?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: smbd: Allow fchmod from the NFS-style mode ACL in set_nt_acl() for a SMB2 POSIX...
[Samba.git] / source3 / smbd / smb2_create.c
blob8a40717235c4ef61b16abc3ef07cfb05b9b5a2c6
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "printing.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "smbd/smbXsrv_open.h"
27 #include "../libcli/smb/smb_common.h"
28 #include "../librpc/gen_ndr/ndr_security.h"
29 #include "../librpc/gen_ndr/ndr_smb2_lease_struct.h"
30 #include "../librpc/gen_ndr/ndr_smb3posix.h"
31 #include "../lib/util/tevent_ntstatus.h"
32 #include "messages.h"
33 #include "lib/util_ea.h"
34 #include "source3/passdb/lookup_sid.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_SMB2
38
39 int map_smb2_oplock_levels_to_samba(uint8_t in_oplock_level)
40 {
41 switch(in_oplock_level) {
42 case SMB2_OPLOCK_LEVEL_NONE:
43 return NO_OPLOCK;
44 case SMB2_OPLOCK_LEVEL_II:
45 return LEVEL_II_OPLOCK;
46 case SMB2_OPLOCK_LEVEL_EXCLUSIVE:
47 return EXCLUSIVE_OPLOCK;
48 case SMB2_OPLOCK_LEVEL_BATCH:
49 return BATCH_OPLOCK;
50 case SMB2_OPLOCK_LEVEL_LEASE:
51 return LEASE_OPLOCK;
52 default:
53 DEBUG(2,("map_smb2_oplock_levels_to_samba: "
54 "unknown level %u\n",
55 (unsigned int)in_oplock_level));
56 return NO_OPLOCK;
57 }
58 }
59
60 static uint8_t map_samba_oplock_levels_to_smb2(int oplock_type)
61 {
62 if (BATCH_OPLOCK_TYPE(oplock_type)) {
63 return SMB2_OPLOCK_LEVEL_BATCH;
64 } else if (EXCLUSIVE_OPLOCK_TYPE(oplock_type)) {
65 return SMB2_OPLOCK_LEVEL_EXCLUSIVE;
66 } else if (oplock_type == LEVEL_II_OPLOCK) {
67 return SMB2_OPLOCK_LEVEL_II;
68 } else if (oplock_type == LEASE_OPLOCK) {
69 return SMB2_OPLOCK_LEVEL_LEASE;
70 } else {
71 return SMB2_OPLOCK_LEVEL_NONE;
72 }
73 }
74
75 /*
76 MS-FSA 2.1.5.1 Server Requests an Open of a File
77 Trailing '/' or '\\' checker.
78 Must be done before the filename parser removes any
79 trailing characters. If we decide to add this to SMB1
80 NTCreate processing we can make this public.
81
82 Note this is Windows pathname processing only. When
83 POSIX pathnames are added to SMB2 this will not apply.
84 */
85
86 static NTSTATUS windows_name_trailing_check(const char *name,
87 uint32_t create_options)
88 {
89 size_t name_len = strlen(name);
90 char trail_c;
91
92 if (name_len <= 1) {
93 return NT_STATUS_OK;
94 }
95
96 trail_c = name[name_len-1];
97
98 /*
99 * Trailing '/' is always invalid.
100 */
101 if (trail_c == '/') {
102 return NT_STATUS_OBJECT_NAME_INVALID;
103 }
104
105 if (create_options & FILE_NON_DIRECTORY_FILE) {
106 if (trail_c == '\\') {
107 return NT_STATUS_OBJECT_NAME_INVALID;
108 }
109 }
110 return NT_STATUS_OK;
111 }
112
113 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
114 struct tevent_context *ev,
115 struct smbd_smb2_request *smb2req,
116 uint8_t in_oplock_level,
117 uint32_t in_impersonation_level,
118 uint32_t in_desired_access,
119 uint32_t in_file_attributes,
120 uint32_t in_share_access,
121 uint32_t in_create_disposition,
122 uint32_t _in_create_options,
123 const char *in_name,
124 struct smb2_create_blobs in_context_blobs);
125 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
126 TALLOC_CTX *mem_ctx,
127 uint8_t *out_oplock_level,
128 uint32_t *out_create_action,
129 struct timespec *out_creation_ts,
130 struct timespec *out_last_access_ts,
131 struct timespec *out_last_write_ts,
132 struct timespec *out_change_ts,
133 uint64_t *out_allocation_size,
134 uint64_t *out_end_of_file,
135 uint32_t *out_file_attributes,
136 uint64_t *out_file_id_persistent,
137 uint64_t *out_file_id_volatile,
138 struct smb2_create_blobs *out_context_blobs);
139
140 static void smbd_smb2_request_create_done(struct tevent_req *tsubreq);
141 NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
142 {
143 const uint8_t *inbody;
144 const struct iovec *indyniov;
145 uint8_t in_oplock_level;
146 uint32_t in_impersonation_level;
147 uint32_t in_desired_access;
148 uint32_t in_file_attributes;
149 uint32_t in_share_access;
150 uint32_t in_create_disposition;
151 uint32_t in_create_options;
152 uint16_t in_name_offset;
153 uint16_t in_name_length;
154 DATA_BLOB in_name_buffer;
155 char *in_name_string;
156 size_t in_name_string_size;
157 uint32_t name_offset = 0;
158 uint32_t name_available_length = 0;
159 uint32_t in_context_offset;
160 uint32_t in_context_length;
161 DATA_BLOB in_context_buffer;
162 struct smb2_create_blobs in_context_blobs;
163 uint32_t context_offset = 0;
164 uint32_t context_available_length = 0;
165 uint32_t dyn_offset;
166 NTSTATUS status;
167 bool ok;
168 struct tevent_req *tsubreq;
169
170 status = smbd_smb2_request_verify_sizes(smb2req, 0x39);
171 if (!NT_STATUS_IS_OK(status)) {
172 return smbd_smb2_request_error(smb2req, status);
173 }
174 inbody = SMBD_SMB2_IN_BODY_PTR(smb2req);
175
176 in_oplock_level = CVAL(inbody, 0x03);
177 in_impersonation_level = IVAL(inbody, 0x04);
178 in_desired_access = IVAL(inbody, 0x18);
179 in_file_attributes = IVAL(inbody, 0x1C);
180 in_share_access = IVAL(inbody, 0x20);
181 in_create_disposition = IVAL(inbody, 0x24);
182 in_create_options = IVAL(inbody, 0x28);
183 in_name_offset = SVAL(inbody, 0x2C);
184 in_name_length = SVAL(inbody, 0x2E);
185 in_context_offset = IVAL(inbody, 0x30);
186 in_context_length = IVAL(inbody, 0x34);
187
188 /*
189 * First check if the dynamic name and context buffers
190 * are correctly specified.
191 *
192 * Note: That we don't check if the name and context buffers
193 * overlap
194 */
195
196 dyn_offset = SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(smb2req);
197
198 if (in_name_offset == 0 && in_name_length == 0) {
199 /* This is ok */
200 name_offset = 0;
201 } else if (in_name_offset < dyn_offset) {
202 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
203 } else {
204 name_offset = in_name_offset - dyn_offset;
205 }
206
207 indyniov = SMBD_SMB2_IN_DYN_IOV(smb2req);
208
209 if (name_offset > indyniov->iov_len) {
210 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
211 }
212
213 name_available_length = indyniov->iov_len - name_offset;
214
215 if (in_name_length > name_available_length) {
216 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
217 }
218
219 in_name_buffer.data = (uint8_t *)indyniov->iov_base + name_offset;
220 in_name_buffer.length = in_name_length;
221
222 if (in_context_offset == 0 && in_context_length == 0) {
223 /* This is ok */
224 context_offset = 0;
225 } else if (in_context_offset < dyn_offset) {
226 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
227 } else {
228 context_offset = in_context_offset - dyn_offset;
229 }
230
231 if (context_offset > indyniov->iov_len) {
232 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
233 }
234
235 context_available_length = indyniov->iov_len - context_offset;
236
237 if (in_context_length > context_available_length) {
238 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
239 }
240
241 in_context_buffer.data = (uint8_t *)indyniov->iov_base +
242 context_offset;
243 in_context_buffer.length = in_context_length;
244
245 /*
246 * Now interpret the name and context buffers
247 */
248
249 ok = convert_string_talloc(smb2req, CH_UTF16, CH_UNIX,
250 in_name_buffer.data,
251 in_name_buffer.length,
252 &in_name_string,
253 &in_name_string_size);
254 if (!ok) {
255 return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
256 }
257
258 if (in_name_buffer.length == 0) {
259 in_name_string_size = 0;
260 }
261
262 if (strlen(in_name_string) != in_name_string_size) {
263 return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
264 }
265
266 ZERO_STRUCT(in_context_blobs);
267 status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
268 if (!NT_STATUS_IS_OK(status)) {
269 return smbd_smb2_request_error(smb2req, status);
270 }
271
272 if (CHECK_DEBUGLVL(DBGLVL_DEBUG)) {
273 char *str = talloc_asprintf(
274 talloc_tos(),
275 "\nGot %"PRIu32" create blobs\n",
276 in_context_blobs.num_blobs);
277 uint32_t i;
278
279 for (i=0; i<in_context_blobs.num_blobs; i++) {
280 struct smb2_create_blob *b =
281 &in_context_blobs.blobs[i];
282 talloc_asprintf_addbuf(&str, "[%"PRIu32"]\n", i);
283 dump_data_addbuf(
284 (uint8_t *)b->tag, strlen(b->tag), &str);
285 dump_data_addbuf(
286 b->data.data, b->data.length, &str);
287 }
288 DBG_DEBUG("%s", str);
289 TALLOC_FREE(str);
290 }
291
292 tsubreq = smbd_smb2_create_send(smb2req,
293 smb2req->sconn->ev_ctx,
294 smb2req,
295 in_oplock_level,
296 in_impersonation_level,
297 in_desired_access,
298 in_file_attributes,
299 in_share_access,
300 in_create_disposition,
301 in_create_options,
302 in_name_string,
303 in_context_blobs);
304 if (tsubreq == NULL) {
305 smb2req->subreq = NULL;
306 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
307 }
308 tevent_req_set_callback(tsubreq, smbd_smb2_request_create_done, smb2req);
309
310 return smbd_smb2_request_pending_queue(smb2req, tsubreq, 500);
311 }
312
313 static uint64_t get_mid_from_smb2req(struct smbd_smb2_request *smb2req)
314 {
315 uint8_t *reqhdr = SMBD_SMB2_OUT_HDR_PTR(smb2req);
316 return BVAL(reqhdr, SMB2_HDR_MESSAGE_ID);
317 }
318
319 static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
320 {
321 struct smbd_smb2_request *smb2req = tevent_req_callback_data(tsubreq,
322 struct smbd_smb2_request);
323 DATA_BLOB outbody;
324 DATA_BLOB outdyn;
325 uint8_t out_oplock_level = 0;
326 uint32_t out_create_action = 0;
327 connection_struct *conn = smb2req->tcon->compat;
328 struct timespec out_creation_ts = { 0, };
329 struct timespec out_last_access_ts = { 0, };
330 struct timespec out_last_write_ts = { 0, };
331 struct timespec out_change_ts = { 0, };
332 uint64_t out_allocation_size = 0;
333 uint64_t out_end_of_file = 0;
334 uint32_t out_file_attributes = 0;
335 uint64_t out_file_id_persistent = 0;
336 uint64_t out_file_id_volatile = 0;
337 struct smb2_create_blobs out_context_blobs;
338 DATA_BLOB out_context_buffer;
339 uint16_t out_context_buffer_offset = 0;
340 NTSTATUS status;
341 NTSTATUS error; /* transport error */
342
343 status = smbd_smb2_create_recv(tsubreq,
344 smb2req,
345 &out_oplock_level,
346 &out_create_action,
347 &out_creation_ts,
348 &out_last_access_ts,
349 &out_last_write_ts,
350 &out_change_ts,
351 &out_allocation_size,
352 &out_end_of_file,
353 &out_file_attributes,
354 &out_file_id_persistent,
355 &out_file_id_volatile,
356 &out_context_blobs);
357 if (!NT_STATUS_IS_OK(status)) {
358 if (smbd_smb2_is_compound(smb2req)) {
359 smb2req->compound_create_err = status;
360 }
361 error = smbd_smb2_request_error(smb2req, status);
362 if (!NT_STATUS_IS_OK(error)) {
363 smbd_server_connection_terminate(smb2req->xconn,
364 nt_errstr(error));
365 return;
366 }
367 return;
368 }
369
370 status = smb2_create_blob_push(smb2req, &out_context_buffer, out_context_blobs);
371 if (!NT_STATUS_IS_OK(status)) {
372 error = smbd_smb2_request_error(smb2req, status);
373 if (!NT_STATUS_IS_OK(error)) {
374 smbd_server_connection_terminate(smb2req->xconn,
375 nt_errstr(error));
376 return;
377 }
378 return;
379 }
380
381 if (out_context_buffer.length > 0) {
382 out_context_buffer_offset = SMB2_HDR_BODY + 0x58;
383 }
384
385 outbody = smbd_smb2_generate_outbody(smb2req, 0x58);
386 if (outbody.data == NULL) {
387 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
388 if (!NT_STATUS_IS_OK(error)) {
389 smbd_server_connection_terminate(smb2req->xconn,
390 nt_errstr(error));
391 return;
392 }
393 return;
394 }
395
396 SSVAL(outbody.data, 0x00, 0x58 + 1); /* struct size */
397 SCVAL(outbody.data, 0x02,
398 out_oplock_level); /* oplock level */
399 SCVAL(outbody.data, 0x03, 0); /* reserved */
400 SIVAL(outbody.data, 0x04,
401 out_create_action); /* create action */
402 put_long_date_full_timespec(conn->ts_res,
403 (char *)outbody.data + 0x08,
404 &out_creation_ts); /* creation time */
405 put_long_date_full_timespec(conn->ts_res,
406 (char *)outbody.data + 0x10,
407 &out_last_access_ts); /* last access time */
408 put_long_date_full_timespec(conn->ts_res,
409 (char *)outbody.data + 0x18,
410 &out_last_write_ts); /* last write time */
411 put_long_date_full_timespec(conn->ts_res,
412 (char *)outbody.data + 0x20,
413 &out_change_ts); /* change time */
414 SBVAL(outbody.data, 0x28,
415 out_allocation_size); /* allocation size */
416 SBVAL(outbody.data, 0x30,
417 out_end_of_file); /* end of file */
418 SIVAL(outbody.data, 0x38,
419 out_file_attributes); /* file attributes */
420 SIVAL(outbody.data, 0x3C, 0); /* reserved */
421 SBVAL(outbody.data, 0x40,
422 out_file_id_persistent); /* file id (persistent) */
423 SBVAL(outbody.data, 0x48,
424 out_file_id_volatile); /* file id (volatile) */
425 SIVAL(outbody.data, 0x50,
426 out_context_buffer_offset); /* create contexts offset */
427 SIVAL(outbody.data, 0x54,
428 out_context_buffer.length); /* create contexts length */
429
430 outdyn = out_context_buffer;
431
432 error = smbd_smb2_request_done(smb2req, outbody, &outdyn);
433 if (!NT_STATUS_IS_OK(error)) {
434 smbd_server_connection_terminate(smb2req->xconn,
435 nt_errstr(error));
436 return;
437 }
438 }
439
440 static bool smb2_lease_key_valid(const struct smb2_lease_key *key)
441 {
442 return ((key->data[0] != 0) || (key->data[1] != 0));
443 }
444
445 static NTSTATUS smbd_smb2_create_durable_lease_check(struct smb_request *smb1req,
446 const char *requested_filename, const struct files_struct *fsp,
447 const struct smb2_lease *lease_ptr)
448 {
449 struct files_struct *dirfsp = NULL;
450 char *filename = NULL;
451 struct smb_filename *smb_fname = NULL;
452 uint32_t ucf_flags;
453 NTTIME twrp = fsp->fsp_name->twrp;
454 NTSTATUS status;
455 bool is_dfs = (smb1req->flags2 & FLAGS2_DFS_PATHNAMES);
456 bool is_posix = (fsp->fsp_name->flags & SMB_FILENAME_POSIX_PATH);
457
458 if (lease_ptr == NULL) {
459 if (fsp->oplock_type != LEASE_OPLOCK) {
460 return NT_STATUS_OK;
461 }
462 DEBUG(10, ("Reopened file has lease, but no lease "
463 "requested\n"));
464 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
465 }
466
467 if (fsp->oplock_type != LEASE_OPLOCK) {
468 DEBUG(10, ("Lease requested, but reopened file has no "
469 "lease\n"));
470 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
471 }
472
473 if (!smb2_lease_key_equal(&lease_ptr->lease_key,
474 &fsp->lease->lease.lease_key)) {
475 DEBUG(10, ("Different lease key requested than found "
476 "in reopened file\n"));
477 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
478 }
479
480 if (is_dfs) {
481 const char *non_dfs_requested_filename = NULL;
482 /*
483 * With a DFS flag set, remove any DFS prefix
484 * before further processing.
485 */
486 status = smb2_strip_dfs_path(requested_filename,
487 &non_dfs_requested_filename);
488 if (!NT_STATUS_IS_OK(status)) {
489 return status;
490 }
491 /*
492 * TODO: Note for dealing with reparse point errors.
493 * We will need to remember and store the number of characters
494 * we have removed here, which is
495 * (requested_filename - non_dfs_requested_filename)
496 * in order to correctly report how many characters we
497 * have removed before hitting the reparse point.
498 * This will be a patch needed once we properly
499 * deal with reparse points later.
500 */
501 requested_filename = non_dfs_requested_filename;
502 /*
503 * Now we're no longer dealing with a DFS path, so
504 * remove the flag.
505 */
506 smb1req->flags2 &= ~FLAGS2_DFS_PATHNAMES;
507 is_dfs = false;
508 }
509
510 filename = talloc_strdup(talloc_tos(), requested_filename);
511 if (filename == NULL) {
512 return NT_STATUS_NO_MEMORY;
513 }
514
515 /* This also converts '\' to '/' */
516 status = check_path_syntax(filename, is_posix);
517 if (!NT_STATUS_IS_OK(status)) {
518 TALLOC_FREE(filename);
519 return status;
520 }
521
522 ucf_flags = filename_create_ucf_flags(smb1req, FILE_OPEN);
523 status = filename_convert_dirfsp(talloc_tos(),
524 fsp->conn,
525 filename,
526 ucf_flags,
527 twrp,
528 &dirfsp,
529 &smb_fname);
530 TALLOC_FREE(filename);
531 if (!NT_STATUS_IS_OK(status)) {
532 DEBUG(10, ("filename_convert returned %s\n",
533 nt_errstr(status)));
534 return status;
535 }
536
537 if (!strequal(fsp->fsp_name->base_name, smb_fname->base_name)) {
538 DEBUG(10, ("Lease requested for file %s, reopened file "
539 "is named %s\n", smb_fname->base_name,
540 fsp->fsp_name->base_name));
541 TALLOC_FREE(smb_fname);
542 return NT_STATUS_INVALID_PARAMETER;
543 }
544
545 TALLOC_FREE(smb_fname);
546
547 return NT_STATUS_OK;
548 }
549
550 struct smbd_smb2_create_state {
551 struct tevent_context *ev;
552 struct smbd_smb2_request *smb2req;
553 struct GUID req_guid;
554 struct smb_request *smb1req;
555 bool open_was_deferred;
556 struct tevent_immediate *im;
557 struct timeval request_time;
558 struct file_id id;
559 struct deferred_open_record *open_rec;
560 files_struct *result;
561 bool replay_operation;
562 uint8_t in_oplock_level;
563 uint32_t in_create_disposition;
564 uint32_t in_create_options;
565 int requested_oplock_level;
566 int info;
567 char *fname;
568 struct ea_list *ea_list;
569 NTTIME max_access_time;
570 struct security_descriptor *sec_desc;
571 uint64_t allocation_size;
572 struct GUID _create_guid;
573 struct GUID *create_guid;
574 struct GUID _purge_create_guid;
575 struct GUID *purge_create_guid;
576 bool update_open;
577 bool durable_requested;
578 uint32_t durable_timeout_msec;
579 bool do_durable_reconnect;
580 uint64_t persistent_id;
581 struct smb2_lease lease;
582 struct smb2_lease *lease_ptr;
583 ssize_t lease_len;
584 bool need_replay_cache;
585 struct smbXsrv_open *op;
586 NTTIME twrp_time;
587
588 struct smb2_create_blob *dhnc;
589 struct smb2_create_blob *dh2c;
590 struct smb2_create_blob *dhnq;
591 struct smb2_create_blob *dh2q;
592 struct smb2_create_blob *rqls;
593 struct smb2_create_blob *exta;
594 struct smb2_create_blob *mxac;
595 struct smb2_create_blob *secd;
596 struct smb2_create_blob *alsi;
597 struct smb2_create_blob *twrp;
598 struct smb2_create_blob *qfid;
599 struct smb2_create_blob *posx;
600 struct smb2_create_blob *svhdx;
601
602 uint8_t out_oplock_level;
603 uint32_t out_create_action;
604 struct timespec out_creation_ts;
605 struct timespec out_last_access_ts;
606 struct timespec out_last_write_ts;
607 struct timespec out_change_ts;
608 uint64_t out_allocation_size;
609 uint64_t out_end_of_file;
610 uint32_t out_file_attributes;
611 uint64_t out_file_id_persistent;
612 uint64_t out_file_id_volatile;
613 struct smb2_create_blobs *out_context_blobs;
614 };
615
616 static void smbd_smb2_create_purge_replay_cache(struct tevent_req *req,
617 const char *caller_func);
618
619 static void smbd_smb2_create_cleanup(struct tevent_req *req,
620 enum tevent_req_state req_state)
621 {
622 smbd_smb2_create_purge_replay_cache(req, __func__);
623 }
624
625 static NTSTATUS smbd_smb2_create_fetch_create_ctx(
626 struct tevent_req *req,
627 struct smb2_create_blobs *in_context_blobs)
628 {
629 struct smbd_smb2_create_state *state = tevent_req_data(
630 req, struct smbd_smb2_create_state);
631 struct smbd_smb2_request *smb2req = state->smb2req;
632 struct smbXsrv_connection *xconn = smb2req->xconn;
633
634 state->dhnq = smb2_create_blob_find(in_context_blobs,
635 SMB2_CREATE_TAG_DHNQ);
636 state->dhnc = smb2_create_blob_find(in_context_blobs,
637 SMB2_CREATE_TAG_DHNC);
638 state->dh2q = smb2_create_blob_find(in_context_blobs,
639 SMB2_CREATE_TAG_DH2Q);
640 state->dh2c = smb2_create_blob_find(in_context_blobs,
641 SMB2_CREATE_TAG_DH2C);
642 if (xconn->smb2.server.capabilities & SMB2_CAP_LEASING) {
643 state->rqls = smb2_create_blob_find(in_context_blobs,
644 SMB2_CREATE_TAG_RQLS);
645 }
646
647 if (((state->dhnc != NULL) && (state->dh2c != NULL)) ||
648 ((state->dhnc != NULL) && (state->dh2q != NULL)) ||
649 ((state->dh2c != NULL) && (state->dhnq != NULL)) ||
650 ((state->dh2q != NULL) && (state->dh2c != NULL)))
651 {
652 /* not both are allowed at the same time */
653 return NT_STATUS_INVALID_PARAMETER;
654 }
655
656 if (state->dhnc != NULL) {
657 uint32_t num_blobs_allowed;
658
659 if (state->dhnc->data.length != 16) {
660 return NT_STATUS_INVALID_PARAMETER;
661 }
662
663 /*
664 * According to MS-SMB2: 3.3.5.9.7, "Handling the
665 * SMB2_CREATE_DURABLE_HANDLE_RECONNECT Create Context",
666 * we should ignore an additional dhnq blob, but fail
667 * the request (with status OBJECT_NAME_NOT_FOUND) if
668 * any other extra create blob has been provided.
669 *
670 * (Note that the cases of an additional dh2q or dh2c blob
671 * which require a different error code, have been treated
672 * above.)
673 */
674
675 if (state->dhnq != NULL) {
676 num_blobs_allowed = 2;
677 } else {
678 num_blobs_allowed = 1;
679 }
680
681 if (state->rqls != NULL) {
682 num_blobs_allowed += 1;
683 }
684
685 if (in_context_blobs->num_blobs != num_blobs_allowed) {
686 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
687 }
688 }
689
690 if (state->dh2c!= NULL) {
691 uint32_t num_blobs_allowed;
692
693 if (state->dh2c->data.length != 36) {
694 return NT_STATUS_INVALID_PARAMETER;
695 }
696
697 /*
698 * According to MS-SMB2: 3.3.5.9.12, "Handling the
699 * SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 Create Context",
700 * we should fail the request with status
701 * OBJECT_NAME_NOT_FOUND if any other create blob has been
702 * provided.
703 *
704 * (Note that the cases of an additional dhnq, dhnc or dh2q
705 * blob which require a different error code, have been
706 * treated above.)
707 */
708
709 num_blobs_allowed = 1;
710
711 if (state->rqls != NULL) {
712 num_blobs_allowed += 1;
713 }
714
715 if (in_context_blobs->num_blobs != num_blobs_allowed) {
716 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
717 }
718 }
719
720 state->exta = smb2_create_blob_find(in_context_blobs,
721 SMB2_CREATE_TAG_EXTA);
722 state->mxac = smb2_create_blob_find(in_context_blobs,
723 SMB2_CREATE_TAG_MXAC);
724 state->secd = smb2_create_blob_find(in_context_blobs,
725 SMB2_CREATE_TAG_SECD);
726 state->alsi = smb2_create_blob_find(in_context_blobs,
727 SMB2_CREATE_TAG_ALSI);
728 state->twrp = smb2_create_blob_find(in_context_blobs,
729 SMB2_CREATE_TAG_TWRP);
730 state->qfid = smb2_create_blob_find(in_context_blobs,
731 SMB2_CREATE_TAG_QFID);
732 if (xconn->protocol >= PROTOCOL_SMB3_02) {
733 /*
734 * This was introduced with SMB3_02
735 */
736 state->svhdx = smb2_create_blob_find(
737 in_context_blobs, SVHDX_OPEN_DEVICE_CONTEXT);
738 }
739 if (xconn->smb2.server.posix_extensions_negotiated &&
740 lp_smb3_unix_extensions(SNUM(state->smb1req->conn)))
741 {
742 /*
743 * Negprot only allowed this for proto>=3.11
744 */
745 SMB_ASSERT(xconn->protocol >= PROTOCOL_SMB3_11);
746
747 state->posx = smb2_create_blob_find(
748 in_context_blobs, SMB2_CREATE_TAG_POSIX);
749 /*
750 * Setting the bool below will cause
751 * ucf_flags_from_smb_request() to
752 * return UCF_POSIX_PATHNAMES in ucf_flags.
753 */
754 state->smb1req->posix_pathnames = (state->posx != NULL);
755 }
756
757 return NT_STATUS_OK;
758 }
759
760 static void smbd_smb2_create_before_exec(struct tevent_req *req);
761 static void smbd_smb2_create_after_exec(struct tevent_req *req);
762 static void smbd_smb2_create_finish(struct tevent_req *req);
763
764 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
765 struct tevent_context *ev,
766 struct smbd_smb2_request *smb2req,
767 uint8_t in_oplock_level,
768 uint32_t in_impersonation_level,
769 uint32_t in_desired_access,
770 uint32_t in_file_attributes,
771 uint32_t in_share_access,
772 uint32_t in_create_disposition,
773 uint32_t _in_create_options,
774 const char *in_name,
775 struct smb2_create_blobs in_context_blobs)
776 {
777 struct tevent_req *req = NULL;
778 struct smbd_smb2_create_state *state = NULL;
779 NTSTATUS status;
780 struct smb_request *smb1req = NULL;
781 struct files_struct *dirfsp = NULL;
782 struct smb_filename *smb_fname = NULL;
783 uint32_t ucf_flags;
784 bool is_dfs = false;
785 bool is_posix = false;
786
787 req = tevent_req_create(mem_ctx, &state,
788 struct smbd_smb2_create_state);
789 if (req == NULL) {
790 return NULL;
791 }
792 *state = (struct smbd_smb2_create_state) {
793 .ev = ev,
794 .smb2req = smb2req,
795 .in_oplock_level = in_oplock_level,
796 .in_create_disposition = in_create_disposition,
797 .in_create_options = _in_create_options,
798 };
799
800 smb1req = smbd_smb2_fake_smb_request(smb2req, NULL);
801 if (tevent_req_nomem(smb1req, req)) {
802 return tevent_req_post(req, state->ev);
803 }
804 state->smb1req = smb1req;
805
806 state->req_guid = smbd_request_guid(smb1req, 0);
807
808 tevent_req_set_cleanup_fn(req, smbd_smb2_create_cleanup);
809
810 if (smb2req->subreq == NULL) {
811 DBG_DEBUG("name [%s]\n", in_name);
812 } else {
813 struct smbd_smb2_create_state *old_state = tevent_req_data(
814 smb2req->subreq, struct smbd_smb2_create_state);
815
816 DBG_DEBUG("reentrant for file %s\n", in_name);
817
818 state->id = old_state->id;
819 state->request_time = old_state->request_time;
820 state->open_rec = talloc_move(state, &old_state->open_rec);
821 state->open_was_deferred = old_state->open_was_deferred;
822 state->_purge_create_guid = old_state->_purge_create_guid;
823 state->purge_create_guid = old_state->purge_create_guid;
824 old_state->purge_create_guid = NULL;
825 }
826
827 TALLOC_FREE(smb2req->subreq);
828 smb2req->subreq = req;
829
830 if (lp_fake_oplocks(SNUM(smb2req->tcon->compat))) {
831 state->requested_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
832 } else {
833 state->requested_oplock_level = state->in_oplock_level;
834 }
835
836 /* these are ignored for SMB2 */
837 state->in_create_options &= ~(0x10); /* NTCREATEX_OPTIONS_SYNC_ALERT */
838 state->in_create_options &= ~(0x20); /* NTCREATEX_OPTIONS_ASYNC_ALERT */
839
840 in_file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
841
842 is_dfs = (smb1req->flags2 & FLAGS2_DFS_PATHNAMES);
843 if (is_dfs) {
844 const char *non_dfs_in_name = NULL;
845 /*
846 * With a DFS flag set, remove any DFS prefix
847 * before further processing.
848 */
849 status = smb2_strip_dfs_path(in_name, &non_dfs_in_name);
850 if (!NT_STATUS_IS_OK(status)) {
851 tevent_req_nterror(req, status);
852 return tevent_req_post(req, state->ev);
853 }
854 /*
855 * TODO: Note for dealing with reparse point errors.
856 * We will need to remember and store the number of characters
857 * we have removed here, which is (non_dfs_in_name - in_name)
858 * in order to correctly report how many characters we
859 * have removed before hitting the reparse point.
860 * This will be a patch needed once we properly
861 * deal with reparse points later.
862 */
863 in_name = non_dfs_in_name;
864 /*
865 * Now we're no longer dealing with a DFS path, so
866 * remove the flag.
867 */
868 smb1req->flags2 &= ~FLAGS2_DFS_PATHNAMES;
869 is_dfs = false;
870 }
871
872 state->fname = talloc_strdup(state, in_name);
873 if (tevent_req_nomem(state->fname, req)) {
874 return tevent_req_post(req, state->ev);
875 }
876
877 state->out_context_blobs = talloc_zero(state, struct smb2_create_blobs);
878 if (tevent_req_nomem(state->out_context_blobs, req)) {
879 return tevent_req_post(req, state->ev);
880 }
881
882 status = smbd_smb2_create_fetch_create_ctx(req, &in_context_blobs);
883 if (tevent_req_nterror(req, status)) {
884 return tevent_req_post(req, state->ev);
885 }
886
887 if (IS_IPC(smb1req->conn)) {
888 const char *pipe_name = in_name;
889
890 if (state->dhnc != NULL || state->dh2c != NULL) {
891 /* durable handles are not supported on IPC$ */
892 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
893 return tevent_req_post(req, state->ev);
894 }
895
896 if (!lp_nt_pipe_support()) {
897 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
898 return tevent_req_post(req, state->ev);
899 }
900
901 status = open_np_file(smb1req, pipe_name, &state->result);
902 if (tevent_req_nterror(req, status)) {
903 return tevent_req_post(req, state->ev);
904 }
905 state->info = FILE_WAS_OPENED;
906
907 smbd_smb2_create_finish(req);
908 return req;
909 }
910
911 if (CAN_PRINT(smb1req->conn)) {
912 if (state->dhnc != NULL || state->dh2c != NULL) {
913 /* durable handles are not supported on printers */
914 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
915 return tevent_req_post(req, state->ev);
916 }
917
918 status = file_new(smb1req, smb1req->conn, &state->result);
919 if (tevent_req_nterror(req, status)) {
920 return tevent_req_post(req, state->ev);
921 }
922
923 status = print_spool_open(state->result, in_name,
924 smb1req->vuid);
925 if (tevent_req_nterror(req, status)) {
926 file_free(smb1req, state->result);
927 return tevent_req_post(req, state->ev);
928 }
929 state->info = FILE_WAS_CREATED;
930
931 smbd_smb2_create_finish(req);
932 return req;
933 }
934
935 /* Check for trailing slash specific directory handling. */
936 status = windows_name_trailing_check(state->fname,
937 state->in_create_options);
938 if (tevent_req_nterror(req, status)) {
939 return tevent_req_post(req, state->ev);
940 }
941
942 smbd_smb2_create_before_exec(req);
943 if (!tevent_req_is_in_progress(req)) {
944 return tevent_req_post(req, state->ev);
945 }
946
947 DBG_DEBUG("open execution phase\n");
948
949 /*
950 * For the backend file open procedure, there are
951 * three possible modes: replay operation (in which case
952 * there is nothing else to do), durable_reconnect or
953 * new open.
954 */
955 if (state->replay_operation) {
956 state->result = state->op->compat;
957 state->result->op = state->op;
958 state->update_open = false;
959 state->info = state->op->create_action;
960
961 smbd_smb2_create_after_exec(req);
962 if (!tevent_req_is_in_progress(req)) {
963 return tevent_req_post(req, state->ev);
964 }
965
966 smbd_smb2_create_finish(req);
967 return req;
968 }
969
970 if (state->do_durable_reconnect) {
971 DATA_BLOB new_cookie = data_blob_null;
972 NTTIME now = timeval_to_nttime(&smb2req->request_time);
973
974 status = smb2srv_open_recreate(smb2req->xconn,
975 smb1req->conn->session_info,
976 state->persistent_id,
977 state->create_guid,
978 now,
979 &state->op);
980 if (tevent_req_nterror(req, status)) {
981 DBG_NOTICE("smb2srv_open_recreate failed: %s\n",
982 nt_errstr(status));
983 return tevent_req_post(req, state->ev);
984 }
985
986 DBG_DEBUG("%s to recreate durable handle\n",
987 state->op->global->durable ? "succeeded" : "failed");
988
989 if (!state->op->global->durable) {
990 talloc_free(state->op);
991 tevent_req_nterror(req,
992 NT_STATUS_OBJECT_NAME_NOT_FOUND);
993 return tevent_req_post(req, state->ev);
994 }
995
996 status = SMB_VFS_DURABLE_RECONNECT(smb1req->conn,
997 smb1req,
998 state->op, /* smbXsrv_open input */
999 state->op->global->backend_cookie,
1000 state->op, /* TALLOC_CTX */
1001 &state->result,
1002 &new_cookie);
1003 if (!NT_STATUS_IS_OK(status)) {
1004 NTSTATUS return_status;
1005
1006 return_status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1007
1008 DBG_NOTICE("durable_reconnect failed: %s => %s\n",
1009 nt_errstr(status),
1010 nt_errstr(return_status));
1011
1012 tevent_req_nterror(req, return_status);
1013 return tevent_req_post(req, state->ev);
1014 }
1015
1016 DBG_DEBUG("oplock_type=%u, lease_ptr==%p\n",
1017 (unsigned)state->result->oplock_type, state->lease_ptr);
1018
1019 status = smbd_smb2_create_durable_lease_check(
1020 smb1req, state->fname, state->result, state->lease_ptr);
1021 if (tevent_req_nterror(req, status)) {
1022 close_file_free(
1023 smb1req, &state->result, SHUTDOWN_CLOSE);
1024 return tevent_req_post(req, state->ev);
1025 }
1026
1027 data_blob_free(&state->op->global->backend_cookie);
1028 state->op->global->backend_cookie = new_cookie;
1029
1030 state->op->status = NT_STATUS_OK;
1031 state->op->global->disconnect_time = 0;
1032
1033 /* save the timeout for later update */
1034 state->durable_timeout_msec = state->op->global->durable_timeout_msec;
1035
1036 state->update_open = true;
1037
1038 state->info = FILE_WAS_OPENED;
1039
1040 smbd_smb2_create_after_exec(req);
1041 if (!tevent_req_is_in_progress(req)) {
1042 return tevent_req_post(req, state->ev);
1043 }
1044
1045 smbd_smb2_create_finish(req);
1046 return req;
1047 }
1048
1049 if (state->requested_oplock_level == SMB2_OPLOCK_LEVEL_LEASE) {
1050 if (state->lease_ptr == NULL) {
1051 state->requested_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
1052 }
1053 } else {
1054 state->lease_ptr = NULL;
1055 }
1056
1057 is_posix = (state->posx != NULL);
1058
1059 /* convert '\\' into '/' */
1060 status = check_path_syntax(state->fname, is_posix);
1061 if (tevent_req_nterror(req, status)) {
1062 return tevent_req_post(req, state->ev);
1063 }
1064
1065 ucf_flags = filename_create_ucf_flags(
1066 smb1req, state->in_create_disposition);
1067
1068 status = filename_convert_dirfsp(
1069 req,
1070 smb1req->conn,
1071 state->fname,
1072 ucf_flags,
1073 state->twrp_time,
1074 &dirfsp,
1075 &smb_fname);
1076 if (tevent_req_nterror(req, status)) {
1077 return tevent_req_post(req, state->ev);
1078 }
1079
1080 /*
1081 * MS-SMB2: 2.2.13 SMB2 CREATE Request
1082 * ImpersonationLevel ... MUST contain one of the
1083 * following values. The server MUST validate this
1084 * field, but otherwise ignore it.
1085 *
1086 * NB. The source4/torture/smb2/durable_open.c test
1087 * shows this check is only done on real opens, not
1088 * on durable handle-reopens.
1089 */
1090
1091 if (in_impersonation_level >
1092 SMB2_IMPERSONATION_DELEGATE) {
1093 tevent_req_nterror(req,
1094 NT_STATUS_BAD_IMPERSONATION_LEVEL);
1095 return tevent_req_post(req, state->ev);
1096 }
1097
1098 /*
1099 * We know we're going to do a local open, so now
1100 * we must be protocol strict. JRA.
1101 *
1102 * MS-SMB2: 3.3.5.9 - Receiving an SMB2 CREATE Request
1103 * If the file name length is greater than zero and the
1104 * first character is a path separator character, the
1105 * server MUST fail the request with
1106 * STATUS_INVALID_PARAMETER.
1107 */
1108 if (in_name[0] == '/') {
1109 /* Names starting with '/' are never allowed. */
1110 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1111 return tevent_req_post(req, ev);
1112 }
1113 if (!is_posix && (in_name[0] == '\\')) {
1114 /*
1115 * Windows names starting with '\' are not allowed.
1116 */
1117 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1118 return tevent_req_post(req, ev);
1119 }
1120
1121 status = SMB_VFS_CREATE_FILE(smb1req->conn,
1122 smb1req,
1123 dirfsp,
1124 smb_fname,
1125 in_desired_access,
1126 in_share_access,
1127 state->in_create_disposition,
1128 state->in_create_options,
1129 in_file_attributes,
1130 map_smb2_oplock_levels_to_samba(
1131 state->requested_oplock_level),
1132 state->lease_ptr,
1133 state->allocation_size,
1134 0, /* private_flags */
1135 state->sec_desc,
1136 state->ea_list,
1137 &state->result,
1138 &state->info,
1139 &in_context_blobs,
1140 state->out_context_blobs);
1141 if (NT_STATUS_IS_OK(status) &&
1142 !(state->in_create_options & FILE_OPEN_REPARSE_POINT))
1143 {
1144
1145 mode_t mode = state->result->fsp_name->st.st_ex_mode;
1146
1147 if (!(S_ISREG(mode) || S_ISDIR(mode))) {
1148 /*
1149 * Only open files and dirs without
1150 * FILE_OPEN_REPARSE_POINT
1151 */
1152 close_file_free(smb1req, &state->result, ERROR_CLOSE);
1153 status = NT_STATUS_IO_REPARSE_TAG_NOT_HANDLED;
1154 }
1155 }
1156 if (!NT_STATUS_IS_OK(status)) {
1157 if (open_was_deferred(smb1req->xconn, smb1req->mid)) {
1158 SMBPROFILE_IOBYTES_ASYNC_SET_IDLE(smb2req->profile);
1159 return req;
1160 }
1161 tevent_req_nterror(req, status);
1162 return tevent_req_post(req, state->ev);
1163 }
1164 state->op = state->result->op;
1165
1166 smbd_smb2_create_after_exec(req);
1167 if (!tevent_req_is_in_progress(req)) {
1168 return tevent_req_post(req, state->ev);
1169 }
1170
1171 smbd_smb2_create_finish(req);
1172 return req;
1173 }
1174
1175 static void smbd_smb2_create_purge_replay_cache(struct tevent_req *req,
1176 const char *caller_func)
1177 {
1178 struct smbd_smb2_create_state *state = tevent_req_data(
1179 req, struct smbd_smb2_create_state);
1180 NTSTATUS status;
1181
1182 if (state->purge_create_guid == NULL) {
1183 return;
1184 }
1185
1186 status = smbXsrv_open_purge_replay_cache(state->smb2req->xconn->client,
1187 state->purge_create_guid);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 struct GUID_txt_buf buf;
1190
1191 D_ERR("%s: smbXsrv_open_purge_replay_cache(%s) %s\n",
1192 caller_func,
1193 GUID_buf_string(state->purge_create_guid, &buf),
1194 nt_errstr(status));
1195 }
1196
1197 state->purge_create_guid = NULL;
1198 }
1199
1200 static void smbd_smb2_create_before_exec(struct tevent_req *req)
1201 {
1202 struct smbd_smb2_create_state *state = tevent_req_data(
1203 req, struct smbd_smb2_create_state);
1204 struct smbd_smb2_request *smb2req = state->smb2req;
1205 NTSTATUS status;
1206
1207 if (state->exta != NULL) {
1208 if (!lp_ea_support(SNUM(smb2req->tcon->compat))) {
1209 tevent_req_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1210 return;
1211 }
1212
1213 state->ea_list = read_nttrans_ea_list(
1214 state,
1215 (const char *)state->exta->data.data,
1216 state->exta->data.length);
1217 if (state->ea_list == NULL) {
1218 DEBUG(10,("smbd_smb2_create_send: read_ea_name_list failed.\n"));
1219 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1220 return;
1221 }
1222
1223 if ((state->posx == NULL) &&
1224 ea_list_has_invalid_name(state->ea_list)) {
1225 tevent_req_nterror(req, STATUS_INVALID_EA_NAME);
1226 return;
1227 }
1228 }
1229
1230 if (state->mxac != NULL) {
1231 if (state->mxac->data.length == 0) {
1232 state->max_access_time = 0;
1233 } else if (state->mxac->data.length == 8) {
1234 state->max_access_time = BVAL(state->mxac->data.data, 0);
1235 } else {
1236 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1237 return;
1238 }
1239 }
1240
1241 if (state->secd != NULL) {
1242 enum ndr_err_code ndr_err;
1243
1244 state->sec_desc = talloc_zero(state, struct security_descriptor);
1245 if (tevent_req_nomem(state->sec_desc, req)) {
1246 return;
1247 }
1248
1249 ndr_err = ndr_pull_struct_blob(&state->secd->data,
1250 state->sec_desc, state->sec_desc,
1251 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
1252 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1253 DEBUG(2,("ndr_pull_security_descriptor failed: %s\n",
1254 ndr_errstr(ndr_err)));
1255 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1256 return;
1257 }
1258 }
1259
1260 if (state->dhnq != NULL) {
1261 if (state->dhnq->data.length != 16) {
1262 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1263 return;
1264 }
1265
1266 if (state->dh2q != NULL) {
1267 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1268 return;
1269 }
1270
1271 /*
1272 * durable handle request is processed below.
1273 */
1274 state->durable_requested = true;
1275 /*
1276 * Set the timeout to 16 mins.
1277 *
1278 * TODO: test this against Windows 2012
1279 * as the default for durable v2 is 1 min.
1280 */
1281 state->durable_timeout_msec = (16*60*1000);
1282 }
1283
1284 if (state->dh2q != NULL) {
1285 const uint8_t *p = state->dh2q->data.data;
1286 NTTIME now = timeval_to_nttime(&smb2req->request_time);
1287 uint32_t durable_v2_timeout = 0;
1288 DATA_BLOB create_guid_blob;
1289 const uint8_t *hdr;
1290 uint32_t flags;
1291
1292 if (state->dh2q->data.length != 32) {
1293 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1294 return;
1295 }
1296
1297 if (state->dhnq != NULL) {
1298 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1299 return;
1300 }
1301
1302 durable_v2_timeout = IVAL(p, 0);
1303 create_guid_blob = data_blob_const(p + 16, 16);
1304
1305 status = GUID_from_ndr_blob(&create_guid_blob,
1306 &state->_create_guid);
1307 if (tevent_req_nterror(req, status)) {
1308 return;
1309 }
1310 state->create_guid = &state->_create_guid;
1311
1312 /*
1313 * we need to store the create_guid later
1314 */
1315 state->update_open = true;
1316
1317 /*
1318 * And we need to create a cache for replaying the
1319 * create.
1320 */
1321 state->need_replay_cache = true;
1322
1323 /*
1324 * durable handle v2 request processed below
1325 */
1326 state->durable_requested = true;
1327 state->durable_timeout_msec = MIN(durable_v2_timeout, 300*1000);
1328 if (state->durable_timeout_msec == 0) {
1329 /*
1330 * Set the timeout to 1 min as default.
1331 *
1332 * This matches Windows 2012.
1333 */
1334 state->durable_timeout_msec = (60*1000);
1335 }
1336
1337 /*
1338 * Check for replay operation.
1339 * Only consider it when we have dh2q.
1340 * If we do not have a replay operation, verify that
1341 * the create_guid is not cached for replay.
1342 */
1343 hdr = SMBD_SMB2_IN_HDR_PTR(smb2req);
1344 flags = IVAL(hdr, SMB2_HDR_FLAGS);
1345 state->replay_operation =
1346 flags & SMB2_HDR_FLAG_REPLAY_OPERATION;
1347
1348 status = smb2srv_open_lookup_replay_cache(smb2req->xconn,
1349 state->req_guid,
1350 *state->create_guid,
1351 state->fname,
1352 now,
1353 &state->op);
1354 if (NT_STATUS_EQUAL(status, NT_STATUS_FWP_RESERVED)) {
1355 /*
1356 * We've reserved the replay_cache record
1357 * for ourself, indicating we're still
1358 * in progress.
1359 *
1360 * It means the smbd_smb2_create_cleanup()
1361 * may need to call smbXsrv_open_purge_replay_cache()
1362 * in order to cleanup.
1363 */
1364 SMB_ASSERT(state->op == NULL);
1365 state->_purge_create_guid = state->_create_guid;
1366 state->purge_create_guid = &state->_purge_create_guid;
1367 status = NT_STATUS_OK;
1368 state->replay_operation = false;
1369 } else if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_NOT_AVAILABLE)) {
1370 tevent_req_nterror(req, status);
1371 return;
1372 } else if (tevent_req_nterror(req, status)) {
1373 DBG_WARNING("smb2srv_open_lookup_replay_cache "
1374 "failed: %s\n", nt_errstr(status));
1375 return;
1376 } else if (!state->replay_operation) {
1377 /*
1378 * If a create without replay operation flag
1379 * is sent but with a create_guid that is
1380 * currently in the replay cache -- fail.
1381 */
1382 status = NT_STATUS_DUPLICATE_OBJECTID;
1383 (void)tevent_req_nterror(req, status);
1384 return;
1385 }
1386 }
1387
1388 if (state->dhnc != NULL) {
1389 state->persistent_id = BVAL(state->dhnc->data.data, 0);
1390 state->do_durable_reconnect = true;
1391 }
1392
1393 if (state->dh2c != NULL) {
1394 const uint8_t *p = state->dh2c->data.data;
1395 DATA_BLOB create_guid_blob;
1396
1397 state->persistent_id = BVAL(p, 0);
1398 create_guid_blob = data_blob_const(p + 16, 16);
1399
1400 status = GUID_from_ndr_blob(&create_guid_blob,
1401 &state->_create_guid);
1402 if (tevent_req_nterror(req, status)) {
1403 return;
1404 }
1405
1406 state->create_guid = &state->_create_guid;
1407 state->do_durable_reconnect = true;
1408 }
1409
1410 if (state->alsi != NULL) {
1411 if (state->alsi->data.length != 8) {
1412 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1413 return;
1414 }
1415 state->allocation_size = BVAL(state->alsi->data.data, 0);
1416 }
1417
1418 if (state->twrp != NULL) {
1419 if (state->twrp->data.length != 8) {
1420 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1421 return;
1422 }
1423
1424 state->twrp_time = BVAL(state->twrp->data.data, 0);
1425 }
1426
1427 if (state->qfid != NULL) {
1428 if (state->qfid->data.length != 0) {
1429 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1430 return;
1431 }
1432 }
1433
1434 if (state->rqls != NULL) {
1435 ssize_t lease_len = -1;
1436
1437 lease_len = smb2_lease_pull(state->rqls->data.data,
1438 state->rqls->data.length,
1439 &state->lease);
1440 if (lease_len == -1) {
1441 tevent_req_nterror(
1442 req, NT_STATUS_INVALID_PARAMETER);
1443 return;
1444 }
1445 state->lease_ptr = &state->lease;
1446
1447 if (DEBUGLEVEL >= 10) {
1448 DEBUG(10, ("Got lease request size %d\n",
1449 (int)lease_len));
1450 NDR_PRINT_DEBUG(smb2_lease, state->lease_ptr);
1451 }
1452
1453 if (!smb2_lease_key_valid(&state->lease.lease_key)) {
1454 state->lease_ptr = NULL;
1455 state->requested_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
1456 }
1457
1458 if ((smb2req->xconn->protocol < PROTOCOL_SMB3_00) &&
1459 (state->lease.lease_version != 1))
1460 {
1461 DEBUG(10, ("v2 lease key only for SMB3\n"));
1462 state->lease_ptr = NULL;
1463 }
1464
1465 /*
1466 * Replay with a lease is only allowed if the
1467 * established open carries a lease with the
1468 * same lease key.
1469 */
1470 if (state->replay_operation) {
1471 struct smb2_lease *op_ls =
1472 &state->op->compat->lease->lease;
1473 int op_oplock = state->op->compat->oplock_type;
1474
1475 if (map_samba_oplock_levels_to_smb2(op_oplock)
1476 != SMB2_OPLOCK_LEVEL_LEASE)
1477 {
1478 status = NT_STATUS_ACCESS_DENIED;
1479 (void)tevent_req_nterror(req, status);
1480 return;
1481 }
1482 if (!smb2_lease_key_equal(&state->lease.lease_key,
1483 &op_ls->lease_key))
1484 {
1485 status = NT_STATUS_ACCESS_DENIED;
1486 (void)tevent_req_nterror(req, status);
1487 return;
1488 }
1489 }
1490 }
1491
1492 if (state->posx != NULL) {
1493 if (state->posx->data.length != 4) {
1494 DBG_DEBUG("Got %zu bytes POSX cctx, expected 4\n",
1495 state->posx->data.length);
1496 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1497 return;
1498 }
1499 }
1500 }
1501
1502 static void smbd_smb2_create_after_exec(struct tevent_req *req)
1503 {
1504 struct smbd_smb2_create_state *state = tevent_req_data(
1505 req, struct smbd_smb2_create_state);
1506 connection_struct *conn = state->result->conn;
1507 NTSTATUS status;
1508
1509 /*
1510 * here we have op == result->op
1511 */
1512
1513 DBG_DEBUG("response construction phase\n");
1514
1515 state->out_file_attributes = fdos_mode(state->result);
1516
1517 if (state->mxac != NULL) {
1518 NTTIME last_write_time;
1519
1520 last_write_time = full_timespec_to_nt_time(
1521 &state->result->fsp_name->st.st_ex_mtime);
1522 if (last_write_time != state->max_access_time) {
1523 uint8_t p[8];
1524 uint32_t max_access_granted;
1525 DATA_BLOB blob = data_blob_const(p, sizeof(p));
1526
1527 status = smbd_calculate_access_mask_fsp(
1528 conn->cwd_fsp,
1529 state->result,
1530 false,
1531 SEC_FLAG_MAXIMUM_ALLOWED,
1532 &max_access_granted);
1533
1534 SIVAL(p, 0, NT_STATUS_V(status));
1535 SIVAL(p, 4, max_access_granted);
1536
1537 status = smb2_create_blob_add(
1538 state->out_context_blobs,
1539 state->out_context_blobs,
1540 SMB2_CREATE_TAG_MXAC,
1541 blob);
1542 if (!NT_STATUS_IS_OK(status)) {
1543 goto fail;
1544 }
1545 }
1546 }
1547
1548 if (!state->replay_operation && state->durable_requested &&
1549 (fsp_lease_type(state->result) & SMB2_LEASE_HANDLE))
1550 {
1551 status = SMB_VFS_DURABLE_COOKIE(
1552 state->result,
1553 state->op,
1554 &state->op->global->backend_cookie);
1555 if (!NT_STATUS_IS_OK(status)) {
1556 state->op->global->backend_cookie = data_blob_null;
1557 }
1558 }
1559 if (!state->replay_operation && state->op->global->backend_cookie.length > 0)
1560 {
1561 state->update_open = true;
1562
1563 state->op->global->durable = true;
1564 state->op->global->durable_timeout_msec = state->durable_timeout_msec;
1565 }
1566
1567 if (state->update_open) {
1568 state->op->global->create_guid = state->_create_guid;
1569 if (state->need_replay_cache) {
1570 state->op->flags |= SMBXSRV_OPEN_NEED_REPLAY_CACHE;
1571 }
1572
1573 status = smbXsrv_open_update(state->op);
1574 DEBUG(10, ("smb2_create_send: smbXsrv_open_update "
1575 "returned %s\n",
1576 nt_errstr(status)));
1577 if (!NT_STATUS_IS_OK(status)) {
1578 goto fail;
1579 }
1580
1581 /*
1582 * We should not purge the replay cache anymore
1583 * as it's attached to the smbXsrv_open record now.
1584 */
1585 state->purge_create_guid = NULL;
1586 }
1587
1588 if (state->dhnq != NULL && state->op->global->durable) {
1589 uint8_t p[8] = { 0, };
1590 DATA_BLOB blob = data_blob_const(p, sizeof(p));
1591
1592 status = smb2_create_blob_add(state->out_context_blobs,
1593 state->out_context_blobs,
1594 SMB2_CREATE_TAG_DHNQ,
1595 blob);
1596 if (!NT_STATUS_IS_OK(status)) {
1597 goto fail;
1598 }
1599 }
1600
1601 if (state->dh2q != NULL && state->op->global->durable &&
1602 /*
1603 * For replay operations, we return the dh2q blob
1604 * in the case of oplocks not based on the state of
1605 * the open, but on whether it could have been granted
1606 * for the request data. In the case of leases instead,
1607 * the state of the open is used...
1608 */
1609 (!state->replay_operation ||
1610 state->in_oplock_level == SMB2_OPLOCK_LEVEL_BATCH ||
1611 state->in_oplock_level == SMB2_OPLOCK_LEVEL_LEASE))
1612 {
1613 uint8_t p[8] = { 0, };
1614 DATA_BLOB blob = data_blob_const(p, sizeof(p));
1615 uint32_t durable_v2_response_flags = 0;
1616
1617 SIVAL(p, 0, state->op->global->durable_timeout_msec);
1618 SIVAL(p, 4, durable_v2_response_flags);
1619
1620 status = smb2_create_blob_add(state->out_context_blobs,
1621 state->out_context_blobs,
1622 SMB2_CREATE_TAG_DH2Q,
1623 blob);
1624 if (!NT_STATUS_IS_OK(status)) {
1625 goto fail;
1626 }
1627 }
1628
1629 if (state->qfid != NULL) {
1630 uint8_t p[32];
1631 SMB_STRUCT_STAT *base_sp = state->result->base_fsp ?
1632 &state->result->base_fsp->fsp_name->st :
1633 &state->result->fsp_name->st;
1634 uint64_t file_id = SMB_VFS_FS_FILE_ID(conn, base_sp);
1635 DATA_BLOB blob = data_blob_const(p, sizeof(p));
1636
1637 ZERO_STRUCT(p);
1638
1639 /* From conversations with Microsoft engineers at
1640 the MS plugfest. The first 8 bytes are the "volume index"
1641 == inode, the second 8 bytes are the "volume id",
1642 == dev. This will be updated in the SMB2 doc. */
1643 SBVAL(p, 0, file_id);
1644 SIVAL(p, 8, base_sp->st_ex_dev);/* FileIndexHigh */
1645
1646 status = smb2_create_blob_add(state->out_context_blobs,
1647 state->out_context_blobs,
1648 SMB2_CREATE_TAG_QFID,
1649 blob);
1650 if (!NT_STATUS_IS_OK(status)) {
1651 goto fail;
1652 }
1653 }
1654
1655 if ((state->rqls != NULL) && (state->result->oplock_type == LEASE_OPLOCK)) {
1656 uint8_t buf[52];
1657 struct smb2_lease lease;
1658 size_t lease_len;
1659
1660 lease = state->result->lease->lease;
1661
1662 lease_len = sizeof(buf);
1663 if (lease.lease_version == 1) {
1664 lease_len = 32;
1665 }
1666
1667 if (!smb2_lease_push(&lease, buf, lease_len)) {
1668 status = NT_STATUS_INTERNAL_ERROR;
1669 goto fail;
1670 }
1671
1672 status = smb2_create_blob_add(
1673 state, state->out_context_blobs,
1674 SMB2_CREATE_TAG_RQLS,
1675 data_blob_const(buf, lease_len));
1676 if (!NT_STATUS_IS_OK(status)) {
1677 goto fail;
1678 }
1679 }
1680
1681 if (state->posx != NULL) {
1682 struct stat_ex *psbuf = &state->result->fsp_name->st;
1683 struct smb3_posix_cc_info cc = {
1684 .nlinks = psbuf->st_ex_nlink,
1685 .posix_perms = unix_perms_to_wire(psbuf->st_ex_mode &
1686 ~S_IFMT),
1687 };
1688 uint8_t buf[sizeof(struct smb3_posix_cc_info)];
1689 struct ndr_push ndr = {
1690 .data = buf,
1691 .alloc_size = sizeof(buf),
1692 .fixed_buf_size = true,
1693 };
1694 enum ndr_err_code ndr_err;
1695
1696 uid_to_sid(&cc.owner, psbuf->st_ex_uid);
1697 gid_to_sid(&cc.group, psbuf->st_ex_gid);
1698
1699 ndr_err =
1700 ndr_push_smb3_posix_cc_info(&ndr,
1701 NDR_SCALARS | NDR_BUFFERS,
1702 &cc);
1703 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1704 status = NT_STATUS_INSUFFICIENT_RESOURCES;
1705 goto fail;
1706 }
1707
1708 status = smb2_create_blob_add(state->out_context_blobs,
1709 state->out_context_blobs,
1710 SMB2_CREATE_TAG_POSIX,
1711 (DATA_BLOB){
1712 .data = buf,
1713 .length = ndr.offset,
1714 });
1715 if (!NT_STATUS_IS_OK(status)) {
1716 goto fail;
1717 }
1718 }
1719
1720 return;
1721
1722 fail:
1723 close_file_free(state->smb1req, &state->result, ERROR_CLOSE);
1724 tevent_req_nterror(req, status);
1725 }
1726
1727 static void smbd_smb2_create_finish(struct tevent_req *req)
1728 {
1729 struct smbd_smb2_create_state *state = tevent_req_data(
1730 req, struct smbd_smb2_create_state);
1731 struct smbd_smb2_request *smb2req = state->smb2req;
1732 struct smb_request *smb1req = state->smb1req;
1733 files_struct *result = state->result;
1734
1735 smb2req->compat_chain_fsp = smb1req->chain_fsp;
1736
1737 if (state->replay_operation) {
1738 state->out_oplock_level = state->in_oplock_level;
1739 } else if (lp_fake_oplocks(SNUM(smb2req->tcon->compat))) {
1740 state->out_oplock_level = state->in_oplock_level;
1741 } else {
1742 state->out_oplock_level = map_samba_oplock_levels_to_smb2(result->oplock_type);
1743 }
1744
1745 if ((state->in_create_disposition == FILE_SUPERSEDE)
1746 && (state->info == FILE_WAS_OVERWRITTEN)) {
1747 state->out_create_action = FILE_WAS_SUPERSEDED;
1748 } else {
1749 state->out_create_action = state->info;
1750 }
1751 result->op->create_action = state->out_create_action;
1752
1753 state->out_creation_ts = get_create_timespec(smb1req->conn,
1754 result, result->fsp_name);
1755 state->out_last_access_ts = result->fsp_name->st.st_ex_atime;
1756 state->out_last_write_ts = result->fsp_name->st.st_ex_mtime;
1757 state->out_change_ts = get_change_timespec(smb1req->conn,
1758 result, result->fsp_name);
1759
1760 if (lp_dos_filetime_resolution(SNUM(smb2req->tcon->compat))) {
1761 dos_filetime_timespec(&state->out_creation_ts);
1762 dos_filetime_timespec(&state->out_last_access_ts);
1763 dos_filetime_timespec(&state->out_last_write_ts);
1764 dos_filetime_timespec(&state->out_change_ts);
1765 }
1766
1767 state->out_allocation_size =
1768 SMB_VFS_GET_ALLOC_SIZE(smb1req->conn, result,
1769 &(result->fsp_name->st));
1770 state->out_end_of_file = result->fsp_name->st.st_ex_size;
1771 if (state->out_file_attributes == 0) {
1772 state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
1773 }
1774 state->out_file_id_persistent = result->op->global->open_persistent_id;
1775 state->out_file_id_volatile = result->op->global->open_volatile_id;
1776
1777 DBG_DEBUG("%s - %s\n", fsp_str_dbg(result), fsp_fnum_dbg(result));
1778
1779 tevent_req_done(req);
1780 tevent_req_post(req, state->ev);
1781 }
1782
1783 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
1784 TALLOC_CTX *mem_ctx,
1785 uint8_t *out_oplock_level,
1786 uint32_t *out_create_action,
1787 struct timespec *out_creation_ts,
1788 struct timespec *out_last_access_ts,
1789 struct timespec *out_last_write_ts,
1790 struct timespec *out_change_ts,
1791 uint64_t *out_allocation_size,
1792 uint64_t *out_end_of_file,
1793 uint32_t *out_file_attributes,
1794 uint64_t *out_file_id_persistent,
1795 uint64_t *out_file_id_volatile,
1796 struct smb2_create_blobs *out_context_blobs)
1797 {
1798 NTSTATUS status;
1799 struct smbd_smb2_create_state *state = tevent_req_data(req,
1800 struct smbd_smb2_create_state);
1801
1802 if (tevent_req_is_nterror(req, &status)) {
1803 tevent_req_received(req);
1804 return status;
1805 }
1806
1807 *out_oplock_level = state->out_oplock_level;
1808 *out_create_action = state->out_create_action;
1809 *out_creation_ts = state->out_creation_ts;
1810 *out_last_access_ts = state->out_last_access_ts;
1811 *out_last_write_ts = state->out_last_write_ts;
1812 *out_change_ts = state->out_change_ts;
1813 *out_allocation_size = state->out_allocation_size;
1814 *out_end_of_file = state->out_end_of_file;
1815 *out_file_attributes = state->out_file_attributes;
1816 *out_file_id_persistent = state->out_file_id_persistent;
1817 *out_file_id_volatile = state->out_file_id_volatile;
1818 *out_context_blobs = *(state->out_context_blobs);
1819
1820 talloc_steal(mem_ctx, state->out_context_blobs->blobs);
1821
1822 tevent_req_received(req);
1823 return NT_STATUS_OK;
1824 }
1825
1826 /*********************************************************
1827 Code for dealing with deferred opens.
1828 *********************************************************/
1829
1830 bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
1831 struct timeval *p_request_time,
1832 struct deferred_open_record **open_rec)
1833 {
1834 struct smbd_smb2_create_state *state = NULL;
1835 struct tevent_req *req = NULL;
1836
1837 if (!smb2req) {
1838 return false;
1839 }
1840 req = smb2req->subreq;
1841 if (!req) {
1842 return false;
1843 }
1844 state = tevent_req_data(req, struct smbd_smb2_create_state);
1845 if (!state) {
1846 return false;
1847 }
1848 if (!state->open_was_deferred) {
1849 return false;
1850 }
1851 if (p_request_time) {
1852 *p_request_time = state->request_time;
1853 }
1854 if (open_rec != NULL) {
1855 *open_rec = state->open_rec;
1856 }
1857 return true;
1858 }
1859
1860 /*********************************************************
1861 Re-process this call early - requested by message or
1862 close.
1863 *********************************************************/
1864
1865 static struct smbd_smb2_request *find_open_smb2req(
1866 struct smbXsrv_connection *xconn, uint64_t mid)
1867 {
1868 struct smbd_smb2_request *smb2req;
1869
1870 for (smb2req = xconn->smb2.requests; smb2req; smb2req = smb2req->next) {
1871 uint64_t message_id;
1872 if (smb2req->subreq == NULL) {
1873 /* This message has been processed. */
1874 continue;
1875 }
1876 if (!tevent_req_is_in_progress(smb2req->subreq)) {
1877 /* This message has been processed. */
1878 continue;
1879 }
1880 message_id = get_mid_from_smb2req(smb2req);
1881 if (message_id == mid) {
1882 return smb2req;
1883 }
1884 }
1885 return NULL;
1886 }
1887
1888 bool open_was_deferred_smb2(struct smbXsrv_connection *xconn, uint64_t mid)
1889 {
1890 struct smbd_smb2_create_state *state = NULL;
1891 struct smbd_smb2_request *smb2req;
1892
1893 smb2req = find_open_smb2req(xconn, mid);
1894
1895 if (!smb2req) {
1896 DEBUG(10,("open_was_deferred_smb2: mid %llu smb2req == NULL\n",
1897 (unsigned long long)mid));
1898 return false;
1899 }
1900 if (!smb2req->subreq) {
1901 return false;
1902 }
1903 if (!tevent_req_is_in_progress(smb2req->subreq)) {
1904 return false;
1905 }
1906 state = tevent_req_data(smb2req->subreq,
1907 struct smbd_smb2_create_state);
1908 if (!state) {
1909 return false;
1910 }
1911 /* It's not in progress if there's no timeout event. */
1912 if (!state->open_was_deferred) {
1913 return false;
1914 }
1915
1916 DEBUG(10,("open_was_deferred_smb2: mid = %llu\n",
1917 (unsigned long long)mid));
1918
1919 return true;
1920 }
1921
1922 static void remove_deferred_open_message_smb2_internal(struct smbd_smb2_request *smb2req,
1923 uint64_t mid)
1924 {
1925 struct smbd_smb2_create_state *state = NULL;
1926
1927 if (!smb2req->subreq) {
1928 return;
1929 }
1930 if (!tevent_req_is_in_progress(smb2req->subreq)) {
1931 return;
1932 }
1933 state = tevent_req_data(smb2req->subreq,
1934 struct smbd_smb2_create_state);
1935 if (!state) {
1936 return;
1937 }
1938
1939 DEBUG(10,("remove_deferred_open_message_smb2_internal: "
1940 "mid %llu\n",
1941 (unsigned long long)mid ));
1942
1943 state->open_was_deferred = false;
1944 /* Ensure we don't have any outstanding immediate event. */
1945 TALLOC_FREE(state->im);
1946 TALLOC_FREE(state->open_rec);
1947 }
1948
1949 void remove_deferred_open_message_smb2(
1950 struct smbXsrv_connection *xconn, uint64_t mid)
1951 {
1952 struct smbd_smb2_request *smb2req;
1953
1954 smb2req = find_open_smb2req(xconn, mid);
1955
1956 if (!smb2req) {
1957 DEBUG(10,("remove_deferred_open_message_smb2: "
1958 "can't find mid %llu\n",
1959 (unsigned long long)mid ));
1960 return;
1961 }
1962 remove_deferred_open_message_smb2_internal(smb2req, mid);
1963 }
1964
1965 static void smbd_smb2_create_request_dispatch_immediate(struct tevent_context *ctx,
1966 struct tevent_immediate *im,
1967 void *private_data)
1968 {
1969 struct smbd_smb2_request *smb2req = talloc_get_type_abort(private_data,
1970 struct smbd_smb2_request);
1971 uint64_t mid = get_mid_from_smb2req(smb2req);
1972 NTSTATUS status;
1973
1974 DEBUG(10,("smbd_smb2_create_request_dispatch_immediate: "
1975 "re-dispatching mid %llu\n",
1976 (unsigned long long)mid ));
1977
1978 status = smbd_smb2_request_dispatch(smb2req);
1979 if (!NT_STATUS_IS_OK(status)) {
1980 smbd_server_connection_terminate(smb2req->xconn,
1981 nt_errstr(status));
1982 return;
1983 }
1984 }
1985
1986 bool schedule_deferred_open_message_smb2(
1987 struct smbXsrv_connection *xconn, uint64_t mid)
1988 {
1989 struct smbd_smb2_create_state *state = NULL;
1990 struct smbd_smb2_request *smb2req;
1991
1992 smb2req = find_open_smb2req(xconn, mid);
1993
1994 if (!smb2req) {
1995 DEBUG(10,("schedule_deferred_open_message_smb2: "
1996 "can't find mid %llu\n",
1997 (unsigned long long)mid ));
1998 return false;
1999 }
2000 if (!smb2req->subreq) {
2001 return false;
2002 }
2003 if (!tevent_req_is_in_progress(smb2req->subreq)) {
2004 return false;
2005 }
2006 state = tevent_req_data(smb2req->subreq,
2007 struct smbd_smb2_create_state);
2008 if (!state) {
2009 return false;
2010 }
2011
2012 /* Ensure we don't have any outstanding immediate event. */
2013 TALLOC_FREE(state->im);
2014
2015 /*
2016 * This is subtle. We must null out the callback
2017 * before rescheduling, else the first call to
2018 * tevent_req_nterror() causes the _receive()
2019 * function to be called, this causing tevent_req_post()
2020 * to crash.
2021 */
2022 tevent_req_set_callback(smb2req->subreq, NULL, NULL);
2023
2024 state->im = tevent_create_immediate(smb2req);
2025 if (!state->im) {
2026 smbd_server_connection_terminate(smb2req->xconn,
2027 nt_errstr(NT_STATUS_NO_MEMORY));
2028 return false;
2029 }
2030
2031 DEBUG(10,("schedule_deferred_open_message_smb2: "
2032 "re-processing mid %llu\n",
2033 (unsigned long long)mid ));
2034
2035 tevent_schedule_immediate(state->im,
2036 smb2req->sconn->ev_ctx,
2037 smbd_smb2_create_request_dispatch_immediate,
2038 smb2req);
2039
2040 return true;
2041 }
2042
2043 static bool smbd_smb2_create_cancel(struct tevent_req *req)
2044 {
2045 struct smbd_smb2_request *smb2req = NULL;
2046 struct smbd_smb2_create_state *state = tevent_req_data(req,
2047 struct smbd_smb2_create_state);
2048 uint64_t mid;
2049
2050 if (!state) {
2051 return false;
2052 }
2053
2054 if (!state->smb2req) {
2055 return false;
2056 }
2057
2058 smb2req = state->smb2req;
2059 mid = get_mid_from_smb2req(smb2req);
2060
2061 if (is_deferred_open_async(state->open_rec)) {
2062 /* Can't cancel an async create. */
2063 return false;
2064 }
2065
2066 remove_deferred_open_message_smb2_internal(smb2req, mid);
2067
2068 tevent_req_defer_callback(req, smb2req->sconn->ev_ctx);
2069 tevent_req_nterror(req, NT_STATUS_CANCELLED);
2070 return true;
2071 }
2072
2073 bool push_deferred_open_message_smb2(struct smbd_smb2_request *smb2req,
2074 struct timeval request_time,
2075 struct timeval timeout,
2076 struct file_id id,
2077 struct deferred_open_record *open_rec)
2078 {
2079 struct tevent_req *req = NULL;
2080 struct smbd_smb2_create_state *state = NULL;
2081 struct timeval end_time;
2082
2083 if (!smb2req) {
2084 return false;
2085 }
2086 req = smb2req->subreq;
2087 if (!req) {
2088 return false;
2089 }
2090 state = tevent_req_data(req, struct smbd_smb2_create_state);
2091 if (!state) {
2092 return false;
2093 }
2094 state->id = id;
2095 state->request_time = request_time;
2096 state->open_rec = talloc_move(state, &open_rec);
2097
2098 /* Re-schedule us to retry on timer expiry. */
2099 end_time = timeval_sum(&request_time, &timeout);
2100
2101 DEBUG(10,("push_deferred_open_message_smb2: "
2102 "timeout at %s\n",
2103 timeval_string(talloc_tos(),
2104 &end_time,
2105 true) ));
2106
2107 state->open_was_deferred = true;
2108
2109 /* allow this request to be canceled */
2110 tevent_req_set_cancel_fn(req, smbd_smb2_create_cancel);
2111
2112 return true;
2113 }
Samba GIT mirror