| blob | 00ac4de617a0795d0ad36707339626cd08e366e4 |
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
53 /****************************************************************************
54 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
55 path or anything including wildcards.
56 We're assuming here that '/' is not the second byte in any multibyte char
57 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
58 set.
59 ****************************************************************************/
61 /* Custom version for processing POSIX paths. */
66 {
83 }
86 }
88 }
89 }
94 }
95 /* Stream names allow more characters than file names.
96 We're overloading posix_path here to allow a wider
97 range of characters. If stream_started is true this
98 is still a Windows path even if posix_path is true.
99 JRA.
100 */
107 }
108 }
111 /*
112 * Safe to assume is not the second part of a mb char
113 * as this is handled below.
114 */
115 /* Eat multiple '/' or '\\' */
117 s++;
118 }
120 /* We only care about non-leading or trailing '/' or '\\' */
122 }
125 /* New component. */
128 }
132 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
134 /*
135 * No mb char starts with '.' so we're safe checking the directory separator here.
136 */
138 /* If we just added a '/' - delete it */
141 d--;
142 }
144 /* Are we at the start ? Can't go back further if so. */
148 }
149 /* Go back one level... */
150 /* We know this is safe as '/' cannot be part of a mb sequence. */
151 /* NOTE - if this assumption is invalid we are not in good shape... */
152 /* Decrement d first as d points to the *next* char to write into. */
156 }
158 /* We're still at the start of a name component, just the previous one. */
163 /* Eat the '.' */
164 s++;
166 }
167 }
169 }
175 }
186 }
187 }
191 /* Get the size of the next MB character. */
196 FALL_THROUGH;
199 FALL_THROUGH;
202 FALL_THROUGH;
205 FALL_THROUGH;
213 }
214 }
216 }
221 }
223 /****************************************************************************
224 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
225 No wildcards allowed.
226 ****************************************************************************/
229 {
231 }
233 /****************************************************************************
234 Check the path for a POSIX client.
235 We're assuming here that '/' is not the second byte in any multibyte char
236 set (a safe assumption).
237 ****************************************************************************/
240 {
242 }
244 /****************************************************************************
245 Pull a string and check the path allowing a wildcard - provide for error return.
246 Passes in posix flag.
247 ****************************************************************************/
258 {
269 }
272 /*
273 * For a DFS path the function parse_dfs_path()
274 * will do the path processing, just make a copy.
275 */
278 }
284 }
287 }
289 /****************************************************************************
290 Pull a string and check the path - provide for error return.
291 ****************************************************************************/
301 {
303 base_ptr,
304 smb_flags2,
305 pp_dest,
306 src,
307 src_len,
308 flags,
310 err);
311 }
313 /****************************************************************************
314 Pull a string and check the path - provide for error return.
315 posix_pathnames version.
316 ****************************************************************************/
326 {
328 base_ptr,
329 smb_flags2,
330 pp_dest,
331 src,
332 src_len,
333 flags,
335 err);
336 }
342 {
348 }
354 pp_dest,
355 src,
356 bufrem,
357 flags,
359 err);
364 pp_dest,
365 src,
366 bufrem,
367 flags,
369 err);
370 }
371 }
373 /**
374 * pull a string from the smb_buf part of a packet. In this case the
375 * string can either be null terminated or it can be terminated by the
376 * end of the smbbuf area
377 */
380 {
385 }
389 }
391 /****************************************************************************
392 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
393 ****************************************************************************/
397 {
401 }
405 }
407 }
409 /****************************************************************************
410 Check if we have a correct fsp pointing to a file.
411 ****************************************************************************/
415 {
418 }
422 }
426 }
429 }
431 /****************************************************************************
432 Check if we have a correct fsp pointing to a quota fake file. Replacement for
433 the CHECK_NTQUOTA_HANDLE_OK macro.
434 ****************************************************************************/
438 {
441 }
445 }
449 }
453 }
457 }
460 }
462 /****************************************************************************
463 Return the port number we've bound to on a socket.
464 ****************************************************************************/
467 {
470 };
474 }
481 }
483 #if defined(HAVE_IPV6)
486 }
487 #endif
490 }
492 }
496 {
511 }
516 }
520 name_type);
523 }
530 }
533 }
538 }
546 }
553 }
554 }
560 }
565 }
575 NULL)) {
578 }
581 fail:
584 }
587 {
591 }
593 /****************************************************************************
594 Reply to a (netbios-level) special message.
595 ****************************************************************************/
598 {
602 /*
603 * We only really use 4 bytes of the outbuf, but for the smb_setlen
604 * calculation & friends (srv_send_smb uses that) we need the full smb
605 * header.
606 */
615 {
616 /* inbuf_size is guarenteed to be at least 4. */
625 }
630 /* inbuf_size is guaranteed to be at least 4. */
636 }
642 }
653 }
660 }
662 /*
663 * Windows NT/2k uses "*SMBSERVER" and XP uses
664 * "*SMBSERV" arrggg!!!
665 */
674 }
677 }
691 }
693 }
697 name_type2));
700 /* We are being asked for a pathworks session ---
701 no thanks! */
704 }
711 }
714 (some old clients produce this?) */
728 }
735 }
739 }
741 }
743 /****************************************************************************
744 Reply to a tcon.
745 conn POINTER CAN BE NULL HERE !
746 ****************************************************************************/
749 {
756 NTSTATUS nt_status;
769 }
783 }
789 }
799 }
811 }
813 /****************************************************************************
814 Reply to a tcon and X.
815 conn POINTER CAN BE NULL HERE !
816 ****************************************************************************/
819 {
825 /* what the client thinks the device is */
827 /* what the server tells the client the share represents */
829 NTSTATUS nt_status;
847 }
852 /* we might have to close an old one */
855 NTSTATUS status;
861 /*
862 * TODO: cancel all outstanding requests on the tcon
863 */
869 /*
870 * If we hit this case, there is something completely
871 * wrong, so we better disconnect the transport connection.
872 */
876 }
879 /*
880 * This tree id is gone. Make sure we can't re-use it
881 * by accident.
882 */
884 }
890 }
896 }
904 }
906 /*
907 * the service name can be either: \\server\share
908 * or share directly like on the DELL PowerVault 705
909 */
916 }
920 }
930 }
940 }
945 }
950 }
956 }
958 /*
959 * If there is no application key defined yet
960 * we create one.
961 *
962 * This means we setup the application key on the
963 * first tcon that happens via the given session.
964 *
965 * Once the application key is defined, it does not
966 * change any more.
967 */
970 {
980 /*
981 * The application key is truncated/padded to 16 bytes
982 */
984 session_key,
991 }
994 NTSTATUS status;
1004 }
1006 }
1008 /*
1009 * Place the application key into the session_info
1010 */
1019 }
1021 }
1034 }
1038 }
1044 else
1054 }
1056 /* NT sets the fstype of IPC$ to the null string */
1060 /* Return permissions. */
1071 }
1077 }
1086 }
1088 /* what does setting this bit do? It is set by NT4 and
1089 may affect the ability to autorun mounted cdroms */
1091 optional_support |=
1098 }
1101 }
1107 service));
1109 /* set the incoming and outgoing tid to the just created one */
1116 }
1118 /****************************************************************************
1119 Reply to an unknown type.
1120 ****************************************************************************/
1123 {
1128 }
1130 /****************************************************************************
1131 Reply to an ioctl.
1132 conn POINTER CAN BE NULL HERE !
1133 ****************************************************************************/
1136 {
1152 }
1168 }
1180 {
1181 NTSTATUS status;
1189 }
1190 /* Job number */
1200 }
1205 lp_sub,
1212 }
1215 }
1217 }
1218 }
1222 }
1224 /****************************************************************************
1225 Strange checkpath NTSTATUS mapping.
1226 ****************************************************************************/
1229 {
1230 /* Strange DOS error code semantics only for checkpath... */
1233 /* We need to map to ERRbadpath */
1235 }
1236 }
1238 }
1240 /****************************************************************************
1241 Reply to a checkpath.
1242 ****************************************************************************/
1245 {
1249 NTSTATUS status;
1263 }
1268 conn,
1269 name,
1270 ucf_flags,
1280 }
1282 }
1290 }
1296 }
1300 path_err:
1301 /* We special case this - as when a Windows machine
1302 is parsing a path is steps through the components
1303 one at a time - if a component fails it expects
1304 ERRbadpath, not ERRbadfile.
1305 */
1308 /*
1309 * Windows returns different error codes if
1310 * the parent directory is valid but not the
1311 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1312 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1313 * if the path is invalid.
1314 */
1318 }
1322 out:
1326 }
1328 /****************************************************************************
1329 Reply to a getatr.
1330 ****************************************************************************/
1333 {
1341 NTSTATUS status;
1352 }
1354 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1355 under WfWg - weird! */
1360 }
1366 conn,
1367 fname,
1368 ucf_flags,
1376 }
1379 }
1387 }
1401 }
1402 }
1407 }
1408 }
1417 }
1423 }
1428 out:
1433 }
1435 /****************************************************************************
1436 Reply to a setatr.
1437 ****************************************************************************/
1440 {
1448 NTSTATUS status;
1458 }
1465 }
1468 conn,
1469 fname,
1470 ucf_flags,
1478 }
1481 }
1484 /*
1485 * Not sure here is the right place to catch this
1486 * condition. Might be moved to somewhere else later -- vl
1487 */
1490 }
1498 else
1503 smb_fname,
1505 FILE_WRITE_ATTRIBUTES);
1509 }
1515 }
1516 }
1524 }
1529 mode));
1530 out:
1534 }
1536 /****************************************************************************
1537 Reply to a dskattr.
1538 ****************************************************************************/
1541 {
1556 }
1563 }
1565 /*
1566 * Force max to fit in 16 bit fields.
1567 */
1579 }
1580 }
1586 /* we need to scale this to a number that DOS6 can handle. We
1587 use floating point so we can handle large drives on systems
1588 that don't have 64 bit integers
1590 we end up displaying a maximum of 2G to DOS systems
1591 */
1610 }
1616 }
1618 /*
1619 * Utility function to split the filename from the directory.
1620 */
1624 {
1637 }
1643 }
1648 }
1650 /****************************************************************************
1651 Make a dir struct.
1652 ****************************************************************************/
1658 off_t size,
1662 {
1668 }
1672 }
1682 }
1689 /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1690 Strange, but verified on W2K3. Needed for OS/2. JRA. */
1694 }
1696 /****************************************************************************
1697 Reply to a search.
1698 Can be called from SMBsearch, SMBffirst or SMBfunique.
1699 ****************************************************************************/
1702 {
1709 off_t size;
1722 NTSTATUS nt_status;
1738 }
1743 }
1745 /* If we were called as SMBffirst then we must expect close. */
1748 }
1759 }
1764 }
1766 p++;
1770 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1778 path,
1779 ucf_flags,
1787 }
1790 }
1802 }
1807 }
1813 directory,
1814 NULL,
1815 NULL,
1821 }
1823 /*
1824 * As we've cut off the last component from
1825 * smb_fname we need to re-stat smb_dname
1826 * so FILE_OPEN disposition knows the directory
1827 * exists.
1828 */
1834 }
1839 }
1843 }
1845 /*
1846 * Open an fsp on this directory for the dptr.
1847 */
1853 FILE_SHARE_READ|
1874 }
1879 True,
1880 expect_close,
1882 mask,
1883 dirtype,
1889 /*
1890 * Use NULL here for the first parameter (req)
1891 * as this is not a client visible handle so
1892 * can'tbe part of an SMB1 chain.
1893 */
1898 }
1909 }
1915 }
1920 }
1926 }
1931 }
1933 }
1946 }
1952 }
1958 }
1970 }
1975 mask,
1976 dirtype,
1981 check_descend,
1982 ask_sharemode);
1987 buf,
1988 mask,
1989 fname,
1990 size,
1991 mode,
1996 }
1999 }
2005 }
2006 numentries++;
2007 }
2008 }
2009 }
2011 SearchEmpty:
2013 /* If we were called as SMBffirst with smb_search_id == NULL
2014 and no entries were found then return error and close fsp->dptr
2015 (X/Open spec) */
2022 }
2024 /* Close the dptr - we know it's gone */
2029 }
2030 }
2032 /* If we were called as SMBfunique, then we can close the fsp->dptr now ! */
2035 /* fsp may have been closed above. */
2039 }
2040 }
2045 }
2052 /* The replies here are never long name. */
2059 }
2061 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
2067 mask,
2068 directory,
2069 dirtype,
2070 numentries,
2071 maxentries ));
2072 out:
2078 }
2080 /****************************************************************************
2081 Reply to a fclose (stop directory search).
2082 ****************************************************************************/
2085 {
2091 NTSTATUS err;
2102 }
2111 }
2117 }
2119 p++;
2127 }
2133 }
2139 /* Close the file - we know it's gone */
2143 }
2152 }
2154 /****************************************************************************
2155 Reply to an open.
2156 ****************************************************************************/
2159 {
2176 NTSTATUS status;
2185 }
2196 }
2204 }
2209 conn,
2210 fname,
2211 ucf_flags,
2217 NT_STATUS_PATH_NOT_COVERED,
2220 }
2223 }
2237 private_flags,
2246 /* We have re-scheduled this call. */
2248 }
2253 }
2256 req,
2257 smb_fname,
2258 access_mask,
2259 create_options,
2260 private_flags);
2265 }
2268 }
2269 }
2271 /* Ensure we're pointing at the correct stat struct. */
2287 }
2296 }
2303 }
2308 }
2309 out:
2312 }
2314 /****************************************************************************
2315 Reply to an open and X.
2316 ****************************************************************************/
2319 {
2326 /* Breakout the oplock request bits so we can set the
2327 reply bits separately. */
2331 #if 0
2334 #endif
2340 NTSTATUS status;
2356 }
2367 /* If it's an IPC, pass off the pipe handler. */
2373 }
2375 }
2377 /* XXXX we need to handle passed times, sattr and flags */
2383 }
2386 smb_ofun,
2393 }
2398 conn,
2399 fname,
2400 ucf_flags,
2406 NT_STATUS_PATH_NOT_COVERED,
2409 }
2412 }
2426 private_flags,
2435 /* We have re-scheduled this call. */
2437 }
2442 }
2445 req,
2446 smb_fname,
2447 access_mask,
2448 create_options,
2449 private_flags);
2454 }
2457 }
2461 }
2463 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2464 if the file is truncated or created. */
2465 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2471 }
2477 }
2483 }
2484 }
2491 }
2494 /* If the caller set the extended oplock request bit
2495 and we granted one (by whatever means) - set the
2496 correct bit for extended oplock reply.
2497 */
2501 }
2505 }
2507 /* If the caller set the core oplock request bit
2508 and we granted one (by whatever means) - set the
2509 correct bit for core oplock reply.
2510 */
2516 }
2524 }
2529 }
2537 }
2544 }
2546 out:
2550 }
2552 /****************************************************************************
2553 Reply to a SMBulogoffX.
2554 ****************************************************************************/
2561 {
2565 NTSTATUS status;
2567 /*
2568 * Don't setup the profile charge here, take
2569 * it in reply_ulogoffX_done(). Not strictly correct
2570 * but better than the other SMB1 async
2571 * code that double-charges at the moment.
2572 */
2579 /* Not going async, profile here. */
2588 }
2592 /* Not going async, profile here. */
2597 }
2599 /* We're async. This will complete later. */
2602 }
2607 };
2611 /****************************************************************************
2612 Async SMB1 ulogoffX.
2613 Note, on failure here we deallocate and return NULL to allow the caller to
2614 SMB1 return an error of ERRnomem immediately.
2615 ****************************************************************************/
2619 {
2631 }
2637 }
2640 /*
2641 * Make sure that no new request will be able to use this session.
2642 * This ensures that once all outstanding fsp->aio_requests
2643 * on this session are done, we are safe to close it.
2644 */
2650 }
2651 /*
2652 * Flag the file as close in progress.
2653 * This will prevent any more IO being
2654 * done on it.
2655 */
2659 /*
2660 * Now wait until all aio requests on this fsp are
2661 * finished.
2662 *
2663 * We don't set a callback, as we just want to block the
2664 * wait queue and the talloc_free() of fsp->aio_request
2665 * will remove the item from the wait queue.
2666 */
2673 }
2674 }
2675 }
2677 /*
2678 * Now we add our own waiter to the end of the queue,
2679 * this way we get notified when all pending requests are finished
2680 * and reply to the outstanding SMB1 request.
2681 */
2688 }
2690 /*
2691 * We're really going async - move the SMB1 request from
2692 * a talloc stackframe above us to the sconn talloc-context.
2693 * We need this to stick around until the wait_done
2694 * callback is invoked.
2695 */
2701 }
2704 {
2711 }
2714 {
2716 }
2719 {
2725 NTSTATUS status;
2727 /*
2728 * Take the profile charge here. Not strictly
2729 * correct but better than the other SMB1 async
2730 * code that double-charges at the moment.
2731 */
2741 }
2749 }
2761 /*
2762 * The following call is needed to push the
2763 * reply data back out the socket after async
2764 * return. Plus it frees smb1req.
2765 */
2768 }
2770 /****************************************************************************
2771 Reply to a mknew or a create.
2772 ****************************************************************************/
2775 {
2783 NTSTATUS status;
2797 }
2803 /* We should fail if file exists. */
2806 /* Create if file doesn't exist, truncate if it does. */
2808 }
2810 /* mtime. */
2818 }
2822 conn,
2823 fname,
2824 ucf_flags,
2830 NT_STATUS_PATH_NOT_COVERED,
2833 }
2836 }
2842 }
2865 /* We have re-scheduled this call. */
2867 }
2872 }
2873 }
2876 }
2883 }
2891 }
2896 }
2903 out:
2907 }
2909 /****************************************************************************
2910 Reply to a create temporary file.
2911 ****************************************************************************/
2914 {
2923 NTSTATUS status;
2933 }
2943 }
2949 wire_name,
2955 }
2960 }
2964 fname,
2965 ucf_flags,
2973 }
2976 }
2978 /* Create the file. */
3002 }
3006 /* We have re-scheduled this call. */
3008 }
3014 }
3015 }
3018 }
3021 }
3024 /* Collision after 10 times... */
3027 }
3032 /* the returned filename is relative to the directory */
3037 s++;
3038 }
3040 #if 0
3041 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
3042 thing in the byte section. JRA */
3044 #endif
3049 }
3054 }
3059 }
3064 out:
3069 }
3071 /*******************************************************************
3072 Check if a user is allowed to rename a file.
3073 ********************************************************************/
3077 {
3080 }
3084 /* Only bother to read the DOS attribute if we might deny the
3085 rename on the grounds of attribute mismatch. */
3089 }
3090 }
3095 }
3097 /* If no pathnames are open below this
3098 directory, allow the rename. */
3101 /*
3102 * Strict rename, check open file db.
3103 */
3106 }
3108 /*
3109 * No strict rename, just look in local process.
3110 */
3112 }
3114 }
3118 }
3121 }
3123 /*******************************************************************
3124 * unlink a file with all relevant access checks
3125 *******************************************************************/
3131 {
3135 NTSTATUS status;
3141 dirtype));
3145 }
3150 }
3156 }
3158 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
3161 }
3166 }
3168 }
3171 /* These will never be set for POSIX. */
3173 }
3175 #if 0
3178 }
3182 }
3185 /* These will never be set for POSIX. */
3187 }
3192 }
3194 /* Can't delete a directory. */
3197 }
3198 #endif
3212 }
3213 }
3215 /* On open checks the open itself will check the share mode, so
3216 don't do it here as we'll get it wrong. */
3218 status = SMB_VFS_CREATE_FILE
3244 }
3254 }
3256 /* The set is across all open files on this dev/inode pair. */
3262 }
3265 }
3267 /****************************************************************************
3268 The guts of the unlink command, split out so it may be called by the NT SMB
3269 code.
3270 ****************************************************************************/
3277 {
3285 /* Split up the directory from the filename/mask. */
3290 }
3292 /*
3293 * We should only check the mangled cache
3294 * here if unix_convert failed. This means
3295 * that the path in 'mask' doesn't exist
3296 * on the file system and so we need to look
3297 * for a possible mangle. This patch from
3298 * Tine Smukavec <valentin.smukavec@hermes.si>.
3299 */
3309 }
3310 }
3314 /*
3315 * Only one file needs to be unlinked. Append the mask back
3316 * onto the directory.
3317 */
3320 /* Ensure we use canonical names on open. */
3323 fname_mask);
3327 fname_dir,
3328 fname_mask);
3329 }
3333 }
3336 }
3341 }
3346 }
3348 count++;
3358 }
3361 }
3369 }
3370 }
3373 fname_dir,
3374 NULL,
3375 NULL,
3381 }
3386 }
3389 dirtype);
3393 }
3395 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
3396 the pattern matches against the long name, otherwise the short name
3397 We don't implement this yet XXXX
3398 */
3409 dir_hnd,
3410 dname,
3416 }
3418 /* Quick check for "." and ".." */
3423 }
3430 }
3433 /* Ensure we use canonical names on open. */
3438 }
3445 }
3447 p,
3448 NULL,
3458 }
3463 {
3468 }
3476 }
3484 }
3486 count++;
3492 }
3494 }
3498 }
3500 out:
3505 }
3507 /****************************************************************************
3508 Reply to a unlink
3509 ****************************************************************************/
3512 {
3517 NTSTATUS status;
3528 }
3537 }
3540 name,
3541 ucf_flags,
3549 }
3552 }
3556 conn,
3557 name,
3558 ucf_flags);
3562 }
3565 }
3572 /* We have re-scheduled this call. */
3574 }
3579 }
3580 }
3583 }
3586 out:
3590 }
3592 /****************************************************************************
3593 Fail for readbraw.
3594 ****************************************************************************/
3597 {
3603 }
3605 }
3607 /****************************************************************************
3608 Fake (read/write) sendfile. Returns -1 on read or write fail.
3609 ****************************************************************************/
3613 {
3620 }
3626 }
3629 ssize_t ret;
3637 }
3639 /* If we had a short read, fill with zeros. */
3642 }
3647 /*
3648 * Try and give an error message saying what
3649 * client failed.
3650 */
3658 }
3661 }
3665 }
3667 /****************************************************************************
3668 Deal with the case of sendfile reading less bytes from the file than
3669 requested. Fill with zeros (all we can do). Returns 0 on success
3670 ****************************************************************************/
3674 ssize_t nread,
3677 {
3678 #define SHORT_SEND_BUFSIZE 1024
3684 }
3695 }
3701 /*
3702 * We asked for the real file size and told sendfile
3703 * to not go beyond the end of the file. But it can
3704 * happen that in between our fstat call and the
3705 * sendfile call the file was truncated. This is very
3706 * bad because we have already announced the larger
3707 * number of bytes to the client.
3708 *
3709 * The best we can do now is to send 0-bytes, just as
3710 * a read from a hole in a sparse file would do.
3711 *
3712 * This should happen rarely enough that I don't care
3713 * about efficiency here :-)
3714 */
3716 ssize_t ret;
3722 /*
3723 * Try and give an error message saying what
3724 * client failed.
3725 */
3732 }
3734 }
3736 }
3739 }
3741 /****************************************************************************
3742 Return a readbraw error (4 bytes of zero).
3743 ****************************************************************************/
3746 {
3754 /*
3755 * Try and give an error message saying what
3756 * client failed.
3757 */
3765 }
3767 }
3769 /*******************************************************************
3770 Ensure we don't use sendfile if server smb signing is active.
3771 ********************************************************************/
3774 {
3777 /* Using sendfile blows the brains out of any DOS or Win9x TCP stack... JRA. */
3780 }
3783 }
3787 }
3788 /****************************************************************************
3789 Use sendfile in readbraw.
3790 ****************************************************************************/
3795 off_t startpos,
3797 ssize_t mincount)
3798 {
3803 /*
3804 * We can only use sendfile on a non-chained packet
3805 * but we can use on a non-oplocked file. tridge proved this
3806 * on a train in Germany :-). JRA.
3807 * reply_readbraw has already checked the length.
3808 */
3814 DATA_BLOB header_blob;
3821 nread);
3823 /* Returning ENOSYS means no data at all was sent.
3824 * Do this as a normal read. */
3827 }
3829 /*
3830 * Special hack for broken Linux with no working sendfile. If we
3831 * return EINTR we sent the header but not the rest of the data.
3832 * Fake this up by doing read/write calls.
3833 */
3835 /* Ensure we don't do this again. */
3841 "fake_sendfile failed for "
3846 }
3848 }
3855 /*
3856 * Some sendfile implementations return 0 to indicate
3857 * that there was a short read, but nothing was
3858 * actually written to the socket. In this case,
3859 * fallback to the normal read path so the header gets
3860 * the correct byte count.
3861 */
3863 "bytes falling back to the normal read: "
3866 }
3868 /* Deal with possible short send. */
3874 }
3875 }
3877 }
3879 normal_readbraw:
3887 }
3894 #else
3897 #endif
3898 }
3903 /*
3904 * Try and give an error message saying what
3905 * client failed.
3906 */
3913 }
3916 }
3918 /****************************************************************************
3919 Reply to a readbraw (core+ protocol).
3920 ****************************************************************************/
3923 {
3928 off_t startpos;
3932 NTSTATUS status;
3939 }
3945 }
3953 }
3955 /*
3956 * Special check if an oplock break has been issued
3957 * and the readraw request croses on the wire, we must
3958 * return a zero length response here.
3959 */
3963 /*
3964 * We have to do a check_fsp by hand here, as
3965 * we must always return 4 zero bytes on error,
3966 * not a NTSTATUS.
3967 */
3975 {
3976 /*
3977 * fsp could be NULL here so use the value from the packet. JRA.
3978 */
3985 }
3987 /* Do a "by hand" version of CHECK_READ. */
3996 }
4000 /*
4001 * This is a large offset (64 bit) read.
4002 */
4013 }
4014 }
4019 /* ensure we don't overrun the packet size */
4030 }
4035 }
4041 }
4046 #endif
4061 }
4063 #undef DBGC_CLASS
4064 #define DBGC_CLASS DBGC_LOCKING
4066 /****************************************************************************
4067 Reply to a lockread (core+ protocol).
4068 ****************************************************************************/
4073 {
4085 }
4092 }
4098 }
4105 }
4107 /*
4108 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
4109 * protocol request that predates the read/write lock concept.
4110 * Thus instead of asking for a read lock here we need to ask
4111 * for a write lock. JRA.
4112 * Note that the requested lock size is unaffected by max_send.
4113 */
4121 };
4124 fsp,
4127 fsp,
4130 WINDOWS_LOCK,
4132 lck);
4137 }
4140 }
4143 {
4147 NTSTATUS status;
4149 off_t startpos;
4165 }
4171 }
4176 /*
4177 * However the requested READ size IS affected by max_send. Insanity.... JRA.
4178 */
4183 "maximum allowed (%zu/%d). "
4184 "Returning short read of maximum allowed for "
4186 numtoread,
4187 maxtoread,
4190 }
4201 }
4214 send:
4220 NULL);
4223 }
4227 }
4229 #undef DBGC_CLASS
4230 #define DBGC_CLASS DBGC_ALL
4232 /****************************************************************************
4233 Reply to a read.
4234 ****************************************************************************/
4237 {
4243 off_t startpos;
4254 }
4261 }
4267 }
4272 /*
4273 * The requested read size cannot be greater than max_send. JRA.
4274 */
4283 }
4297 }
4305 }
4317 out:
4320 }
4322 /****************************************************************************
4323 Setup readX header.
4324 ****************************************************************************/
4327 {
4331 False);
4346 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
4350 }
4352 /****************************************************************************
4353 Reply to a read and X - possibly using sendfile.
4354 ****************************************************************************/
4359 {
4364 NTSTATUS status;
4373 }
4375 /*
4376 * We can only use sendfile on a non-chained packet
4377 * but we can use on a non-oplocked file. tridge proved this
4378 * on a train in Germany :-). JRA.
4379 */
4386 DATA_BLOB header;
4392 }
4397 /*
4398 * We already know that we would do a short read, so don't
4399 * try the sendfile() path.
4400 */
4402 }
4404 /*
4405 * Set up the packet header before send. We
4406 * assume here the sendfile will work (get the
4407 * correct amount of data).
4408 */
4420 /* Returning ENOSYS means no data at all was sent.
4421 Do this as a normal read. */
4424 }
4426 /*
4427 * Special hack for broken Linux with no working sendfile. If we
4428 * return EINTR we sent the header but not the rest of the data.
4429 * Fake this up by doing read/write calls.
4430 */
4433 /* Ensure we don't do this again. */
4437 smb_maxcnt);
4441 "fake_sendfile failed for "
4442 "file %s (%s) for client %s. "
4449 }
4452 /* No outbuf here means successful sendfile. */
4454 }
4461 /*
4462 * Some sendfile implementations return 0 to indicate
4463 * that there was a short read, but nothing was
4464 * actually written to the socket. In this case,
4465 * fallback to the normal read path so the header gets
4466 * the correct byte count.
4467 */
4472 }
4477 /* Deal with possible short send. */
4479 ssize_t ret;
4489 }
4490 }
4491 /* No outbuf here means successful sendfile. */
4495 }
4497 normal_read:
4501 ssize_t ret;
4506 /*
4507 * We already know that we would do a short
4508 * read, so don't try the sendfile() path.
4509 */
4511 }
4516 /* Send out the header. */
4521 /*
4522 * Try and give an error message saying what
4523 * client failed.
4524 */
4532 }
4543 }
4545 }
4547 nosendfile_read:
4560 }
4568 out:
4571 }
4573 /****************************************************************************
4574 Work out how much space we have for a read return.
4575 ****************************************************************************/
4578 {
4583 }
4587 }
4591 }
4594 /*
4595 * Don't take encrypted traffic up to the
4596 * limit. There are padding considerations
4597 * that make that tricky.
4598 */
4600 }
4604 }
4608 }
4610 /*
4611 * We can do ultra-large POSIX reads.
4612 */
4614 }
4616 /****************************************************************************
4617 Calculate how big a read can be. Copes with all clients. It's always
4618 safe to return a short read - Windows does this.
4619 ****************************************************************************/
4624 {
4631 /*
4632 * Windows explicitly ignores upper size of 0xFFFF.
4633 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4634 * We must do the same as these will never fit even in
4635 * an extended size NetBIOS packet.
4636 */
4639 }
4643 }
4647 /*
4648 * LARGE_READX test shows it's always safe to return
4649 * a short read. Windows does so.
4650 */
4652 }
4654 /****************************************************************************
4655 Reply to a read and X.
4656 ****************************************************************************/
4659 {
4662 off_t startpos;
4666 #if 0
4668 #endif
4675 }
4681 /* If it's an IPC, pass off the pipe handler. */
4686 }
4691 }
4697 }
4702 /*
4703 * This is a heuristic to avoid keeping large
4704 * outgoing buffers around over long-lived aio
4705 * requests.
4706 */
4708 }
4711 /*
4712 * This is a large offset (64 bit) read.
4713 */
4716 }
4720 req,
4721 fsp,
4722 startpos,
4723 smb_maxcnt);
4725 /* Read scheduled - we're done. */
4727 }
4729 /* Real error - report to client. */
4733 }
4734 /* NT_STATUS_RETRY - fall back to sync read. */
4735 }
4741 out:
4744 }
4746 /****************************************************************************
4747 Error replies to writebraw must have smb_wct == 1. Fix this up.
4748 ****************************************************************************/
4751 {
4758 }
4760 /****************************************************************************
4761 Read 4 bytes of a smb packet and return the smb length of the packet.
4762 Store the result in the buffer. This version of the function will
4763 never return a session keepalive (length of zero).
4764 Timeout is in milliseconds.
4765 ****************************************************************************/
4769 {
4773 NTSTATUS status;
4776 len);
4779 /* Try and give an error message
4780 * saying what client failed. */
4786 }
4789 }
4795 }
4797 /****************************************************************************
4798 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4799 ****************************************************************************/
4802 {
4810 off_t startpos;
4815 NTSTATUS status;
4819 /*
4820 * If we ever reply with an error, it must have the SMB command
4821 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4822 * we're finished.
4823 */
4830 }
4837 }
4846 }
4853 }
4860 }
4866 /* We have to deal with slightly different formats depending
4867 on whether we are using the core+ or lanman1.0 protocol */
4875 }
4877 /* Ensure we don't write bytes past the end of this packet. */
4878 /*
4879 * This already protects us against CVE-2017-12163.
4880 */
4886 }
4898 }
4899 }
4903 }
4914 }
4918 /* Allocate a buffer of 64k + length. */
4924 }
4926 /* Return a SMBwritebraw message to the redirector to tell
4927 * it to send more bytes */
4935 buf,
4941 }
4943 /* Now read the raw data into the buffer and write it */
4948 }
4950 /* Set up outbuf to return the correct size */
4960 }
4966 }
4969 numtowrite);
4972 /* Try and give an error message
4973 * saying what client failed. */
4975 "raw read failed (%s) for client %s. "
4979 }
4981 /*
4982 * We are not vulnerable to CVE-2017-12163
4983 * here as we are guaranteed to have numtowrite
4984 * bytes available - we just read from the client.
4985 */
4992 }
4997 }
5001 }
5002 }
5014 }
5021 /* We won't return a status if write through is not selected - this
5022 * follows what WfWg does */
5027 #if RABBIT_PELLET_FIX
5028 /*
5029 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
5030 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
5031 * JRA.
5032 */
5036 }
5037 #endif
5039 }
5042 out:
5045 }
5047 #undef DBGC_CLASS
5048 #define DBGC_CLASS DBGC_LOCKING
5050 /****************************************************************************
5051 Reply to a writeunlock (core+).
5052 ****************************************************************************/
5055 {
5060 off_t startpos;
5073 }
5080 }
5086 }
5092 /*
5093 * Ensure client isn't asking us to write more than
5094 * they sent. CVE-2017-12163.
5095 */
5101 }
5112 }
5113 }
5115 /* The special X/Open SMB protocol handling of
5116 zero length writes is *NOT* done for
5117 this call */
5123 }
5131 }
5136 }
5141 }
5150 };
5155 }
5156 }
5165 out:
5168 }
5170 #undef DBGC_CLASS
5171 #define DBGC_CLASS DBGC_ALL
5173 /****************************************************************************
5174 Reply to a write.
5175 ****************************************************************************/
5178 {
5183 off_t startpos;
5187 NTSTATUS status;
5196 }
5198 /* If it's an IPC, pass off the pipe handler. */
5203 }
5210 }
5216 }
5222 /*
5223 * Ensure client isn't asking us to write more than
5224 * they sent. CVE-2017-12163.
5225 */
5231 }
5242 }
5243 }
5245 /*
5246 * X/Open SMB protocol says that if smb_vwv1 is
5247 * zero then the file size should be extended or
5248 * truncated to the size given in smb_vwv[2-3].
5249 */
5252 /*
5253 * This is actually an allocate call, and set EOF. JRA.
5254 */
5259 }
5264 }
5268 }
5276 }
5281 }
5286 }
5295 }
5299 out:
5302 }
5304 /****************************************************************************
5305 Ensure a buffer is a valid writeX for recvfile purposes.
5306 ****************************************************************************/
5314 {
5321 NTSTATUS status;
5324 /* Can't do this on encrypted
5325 * connections. */
5327 }
5331 }
5338 }
5342 fnum,
5348 }
5353 }
5357 }
5362 }
5366 }
5370 }
5377 }
5382 }
5384 /* Ensure the sizes match up. */
5386 /* no pad byte...old smbclient :-( */
5391 }
5400 }
5409 }
5411 /****************************************************************************
5412 Reply to a write and X.
5413 ****************************************************************************/
5416 {
5421 off_t startpos;
5424 ssize_t nwritten;
5428 NTSTATUS status;
5436 }
5446 }
5449 /* Can't do a recvfile write on IPC$ */
5453 }
5457 }
5459 /*
5460 * This already protects us against CVE-2017-12163.
5461 */
5466 }
5467 }
5469 /* If it's an IPC, pass off the pipe handler. */
5474 }
5477 }
5485 }
5490 }
5495 /*
5496 * This is a large offset (64 bit) write.
5497 */
5500 }
5502 /* X/Open SMB protocol says that, unlike SMBwrite
5503 if the length is zero then NO truncation is
5504 done, just a write of zero. To truncate a file,
5505 use SMBwrite. */
5512 req,
5513 fsp,
5514 data,
5515 startpos,
5516 numtowrite);
5519 /* write scheduled - we're done. */
5521 }
5523 /* Real error - report to client. */
5526 }
5527 /* NT_STATUS_RETRY - fall through to sync write. */
5528 }
5537 }
5541 }
5546 }
5551 }
5568 }
5573 out:
5575 /* writeX failed. drain socket. */
5579 }
5581 }
5585 }
5587 /****************************************************************************
5588 Reply to a lseek.
5589 ****************************************************************************/
5592 {
5594 off_t startpos;
5598 NTSTATUS status;
5606 }
5612 }
5615 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
5634 }
5646 }
5651 }
5652 }
5658 }
5659 }
5671 }
5675 {
5681 }
5684 }
5689 }
5692 }
5694 /****************************************************************************
5695 Reply to a flush.
5696 ****************************************************************************/
5699 {
5709 }
5716 }
5728 }
5731 }
5732 }
5739 }
5741 /****************************************************************************
5742 Reply to a exit.
5743 conn POINTER CAN BE NULL HERE !
5744 ****************************************************************************/
5750 {
5753 /*
5754 * Don't setup the profile charge here, take
5755 * it in reply_exit_done(). Not strictly correct
5756 * but better than the other SMB1 async
5757 * code that double-charges at the moment.
5758 */
5761 /* Not going async, profile here. */
5766 }
5768 /* We're async. This will complete later. */
5771 }
5775 };
5779 /****************************************************************************
5780 Async SMB1 exit.
5781 Note, on failure here we deallocate and return NULL to allow the caller to
5782 SMB1 return an error of ERRnomem immediately.
5783 ****************************************************************************/
5786 {
5797 }
5803 }
5808 }
5811 }
5812 /*
5813 * Flag the file as close in progress.
5814 * This will prevent any more IO being
5815 * done on it.
5816 */
5820 /*
5821 * Now wait until all aio requests on this fsp are
5822 * finished.
5823 *
5824 * We don't set a callback, as we just want to block the
5825 * wait queue and the talloc_free() of fsp->aio_request
5826 * will remove the item from the wait queue.
5827 */
5834 }
5835 }
5836 }
5838 /*
5839 * Now we add our own waiter to the end of the queue,
5840 * this way we get notified when all pending requests are finished
5841 * and reply to the outstanding SMB1 request.
5842 */
5849 }
5851 /*
5852 * We're really going async - move the SMB1 request from
5853 * a talloc stackframe above us to the conn talloc-context.
5854 * We need this to stick around until the wait_done
5855 * callback is invoked.
5856 */
5862 }
5865 {
5872 }
5875 {
5877 }
5880 {
5888 NTSTATUS status;
5890 /*
5891 * Take the profile charge here. Not strictly
5892 * correct but better than the other SMB1 async
5893 * code that double-charges at the moment.
5894 */
5904 }
5906 /*
5907 * Ensure the session is still valid.
5908 */
5911 now,
5917 }
5919 /*
5920 * Ensure the vuid is still valid - no one
5921 * called reply_ulogoffX() in the meantime.
5922 * reply_exit() doesn't have AS_USER set, so
5923 * use set_current_user_info() directly.
5924 * This is the same logic as in switch_message().
5925 */
5931 }
5933 /* No more aio - do the actual closes. */
5940 }
5943 }
5946 }
5948 /*
5949 * reply_exit() has the DO_CHDIR flag set.
5950 */
5956 }
5958 }
5961 /*
5962 * The following call is needed to push the
5963 * reply data back out the socket after async
5964 * return. Plus it frees smb1req.
5965 */
5970 }
5977 {
5987 }
5991 /*
5992 * We can only use check_fsp if we know it's not a directory.
5993 */
5999 }
6010 /*
6011 * Take care of any time sent in the close.
6012 */
6016 }
6025 }
6026 /* We're async. This will complete later. */
6030 }
6032 /*
6033 * close_file() returns the unix errno if an error was detected on
6034 * close - normally this is due to a disk full error. If not then it
6035 * was probably an I/O error.
6036 */
6039 done:
6044 }
6049 }
6054 };
6058 /****************************************************************************
6059 Async SMB1 close.
6060 Note, on failure here we deallocate and return NULL to allow the caller to
6061 SMB1 return an error of ERRnomem immediately.
6062 ****************************************************************************/
6066 {
6076 }
6082 }
6084 /*
6085 * Flag the file as close in progress.
6086 * This will prevent any more IO being
6087 * done on it.
6088 */
6091 /*
6092 * Now wait until all aio requests on this fsp are
6093 * finished.
6094 *
6095 * We don't set a callback, as we just want to block the
6096 * wait queue and the talloc_free() of fsp->aio_request
6097 * will remove the item from the wait queue.
6098 */
6105 }
6107 /*
6108 * Now we add our own waiter to the end of the queue,
6109 * this way we get notified when all pending requests are finished
6110 * and reply to the outstanding SMB1 request.
6111 */
6118 }
6120 /*
6121 * We're really going async - move the SMB1 request from
6122 * a talloc stackframe above us to the conn talloc-context.
6123 * We need this to stick around until the wait_done
6124 * callback is invoked.
6125 */
6131 }
6134 {
6141 }
6144 {
6146 }
6149 {
6154 NTSTATUS status;
6162 }
6169 }
6170 /*
6171 * The following call is needed to push the
6172 * reply data back out the socket after async
6173 * return. Plus it frees smb1req.
6174 */
6176 }
6178 /****************************************************************************
6179 Reply to a writeclose (Core+ protocol).
6180 ****************************************************************************/
6183 {
6189 off_t startpos;
6201 }
6208 }
6213 }
6220 /*
6221 * Ensure client isn't asking us to write more than
6222 * they sent. CVE-2017-12163.
6223 */
6229 }
6240 }
6241 }
6247 /*
6248 * More insanity. W2K only closes the file if writelen > 0.
6249 * JRA.
6250 */
6261 }
6266 }
6271 }
6277 out:
6281 }
6283 #undef DBGC_CLASS
6284 #define DBGC_CLASS DBGC_LOCKING
6286 /****************************************************************************
6287 Reply to a lock.
6288 ****************************************************************************/
6293 {
6305 }
6312 }
6319 }
6327 };
6336 fsp,
6339 fsp,
6342 WINDOWS_LOCK,
6344 lck);
6349 }
6352 }
6355 {
6357 NTSTATUS status;
6372 }
6379 NULL);
6382 }
6385 }
6387 /****************************************************************************
6388 Reply to a unlock.
6389 ****************************************************************************/
6392 {
6394 NTSTATUS status;
6404 }
6411 }
6419 };
6427 }
6439 }
6441 #undef DBGC_CLASS
6442 #define DBGC_CLASS DBGC_ALL
6444 /****************************************************************************
6445 Reply to a tdis.
6446 conn POINTER CAN BE NULL HERE !
6447 ****************************************************************************/
6453 {
6457 /*
6458 * Don't setup the profile charge here, take
6459 * it in reply_tdis_done(). Not strictly correct
6460 * but better than the other SMB1 async
6461 * code that double-charges at the moment.
6462 */
6465 /* Not going async, profile here. */
6471 }
6475 /* Not going async, profile here. */
6480 }
6481 /* We're async. This will complete later. */
6484 }
6488 };
6492 /****************************************************************************
6493 Async SMB1 tdis.
6494 Note, on failure here we deallocate and return NULL to allow the caller to
6495 SMB1 return an error of ERRnomem immediately.
6496 ****************************************************************************/
6499 {
6510 }
6515 }
6517 /*
6518 * Make sure that no new request will be able to use this tcon.
6519 * This ensures that once all outstanding fsp->aio_requests
6520 * on this tcon are done, we are safe to close it.
6521 */
6527 }
6528 /*
6529 * Flag the file as close in progress.
6530 * This will prevent any more IO being
6531 * done on it. Not strictly needed, but
6532 * doesn't hurt to flag it as closing.
6533 */
6537 /*
6538 * Now wait until all aio requests on this fsp are
6539 * finished.
6540 *
6541 * We don't set a callback, as we just want to block the
6542 * wait queue and the talloc_free() of fsp->aio_request
6543 * will remove the item from the wait queue.
6544 */
6551 }
6552 }
6553 }
6555 /*
6556 * Now we add our own waiter to the end of the queue,
6557 * this way we get notified when all pending requests are finished
6558 * and reply to the outstanding SMB1 request.
6559 */
6566 }
6568 /*
6569 * We're really going async - move the SMB1 request from
6570 * a talloc stackframe above us to the sconn talloc-context.
6571 * We need this to stick around until the wait_done
6572 * callback is invoked.
6573 */
6579 }
6582 {
6589 }
6592 {
6594 }
6597 {
6600 NTSTATUS status;
6604 /*
6605 * Take the profile charge here. Not strictly
6606 * correct but better than the other SMB1 async
6607 * code that double-charges at the moment.
6608 */
6618 }
6620 /*
6621 * As we've been awoken, we may have changed
6622 * directory in the meantime.
6623 * reply_tdis() has the DO_CHDIR flag set.
6624 */
6630 }
6639 }
6641 /* smbXsrv_tcon_disconnect frees smb1req->conn. */
6647 /*
6648 * The following call is needed to push the
6649 * reply data back out the socket after async
6650 * return. Plus it frees smb1req.
6651 */
6654 }
6656 /****************************************************************************
6657 Reply to a echo.
6658 conn POINTER CAN BE NULL HERE !
6659 ****************************************************************************/
6662 {
6677 }
6683 /* copy any incoming data back out */
6686 }
6691 }
6695 /* this makes sure we catch the request pcd */
6701 }
6710 cur_pcd))
6712 }
6720 }
6722 /****************************************************************************
6723 Reply to a printopen.
6724 ****************************************************************************/
6727 {
6730 NTSTATUS status;
6738 }
6744 }
6751 }
6753 /* Open for exclusive use, write only. */
6761 }
6771 }
6773 /****************************************************************************
6774 Reply to a printclose.
6775 ****************************************************************************/
6778 {
6781 NTSTATUS status;
6789 }
6796 }
6802 }
6813 }
6819 }
6821 /****************************************************************************
6822 Reply to a printqueue.
6823 ****************************************************************************/
6826 {
6839 }
6844 /* we used to allow the client to get the cnum wrong, but that
6845 is really quite gross and only worked when there was only
6846 one printer - I think we should now only accept it if they
6847 get it right (tridge) */
6852 }
6863 {
6865 NTSTATUS status;
6866 WERROR werr;
6893 }
6899 sharename,
6901 SEC_FLAG_MAXIMUM_ALLOWED,
6907 }
6911 }
6924 }
6930 }
6936 }
6951 }
6963 }
6970 }
6971 }
6979 }
6985 out:
6988 }
6990 }
6994 }
6996 /****************************************************************************
6997 Reply to a printwrite.
6998 ****************************************************************************/
7001 {
7013 }
7020 }
7026 }
7032 }
7036 /*
7037 * This already protects us against CVE-2017-12163.
7038 */
7043 }
7051 }
7057 }
7059 /****************************************************************************
7060 Reply to a mkdir.
7061 ****************************************************************************/
7064 {
7068 NTSTATUS status;
7079 }
7083 directory,
7084 ucf_flags,
7092 }
7095 }
7105 NT_STATUS_OBJECT_NAME_COLLISION)) {
7106 /*
7107 * Yes, in the DOS error code case we get a
7108 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
7109 * samba4 torture test.
7110 */
7112 }
7116 }
7121 out:
7125 }
7127 /****************************************************************************
7128 Reply to a rmdir.
7129 ****************************************************************************/
7132 {
7136 NTSTATUS status;
7149 }
7152 directory,
7153 ucf_flags,
7161 }
7164 }
7169 }
7177 FILE_SHARE_DELETE),
7193 /* We have re-scheduled this call. */
7195 }
7200 }
7201 }
7204 }
7211 }
7219 }
7226 }
7229 out:
7233 }
7235 /*******************************************************************
7236 Resolve wildcards in a filename rename.
7237 ********************************************************************/
7243 {
7254 }
7261 }
7263 /* Truncate the copy of name2 at the last '/' */
7266 /* Now go past the '/' */
7267 pname1++;
7268 pname2++;
7275 }
7283 }
7290 }
7294 }
7300 /* Hmmm. Should this be mb-aware ? */
7302 p2++;
7306 root2,
7307 p);
7310 }
7313 p2++;
7314 }
7316 p++;
7317 }
7318 }
7324 /* Hmmm. Should this be mb-aware ? */
7326 p2++;
7330 ext2,
7331 p);
7334 }
7337 p2++;
7338 }
7340 p++;
7341 }
7342 }
7346 name2_copy,
7347 root2,
7348 ext2);
7351 name2_copy,
7352 root2);
7353 }
7357 }
7360 }
7362 /****************************************************************************
7363 Ensure open files have their names updated. Updated to notify other smbd's
7364 asynchronously.
7365 ****************************************************************************/
7372 {
7375 NTSTATUS status;
7381 /* fsp_name is a relative path under the fsp. To change this for other
7382 sharepaths we need to manipulate relative paths. */
7383 /* TODO - create the absolute path and manipulate the newname
7384 relative to the sharepath. */
7387 }
7390 }
7402 }
7403 }
7411 }
7413 /* Send messages to all smbd's (not ourself) that the name has changed. */
7416 smb_fname_dst);
7418 }
7420 /****************************************************************************
7421 We need to check if the source path is a parent directory of the destination
7422 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
7423 refuse the rename with a sharing violation. Under UNIX the above call can
7424 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
7425 probably need to check that the client is a Windows one before disallowing
7426 this as a UNIX client (one with UNIX extensions) can know the source is a
7427 symlink and make this decision intelligently. Found by an excellent bug
7428 report from <AndyLiebman@aol.com>.
7429 ****************************************************************************/
7433 {
7440 }
7443 }
7446 }
7448 }
7450 /*
7451 * Do the notify calls from a rename
7452 */
7457 {
7470 }
7477 }
7483 }
7485 /* this is a strange one. w2k3 gives an additional event for
7486 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
7487 files, but not directories */
7490 FILE_NOTIFY_CHANGE_ATTRIBUTES
7493 }
7494 out:
7497 }
7499 /****************************************************************************
7500 Returns an error if the parent directory for a filename is open in an
7501 incompatible way.
7502 ****************************************************************************/
7506 {
7514 smb_fname_dst_in,
7516 NULL);
7519 }
7524 }
7526 /*
7527 * We're only checking on this smbd here, mostly good
7528 * enough.. and will pass tests.
7529 */
7536 }
7537 }
7539 }
7541 /****************************************************************************
7542 Rename an open file - given an fsp.
7543 ****************************************************************************/
7551 {
7563 }
7568 }
7572 }
7574 /* Make a copy of the dst smb_fname structs */
7580 }
7582 /*
7583 * Check for special case with case preserving and not
7584 * case sensitive. If the new last component differs from the original
7585 * last component only by case, then we should allow
7586 * the rename (user is trying to change the case of the
7587 * filename).
7588 */
7598 /*
7599 * Split off the last component of the processed
7600 * destination name. We will compare this to
7601 * the split components of dst_original_lcomp.
7602 */
7609 }
7611 /*
7612 * The dst_original_lcomp component contains
7613 * the last_component of the path + stream
7614 * name (if a stream exists).
7615 *
7616 * Split off the stream name so we
7617 * can check them separately.
7618 */
7621 /* POSIX - no stream component. */
7623 dst_original_lcomp);
7626 }
7629 dst_original_lcomp,
7632 }
7638 }
7640 /* If the base names only differ by case, use original. */
7643 /*
7644 * Replace the modified last component with the
7645 * original.
7646 */
7650 fname_dst_parent,
7651 orig_lcomp_path);
7654 orig_lcomp_path);
7655 }
7662 }
7665 }
7667 /* If the stream_names only differ by case, use original. */
7669 orig_lcomp_stream)) {
7670 /* Use the original stream. */
7672 orig_lcomp_stream);
7679 }
7682 }
7686 }
7688 /*
7689 * If the src and dest names are identical - including case,
7690 * don't do the rename, just return success.
7691 */
7701 }
7706 /* Return the correct error code if both names aren't streams. */
7710 }
7715 }
7725 }
7727 /*
7728 * Drop the pathref fsp on the destination otherwise we trip upon in in
7729 * the below check for open files check.
7730 */
7735 }
7742 /* The file can be open when renaming a stream */
7747 }
7748 }
7750 /* Ensure we have a valid stat struct for the source. */
7754 }
7765 }
7770 }
7772 /* Do we have rights to move into the destination ? */
7774 /* We're moving a directory. */
7776 }
7779 smb_fname_dst,
7780 access_mask);
7787 }
7791 /*
7792 * We have the file open ourselves, so not being able to get the
7793 * corresponding share mode lock is a fatal error.
7794 */
7802 smb_fname_dst);
7814 /* We must set the archive bit on the newly
7815 renamed file. */
7818 smb_fname_dst);
7820 smb_fname_dst,
7822 NULL,
7824 }
7825 }
7830 smb_fname_dst);
7833 smb_fname_dst);
7835 /*
7836 * A rename acts as a new file create w.r.t. allowing an initial delete
7837 * on close, probably because in Windows there is a new handle to the
7838 * new file. If initial delete on close was requested but not
7839 * originally set, we need to set it here. This is probably not 100% correct,
7840 * but will work for the CIFSFS client which in non-posix mode
7841 * depends on these semantics. JRA.
7842 */
7848 /* Note that here we set the *initial* delete on close flag,
7849 * not the regular one. The magic gets handled in close. */
7851 }
7852 }
7856 }
7864 }
7870 out:
7874 }
7876 /****************************************************************************
7877 The guts of the rename command, split out so it may be called by the NT SMB
7878 code.
7879 ****************************************************************************/
7891 {
7907 /*
7908 * Split the old name into directory and last component
7909 * strings. Note that unix_convert may have stripped off a
7910 * leading ./ from both name and newname if the rename is
7911 * at the root of the share. We need to make sure either both
7912 * name and newname contain a / character or neither of them do
7913 * as this is checked in resolve_wildcards().
7914 */
7916 /* Split up the directory from the filename/mask. */
7922 }
7925 /*
7926 * Check the wildcard mask *before*
7927 * unmangling. As mangling is done
7928 * for names that can't be returned
7929 * to Windows the unmangled name may
7930 * contain Windows wildcard characters.
7931 */
7934 }
7936 }
7938 /*
7939 * We should only check the mangled cache
7940 * here if unix_convert failed. This means
7941 * that the path in 'mask' doesn't exist
7942 * on the file system and so we need to look
7943 * for a possible mangle. This patch from
7944 * Tine Smukavec <valentin.smukavec@hermes.si>.
7945 */
7955 }
7956 }
7964 }
7965 }
7970 /*
7971 * Only one file needs to be renamed. Append the mask back
7972 * onto the directory.
7973 */
7976 /* Ensure we use canonical names on open. */
7979 fname_src_mask);
7983 fname_src_dir,
7984 fname_src_mask);
7985 }
7989 }
7992 "case_preserve = %d, short case preserve = %d, "
7993 "directory = %s, newname = %s, "
7999 dst_original_lcomp));
8001 /* The dest name still may have wildcards. */
8014 }
8017 }
8025 }
8030 }
8033 }
8037 }
8045 FILE_SHARE_WRITE),
8065 }
8068 fsp,
8069 smb_fname_dst,
8070 dst_original_lcomp,
8071 attrs,
8072 replace_if_exists);
8081 }
8083 /*
8084 * Wildcards - process each file that matches.
8085 */
8092 }
8093 }
8096 fname_src_dir,
8097 NULL,
8098 NULL,
8104 }
8109 }
8112 attrs);
8116 }
8119 /*
8120 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
8121 * - gentest fix. JRA
8122 */
8130 /* Quick check for "." and ".." */
8137 }
8138 }
8141 dir_hnd,
8142 dname,
8147 }
8152 }
8157 }
8161 /* Ensure we use canonical names on open. */
8164 dname);
8168 fname_src_dir,
8169 dname);
8170 }
8174 }
8183 }
8187 }
8198 }
8204 }
8210 }
8218 FILE_SHARE_WRITE),
8240 }
8246 }
8249 fsp,
8250 smb_fname_dst,
8251 dst_original_lcomp,
8252 attrs,
8253 replace_if_exists);
8263 }
8265 count++;
8271 }
8276 }
8278 out:
8285 }
8287 /****************************************************************************
8288 Reply to a mv.
8289 ****************************************************************************/
8292 {
8298 NTSTATUS status;
8315 }
8325 }
8326 p++;
8332 }
8335 /* The newname must begin with a ':' if the
8336 name contains a ':'. */
8341 }
8343 }
8344 }
8347 conn,
8348 name,
8349 src_ucf_flags,
8358 }
8361 }
8363 /* Get the last component of the source for rename_internals(). */
8365 conn,
8366 name,
8367 dst_ucf_flags);
8371 }
8374 conn,
8375 newname,
8376 dst_ucf_flags,
8385 }
8388 }
8390 /* Get the last component of the destination for rename_internals(). */
8392 conn,
8393 newname,
8394 dst_ucf_flags);
8398 }
8401 /* smb_fname_dst->base_name must be the same as
8402 smb_fname_src->base_name. */
8409 }
8410 }
8416 conn,
8417 req,
8418 smb_fname_src,
8419 src_original_lcomp,
8420 smb_fname_dst,
8421 dst_original_lcomp,
8422 attrs,
8424 DELETE_ACCESS);
8427 /* We have re-scheduled this call. */
8429 }
8434 }
8435 }
8438 }
8441 out:
8446 }
8448 /*******************************************************************
8449 Copy a file as part of a reply_copy.
8450 ******************************************************************/
8452 /*
8453 * TODO: check error codes on all callers
8454 */
8463 {
8469 NTSTATUS status;
8475 }
8477 /*
8478 * If the target is a directory, extract the last component from the
8479 * src filename and append it to the dst filename
8480 */
8484 /* dest/target can't be a stream if it's a directory. */
8489 p++;
8492 }
8495 p);
8499 }
8500 }
8505 }
8510 }
8513 }
8522 NULL,
8523 NULL)) {
8526 }
8527 }
8529 /* Open the src file for reading. */
8551 }
8557 }
8563 }
8566 {
8568 }
8570 /* Open the dst file for writing. */
8593 }
8604 }
8605 }
8607 /* Do the actual copy. */
8612 }
8616 /* Ensure the modtime is set correctly on the destination file. */
8619 /*
8620 * As we are opening fsp1 read-only we only expect
8621 * an error on close on fsp2 if we are out of space.
8622 * Thus we don't look at the error return from the
8623 * close of fsp1.
8624 */
8629 }
8634 }
8638 out:
8641 }
8643 /****************************************************************************
8644 Reply to a file copy.
8645 ****************************************************************************/
8648 {
8666 NTSTATUS status;
8678 }
8690 }
8696 }
8701 /* can't currently handle inter share copies XXXX */
8705 }
8708 fname_src,
8709 ucf_flags_src,
8717 }
8720 }
8723 fname_dst,
8724 ucf_flags_dst,
8732 }
8735 }
8742 }
8747 }
8750 /* wants a tree copy! XXXX */
8754 }
8756 /* Split up the directory from the filename/mask. */
8762 }
8767 /*
8768 * Check the wildcard mask *before*
8769 * unmangling. As mangling is done
8770 * for names that can't be returned
8771 * to Windows the unmangled name may
8772 * contain Windows wildcard characters.
8773 */
8775 conn,
8776 fname_src,
8777 ucf_flags_src);
8781 }
8783 conn,
8784 fname_dst,
8785 ucf_flags_dst);
8789 }
8794 }
8796 /*
8797 * We should only check the mangled cache
8798 * here if unix_convert failed. This means
8799 * that the path in 'mask' doesn't exist
8800 * on the file system and so we need to look
8801 * for a possible mangle. This patch from
8802 * Tine Smukavec <valentin.smukavec@hermes.si>.
8803 */
8810 /* Use demangled name if one was successfully found. */
8814 }
8815 }
8819 /*
8820 * Only one file needs to be copied. Append the mask back onto
8821 * the directory.
8822 */
8825 /* Ensure we use canonical names on open. */
8828 fname_src_mask);
8832 fname_src_dir,
8833 fname_src_mask);
8834 }
8838 }
8848 }
8851 }
8857 }
8863 }
8872 count++;
8873 }
8880 /*
8881 * There is a wildcard that requires us to actually read the
8882 * src dir and copy each file matching the mask to the dst.
8883 * Right now streams won't be copied, but this could
8884 * presumably be added with a nested loop for reach dir entry.
8885 */
8898 }
8899 }
8902 fname_src_dir,
8903 NULL,
8904 NULL,
8910 }
8916 }
8919 conn,
8920 smb_fname_src_dir,
8921 fname_src_mask,
8927 }
8931 /* Iterate over the src dir copying each entry to the dst. */
8939 }
8942 dir_hnd,
8943 dname,
8948 }
8954 }
8958 /* Get the src smb_fname struct setup. */
8961 /* Ensure we use canonical names on open. */
8964 dname);
8969 }
8976 }
8983 }
8989 }
9000 }
9008 }
9016 target_is_directory);
9018 count++;
9019 }
9022 }
9024 }
9029 }
9033 out:
9044 }
9046 #undef DBGC_CLASS
9047 #define DBGC_CLASS DBGC_LOCKING
9049 /****************************************************************************
9050 Get a lock pid, dealing with large count requests.
9051 ****************************************************************************/
9055 {
9058 else
9060 }
9062 /****************************************************************************
9063 Get a lock count, dealing with large count requests.
9064 ****************************************************************************/
9068 {
9074 /*
9075 * No BVAL, this is reversed!
9076 */
9079 }
9082 }
9084 /****************************************************************************
9085 Get a lock offset, dealing with large offset requests.
9086 ****************************************************************************/
9090 {
9096 /*
9097 * No BVAL, this is reversed!
9098 */
9101 }
9104 }
9111 NTSTATUS status;
9112 };
9119 {
9136 /* this can only happen with SMB2 */
9139 }
9149 }
9150 }
9153 }
9160 {
9166 };
9167 NTSTATUS status;
9178 }
9183 }
9186 }
9188 /****************************************************************************
9189 Reply to a lockingX request.
9190 ****************************************************************************/
9195 {
9217 }
9230 }
9235 /* we don't support these - and CANCEL_LOCK makes w2k
9236 and XP reboot so I don't really want to be
9237 compatible! (tridge) */
9241 }
9243 /* Check if this is an oplock break on a file
9244 we have granted an oplock on.
9245 */
9247 /* Client can insist on breaking to none. */
9255 /*
9256 * Make sure we have granted an exclusive or batch oplock on
9257 * this file.
9258 */
9262 /* The Samba4 nbench simulator doesn't understand
9263 the difference between break to level2 and break
9264 to none from level2 - it sends oplock break
9265 replies in both cases. Don't keep logging an error
9266 message here - just ignore it. JRA. */
9269 "client for %s (oplock=%d) and no "
9274 /* if this is a pure oplock break request then don't
9275 * send a reply */
9279 }
9284 }
9291 }
9296 /* Hmmm. Is this panic justified? */
9298 }
9300 /* if this is a pure oplock break request then don't send a
9301 * reply */
9303 /* Sanity check - ensure a pure oplock break is not a
9304 chained request. */
9309 }
9312 }
9313 }
9320 }
9332 }
9334 /*
9335 * Data now points at the beginning of the list of
9336 * smb_unlkrng structs
9337 */
9348 }
9350 /*
9351 * Unlock cancels pending locks
9352 */
9355 fsp,
9356 large_file_format,
9357 WINDOWS_LOCK,
9359 NT_STATUS_OK);
9366 }
9375 }
9376 }
9378 /* Now do any requested locks */
9381 /* Data now points at the beginning of the list
9382 of smb_lkrng structs */
9388 }
9395 }
9403 }
9410 /* See smbtorture3 lock11 test */
9412 /* andx chain ends */
9417 }
9420 fsp,
9421 large_file_format,
9422 WINDOWS_LOCK,
9424 NT_STATUS_FILE_LOCK_CONFLICT);
9430 }
9437 }
9440 fsp,
9443 fsp,
9444 lock_timeout,
9445 large_file_format,
9446 WINDOWS_LOCK,
9447 num_locks,
9448 locks);
9453 }
9456 }
9459 {
9461 NTSTATUS status;
9480 }
9487 NULL);
9490 }
9493 }
9495 #undef DBGC_CLASS
9496 #define DBGC_CLASS DBGC_ALL
9498 /****************************************************************************
9499 Reply to a SMBreadbmpx (read block multiplex) request.
9500 Always reply with an error, if someone has a platform really needs this,
9501 please contact vl@samba.org
9502 ****************************************************************************/
9505 {
9510 }
9512 /****************************************************************************
9513 Reply to a SMBreadbs (read block multiplex secondary) request.
9514 Always reply with an error, if someone has a platform really needs this,
9515 please contact vl@samba.org
9516 ****************************************************************************/
9519 {
9524 }
9526 /****************************************************************************
9527 Reply to a SMBsetattrE.
9528 ****************************************************************************/
9531 {
9535 NTSTATUS status;
9543 }
9550 }
9552 /*
9553 * Convert the DOS times into unix times.
9554 */
9565 /*
9566 * Patch from Ray Frush <frush@engr.colostate.edu>
9567 * Sometimes times are sent as zero - ignore them.
9568 */
9570 /* Ensure we have a valid stat struct for the source. */
9575 }
9580 }
9586 }
9590 }
9598 ));
9599 out:
9602 }
9605 /* Back from the dead for OS/2..... JRA. */
9607 /****************************************************************************
9608 Reply to a SMBwritebmpx (write block multiplex primary) request.
9609 Always reply with an error, if someone has a platform really needs this,
9610 please contact vl@samba.org
9611 ****************************************************************************/
9614 {
9619 }
9621 /****************************************************************************
9622 Reply to a SMBwritebs (write block multiplex secondary) request.
9623 Always reply with an error, if someone has a platform really needs this,
9624 please contact vl@samba.org
9625 ****************************************************************************/
9628 {
9633 }
9635 /****************************************************************************
9636 Reply to a SMBgetattrE.
9637 ****************************************************************************/
9640 {
9645 NTSTATUS status;
9653 }
9661 }
9663 /* Do an fstat on this file */
9669 }
9673 /*
9674 * Convert the times into dos times. Set create
9675 * date to be last modify date as UNIX doesn't save
9676 * this.
9677 */
9685 /* Should we check pending modtime here ? JRA */
9696 }
9703 }