right...
[Samba.git] / source / smbd / nttrans.c
blob92c24aedf459f5aa08737b1bbde759b6674347ec
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25 extern const struct generic_mapping file_generic_mapping;
26
27 static char *nttrans_realloc(char **ptr, size_t size)
28 {
29 if (ptr==NULL) {
30 smb_panic("nttrans_realloc() called with NULL ptr");
31 }
32
33 *ptr = (char *)SMB_REALLOC(*ptr, size);
34 if(*ptr == NULL) {
35 return NULL;
36 }
37 memset(*ptr,'\0',size);
38 return *ptr;
39 }
40
41 /****************************************************************************
42 Send the required number of replies back.
43 We assume all fields other than the data fields are
44 set correctly for the type of call.
45 HACK ! Always assumes smb_setup field is zero.
46 ****************************************************************************/
47
48 void send_nt_replies(connection_struct *conn,
49 struct smb_request *req, NTSTATUS nt_error,
50 char *params, int paramsize,
51 char *pdata, int datasize)
52 {
53 int data_to_send = datasize;
54 int params_to_send = paramsize;
55 int useable_space;
56 char *pp = params;
57 char *pd = pdata;
58 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59 int alignment_offset = 3;
60 int data_alignment_offset = 0;
61
62 /*
63 * If there genuinely are no parameters or data to send just send
64 * the empty packet.
65 */
66
67 if(params_to_send == 0 && data_to_send == 0) {
68 reply_outbuf(req, 18, 0);
69 show_msg((char *)req->outbuf);
70 return;
71 }
72
73 /*
74 * When sending params and data ensure that both are nicely aligned.
75 * Only do this alignment when there is also data to send - else
76 * can cause NT redirector problems.
77 */
78
79 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
80 data_alignment_offset = 4 - (params_to_send % 4);
81 }
82
83 /*
84 * Space is bufsize minus Netbios over TCP header minus SMB header.
85 * The alignment_offset is to align the param bytes on a four byte
86 * boundary (2 bytes for data len, one byte pad).
87 * NT needs this to work correctly.
88 */
89
90 useable_space = max_send - (smb_size
91 + 2 * 18 /* wct */
92 + alignment_offset
93 + data_alignment_offset);
94
95 if (useable_space < 0) {
96 DEBUG(0, ("send_nt_replies failed sanity useable_space "
97 "= %d!!!", useable_space));
98 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
99 }
100
101 while (params_to_send || data_to_send) {
102
103 /*
104 * Calculate whether we will totally or partially fill this packet.
105 */
106
107 total_sent_thistime = params_to_send + data_to_send;
108
109 /*
110 * We can never send more than useable_space.
111 */
112
113 total_sent_thistime = MIN(total_sent_thistime, useable_space);
114
115 reply_outbuf(req, 18,
116 total_sent_thistime + alignment_offset
117 + data_alignment_offset);
118
119 /*
120 * Set total params and data to be sent.
121 */
122
123 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
124 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
125
126 /*
127 * Calculate how many parameters and data we can fit into
128 * this packet. Parameters get precedence.
129 */
130
131 params_sent_thistime = MIN(params_to_send,useable_space);
132 data_sent_thistime = useable_space - params_sent_thistime;
133 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
134
135 SIVAL(req->outbuf, smb_ntr_ParameterCount,
136 params_sent_thistime);
137
138 if(params_sent_thistime == 0) {
139 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
140 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
141 } else {
142 /*
143 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
144 * parameter bytes, however the first 4 bytes of outbuf are
145 * the Netbios over TCP header. Thus use smb_base() to subtract
146 * them from the calculation.
147 */
148
149 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
150 ((smb_buf(req->outbuf)+alignment_offset)
151 - smb_base(req->outbuf)));
152 /*
153 * Absolute displacement of param bytes sent in this packet.
154 */
155
156 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
157 pp - params);
158 }
159
160 /*
161 * Deal with the data portion.
162 */
163
164 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
165
166 if(data_sent_thistime == 0) {
167 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
168 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
169 } else {
170 /*
171 * The offset of the data bytes is the offset of the
172 * parameter bytes plus the number of parameters being sent this time.
173 */
174
175 SIVAL(req->outbuf, smb_ntr_DataOffset,
176 ((smb_buf(req->outbuf)+alignment_offset) -
177 smb_base(req->outbuf))
178 + params_sent_thistime + data_alignment_offset);
179 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
180 }
181
182 /*
183 * Copy the param bytes into the packet.
184 */
185
186 if(params_sent_thistime) {
187 if (alignment_offset != 0) {
188 memset(smb_buf(req->outbuf), 0,
189 alignment_offset);
190 }
191 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
192 params_sent_thistime);
193 }
194
195 /*
196 * Copy in the data bytes
197 */
198
199 if(data_sent_thistime) {
200 if (data_alignment_offset != 0) {
201 memset((smb_buf(req->outbuf)+alignment_offset+
202 params_sent_thistime), 0,
203 data_alignment_offset);
204 }
205 memcpy(smb_buf(req->outbuf)+alignment_offset
206 +params_sent_thistime+data_alignment_offset,
207 pd,data_sent_thistime);
208 }
209
210 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
211 params_sent_thistime, data_sent_thistime, useable_space));
212 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
213 params_to_send, data_to_send, paramsize, datasize));
214
215 if (NT_STATUS_V(nt_error)) {
216 error_packet_set((char *)req->outbuf,
217 0, 0, nt_error,
218 __LINE__,__FILE__);
219 }
220
221 /* Send the packet */
222 show_msg((char *)req->outbuf);
223 if (!srv_send_smb(smbd_server_fd(),
224 (char *)req->outbuf,
225 IS_CONN_ENCRYPTED(conn))) {
226 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
227 }
228
229 TALLOC_FREE(req->outbuf);
230
231 pp += params_sent_thistime;
232 pd += data_sent_thistime;
233
234 params_to_send -= params_sent_thistime;
235 data_to_send -= data_sent_thistime;
236
237 /*
238 * Sanity check
239 */
240
241 if(params_to_send < 0 || data_to_send < 0) {
242 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
243 params_to_send, data_to_send));
244 exit_server_cleanly("send_nt_replies: internal error");
245 }
246 }
247 }
248
249 /****************************************************************************
250 Is it an NTFS stream name ?
251 An NTFS file name is <path>.<extention>:<stream name>:<stream type>
252 $DATA can be used as both a stream name and a stream type. A missing stream
253 name or type implies $DATA.
254 ****************************************************************************/
255
256 bool is_ntfs_stream_name(const char *fname)
257 {
258 if (lp_posix_pathnames()) {
259 return False;
260 }
261 return (strchr_m(fname, ':') != NULL) ? True : False;
262 }
263
264 /****************************************************************************
265 Reply to an NT create and X call on a pipe
266 ****************************************************************************/
267
268 static void nt_open_pipe(char *fname, connection_struct *conn,
269 struct smb_request *req, int *ppnum)
270 {
271 smb_np_struct *p = NULL;
272
273 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
274
275 /* See if it is one we want to handle. */
276
277 if (!is_known_pipename(fname)) {
278 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
279 ERRDOS, ERRbadpipe);
280 return;
281 }
282
283 /* Strip \\ off the name. */
284 fname++;
285
286 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
287
288 p = open_rpc_pipe_p(fname, conn, req->vuid);
289 if (!p) {
290 reply_doserror(req, ERRSRV, ERRnofids);
291 return;
292 }
293
294 /* TODO: Add pipe to db */
295
296 if ( !store_pipe_opendb( p ) ) {
297 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
298 }
299
300 *ppnum = p->pnum;
301 return;
302 }
303
304 /****************************************************************************
305 Reply to an NT create and X call for pipes.
306 ****************************************************************************/
307
308 static void do_ntcreate_pipe_open(connection_struct *conn,
309 struct smb_request *req)
310 {
311 char *fname = NULL;
312 int pnum = -1;
313 char *p = NULL;
314 uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
315 TALLOC_CTX *ctx = talloc_tos();
316
317 srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
318 smb_buf(req->inbuf), STR_TERMINATE);
319
320 if (!fname) {
321 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
322 ERRDOS, ERRbadpipe);
323 return;
324 }
325 nt_open_pipe(fname, conn, req, &pnum);
326
327 if (req->outbuf) {
328 /* error reply */
329 return;
330 }
331
332 /*
333 * Deal with pipe return.
334 */
335
336 if (flags & EXTENDED_RESPONSE_REQUIRED) {
337 /* This is very strange. We
338 * return 50 words, but only set
339 * the wcnt to 42 ? It's definately
340 * what happens on the wire....
341 */
342 reply_outbuf(req, 50, 0);
343 SCVAL(req->outbuf,smb_wct,42);
344 } else {
345 reply_outbuf(req, 34, 0);
346 }
347
348 p = (char *)req->outbuf + smb_vwv2;
349 p++;
350 SSVAL(p,0,pnum);
351 p += 2;
352 SIVAL(p,0,FILE_WAS_OPENED);
353 p += 4;
354 p += 32;
355 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
356 p += 20;
357 /* File type. */
358 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
359 /* Device state. */
360 SSVAL(p,2, 0x5FF); /* ? */
361 p += 4;
362
363 if (flags & EXTENDED_RESPONSE_REQUIRED) {
364 p += 25;
365 SIVAL(p,0,FILE_GENERIC_ALL);
366 /*
367 * For pipes W2K3 seems to return
368 * 0x12019B next.
369 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
370 */
371 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
372 }
373
374 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
375
376 chain_reply(req);
377 }
378
379 /****************************************************************************
380 Reply to an NT create and X call.
381 ****************************************************************************/
382
383 void reply_ntcreate_and_X(struct smb_request *req)
384 {
385 connection_struct *conn = req->conn;
386 char *fname = NULL;
387 uint32 flags;
388 uint32 access_mask;
389 uint32 file_attributes;
390 uint32 share_access;
391 uint32 create_disposition;
392 uint32 create_options;
393 uint16 root_dir_fid;
394 SMB_BIG_UINT allocation_size;
395 /* Breakout the oplock request bits so we can set the
396 reply bits separately. */
397 uint32 fattr=0;
398 SMB_OFF_T file_len = 0;
399 SMB_STRUCT_STAT sbuf;
400 int info = 0;
401 files_struct *fsp = NULL;
402 char *p = NULL;
403 struct timespec c_timespec;
404 struct timespec a_timespec;
405 struct timespec m_timespec;
406 NTSTATUS status;
407 int oplock_request;
408 uint8_t oplock_granted = NO_OPLOCK_RETURN;
409 TALLOC_CTX *ctx = talloc_tos();
410
411 START_PROFILE(SMBntcreateX);
412
413 if (req->wct < 24) {
414 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
415 return;
416 }
417
418 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
419 access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
420 file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
421 share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
422 create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
423 create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
424 root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
425
426 allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
427 smb_ntcreate_AllocationSize);
428 #ifdef LARGE_SMB_OFF_T
429 allocation_size |= (((SMB_BIG_UINT)IVAL(
430 req->inbuf,
431 smb_ntcreate_AllocationSize + 4)) << 32);
432 #endif
433
434 srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
435 smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
436
437 if (!NT_STATUS_IS_OK(status)) {
438 reply_nterror(req, status);
439 END_PROFILE(SMBntcreateX);
440 return;
441 }
442
443 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
444 "file_attributes = 0x%x, share_access = 0x%x, "
445 "create_disposition = 0x%x create_options = 0x%x "
446 "root_dir_fid = 0x%x, fname = %s\n",
447 (unsigned int)flags,
448 (unsigned int)access_mask,
449 (unsigned int)file_attributes,
450 (unsigned int)share_access,
451 (unsigned int)create_disposition,
452 (unsigned int)create_options,
453 (unsigned int)root_dir_fid,
454 fname));
455
456 /*
457 * we need to remove ignored bits when they come directly from the client
458 * because we reuse some of them for internal stuff
459 */
460 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
461
462 /*
463 * If it's an IPC, use the pipe handler.
464 */
465
466 if (IS_IPC(conn)) {
467 if (lp_nt_pipe_support()) {
468 do_ntcreate_pipe_open(conn, req);
469 END_PROFILE(SMBntcreateX);
470 return;
471 }
472 reply_doserror(req, ERRDOS, ERRnoaccess);
473 END_PROFILE(SMBntcreateX);
474 return;
475 }
476
477 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
478 if (oplock_request) {
479 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
480 ? BATCH_OPLOCK : 0;
481 }
482
483 status = create_file(conn, req, root_dir_fid, fname,
484 access_mask, share_access, create_disposition,
485 create_options, file_attributes, oplock_request,
486 allocation_size, NULL, NULL, &fsp, &info, &sbuf);
487
488 if (!NT_STATUS_IS_OK(status)) {
489 if (open_was_deferred(req->mid)) {
490 /* We have re-scheduled this call, no error. */
491 END_PROFILE(SMBntcreateX);
492 return;
493 }
494 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
495 reply_botherror(req, status, ERRDOS, ERRfilexists);
496 }
497 else {
498 reply_nterror(req, status);
499 }
500 END_PROFILE(SMBntcreateX);
501 return;
502 }
503
504 /*
505 * If the caller set the extended oplock request bit
506 * and we granted one (by whatever means) - set the
507 * correct bit for extended oplock reply.
508 */
509
510 if (oplock_request &&
511 (lp_fake_oplocks(SNUM(conn))
512 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
513
514 /*
515 * Exclusive oplock granted
516 */
517
518 if (flags & REQUEST_BATCH_OPLOCK) {
519 oplock_granted = BATCH_OPLOCK_RETURN;
520 } else {
521 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
522 }
523 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
524 oplock_granted = LEVEL_II_OPLOCK_RETURN;
525 } else {
526 oplock_granted = NO_OPLOCK_RETURN;
527 }
528
529 file_len = sbuf.st_size;
530 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
531 if (fattr == 0) {
532 fattr = FILE_ATTRIBUTE_NORMAL;
533 }
534
535 if (flags & EXTENDED_RESPONSE_REQUIRED) {
536 /* This is very strange. We
537 * return 50 words, but only set
538 * the wcnt to 42 ? It's definately
539 * what happens on the wire....
540 */
541 reply_outbuf(req, 50, 0);
542 SCVAL(req->outbuf,smb_wct,42);
543 } else {
544 reply_outbuf(req, 34, 0);
545 }
546
547 p = (char *)req->outbuf + smb_vwv2;
548
549 SCVAL(p, 0, oplock_granted);
550
551 p++;
552 SSVAL(p,0,fsp->fnum);
553 p += 2;
554 if ((create_disposition == FILE_SUPERSEDE)
555 && (info == FILE_WAS_OVERWRITTEN)) {
556 SIVAL(p,0,FILE_WAS_SUPERSEDED);
557 } else {
558 SIVAL(p,0,info);
559 }
560 p += 4;
561
562 /* Create time. */
563 c_timespec = get_create_timespec(
564 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
565 a_timespec = get_atimespec(&sbuf);
566 m_timespec = get_mtimespec(&sbuf);
567
568 if (lp_dos_filetime_resolution(SNUM(conn))) {
569 dos_filetime_timespec(&c_timespec);
570 dos_filetime_timespec(&a_timespec);
571 dos_filetime_timespec(&m_timespec);
572 }
573
574 put_long_date_timespec(p, c_timespec); /* create time. */
575 p += 8;
576 put_long_date_timespec(p, a_timespec); /* access time */
577 p += 8;
578 put_long_date_timespec(p, m_timespec); /* write time */
579 p += 8;
580 put_long_date_timespec(p, m_timespec); /* change time */
581 p += 8;
582 SIVAL(p,0,fattr); /* File Attributes. */
583 p += 4;
584 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
585 p += 8;
586 SOFF_T(p,0,file_len);
587 p += 8;
588 if (flags & EXTENDED_RESPONSE_REQUIRED) {
589 SSVAL(p,2,0x7);
590 }
591 p += 4;
592 SCVAL(p,0,fsp->is_directory ? 1 : 0);
593
594 if (flags & EXTENDED_RESPONSE_REQUIRED) {
595 uint32 perms = 0;
596 p += 25;
597 if (fsp->is_directory
598 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
599 perms = FILE_GENERIC_ALL;
600 } else {
601 perms = FILE_GENERIC_READ|FILE_EXECUTE;
602 }
603 SIVAL(p,0,perms);
604 }
605
606 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
607 fsp->fnum, fsp->fsp_name));
608
609 chain_reply(req);
610 END_PROFILE(SMBntcreateX);
611 return;
612 }
613
614 /****************************************************************************
615 Reply to a NT_TRANSACT_CREATE call to open a pipe.
616 ****************************************************************************/
617
618 static void do_nt_transact_create_pipe(connection_struct *conn,
619 struct smb_request *req,
620 uint16 **ppsetup, uint32 setup_count,
621 char **ppparams, uint32 parameter_count,
622 char **ppdata, uint32 data_count)
623 {
624 char *fname = NULL;
625 char *params = *ppparams;
626 int pnum = -1;
627 char *p = NULL;
628 NTSTATUS status;
629 size_t param_len;
630 uint32 flags;
631 TALLOC_CTX *ctx = talloc_tos();
632
633 /*
634 * Ensure minimum number of parameters sent.
635 */
636
637 if(parameter_count < 54) {
638 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
639 reply_doserror(req, ERRDOS, ERRnoaccess);
640 return;
641 }
642
643 flags = IVAL(params,0);
644
645 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
646 parameter_count-53, STR_TERMINATE,
647 &status);
648 if (!NT_STATUS_IS_OK(status)) {
649 reply_nterror(req, status);
650 return;
651 }
652
653 nt_open_pipe(fname, conn, req, &pnum);
654
655 if (req->outbuf) {
656 /* Error return */
657 return;
658 }
659
660 /* Realloc the size of parameters and data we will return */
661 if (flags & EXTENDED_RESPONSE_REQUIRED) {
662 /* Extended response is 32 more byyes. */
663 param_len = 101;
664 } else {
665 param_len = 69;
666 }
667 params = nttrans_realloc(ppparams, param_len);
668 if(params == NULL) {
669 reply_doserror(req, ERRDOS, ERRnomem);
670 return;
671 }
672
673 p = params;
674 SCVAL(p,0,NO_OPLOCK_RETURN);
675
676 p += 2;
677 SSVAL(p,0,pnum);
678 p += 2;
679 SIVAL(p,0,FILE_WAS_OPENED);
680 p += 8;
681
682 p += 32;
683 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
684 p += 20;
685 /* File type. */
686 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
687 /* Device state. */
688 SSVAL(p,2, 0x5FF); /* ? */
689 p += 4;
690
691 if (flags & EXTENDED_RESPONSE_REQUIRED) {
692 p += 25;
693 SIVAL(p,0,FILE_GENERIC_ALL);
694 /*
695 * For pipes W2K3 seems to return
696 * 0x12019B next.
697 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
698 */
699 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
700 }
701
702 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
703
704 /* Send the required number of replies */
705 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
706
707 return;
708 }
709
710 /****************************************************************************
711 Internal fn to set security descriptors.
712 ****************************************************************************/
713
714 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
715 uint32 security_info_sent)
716 {
717 SEC_DESC *psd = NULL;
718 NTSTATUS status;
719
720 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
721 return NT_STATUS_OK;
722 }
723
724 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
725
726 if (!NT_STATUS_IS_OK(status)) {
727 return status;
728 }
729
730 if (psd->owner_sid==0) {
731 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
732 }
733 if (psd->group_sid==0) {
734 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
735 }
736 if (psd->sacl==0) {
737 security_info_sent &= ~SACL_SECURITY_INFORMATION;
738 }
739 if (security_info_sent & DACL_SECURITY_INFORMATION) {
740 psd->type |= SEC_DESC_DACL_PRESENT;
741 }
742 if (psd->dacl==0) {
743 security_info_sent &= ~DACL_SECURITY_INFORMATION;
744 }
745
746 /* Convert all the generic bits. */
747 security_acl_map_generic(psd->dacl, &file_generic_mapping);
748 security_acl_map_generic(psd->sacl, &file_generic_mapping);
749
750 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
751
752 TALLOC_FREE(psd);
753
754 return status;
755 }
756
757 /****************************************************************************
758 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
759 ****************************************************************************/
760
761 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
762 {
763 struct ea_list *ea_list_head = NULL;
764 size_t offset = 0;
765
766 if (data_size < 4) {
767 return NULL;
768 }
769
770 while (offset + 4 <= data_size) {
771 size_t next_offset = IVAL(pdata,offset);
772 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
773
774 if (!eal) {
775 return NULL;
776 }
777
778 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
779 if (next_offset == 0) {
780 break;
781 }
782 offset += next_offset;
783 }
784
785 return ea_list_head;
786 }
787
788 /****************************************************************************
789 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
790 ****************************************************************************/
791
792 static void call_nt_transact_create(connection_struct *conn,
793 struct smb_request *req,
794 uint16 **ppsetup, uint32 setup_count,
795 char **ppparams, uint32 parameter_count,
796 char **ppdata, uint32 data_count,
797 uint32 max_data_count)
798 {
799 char *fname = NULL;
800 char *params = *ppparams;
801 char *data = *ppdata;
802 /* Breakout the oplock request bits so we can set the reply bits separately. */
803 uint32 fattr=0;
804 SMB_OFF_T file_len = 0;
805 SMB_STRUCT_STAT sbuf;
806 int info = 0;
807 files_struct *fsp = NULL;
808 char *p = NULL;
809 uint32 flags;
810 uint32 access_mask;
811 uint32 file_attributes;
812 uint32 share_access;
813 uint32 create_disposition;
814 uint32 create_options;
815 uint32 sd_len;
816 struct security_descriptor *sd = NULL;
817 uint32 ea_len;
818 uint16 root_dir_fid;
819 struct timespec c_timespec;
820 struct timespec a_timespec;
821 struct timespec m_timespec;
822 struct ea_list *ea_list = NULL;
823 NTSTATUS status;
824 size_t param_len;
825 SMB_BIG_UINT allocation_size;
826 int oplock_request;
827 uint8_t oplock_granted;
828 TALLOC_CTX *ctx = talloc_tos();
829
830 DEBUG(5,("call_nt_transact_create\n"));
831
832 /*
833 * If it's an IPC, use the pipe handler.
834 */
835
836 if (IS_IPC(conn)) {
837 if (lp_nt_pipe_support()) {
838 do_nt_transact_create_pipe(
839 conn, req,
840 ppsetup, setup_count,
841 ppparams, parameter_count,
842 ppdata, data_count);
843 return;
844 }
845 reply_doserror(req, ERRDOS, ERRnoaccess);
846 return;
847 }
848
849 /*
850 * Ensure minimum number of parameters sent.
851 */
852
853 if(parameter_count < 54) {
854 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
855 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
856 return;
857 }
858
859 flags = IVAL(params,0);
860 access_mask = IVAL(params,8);
861 file_attributes = IVAL(params,20);
862 share_access = IVAL(params,24);
863 create_disposition = IVAL(params,28);
864 create_options = IVAL(params,32);
865 sd_len = IVAL(params,36);
866 ea_len = IVAL(params,40);
867 root_dir_fid = (uint16)IVAL(params,4);
868 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
869 #ifdef LARGE_SMB_OFF_T
870 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
871 #endif
872
873 /*
874 * we need to remove ignored bits when they come directly from the client
875 * because we reuse some of them for internal stuff
876 */
877 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
878
879 /* Ensure the data_len is correct for the sd and ea values given. */
880 if ((ea_len + sd_len > data_count)
881 || (ea_len > data_count) || (sd_len > data_count)
882 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
883 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
884 "%u, data_count = %u\n", (unsigned int)ea_len,
885 (unsigned int)sd_len, (unsigned int)data_count));
886 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
887 return;
888 }
889
890 if (sd_len) {
891 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
892 sd_len));
893
894 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
895 &sd);
896 if (!NT_STATUS_IS_OK(status)) {
897 DEBUG(10, ("call_nt_transact_create: "
898 "unmarshall_sec_desc failed: %s\n",
899 nt_errstr(status)));
900 reply_nterror(req, status);
901 return;
902 }
903 }
904
905 if (ea_len) {
906 if (!lp_ea_support(SNUM(conn))) {
907 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
908 "EA's not supported.\n",
909 (unsigned int)ea_len));
910 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
911 return;
912 }
913
914 if (ea_len < 10) {
915 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
916 "too small (should be more than 10)\n",
917 (unsigned int)ea_len ));
918 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
919 return;
920 }
921
922 /* We have already checked that ea_len <= data_count here. */
923 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
924 ea_len);
925 if (ea_list == NULL) {
926 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
927 return;
928 }
929 }
930
931 srvstr_get_path(ctx, params, req->flags2, &fname,
932 params+53, parameter_count-53,
933 STR_TERMINATE, &status);
934 if (!NT_STATUS_IS_OK(status)) {
935 reply_nterror(req, status);
936 return;
937 }
938
939 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
940 if (oplock_request) {
941 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
942 ? BATCH_OPLOCK : 0;
943 }
944
945 status = create_file(conn, req, root_dir_fid, fname,
946 access_mask, share_access, create_disposition,
947 create_options, file_attributes, oplock_request,
948 allocation_size, sd, ea_list, &fsp, &info, &sbuf);
949
950 if(!NT_STATUS_IS_OK(status)) {
951 if (open_was_deferred(req->mid)) {
952 /* We have re-scheduled this call, no error. */
953 return;
954 }
955 reply_openerror(req, status);
956 return;
957 }
958
959 /*
960 * If the caller set the extended oplock request bit
961 * and we granted one (by whatever means) - set the
962 * correct bit for extended oplock reply.
963 */
964
965 if (oplock_request &&
966 (lp_fake_oplocks(SNUM(conn))
967 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
968
969 /*
970 * Exclusive oplock granted
971 */
972
973 if (flags & REQUEST_BATCH_OPLOCK) {
974 oplock_granted = BATCH_OPLOCK_RETURN;
975 } else {
976 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
977 }
978 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
979 oplock_granted = LEVEL_II_OPLOCK_RETURN;
980 } else {
981 oplock_granted = NO_OPLOCK_RETURN;
982 }
983
984 file_len = sbuf.st_size;
985 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
986 if (fattr == 0) {
987 fattr = FILE_ATTRIBUTE_NORMAL;
988 }
989
990 /* Realloc the size of parameters and data we will return */
991 if (flags & EXTENDED_RESPONSE_REQUIRED) {
992 /* Extended response is 32 more byyes. */
993 param_len = 101;
994 } else {
995 param_len = 69;
996 }
997 params = nttrans_realloc(ppparams, param_len);
998 if(params == NULL) {
999 reply_doserror(req, ERRDOS, ERRnomem);
1000 return;
1001 }
1002
1003 p = params;
1004 SCVAL(p, 0, oplock_granted);
1005
1006 p += 2;
1007 SSVAL(p,0,fsp->fnum);
1008 p += 2;
1009 if ((create_disposition == FILE_SUPERSEDE)
1010 && (info == FILE_WAS_OVERWRITTEN)) {
1011 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1012 } else {
1013 SIVAL(p,0,info);
1014 }
1015 p += 8;
1016
1017 /* Create time. */
1018 c_timespec = get_create_timespec(
1019 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1020 a_timespec = get_atimespec(&sbuf);
1021 m_timespec = get_mtimespec(&sbuf);
1022
1023 if (lp_dos_filetime_resolution(SNUM(conn))) {
1024 dos_filetime_timespec(&c_timespec);
1025 dos_filetime_timespec(&a_timespec);
1026 dos_filetime_timespec(&m_timespec);
1027 }
1028
1029 put_long_date_timespec(p, c_timespec); /* create time. */
1030 p += 8;
1031 put_long_date_timespec(p, a_timespec); /* access time */
1032 p += 8;
1033 put_long_date_timespec(p, m_timespec); /* write time */
1034 p += 8;
1035 put_long_date_timespec(p, m_timespec); /* change time */
1036 p += 8;
1037 SIVAL(p,0,fattr); /* File Attributes. */
1038 p += 4;
1039 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1040 p += 8;
1041 SOFF_T(p,0,file_len);
1042 p += 8;
1043 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1044 SSVAL(p,2,0x7);
1045 }
1046 p += 4;
1047 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1048
1049 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1050 uint32 perms = 0;
1051 p += 25;
1052 if (fsp->is_directory
1053 || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1054 perms = FILE_GENERIC_ALL;
1055 } else {
1056 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1057 }
1058 SIVAL(p,0,perms);
1059 }
1060
1061 DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1062
1063 /* Send the required number of replies */
1064 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1065
1066 return;
1067 }
1068
1069 /****************************************************************************
1070 Reply to a NT CANCEL request.
1071 conn POINTER CAN BE NULL HERE !
1072 ****************************************************************************/
1073
1074 void reply_ntcancel(struct smb_request *req)
1075 {
1076 /*
1077 * Go through and cancel any pending change notifies.
1078 */
1079
1080 START_PROFILE(SMBntcancel);
1081 remove_pending_change_notify_requests_by_mid(req->mid);
1082 remove_pending_lock_requests_by_mid(req->mid);
1083 srv_cancel_sign_response(req->mid);
1084
1085 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1086
1087 END_PROFILE(SMBntcancel);
1088 return;
1089 }
1090
1091 /****************************************************************************
1092 Copy a file.
1093 ****************************************************************************/
1094
1095 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1096 connection_struct *conn,
1097 struct smb_request *req,
1098 const char *oldname_in,
1099 const char *newname_in,
1100 uint32 attrs)
1101 {
1102 SMB_STRUCT_STAT sbuf1, sbuf2;
1103 char *oldname = NULL;
1104 char *newname = NULL;
1105 char *last_component_oldname = NULL;
1106 char *last_component_newname = NULL;
1107 files_struct *fsp1,*fsp2;
1108 uint32 fattr;
1109 int info;
1110 SMB_OFF_T ret=-1;
1111 NTSTATUS status = NT_STATUS_OK;
1112
1113 ZERO_STRUCT(sbuf1);
1114 ZERO_STRUCT(sbuf2);
1115
1116 if (!CAN_WRITE(conn)) {
1117 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1118 }
1119
1120 status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1121 &last_component_oldname, &sbuf1);
1122 if (!NT_STATUS_IS_OK(status)) {
1123 return status;
1124 }
1125
1126 status = check_name(conn, oldname);
1127 if (!NT_STATUS_IS_OK(status)) {
1128 return status;
1129 }
1130
1131 /* Source must already exist. */
1132 if (!VALID_STAT(sbuf1)) {
1133 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1134 }
1135 /* Ensure attributes match. */
1136 fattr = dos_mode(conn,oldname,&sbuf1);
1137 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1138 return NT_STATUS_NO_SUCH_FILE;
1139 }
1140
1141 status = unix_convert(ctx, conn, newname_in, False, &newname,
1142 &last_component_newname, &sbuf2);
1143 if (!NT_STATUS_IS_OK(status)) {
1144 return status;
1145 }
1146
1147 status = check_name(conn, newname);
1148 if (!NT_STATUS_IS_OK(status)) {
1149 return status;
1150 }
1151
1152 /* Disallow if newname already exists. */
1153 if (VALID_STAT(sbuf2)) {
1154 return NT_STATUS_OBJECT_NAME_COLLISION;
1155 }
1156
1157 /* No links from a directory. */
1158 if (S_ISDIR(sbuf1.st_mode)) {
1159 return NT_STATUS_FILE_IS_A_DIRECTORY;
1160 }
1161
1162 /* Ensure this is within the share. */
1163 status = check_reduced_name(conn, oldname);
1164 if (!NT_STATUS_IS_OK(status)) {
1165 return status;
1166 }
1167
1168 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1169 oldname, newname));
1170
1171 status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1172 FILE_READ_DATA, /* Read-only. */
1173 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1174 FILE_OPEN,
1175 0, /* No create options. */
1176 FILE_ATTRIBUTE_NORMAL,
1177 NO_OPLOCK,
1178 &info, &fsp1);
1179
1180 if (!NT_STATUS_IS_OK(status)) {
1181 return status;
1182 }
1183
1184 status = open_file_ntcreate(conn, req, newname, &sbuf2,
1185 FILE_WRITE_DATA, /* Read-only. */
1186 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1187 FILE_CREATE,
1188 0, /* No create options. */
1189 fattr,
1190 NO_OPLOCK,
1191 &info, &fsp2);
1192
1193 if (!NT_STATUS_IS_OK(status)) {
1194 close_file(fsp1,ERROR_CLOSE);
1195 return status;
1196 }
1197
1198 if (sbuf1.st_size) {
1199 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1200 }
1201
1202 /*
1203 * As we are opening fsp1 read-only we only expect
1204 * an error on close on fsp2 if we are out of space.
1205 * Thus we don't look at the error return from the
1206 * close of fsp1.
1207 */
1208 close_file(fsp1,NORMAL_CLOSE);
1209
1210 /* Ensure the modtime is set correctly on the destination file. */
1211 set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1212
1213 status = close_file(fsp2,NORMAL_CLOSE);
1214
1215 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1216 creates the file. This isn't the correct thing to do in the copy
1217 case. JRA */
1218 file_set_dosmode(conn, newname, fattr, &sbuf2,
1219 parent_dirname(newname),false);
1220
1221 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1222 return NT_STATUS_DISK_FULL;
1223 }
1224
1225 if (!NT_STATUS_IS_OK(status)) {
1226 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1227 nt_errstr(status), oldname, newname));
1228 }
1229 return status;
1230 }
1231
1232 /****************************************************************************
1233 Reply to a NT rename request.
1234 ****************************************************************************/
1235
1236 void reply_ntrename(struct smb_request *req)
1237 {
1238 connection_struct *conn = req->conn;
1239 char *oldname = NULL;
1240 char *newname = NULL;
1241 char *p;
1242 NTSTATUS status;
1243 bool src_has_wcard = False;
1244 bool dest_has_wcard = False;
1245 uint32 attrs;
1246 uint16 rename_type;
1247 TALLOC_CTX *ctx = talloc_tos();
1248
1249 START_PROFILE(SMBntrename);
1250
1251 if (req->wct < 4) {
1252 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1253 END_PROFILE(SMBntrename);
1254 return;
1255 }
1256
1257 attrs = SVAL(req->inbuf,smb_vwv0);
1258 rename_type = SVAL(req->inbuf,smb_vwv1);
1259
1260 p = smb_buf(req->inbuf) + 1;
1261 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1262 0, STR_TERMINATE, &status,
1263 &src_has_wcard);
1264 if (!NT_STATUS_IS_OK(status)) {
1265 reply_nterror(req, status);
1266 END_PROFILE(SMBntrename);
1267 return;
1268 }
1269
1270 if( is_ntfs_stream_name(oldname)) {
1271 /* Can't rename a stream. */
1272 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1273 END_PROFILE(SMBntrename);
1274 return;
1275 }
1276
1277 if (ms_has_wild(oldname)) {
1278 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1279 END_PROFILE(SMBntrename);
1280 return;
1281 }
1282
1283 p++;
1284 p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1285 0, STR_TERMINATE, &status,
1286 &dest_has_wcard);
1287 if (!NT_STATUS_IS_OK(status)) {
1288 reply_nterror(req, status);
1289 END_PROFILE(SMBntrename);
1290 return;
1291 }
1292
1293 status = resolve_dfspath(ctx, conn,
1294 req->flags2 & FLAGS2_DFS_PATHNAMES,
1295 oldname,
1296 &oldname);
1297 if (!NT_STATUS_IS_OK(status)) {
1298 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1299 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1300 ERRSRV, ERRbadpath);
1301 END_PROFILE(SMBntrename);
1302 return;
1303 }
1304 reply_nterror(req, status);
1305 END_PROFILE(SMBntrename);
1306 return;
1307 }
1308
1309 status = resolve_dfspath(ctx, conn,
1310 req->flags2 & FLAGS2_DFS_PATHNAMES,
1311 newname,
1312 &newname);
1313 if (!NT_STATUS_IS_OK(status)) {
1314 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1315 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1316 ERRSRV, ERRbadpath);
1317 END_PROFILE(SMBntrename);
1318 return;
1319 }
1320 reply_nterror(req, status);
1321 END_PROFILE(SMBntrename);
1322 return;
1323 }
1324
1325 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1326
1327 switch(rename_type) {
1328 case RENAME_FLAG_RENAME:
1329 status = rename_internals(ctx, conn, req, oldname,
1330 newname, attrs, False, src_has_wcard,
1331 dest_has_wcard, DELETE_ACCESS);
1332 break;
1333 case RENAME_FLAG_HARD_LINK:
1334 if (src_has_wcard || dest_has_wcard) {
1335 /* No wildcards. */
1336 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1337 } else {
1338 status = hardlink_internals(ctx,
1339 conn,
1340 oldname,
1341 newname);
1342 }
1343 break;
1344 case RENAME_FLAG_COPY:
1345 if (src_has_wcard || dest_has_wcard) {
1346 /* No wildcards. */
1347 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1348 } else {
1349 status = copy_internals(ctx, conn, req, oldname,
1350 newname, attrs);
1351 }
1352 break;
1353 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1354 status = NT_STATUS_INVALID_PARAMETER;
1355 break;
1356 default:
1357 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1358 break;
1359 }
1360
1361 if (!NT_STATUS_IS_OK(status)) {
1362 if (open_was_deferred(req->mid)) {
1363 /* We have re-scheduled this call. */
1364 END_PROFILE(SMBntrename);
1365 return;
1366 }
1367
1368 reply_nterror(req, status);
1369 END_PROFILE(SMBntrename);
1370 return;
1371 }
1372
1373 reply_outbuf(req, 0, 0);
1374
1375 END_PROFILE(SMBntrename);
1376 return;
1377 }
1378
1379 /****************************************************************************
1380 Reply to a notify change - queue the request and
1381 don't allow a directory to be opened.
1382 ****************************************************************************/
1383
1384 static void call_nt_transact_notify_change(connection_struct *conn,
1385 struct smb_request *req,
1386 uint16 **ppsetup,
1387 uint32 setup_count,
1388 char **ppparams,
1389 uint32 parameter_count,
1390 char **ppdata, uint32 data_count,
1391 uint32 max_data_count,
1392 uint32 max_param_count)
1393 {
1394 uint16 *setup = *ppsetup;
1395 files_struct *fsp;
1396 uint32 filter;
1397 NTSTATUS status;
1398 bool recursive;
1399
1400 if(setup_count < 6) {
1401 reply_doserror(req, ERRDOS, ERRbadfunc);
1402 return;
1403 }
1404
1405 fsp = file_fsp(SVAL(setup,4));
1406 filter = IVAL(setup, 0);
1407 recursive = (SVAL(setup, 6) != 0) ? True : False;
1408
1409 DEBUG(3,("call_nt_transact_notify_change\n"));
1410
1411 if(!fsp) {
1412 reply_doserror(req, ERRDOS, ERRbadfid);
1413 return;
1414 }
1415
1416 {
1417 char *filter_string;
1418
1419 if (!(filter_string = notify_filter_string(NULL, filter))) {
1420 reply_nterror(req,NT_STATUS_NO_MEMORY);
1421 return;
1422 }
1423
1424 DEBUG(3,("call_nt_transact_notify_change: notify change "
1425 "called on %s, filter = %s, recursive = %d\n",
1426 fsp->fsp_name, filter_string, recursive));
1427
1428 TALLOC_FREE(filter_string);
1429 }
1430
1431 if((!fsp->is_directory) || (conn != fsp->conn)) {
1432 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1433 return;
1434 }
1435
1436 if (fsp->notify == NULL) {
1437
1438 status = change_notify_create(fsp, filter, recursive);
1439
1440 if (!NT_STATUS_IS_OK(status)) {
1441 DEBUG(10, ("change_notify_create returned %s\n",
1442 nt_errstr(status)));
1443 reply_nterror(req, status);
1444 return;
1445 }
1446 }
1447
1448 if (fsp->notify->num_changes != 0) {
1449
1450 /*
1451 * We've got changes pending, respond immediately
1452 */
1453
1454 /*
1455 * TODO: write a torture test to check the filtering behaviour
1456 * here.
1457 */
1458
1459 change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1460
1461 /*
1462 * change_notify_reply() above has independently sent its
1463 * results
1464 */
1465 return;
1466 }
1467
1468 /*
1469 * No changes pending, queue the request
1470 */
1471
1472 status = change_notify_add_request(req,
1473 max_param_count,
1474 filter,
1475 recursive, fsp);
1476 if (!NT_STATUS_IS_OK(status)) {
1477 reply_nterror(req, status);
1478 }
1479 return;
1480 }
1481
1482 /****************************************************************************
1483 Reply to an NT transact rename command.
1484 ****************************************************************************/
1485
1486 static void call_nt_transact_rename(connection_struct *conn,
1487 struct smb_request *req,
1488 uint16 **ppsetup, uint32 setup_count,
1489 char **ppparams, uint32 parameter_count,
1490 char **ppdata, uint32 data_count,
1491 uint32 max_data_count)
1492 {
1493 char *params = *ppparams;
1494 char *new_name = NULL;
1495 files_struct *fsp = NULL;
1496 bool dest_has_wcard = False;
1497 NTSTATUS status;
1498 TALLOC_CTX *ctx = talloc_tos();
1499
1500 if(parameter_count < 5) {
1501 reply_doserror(req, ERRDOS, ERRbadfunc);
1502 return;
1503 }
1504
1505 fsp = file_fsp(SVAL(params, 0));
1506 if (!check_fsp(conn, req, fsp)) {
1507 return;
1508 }
1509 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1510 parameter_count - 4,
1511 STR_TERMINATE, &status, &dest_has_wcard);
1512 if (!NT_STATUS_IS_OK(status)) {
1513 reply_nterror(req, status);
1514 return;
1515 }
1516
1517 /*
1518 * W2K3 ignores this request as the RAW-RENAME test
1519 * demonstrates, so we do.
1520 */
1521 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1522
1523 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1524 fsp->fsp_name, new_name));
1525
1526 return;
1527 }
1528
1529 /******************************************************************************
1530 Fake up a completely empty SD.
1531 *******************************************************************************/
1532
1533 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1534 {
1535 size_t sd_size;
1536
1537 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1538 if(!*ppsd) {
1539 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1540 return NT_STATUS_NO_MEMORY;
1541 }
1542
1543 return NT_STATUS_OK;
1544 }
1545
1546 /****************************************************************************
1547 Reply to query a security descriptor.
1548 ****************************************************************************/
1549
1550 static void call_nt_transact_query_security_desc(connection_struct *conn,
1551 struct smb_request *req,
1552 uint16 **ppsetup,
1553 uint32 setup_count,
1554 char **ppparams,
1555 uint32 parameter_count,
1556 char **ppdata,
1557 uint32 data_count,
1558 uint32 max_data_count)
1559 {
1560 char *params = *ppparams;
1561 char *data = *ppdata;
1562 SEC_DESC *psd = NULL;
1563 size_t sd_size;
1564 uint32 security_info_wanted;
1565 files_struct *fsp = NULL;
1566 NTSTATUS status;
1567 DATA_BLOB blob;
1568
1569 if(parameter_count < 8) {
1570 reply_doserror(req, ERRDOS, ERRbadfunc);
1571 return;
1572 }
1573
1574 fsp = file_fsp(SVAL(params,0));
1575 if(!fsp) {
1576 reply_doserror(req, ERRDOS, ERRbadfid);
1577 return;
1578 }
1579
1580 security_info_wanted = IVAL(params,4);
1581
1582 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1583 (unsigned int)security_info_wanted ));
1584
1585 params = nttrans_realloc(ppparams, 4);
1586 if(params == NULL) {
1587 reply_doserror(req, ERRDOS, ERRnomem);
1588 return;
1589 }
1590
1591 /*
1592 * Get the permissions to return.
1593 */
1594
1595 if (!lp_nt_acl_support(SNUM(conn))) {
1596 status = get_null_nt_acl(talloc_tos(), &psd);
1597 } else {
1598 status = SMB_VFS_FGET_NT_ACL(
1599 fsp, security_info_wanted, &psd);
1600 }
1601
1602 if (!NT_STATUS_IS_OK(status)) {
1603 reply_nterror(req, status);
1604 return;
1605 }
1606
1607 sd_size = ndr_size_security_descriptor(psd, 0);
1608
1609 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1610
1611 SIVAL(params,0,(uint32)sd_size);
1612
1613 if (max_data_count < sd_size) {
1614 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1615 params, 4, *ppdata, 0);
1616 return;
1617 }
1618
1619 /*
1620 * Allocate the data we will point this at.
1621 */
1622
1623 data = nttrans_realloc(ppdata, sd_size);
1624 if(data == NULL) {
1625 reply_doserror(req, ERRDOS, ERRnomem);
1626 return;
1627 }
1628
1629 status = marshall_sec_desc(talloc_tos(), psd,
1630 &blob.data, &blob.length);
1631
1632 if (!NT_STATUS_IS_OK(status)) {
1633 reply_nterror(req, status);
1634 return;
1635 }
1636
1637 SMB_ASSERT(sd_size == blob.length);
1638 memcpy(data, blob.data, sd_size);
1639
1640 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1641
1642 return;
1643 }
1644
1645 /****************************************************************************
1646 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1647 ****************************************************************************/
1648
1649 static void call_nt_transact_set_security_desc(connection_struct *conn,
1650 struct smb_request *req,
1651 uint16 **ppsetup,
1652 uint32 setup_count,
1653 char **ppparams,
1654 uint32 parameter_count,
1655 char **ppdata,
1656 uint32 data_count,
1657 uint32 max_data_count)
1658 {
1659 char *params= *ppparams;
1660 char *data = *ppdata;
1661 files_struct *fsp = NULL;
1662 uint32 security_info_sent = 0;
1663 NTSTATUS status;
1664
1665 if(parameter_count < 8) {
1666 reply_doserror(req, ERRDOS, ERRbadfunc);
1667 return;
1668 }
1669
1670 if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1671 reply_doserror(req, ERRDOS, ERRbadfid);
1672 return;
1673 }
1674
1675 if(!lp_nt_acl_support(SNUM(conn))) {
1676 goto done;
1677 }
1678
1679 security_info_sent = IVAL(params,4);
1680
1681 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1682 (unsigned int)security_info_sent ));
1683
1684 if (data_count == 0) {
1685 reply_doserror(req, ERRDOS, ERRnoaccess);
1686 return;
1687 }
1688
1689 status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1690
1691 if (!NT_STATUS_IS_OK(status)) {
1692 reply_nterror(req, status);
1693 return;
1694 }
1695
1696 done:
1697 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1698 return;
1699 }
1700
1701 /****************************************************************************
1702 Reply to NT IOCTL
1703 ****************************************************************************/
1704
1705 static void call_nt_transact_ioctl(connection_struct *conn,
1706 struct smb_request *req,
1707 uint16 **ppsetup, uint32 setup_count,
1708 char **ppparams, uint32 parameter_count,
1709 char **ppdata, uint32 data_count,
1710 uint32 max_data_count)
1711 {
1712 uint32 function;
1713 uint16 fidnum;
1714 files_struct *fsp;
1715 uint8 isFSctl;
1716 uint8 compfilter;
1717 static bool logged_message;
1718 char *pdata = *ppdata;
1719
1720 if (setup_count != 8) {
1721 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1722 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1723 return;
1724 }
1725
1726 function = IVAL(*ppsetup, 0);
1727 fidnum = SVAL(*ppsetup, 4);
1728 isFSctl = CVAL(*ppsetup, 6);
1729 compfilter = CVAL(*ppsetup, 7);
1730
1731 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1732 function, fidnum, isFSctl, compfilter));
1733
1734 fsp=file_fsp(fidnum);
1735 /* this check is done in each implemented function case for now
1736 because I don't want to break anything... --metze
1737 FSP_BELONGS_CONN(fsp,conn);*/
1738
1739 switch (function) {
1740 case FSCTL_SET_SPARSE:
1741 /* pretend this succeeded - tho strictly we should
1742 mark the file sparse (if the local fs supports it)
1743 so we can know if we need to pre-allocate or not */
1744
1745 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1746 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1747 return;
1748
1749 case FSCTL_CREATE_OR_GET_OBJECT_ID:
1750 {
1751 unsigned char objid[16];
1752
1753 /* This should return the object-id on this file.
1754 * I think I'll make this be the inode+dev. JRA.
1755 */
1756
1757 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1758
1759 if (!fsp_belongs_conn(conn, req, fsp)) {
1760 return;
1761 }
1762
1763 data_count = 64;
1764 pdata = nttrans_realloc(ppdata, data_count);
1765 if (pdata == NULL) {
1766 reply_nterror(req, NT_STATUS_NO_MEMORY);
1767 return;
1768 }
1769 push_file_id_16(pdata, &fsp->file_id);
1770 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1771 push_file_id_16(pdata+32, &fsp->file_id);
1772 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1773 pdata, data_count);
1774 return;
1775 }
1776
1777 case FSCTL_GET_REPARSE_POINT:
1778 /* pretend this fail - my winXP does it like this
1779 * --metze
1780 */
1781
1782 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1783 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1784 return;
1785
1786 case FSCTL_SET_REPARSE_POINT:
1787 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1788 * --metze
1789 */
1790
1791 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1792 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1793 return;
1794
1795 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1796 {
1797 /*
1798 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1799 * and return their volume names. If max_data_count is 16, then it is just
1800 * asking for the number of volumes and length of the combined names.
1801 *
1802 * pdata is the data allocated by our caller, but that uses
1803 * total_data_count (which is 0 in our case) rather than max_data_count.
1804 * Allocate the correct amount and return the pointer to let
1805 * it be deallocated when we return.
1806 */
1807 SHADOW_COPY_DATA *shadow_data = NULL;
1808 TALLOC_CTX *shadow_mem_ctx = NULL;
1809 bool labels = False;
1810 uint32 labels_data_count = 0;
1811 uint32 i;
1812 char *cur_pdata;
1813
1814 if (!fsp_belongs_conn(conn, req, fsp)) {
1815 return;
1816 }
1817
1818 if (max_data_count < 16) {
1819 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1820 max_data_count));
1821 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1822 return;
1823 }
1824
1825 if (max_data_count > 16) {
1826 labels = True;
1827 }
1828
1829 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1830 if (shadow_mem_ctx == NULL) {
1831 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1832 reply_nterror(req, NT_STATUS_NO_MEMORY);
1833 return;
1834 }
1835
1836 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1837 if (shadow_data == NULL) {
1838 DEBUG(0,("TALLOC_ZERO() failed!\n"));
1839 talloc_destroy(shadow_mem_ctx);
1840 reply_nterror(req, NT_STATUS_NO_MEMORY);
1841 return;
1842 }
1843
1844 shadow_data->mem_ctx = shadow_mem_ctx;
1845
1846 /*
1847 * Call the VFS routine to actually do the work.
1848 */
1849 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1850 talloc_destroy(shadow_data->mem_ctx);
1851 if (errno == ENOSYS) {
1852 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
1853 conn->connectpath));
1854 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1855 return;
1856 } else {
1857 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
1858 conn->connectpath));
1859 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1860 return;
1861 }
1862 }
1863
1864 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1865
1866 if (!labels) {
1867 data_count = 16;
1868 } else {
1869 data_count = 12+labels_data_count+4;
1870 }
1871
1872 if (max_data_count<data_count) {
1873 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1874 max_data_count,data_count));
1875 talloc_destroy(shadow_data->mem_ctx);
1876 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1877 return;
1878 }
1879
1880 pdata = nttrans_realloc(ppdata, data_count);
1881 if (pdata == NULL) {
1882 talloc_destroy(shadow_data->mem_ctx);
1883 reply_nterror(req, NT_STATUS_NO_MEMORY);
1884 return;
1885 }
1886
1887 cur_pdata = pdata;
1888
1889 /* num_volumes 4 bytes */
1890 SIVAL(pdata,0,shadow_data->num_volumes);
1891
1892 if (labels) {
1893 /* num_labels 4 bytes */
1894 SIVAL(pdata,4,shadow_data->num_volumes);
1895 }
1896
1897 /* needed_data_count 4 bytes */
1898 SIVAL(pdata,8,labels_data_count);
1899
1900 cur_pdata+=12;
1901
1902 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1903 shadow_data->num_volumes,fsp->fsp_name));
1904 if (labels && shadow_data->labels) {
1905 for (i=0;i<shadow_data->num_volumes;i++) {
1906 srvstr_push(pdata, req->flags2,
1907 cur_pdata, shadow_data->labels[i],
1908 2*sizeof(SHADOW_COPY_LABEL),
1909 STR_UNICODE|STR_TERMINATE);
1910 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1911 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1912 }
1913 }
1914
1915 talloc_destroy(shadow_data->mem_ctx);
1916
1917 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1918 pdata, data_count);
1919
1920 return;
1921 }
1922
1923 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1924 {
1925 /* pretend this succeeded -
1926 *
1927 * we have to send back a list with all files owned by this SID
1928 *
1929 * but I have to check that --metze
1930 */
1931 DOM_SID sid;
1932 uid_t uid;
1933 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1934
1935 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1936
1937 if (!fsp_belongs_conn(conn, req, fsp)) {
1938 return;
1939 }
1940
1941 /* unknown 4 bytes: this is not the length of the sid :-( */
1942 /*unknown = IVAL(pdata,0);*/
1943
1944 sid_parse(pdata+4,sid_len,&sid);
1945 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1946
1947 if (!sid_to_uid(&sid, &uid)) {
1948 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1949 sid_string_dbg(&sid),
1950 (unsigned long)sid_len));
1951 uid = (-1);
1952 }
1953
1954 /* we can take a look at the find source :-)
1955 *
1956 * find ./ -uid $uid -name '*' is what we need here
1957 *
1958 *
1959 * and send 4bytes len and then NULL terminated unicode strings
1960 * for each file
1961 *
1962 * but I don't know how to deal with the paged results
1963 * (maybe we can hang the result anywhere in the fsp struct)
1964 *
1965 * we don't send all files at once
1966 * and at the next we should *not* start from the beginning,
1967 * so we have to cache the result
1968 *
1969 * --metze
1970 */
1971
1972 /* this works for now... */
1973 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1974 return;
1975 }
1976 default:
1977 if (!logged_message) {
1978 logged_message = True; /* Only print this once... */
1979 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
1980 function));
1981 }
1982 }
1983
1984 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1985 }
1986
1987
1988 #ifdef HAVE_SYS_QUOTAS
1989 /****************************************************************************
1990 Reply to get user quota
1991 ****************************************************************************/
1992
1993 static void call_nt_transact_get_user_quota(connection_struct *conn,
1994 struct smb_request *req,
1995 uint16 **ppsetup,
1996 uint32 setup_count,
1997 char **ppparams,
1998 uint32 parameter_count,
1999 char **ppdata,
2000 uint32 data_count,
2001 uint32 max_data_count)
2002 {
2003 NTSTATUS nt_status = NT_STATUS_OK;
2004 char *params = *ppparams;
2005 char *pdata = *ppdata;
2006 char *entry;
2007 int data_len=0,param_len=0;
2008 int qt_len=0;
2009 int entry_len = 0;
2010 files_struct *fsp = NULL;
2011 uint16 level = 0;
2012 size_t sid_len;
2013 DOM_SID sid;
2014 bool start_enum = True;
2015 SMB_NTQUOTA_STRUCT qt;
2016 SMB_NTQUOTA_LIST *tmp_list;
2017 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2018
2019 ZERO_STRUCT(qt);
2020
2021 /* access check */
2022 if (conn->server_info->utok.uid != 0) {
2023 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2024 "[%s]\n", lp_servicename(SNUM(conn)),
2025 conn->server_info->unix_name));
2026 reply_doserror(req, ERRDOS, ERRnoaccess);
2027 return;
2028 }
2029
2030 /*
2031 * Ensure minimum number of parameters sent.
2032 */
2033
2034 if (parameter_count < 4) {
2035 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2036 reply_doserror(req, ERRDOS, ERRinvalidparam);
2037 return;
2038 }
2039
2040 /* maybe we can check the quota_fnum */
2041 fsp = file_fsp(SVAL(params,0));
2042 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2043 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2044 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2045 return;
2046 }
2047
2048 /* the NULL pointer checking for fsp->fake_file_handle->pd
2049 * is done by CHECK_NTQUOTA_HANDLE_OK()
2050 */
2051 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2052
2053 level = SVAL(params,2);
2054
2055 /* unknown 12 bytes leading in params */
2056
2057 switch (level) {
2058 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2059 /* seems that we should continue with the enum here --metze */
2060
2061 if (qt_handle->quota_list!=NULL &&
2062 qt_handle->tmp_list==NULL) {
2063
2064 /* free the list */
2065 free_ntquota_list(&(qt_handle->quota_list));
2066
2067 /* Realloc the size of parameters and data we will return */
2068 param_len = 4;
2069 params = nttrans_realloc(ppparams, param_len);
2070 if(params == NULL) {
2071 reply_doserror(req, ERRDOS, ERRnomem);
2072 return;
2073 }
2074
2075 data_len = 0;
2076 SIVAL(params,0,data_len);
2077
2078 break;
2079 }
2080
2081 start_enum = False;
2082
2083 case TRANSACT_GET_USER_QUOTA_LIST_START:
2084
2085 if (qt_handle->quota_list==NULL &&
2086 qt_handle->tmp_list==NULL) {
2087 start_enum = True;
2088 }
2089
2090 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2091 reply_doserror(req, ERRSRV, ERRerror);
2092 return;
2093 }
2094
2095 /* Realloc the size of parameters and data we will return */
2096 param_len = 4;
2097 params = nttrans_realloc(ppparams, param_len);
2098 if(params == NULL) {
2099 reply_doserror(req, ERRDOS, ERRnomem);
2100 return;
2101 }
2102
2103 /* we should not trust the value in max_data_count*/
2104 max_data_count = MIN(max_data_count,2048);
2105
2106 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2107 if(pdata == NULL) {
2108 reply_doserror(req, ERRDOS, ERRnomem);
2109 return;
2110 }
2111
2112 entry = pdata;
2113
2114 /* set params Size of returned Quota Data 4 bytes*/
2115 /* but set it later when we know it */
2116
2117 /* for each entry push the data */
2118
2119 if (start_enum) {
2120 qt_handle->tmp_list = qt_handle->quota_list;
2121 }
2122
2123 tmp_list = qt_handle->tmp_list;
2124
2125 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2126 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2127
2128 sid_len = ndr_size_dom_sid(
2129 &tmp_list->quotas->sid, 0);
2130 entry_len = 40 + sid_len;
2131
2132 /* nextoffset entry 4 bytes */
2133 SIVAL(entry,0,entry_len);
2134
2135 /* then the len of the SID 4 bytes */
2136 SIVAL(entry,4,sid_len);
2137
2138 /* unknown data 8 bytes SMB_BIG_UINT */
2139 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2140
2141 /* the used disk space 8 bytes SMB_BIG_UINT */
2142 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2143
2144 /* the soft quotas 8 bytes SMB_BIG_UINT */
2145 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2146
2147 /* the hard quotas 8 bytes SMB_BIG_UINT */
2148 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2149
2150 /* and now the SID */
2151 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2152 }
2153
2154 qt_handle->tmp_list = tmp_list;
2155
2156 /* overwrite the offset of the last entry */
2157 SIVAL(entry-entry_len,0,0);
2158
2159 data_len = 4+qt_len;
2160 /* overwrite the params quota_data_len */
2161 SIVAL(params,0,data_len);
2162
2163 break;
2164
2165 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2166
2167 /* unknown 4 bytes IVAL(pdata,0) */
2168
2169 if (data_count < 8) {
2170 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2171 reply_doserror(req, ERRDOS, ERRunknownlevel);
2172 return;
2173 }
2174
2175 sid_len = IVAL(pdata,4);
2176 /* Ensure this is less than 1mb. */
2177 if (sid_len > (1024*1024)) {
2178 reply_doserror(req, ERRDOS, ERRnomem);
2179 return;
2180 }
2181
2182 if (data_count < 8+sid_len) {
2183 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2184 reply_doserror(req, ERRDOS, ERRunknownlevel);
2185 return;
2186 }
2187
2188 data_len = 4+40+sid_len;
2189
2190 if (max_data_count < data_len) {
2191 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2192 max_data_count, data_len));
2193 param_len = 4;
2194 SIVAL(params,0,data_len);
2195 data_len = 0;
2196 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2197 break;
2198 }
2199
2200 sid_parse(pdata+8,sid_len,&sid);
2201
2202 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2203 ZERO_STRUCT(qt);
2204 /*
2205 * we have to return zero's in all fields
2206 * instead of returning an error here
2207 * --metze
2208 */
2209 }
2210
2211 /* Realloc the size of parameters and data we will return */
2212 param_len = 4;
2213 params = nttrans_realloc(ppparams, param_len);
2214 if(params == NULL) {
2215 reply_doserror(req, ERRDOS, ERRnomem);
2216 return;
2217 }
2218
2219 pdata = nttrans_realloc(ppdata, data_len);
2220 if(pdata == NULL) {
2221 reply_doserror(req, ERRDOS, ERRnomem);
2222 return;
2223 }
2224
2225 entry = pdata;
2226
2227 /* set params Size of returned Quota Data 4 bytes*/
2228 SIVAL(params,0,data_len);
2229
2230 /* nextoffset entry 4 bytes */
2231 SIVAL(entry,0,0);
2232
2233 /* then the len of the SID 4 bytes */
2234 SIVAL(entry,4,sid_len);
2235
2236 /* unknown data 8 bytes SMB_BIG_UINT */
2237 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2238
2239 /* the used disk space 8 bytes SMB_BIG_UINT */
2240 SBIG_UINT(entry,16,qt.usedspace);
2241
2242 /* the soft quotas 8 bytes SMB_BIG_UINT */
2243 SBIG_UINT(entry,24,qt.softlim);
2244
2245 /* the hard quotas 8 bytes SMB_BIG_UINT */
2246 SBIG_UINT(entry,32,qt.hardlim);
2247
2248 /* and now the SID */
2249 sid_linearize(entry+40, sid_len, &sid);
2250
2251 break;
2252
2253 default:
2254 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2255 reply_doserror(req, ERRSRV, ERRerror);
2256 return;
2257 break;
2258 }
2259
2260 send_nt_replies(conn, req, nt_status, params, param_len,
2261 pdata, data_len);
2262 }
2263
2264 /****************************************************************************
2265 Reply to set user quota
2266 ****************************************************************************/
2267
2268 static void call_nt_transact_set_user_quota(connection_struct *conn,
2269 struct smb_request *req,
2270 uint16 **ppsetup,
2271 uint32 setup_count,
2272 char **ppparams,
2273 uint32 parameter_count,
2274 char **ppdata,
2275 uint32 data_count,
2276 uint32 max_data_count)
2277 {
2278 char *params = *ppparams;
2279 char *pdata = *ppdata;
2280 int data_len=0,param_len=0;
2281 SMB_NTQUOTA_STRUCT qt;
2282 size_t sid_len;
2283 DOM_SID sid;
2284 files_struct *fsp = NULL;
2285
2286 ZERO_STRUCT(qt);
2287
2288 /* access check */
2289 if (conn->server_info->utok.uid != 0) {
2290 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2291 "[%s]\n", lp_servicename(SNUM(conn)),
2292 conn->server_info->unix_name));
2293 reply_doserror(req, ERRDOS, ERRnoaccess);
2294 return;
2295 }
2296
2297 /*
2298 * Ensure minimum number of parameters sent.
2299 */
2300
2301 if (parameter_count < 2) {
2302 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2303 reply_doserror(req, ERRDOS, ERRinvalidparam);
2304 return;
2305 }
2306
2307 /* maybe we can check the quota_fnum */
2308 fsp = file_fsp(SVAL(params,0));
2309 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2310 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2311 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2312 return;
2313 }
2314
2315 if (data_count < 40) {
2316 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2317 reply_doserror(req, ERRDOS, ERRunknownlevel);
2318 return;
2319 }
2320
2321 /* offset to next quota record.
2322 * 4 bytes IVAL(pdata,0)
2323 * unused here...
2324 */
2325
2326 /* sid len */
2327 sid_len = IVAL(pdata,4);
2328
2329 if (data_count < 40+sid_len) {
2330 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2331 reply_doserror(req, ERRDOS, ERRunknownlevel);
2332 return;
2333 }
2334
2335 /* unknown 8 bytes in pdata
2336 * maybe its the change time in NTTIME
2337 */
2338
2339 /* the used space 8 bytes (SMB_BIG_UINT)*/
2340 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2341 #ifdef LARGE_SMB_OFF_T
2342 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2343 #else /* LARGE_SMB_OFF_T */
2344 if ((IVAL(pdata,20) != 0)&&
2345 ((qt.usedspace != 0xFFFFFFFF)||
2346 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2347 /* more than 32 bits? */
2348 reply_doserror(req, ERRDOS, ERRunknownlevel);
2349 return;
2350 }
2351 #endif /* LARGE_SMB_OFF_T */
2352
2353 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2354 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2355 #ifdef LARGE_SMB_OFF_T
2356 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2357 #else /* LARGE_SMB_OFF_T */
2358 if ((IVAL(pdata,28) != 0)&&
2359 ((qt.softlim != 0xFFFFFFFF)||
2360 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2361 /* more than 32 bits? */
2362 reply_doserror(req, ERRDOS, ERRunknownlevel);
2363 return;
2364 }
2365 #endif /* LARGE_SMB_OFF_T */
2366
2367 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2368 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2369 #ifdef LARGE_SMB_OFF_T
2370 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2371 #else /* LARGE_SMB_OFF_T */
2372 if ((IVAL(pdata,36) != 0)&&
2373 ((qt.hardlim != 0xFFFFFFFF)||
2374 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2375 /* more than 32 bits? */
2376 reply_doserror(req, ERRDOS, ERRunknownlevel);
2377 return;
2378 }
2379 #endif /* LARGE_SMB_OFF_T */
2380
2381 sid_parse(pdata+40,sid_len,&sid);
2382 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2383
2384 /* 44 unknown bytes left... */
2385
2386 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2387 reply_doserror(req, ERRSRV, ERRerror);
2388 return;
2389 }
2390
2391 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2392 pdata, data_len);
2393 }
2394 #endif /* HAVE_SYS_QUOTAS */
2395
2396 static void handle_nttrans(connection_struct *conn,
2397 struct trans_state *state,
2398 struct smb_request *req)
2399 {
2400 if (Protocol >= PROTOCOL_NT1) {
2401 req->flags2 |= 0x40; /* IS_LONG_NAME */
2402 SSVAL(req->inbuf,smb_flg2,req->flags2);
2403 }
2404
2405 /* Now we must call the relevant NT_TRANS function */
2406 switch(state->call) {
2407 case NT_TRANSACT_CREATE:
2408 {
2409 START_PROFILE(NT_transact_create);
2410 call_nt_transact_create(
2411 conn, req,
2412 &state->setup, state->setup_count,
2413 &state->param, state->total_param,
2414 &state->data, state->total_data,
2415 state->max_data_return);
2416 END_PROFILE(NT_transact_create);
2417 break;
2418 }
2419
2420 case NT_TRANSACT_IOCTL:
2421 {
2422 START_PROFILE(NT_transact_ioctl);
2423 call_nt_transact_ioctl(
2424 conn, req,
2425 &state->setup, state->setup_count,
2426 &state->param, state->total_param,
2427 &state->data, state->total_data,
2428 state->max_data_return);
2429 END_PROFILE(NT_transact_ioctl);
2430 break;
2431 }
2432
2433 case NT_TRANSACT_SET_SECURITY_DESC:
2434 {
2435 START_PROFILE(NT_transact_set_security_desc);
2436 call_nt_transact_set_security_desc(
2437 conn, req,
2438 &state->setup, state->setup_count,
2439 &state->param, state->total_param,
2440 &state->data, state->total_data,
2441 state->max_data_return);
2442 END_PROFILE(NT_transact_set_security_desc);
2443 break;
2444 }
2445
2446 case NT_TRANSACT_NOTIFY_CHANGE:
2447 {
2448 START_PROFILE(NT_transact_notify_change);
2449 call_nt_transact_notify_change(
2450 conn, req,
2451 &state->setup, state->setup_count,
2452 &state->param, state->total_param,
2453 &state->data, state->total_data,
2454 state->max_data_return,
2455 state->max_param_return);
2456 END_PROFILE(NT_transact_notify_change);
2457 break;
2458 }
2459
2460 case NT_TRANSACT_RENAME:
2461 {
2462 START_PROFILE(NT_transact_rename);
2463 call_nt_transact_rename(
2464 conn, req,
2465 &state->setup, state->setup_count,
2466 &state->param, state->total_param,
2467 &state->data, state->total_data,
2468 state->max_data_return);
2469 END_PROFILE(NT_transact_rename);
2470 break;
2471 }
2472
2473 case NT_TRANSACT_QUERY_SECURITY_DESC:
2474 {
2475 START_PROFILE(NT_transact_query_security_desc);
2476 call_nt_transact_query_security_desc(
2477 conn, req,
2478 &state->setup, state->setup_count,
2479 &state->param, state->total_param,
2480 &state->data, state->total_data,
2481 state->max_data_return);
2482 END_PROFILE(NT_transact_query_security_desc);
2483 break;
2484 }
2485
2486 #ifdef HAVE_SYS_QUOTAS
2487 case NT_TRANSACT_GET_USER_QUOTA:
2488 {
2489 START_PROFILE(NT_transact_get_user_quota);
2490 call_nt_transact_get_user_quota(
2491 conn, req,
2492 &state->setup, state->setup_count,
2493 &state->param, state->total_param,
2494 &state->data, state->total_data,
2495 state->max_data_return);
2496 END_PROFILE(NT_transact_get_user_quota);
2497 break;
2498 }
2499
2500 case NT_TRANSACT_SET_USER_QUOTA:
2501 {
2502 START_PROFILE(NT_transact_set_user_quota);
2503 call_nt_transact_set_user_quota(
2504 conn, req,
2505 &state->setup, state->setup_count,
2506 &state->param, state->total_param,
2507 &state->data, state->total_data,
2508 state->max_data_return);
2509 END_PROFILE(NT_transact_set_user_quota);
2510 break;
2511 }
2512 #endif /* HAVE_SYS_QUOTAS */
2513
2514 default:
2515 /* Error in request */
2516 DEBUG(0,("handle_nttrans: Unknown request %d in "
2517 "nttrans call\n", state->call));
2518 reply_doserror(req, ERRSRV, ERRerror);
2519 return;
2520 }
2521 return;
2522 }
2523
2524 /****************************************************************************
2525 Reply to a SMBNTtrans.
2526 ****************************************************************************/
2527
2528 void reply_nttrans(struct smb_request *req)
2529 {
2530 connection_struct *conn = req->conn;
2531 uint32_t pscnt;
2532 uint32_t psoff;
2533 uint32_t dscnt;
2534 uint32_t dsoff;
2535 uint16 function_code;
2536 NTSTATUS result;
2537 struct trans_state *state;
2538 uint32_t size;
2539 uint32_t av_size;
2540
2541 START_PROFILE(SMBnttrans);
2542
2543 if (req->wct < 19) {
2544 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2545 END_PROFILE(SMBnttrans);
2546 return;
2547 }
2548
2549 size = smb_len(req->inbuf) + 4;
2550 av_size = smb_len(req->inbuf);
2551 pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2552 psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2553 dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2554 dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2555 function_code = SVAL(req->inbuf, smb_nt_Function);
2556
2557 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2558 reply_doserror(req, ERRSRV, ERRaccess);
2559 END_PROFILE(SMBnttrans);
2560 return;
2561 }
2562
2563 result = allow_new_trans(conn->pending_trans, req->mid);
2564 if (!NT_STATUS_IS_OK(result)) {
2565 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2566 reply_nterror(req, result);
2567 END_PROFILE(SMBnttrans);
2568 return;
2569 }
2570
2571 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2572 reply_doserror(req, ERRSRV, ERRaccess);
2573 END_PROFILE(SMBnttrans);
2574 return;
2575 }
2576
2577 state->cmd = SMBnttrans;
2578
2579 state->mid = req->mid;
2580 state->vuid = req->vuid;
2581 state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2582 state->data = NULL;
2583 state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2584 state->param = NULL;
2585 state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2586 state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2587
2588 /* setup count is in *words* */
2589 state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2590 state->setup = NULL;
2591 state->call = function_code;
2592
2593 /*
2594 * All nttrans messages we handle have smb_wct == 19 +
2595 * state->setup_count. Ensure this is so as a sanity check.
2596 */
2597
2598 if(req->wct != 19 + (state->setup_count/2)) {
2599 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2600 req->wct, 19 + (state->setup_count/2)));
2601 goto bad_param;
2602 }
2603
2604 /* Don't allow more than 128mb for each value. */
2605 if ((state->total_data > (1024*1024*128)) ||
2606 (state->total_param > (1024*1024*128))) {
2607 reply_doserror(req, ERRDOS, ERRnomem);
2608 END_PROFILE(SMBnttrans);
2609 return;
2610 }
2611
2612 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2613 goto bad_param;
2614
2615 if (state->total_data) {
2616 /* Can't use talloc here, the core routines do realloc on the
2617 * params and data. */
2618 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2619 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2620 "bytes !\n", (unsigned int)state->total_data));
2621 TALLOC_FREE(state);
2622 reply_doserror(req, ERRDOS, ERRnomem);
2623 END_PROFILE(SMBnttrans);
2624 return;
2625 }
2626
2627 if (dscnt > state->total_data ||
2628 dsoff+dscnt < dsoff) {
2629 goto bad_param;
2630 }
2631
2632 if (dsoff > av_size ||
2633 dscnt > av_size ||
2634 dsoff+dscnt > av_size) {
2635 goto bad_param;
2636 }
2637
2638 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2639 }
2640
2641 if (state->total_param) {
2642 /* Can't use talloc here, the core routines do realloc on the
2643 * params and data. */
2644 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2645 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2646 "bytes !\n", (unsigned int)state->total_param));
2647 SAFE_FREE(state->data);
2648 TALLOC_FREE(state);
2649 reply_doserror(req, ERRDOS, ERRnomem);
2650 END_PROFILE(SMBnttrans);
2651 return;
2652 }
2653
2654 if (pscnt > state->total_param ||
2655 psoff+pscnt < psoff) {
2656 goto bad_param;
2657 }
2658
2659 if (psoff > av_size ||
2660 pscnt > av_size ||
2661 psoff+pscnt > av_size) {
2662 goto bad_param;
2663 }
2664
2665 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2666 }
2667
2668 state->received_data = dscnt;
2669 state->received_param = pscnt;
2670
2671 if(state->setup_count > 0) {
2672 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2673 state->setup_count));
2674 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2675 if (state->setup == NULL) {
2676 DEBUG(0,("reply_nttrans : Out of memory\n"));
2677 SAFE_FREE(state->data);
2678 SAFE_FREE(state->param);
2679 TALLOC_FREE(state);
2680 reply_doserror(req, ERRDOS, ERRnomem);
2681 END_PROFILE(SMBnttrans);
2682 return;
2683 }
2684
2685 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2686 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2687 goto bad_param;
2688 }
2689 if (smb_nt_SetupStart + state->setup_count > size) {
2690 goto bad_param;
2691 }
2692
2693 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2694 state->setup_count);
2695 dump_data(10, (uint8 *)state->setup, state->setup_count);
2696 }
2697
2698 if ((state->received_data == state->total_data) &&
2699 (state->received_param == state->total_param)) {
2700 handle_nttrans(conn, state, req);
2701 SAFE_FREE(state->param);
2702 SAFE_FREE(state->data);
2703 TALLOC_FREE(state);
2704 END_PROFILE(SMBnttrans);
2705 return;
2706 }
2707
2708 DLIST_ADD(conn->pending_trans, state);
2709
2710 /* We need to send an interim response then receive the rest
2711 of the parameter/data bytes */
2712 reply_outbuf(req, 0, 0);
2713 show_msg((char *)req->outbuf);
2714 END_PROFILE(SMBnttrans);
2715 return;
2716
2717 bad_param:
2718
2719 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2720 SAFE_FREE(state->data);
2721 SAFE_FREE(state->param);
2722 TALLOC_FREE(state);
2723 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2724 END_PROFILE(SMBnttrans);
2725 return;
2726 }
2727
2728 /****************************************************************************
2729 Reply to a SMBnttranss
2730 ****************************************************************************/
2731
2732 void reply_nttranss(struct smb_request *req)
2733 {
2734 connection_struct *conn = req->conn;
2735 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2736 struct trans_state *state;
2737 uint32_t av_size;
2738 uint32_t size;
2739
2740 START_PROFILE(SMBnttranss);
2741
2742 show_msg((char *)req->inbuf);
2743
2744 if (req->wct < 18) {
2745 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2746 END_PROFILE(SMBnttranss);
2747 return;
2748 }
2749
2750 for (state = conn->pending_trans; state != NULL;
2751 state = state->next) {
2752 if (state->mid == req->mid) {
2753 break;
2754 }
2755 }
2756
2757 if ((state == NULL) || (state->cmd != SMBnttrans)) {
2758 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2759 END_PROFILE(SMBnttranss);
2760 return;
2761 }
2762
2763 /* Revise state->total_param and state->total_data in case they have
2764 changed downwards */
2765 if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2766 < state->total_param) {
2767 state->total_param = IVAL(req->inbuf,
2768 smb_nts_TotalParameterCount);
2769 }
2770 if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2771 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2772 }
2773
2774 size = smb_len(req->inbuf) + 4;
2775 av_size = smb_len(req->inbuf);
2776
2777 pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2778 poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2779 pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2780
2781 dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2782 ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2783 doff = IVAL(req->inbuf, smb_nts_DataOffset);
2784
2785 state->received_param += pcnt;
2786 state->received_data += dcnt;
2787
2788 if ((state->received_data > state->total_data) ||
2789 (state->received_param > state->total_param))
2790 goto bad_param;
2791
2792 if (pcnt) {
2793 if (pdisp > state->total_param ||
2794 pcnt > state->total_param ||
2795 pdisp+pcnt > state->total_param ||
2796 pdisp+pcnt < pdisp) {
2797 goto bad_param;
2798 }
2799
2800 if (poff > av_size ||
2801 pcnt > av_size ||
2802 poff+pcnt > av_size ||
2803 poff+pcnt < poff) {
2804 goto bad_param;
2805 }
2806
2807 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2808 pcnt);
2809 }
2810
2811 if (dcnt) {
2812 if (ddisp > state->total_data ||
2813 dcnt > state->total_data ||
2814 ddisp+dcnt > state->total_data ||
2815 ddisp+dcnt < ddisp) {
2816 goto bad_param;
2817 }
2818
2819 if (ddisp > av_size ||
2820 dcnt > av_size ||
2821 ddisp+dcnt > av_size ||
2822 ddisp+dcnt < ddisp) {
2823 goto bad_param;
2824 }
2825
2826 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2827 dcnt);
2828 }
2829
2830 if ((state->received_param < state->total_param) ||
2831 (state->received_data < state->total_data)) {
2832 END_PROFILE(SMBnttranss);
2833 return;
2834 }
2835
2836 /*
2837 * construct_reply_common will copy smb_com from inbuf to
2838 * outbuf. SMBnttranss is wrong here.
2839 */
2840 SCVAL(req->inbuf,smb_com,SMBnttrans);
2841
2842 handle_nttrans(conn, state, req);
2843
2844 DLIST_REMOVE(conn->pending_trans, state);
2845 SAFE_FREE(state->data);
2846 SAFE_FREE(state->param);
2847 TALLOC_FREE(state);
2848 END_PROFILE(SMBnttranss);
2849 return;
2850
2851 bad_param:
2852
2853 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2854 DLIST_REMOVE(conn->pending_trans, state);
2855 SAFE_FREE(state->data);
2856 SAFE_FREE(state->param);
2857 TALLOC_FREE(state);
2858 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2859 END_PROFILE(SMBnttranss);
2860 return;
2861 }
Samba GIT mirror