?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:dsdb:tests: Also pass tests if asserted identity is present
[Samba.git] / source3 / smbd / smb1_nttrans.c
blobc370da4c935936094edfc809d529043f3f26de2d
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "fake_file.h"
26 #include "../libcli/security/security.h"
27 #include "../librpc/gen_ndr/ndr_security.h"
28 #include "passdb/lookup_sid.h"
29 #include "auth.h"
30 #include "smbprofile.h"
31 #include "libsmb/libsmb.h"
32 #include "lib/util_ea.h"
33 #include "librpc/gen_ndr/ndr_quota.h"
34 #include "librpc/gen_ndr/ndr_security.h"
35
36 static char *nttrans_realloc(char **ptr, size_t size)
37 {
38 if (ptr==NULL) {
39 smb_panic("nttrans_realloc() called with NULL ptr");
40 }
41
42 *ptr = (char *)SMB_REALLOC(*ptr, size);
43 if(*ptr == NULL) {
44 return NULL;
45 }
46 memset(*ptr,'\0',size);
47 return *ptr;
48 }
49
50 /****************************************************************************
51 Send the required number of replies back.
52 We assume all fields other than the data fields are
53 set correctly for the type of call.
54 HACK ! Always assumes smb_setup field is zero.
55 ****************************************************************************/
56
57 static void send_nt_replies(connection_struct *conn,
58 struct smb_request *req, NTSTATUS nt_error,
59 char *params, int paramsize,
60 char *pdata, int datasize)
61 {
62 int data_to_send = datasize;
63 int params_to_send = paramsize;
64 int useable_space;
65 char *pp = params;
66 char *pd = pdata;
67 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
68 int alignment_offset = 1;
69 int data_alignment_offset = 0;
70 struct smbXsrv_connection *xconn = req->xconn;
71 int max_send = xconn->smb1.sessions.max_send;
72
73 /*
74 * If there genuinely are no parameters or data to send just send
75 * the empty packet.
76 */
77
78 if(params_to_send == 0 && data_to_send == 0) {
79 reply_smb1_outbuf(req, 18, 0);
80 if (NT_STATUS_V(nt_error)) {
81 error_packet_set((char *)req->outbuf,
82 0, 0, nt_error,
83 __LINE__,__FILE__);
84 }
85 show_msg((char *)req->outbuf);
86 if (!smb1_srv_send(xconn,
87 (char *)req->outbuf,
88 true, req->seqnum+1,
89 IS_CONN_ENCRYPTED(conn),
90 &req->pcd)) {
91 exit_server_cleanly("send_nt_replies: smb1_srv_send failed.");
92 }
93 TALLOC_FREE(req->outbuf);
94 return;
95 }
96
97 /*
98 * When sending params and data ensure that both are nicely aligned.
99 * Only do this alignment when there is also data to send - else
100 * can cause NT redirector problems.
101 */
102
103 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
104 data_alignment_offset = 4 - (params_to_send % 4);
105 }
106
107 /*
108 * Space is bufsize minus Netbios over TCP header minus SMB header.
109 * The alignment_offset is to align the param bytes on a four byte
110 * boundary (2 bytes for data len, one byte pad).
111 * NT needs this to work correctly.
112 */
113
114 useable_space = max_send - (smb_size
115 + 2 * 18 /* wct */
116 + alignment_offset
117 + data_alignment_offset);
118
119 if (useable_space < 0) {
120 char *msg = talloc_asprintf(
121 talloc_tos(),
122 "send_nt_replies failed sanity useable_space = %d!!!",
123 useable_space);
124 DEBUG(0, ("%s\n", msg));
125 exit_server_cleanly(msg);
126 }
127
128 while (params_to_send || data_to_send) {
129
130 /*
131 * Calculate whether we will totally or partially fill this packet.
132 */
133
134 total_sent_thistime = params_to_send + data_to_send;
135
136 /*
137 * We can never send more than useable_space.
138 */
139
140 total_sent_thistime = MIN(total_sent_thistime, useable_space);
141
142 reply_smb1_outbuf(req, 18,
143 total_sent_thistime + alignment_offset
144 + data_alignment_offset);
145
146 /*
147 * Set total params and data to be sent.
148 */
149
150 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
151 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
152
153 /*
154 * Calculate how many parameters and data we can fit into
155 * this packet. Parameters get precedence.
156 */
157
158 params_sent_thistime = MIN(params_to_send,useable_space);
159 data_sent_thistime = useable_space - params_sent_thistime;
160 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
161
162 SIVAL(req->outbuf, smb_ntr_ParameterCount,
163 params_sent_thistime);
164
165 if(params_sent_thistime == 0) {
166 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
167 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
168 } else {
169 /*
170 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
171 * parameter bytes, however the first 4 bytes of outbuf are
172 * the Netbios over TCP header. Thus use smb_base() to subtract
173 * them from the calculation.
174 */
175
176 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
177 ((smb_buf(req->outbuf)+alignment_offset)
178 - smb_base(req->outbuf)));
179 /*
180 * Absolute displacement of param bytes sent in this packet.
181 */
182
183 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
184 pp - params);
185 }
186
187 /*
188 * Deal with the data portion.
189 */
190
191 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
192
193 if(data_sent_thistime == 0) {
194 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
195 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
196 } else {
197 /*
198 * The offset of the data bytes is the offset of the
199 * parameter bytes plus the number of parameters being sent this time.
200 */
201
202 SIVAL(req->outbuf, smb_ntr_DataOffset,
203 ((smb_buf(req->outbuf)+alignment_offset) -
204 smb_base(req->outbuf))
205 + params_sent_thistime + data_alignment_offset);
206 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
207 }
208
209 /*
210 * Copy the param bytes into the packet.
211 */
212
213 if(params_sent_thistime) {
214 if (alignment_offset != 0) {
215 memset(smb_buf(req->outbuf), 0,
216 alignment_offset);
217 }
218 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
219 params_sent_thistime);
220 }
221
222 /*
223 * Copy in the data bytes
224 */
225
226 if(data_sent_thistime) {
227 if (data_alignment_offset != 0) {
228 memset((smb_buf(req->outbuf)+alignment_offset+
229 params_sent_thistime), 0,
230 data_alignment_offset);
231 }
232 memcpy(smb_buf(req->outbuf)+alignment_offset
233 +params_sent_thistime+data_alignment_offset,
234 pd,data_sent_thistime);
235 }
236
237 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
238 params_sent_thistime, data_sent_thistime, useable_space));
239 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
240 params_to_send, data_to_send, paramsize, datasize));
241
242 if (NT_STATUS_V(nt_error)) {
243 error_packet_set((char *)req->outbuf,
244 0, 0, nt_error,
245 __LINE__,__FILE__);
246 }
247
248 /* Send the packet */
249 show_msg((char *)req->outbuf);
250 if (!smb1_srv_send(xconn,
251 (char *)req->outbuf,
252 true, req->seqnum+1,
253 IS_CONN_ENCRYPTED(conn),
254 &req->pcd)) {
255 exit_server_cleanly("send_nt_replies: smb1_srv_send failed.");
256 }
257
258 TALLOC_FREE(req->outbuf);
259
260 pp += params_sent_thistime;
261 pd += data_sent_thistime;
262
263 params_to_send -= params_sent_thistime;
264 data_to_send -= data_sent_thistime;
265
266 /*
267 * Sanity check
268 */
269
270 if(params_to_send < 0 || data_to_send < 0) {
271 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
272 params_to_send, data_to_send));
273 exit_server_cleanly("send_nt_replies: internal error");
274 }
275 }
276 }
277
278 /****************************************************************************
279 Reply to an NT create and X call on a pipe
280 ****************************************************************************/
281
282 static void nt_open_pipe(char *fname, connection_struct *conn,
283 struct smb_request *req, uint16_t *ppnum)
284 {
285 files_struct *fsp;
286 NTSTATUS status;
287
288 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
289
290 /* Strip \\ off the name if present. */
291 while (fname[0] == '\\') {
292 fname++;
293 }
294
295 status = open_np_file(req, fname, &fsp);
296 if (!NT_STATUS_IS_OK(status)) {
297 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
298 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
299 ERRDOS, ERRbadpipe);
300 return;
301 }
302 reply_nterror(req, status);
303 return;
304 }
305
306 *ppnum = fsp->fnum;
307 return;
308 }
309
310 /****************************************************************************
311 Reply to an NT create and X call for pipes.
312 ****************************************************************************/
313
314 static void do_ntcreate_pipe_open(connection_struct *conn,
315 struct smb_request *req)
316 {
317 char *fname = NULL;
318 uint16_t pnum = FNUM_FIELD_INVALID;
319 char *p = NULL;
320 uint32_t flags = IVAL(req->vwv+3, 1);
321 TALLOC_CTX *ctx = talloc_tos();
322
323 srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
324
325 if (!fname) {
326 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
327 ERRDOS, ERRbadpipe);
328 return;
329 }
330 nt_open_pipe(fname, conn, req, &pnum);
331
332 if (req->outbuf) {
333 /* error reply */
334 return;
335 }
336
337 /*
338 * Deal with pipe return.
339 */
340
341 if (flags & EXTENDED_RESPONSE_REQUIRED) {
342 /* This is very strange. We
343 * return 50 words, but only set
344 * the wcnt to 42 ? It's definitely
345 * what happens on the wire....
346 */
347 reply_smb1_outbuf(req, 50, 0);
348 SCVAL(req->outbuf,smb_wct,42);
349 } else {
350 reply_smb1_outbuf(req, 34, 0);
351 }
352
353 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
354 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
355
356 p = (char *)req->outbuf + smb_vwv2;
357 p++;
358 SSVAL(p,0,pnum);
359 p += 2;
360 SIVAL(p,0,FILE_WAS_OPENED);
361 p += 4;
362 p += 32;
363 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
364 p += 20;
365 /* File type. */
366 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
367 /* Device state. */
368 SSVAL(p,2, 0x5FF); /* ? */
369 p += 4;
370
371 if (flags & EXTENDED_RESPONSE_REQUIRED) {
372 p += 25;
373 SIVAL(p,0,FILE_GENERIC_ALL);
374 /*
375 * For pipes W2K3 seems to return
376 * 0x12019B next.
377 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
378 */
379 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
380 }
381
382 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
383 }
384
385 struct case_semantics_state {
386 connection_struct *conn;
387 bool case_sensitive;
388 bool case_preserve;
389 bool short_case_preserve;
390 };
391
392 /****************************************************************************
393 Restore case semantics.
394 ****************************************************************************/
395
396 static int restore_case_semantics(struct case_semantics_state *state)
397 {
398 state->conn->case_sensitive = state->case_sensitive;
399 state->conn->case_preserve = state->case_preserve;
400 state->conn->short_case_preserve = state->short_case_preserve;
401 return 0;
402 }
403
404 /****************************************************************************
405 Save case semantics.
406 ****************************************************************************/
407
408 static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
409 connection_struct *conn)
410 {
411 struct case_semantics_state *result;
412
413 if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
414 return NULL;
415 }
416
417 result->conn = conn;
418 result->case_sensitive = conn->case_sensitive;
419 result->case_preserve = conn->case_preserve;
420 result->short_case_preserve = conn->short_case_preserve;
421
422 /* Set to POSIX. */
423 conn->case_sensitive = True;
424 conn->case_preserve = True;
425 conn->short_case_preserve = True;
426
427 talloc_set_destructor(result, restore_case_semantics);
428
429 return result;
430 }
431
432 /*
433 * Calculate the full path name given a relative fid.
434 */
435 static NTSTATUS get_relative_fid_filename(connection_struct *conn,
436 struct smb_request *req,
437 uint16_t root_dir_fid,
438 char *path,
439 char **path_out)
440 {
441 struct files_struct *dir_fsp = NULL;
442 char *new_path = NULL;
443
444 if (root_dir_fid == 0 || path == NULL) {
445 return NT_STATUS_INTERNAL_ERROR;
446 }
447
448 dir_fsp = file_fsp(req, root_dir_fid);
449 if (dir_fsp == NULL) {
450 return NT_STATUS_INVALID_HANDLE;
451 }
452
453 if (fsp_is_alternate_stream(dir_fsp)) {
454 return NT_STATUS_INVALID_HANDLE;
455 }
456
457 if (!dir_fsp->fsp_flags.is_directory) {
458 /*
459 * Check to see if this is a mac fork of some kind.
460 */
461 if (conn->fs_capabilities & FILE_NAMED_STREAMS) {
462 char *stream = NULL;
463
464 stream = strchr_m(path, ':');
465 if (stream != NULL) {
466 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
467 }
468 }
469
470 /*
471 * We need to handle the case when we get a relative open
472 * relative to a file and the pathname is blank - this is a
473 * reopen! (hint from demyn plantenberg)
474 */
475 return NT_STATUS_INVALID_HANDLE;
476 }
477
478 if (ISDOT(dir_fsp->fsp_name->base_name)) {
479 /*
480 * We're at the toplevel dir, the final file name
481 * must not contain ./, as this is filtered out
482 * normally by srvstr_get_path and unix_convert
483 * explicitly rejects paths containing ./.
484 */
485 new_path = talloc_strdup(talloc_tos(), path);
486 } else {
487 /*
488 * Copy in the base directory name.
489 */
490
491 new_path = talloc_asprintf(talloc_tos(),
492 "%s/%s",
493 dir_fsp->fsp_name->base_name,
494 path);
495 }
496 if (new_path == NULL) {
497 return NT_STATUS_NO_MEMORY;
498 }
499
500 *path_out = new_path;
501 return NT_STATUS_OK;
502 }
503
504 /****************************************************************************
505 Reply to an NT create and X call.
506 ****************************************************************************/
507
508 void reply_ntcreate_and_X(struct smb_request *req)
509 {
510 connection_struct *conn = req->conn;
511 struct smb_filename *smb_fname = NULL;
512 char *fname = NULL;
513 uint32_t flags;
514 uint32_t access_mask;
515 uint32_t file_attributes;
516 uint32_t share_access;
517 uint32_t create_disposition;
518 uint32_t create_options;
519 uint16_t root_dir_fid;
520 uint64_t allocation_size;
521 /* Breakout the oplock request bits so we can set the
522 reply bits separately. */
523 uint32_t fattr=0;
524 off_t file_len = 0;
525 int info = 0;
526 files_struct *fsp = NULL;
527 char *p = NULL;
528 struct timespec create_timespec;
529 struct timespec c_timespec;
530 struct timespec a_timespec;
531 struct timespec m_timespec;
532 NTSTATUS status;
533 int oplock_request;
534 uint8_t oplock_granted = NO_OPLOCK_RETURN;
535 struct case_semantics_state *case_state = NULL;
536 uint32_t ucf_flags;
537 TALLOC_CTX *ctx = talloc_tos();
538
539 START_PROFILE(SMBntcreateX);
540
541 if (req->wct < 24) {
542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
543 goto out;
544 }
545
546 flags = IVAL(req->vwv+3, 1);
547 access_mask = IVAL(req->vwv+7, 1);
548 file_attributes = IVAL(req->vwv+13, 1);
549 share_access = IVAL(req->vwv+15, 1);
550 create_disposition = IVAL(req->vwv+17, 1);
551 create_options = IVAL(req->vwv+19, 1);
552 root_dir_fid = (uint16_t)IVAL(req->vwv+5, 1);
553
554 allocation_size = BVAL(req->vwv+9, 1);
555
556 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
557 STR_TERMINATE, &status);
558
559 if (!NT_STATUS_IS_OK(status)) {
560 reply_nterror(req, status);
561 goto out;
562 }
563
564 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
565 "file_attributes = 0x%x, share_access = 0x%x, "
566 "create_disposition = 0x%x create_options = 0x%x "
567 "root_dir_fid = 0x%x, fname = %s\n",
568 (unsigned int)flags,
569 (unsigned int)access_mask,
570 (unsigned int)file_attributes,
571 (unsigned int)share_access,
572 (unsigned int)create_disposition,
573 (unsigned int)create_options,
574 (unsigned int)root_dir_fid,
575 fname));
576
577 /*
578 * we need to remove ignored bits when they come directly from the client
579 * because we reuse some of them for internal stuff
580 */
581 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
582
583 /*
584 * If it's an IPC, use the pipe handler.
585 */
586
587 if (IS_IPC(conn)) {
588 if (lp_nt_pipe_support()) {
589 do_ntcreate_pipe_open(conn, req);
590 goto out;
591 }
592 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
593 goto out;
594 }
595
596 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
597 if (oplock_request) {
598 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
599 ? BATCH_OPLOCK : 0;
600 }
601
602 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
603 case_state = set_posix_case_semantics(ctx, conn);
604 if (!case_state) {
605 reply_nterror(req, NT_STATUS_NO_MEMORY);
606 goto out;
607 }
608 }
609
610 if (root_dir_fid != 0) {
611 char *new_fname = NULL;
612
613 status = get_relative_fid_filename(conn,
614 req,
615 root_dir_fid,
616 fname,
617 &new_fname);
618 if (!NT_STATUS_IS_OK(status)) {
619 reply_nterror(req, status);
620 goto out;
621 }
622 fname = new_fname;
623 }
624
625 ucf_flags = filename_create_ucf_flags(req, create_disposition);
626 status = filename_convert(ctx,
627 conn,
628 fname,
629 ucf_flags,
630 0,
631 &smb_fname);
632
633 TALLOC_FREE(case_state);
634
635 if (!NT_STATUS_IS_OK(status)) {
636 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
637 reply_botherror(req,
638 NT_STATUS_PATH_NOT_COVERED,
639 ERRSRV, ERRbadpath);
640 goto out;
641 }
642 reply_nterror(req, status);
643 goto out;
644 }
645
646 /*
647 * Bug #6898 - clients using Windows opens should
648 * never be able to set this attribute into the
649 * VFS.
650 */
651 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
652
653 status = SMB_VFS_CREATE_FILE(
654 conn, /* conn */
655 req, /* req */
656 smb_fname, /* fname */
657 access_mask, /* access_mask */
658 share_access, /* share_access */
659 create_disposition, /* create_disposition*/
660 create_options, /* create_options */
661 file_attributes, /* file_attributes */
662 oplock_request, /* oplock_request */
663 NULL, /* lease */
664 allocation_size, /* allocation_size */
665 0, /* private_flags */
666 NULL, /* sd */
667 NULL, /* ea_list */
668 &fsp, /* result */
669 &info, /* pinfo */
670 NULL, NULL); /* create context */
671
672 if (!NT_STATUS_IS_OK(status)) {
673 if (open_was_deferred(req->xconn, req->mid)) {
674 /* We have re-scheduled this call, no error. */
675 goto out;
676 }
677 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
678 bool ok = defer_smb1_sharing_violation(req);
679 if (ok) {
680 goto out;
681 }
682 }
683 reply_openerror(req, status);
684 goto out;
685 }
686
687 /* Ensure we're pointing at the correct stat struct. */
688 TALLOC_FREE(smb_fname);
689 smb_fname = fsp->fsp_name;
690
691 /*
692 * If the caller set the extended oplock request bit
693 * and we granted one (by whatever means) - set the
694 * correct bit for extended oplock reply.
695 */
696
697 if (oplock_request &&
698 (lp_fake_oplocks(SNUM(conn))
699 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
700
701 /*
702 * Exclusive oplock granted
703 */
704
705 if (flags & REQUEST_BATCH_OPLOCK) {
706 oplock_granted = BATCH_OPLOCK_RETURN;
707 } else {
708 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
709 }
710 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
711 oplock_granted = LEVEL_II_OPLOCK_RETURN;
712 } else {
713 oplock_granted = NO_OPLOCK_RETURN;
714 }
715
716 file_len = smb_fname->st.st_ex_size;
717
718 if (flags & EXTENDED_RESPONSE_REQUIRED) {
719 /* This is very strange. We
720 * return 50 words, but only set
721 * the wcnt to 42 ? It's definitely
722 * what happens on the wire....
723 */
724 reply_smb1_outbuf(req, 50, 0);
725 SCVAL(req->outbuf,smb_wct,42);
726 } else {
727 reply_smb1_outbuf(req, 34, 0);
728 }
729
730 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
731 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
732
733 p = (char *)req->outbuf + smb_vwv2;
734
735 SCVAL(p, 0, oplock_granted);
736
737 p++;
738 SSVAL(p,0,fsp->fnum);
739 p += 2;
740 if ((create_disposition == FILE_SUPERSEDE)
741 && (info == FILE_WAS_OVERWRITTEN)) {
742 SIVAL(p,0,FILE_WAS_SUPERSEDED);
743 } else {
744 SIVAL(p,0,info);
745 }
746 p += 4;
747
748 fattr = fdos_mode(fsp);
749 if (fattr == 0) {
750 fattr = FILE_ATTRIBUTE_NORMAL;
751 }
752
753 /* Create time. */
754 create_timespec = get_create_timespec(conn, fsp, smb_fname);
755 a_timespec = smb_fname->st.st_ex_atime;
756 m_timespec = smb_fname->st.st_ex_mtime;
757 c_timespec = get_change_timespec(conn, fsp, smb_fname);
758
759 if (lp_dos_filetime_resolution(SNUM(conn))) {
760 dos_filetime_timespec(&create_timespec);
761 dos_filetime_timespec(&a_timespec);
762 dos_filetime_timespec(&m_timespec);
763 dos_filetime_timespec(&c_timespec);
764 }
765
766 put_long_date_full_timespec(conn->ts_res, p, &create_timespec); /* create time. */
767 p += 8;
768 put_long_date_full_timespec(conn->ts_res, p, &a_timespec); /* access time */
769 p += 8;
770 put_long_date_full_timespec(conn->ts_res, p, &m_timespec); /* write time */
771 p += 8;
772 put_long_date_full_timespec(conn->ts_res, p, &c_timespec); /* change time */
773 p += 8;
774 SIVAL(p,0,fattr); /* File Attributes. */
775 p += 4;
776 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
777 p += 8;
778 SOFF_T(p,0,file_len);
779 p += 8;
780 if (flags & EXTENDED_RESPONSE_REQUIRED) {
781 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
782 unsigned int num_streams = 0;
783 struct stream_struct *streams = NULL;
784
785 if (lp_ea_support(SNUM(conn))) {
786 size_t num_names = 0;
787 /* Do we have any EA's ? */
788 status = get_ea_names_from_fsp(
789 ctx, smb_fname->fsp, NULL, &num_names);
790 if (NT_STATUS_IS_OK(status) && num_names) {
791 file_status &= ~NO_EAS;
792 }
793 }
794
795 status = vfs_fstreaminfo(smb_fname->fsp, ctx,
796 &num_streams, &streams);
797 /* There is always one stream, ::$DATA. */
798 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
799 file_status &= ~NO_SUBSTREAMS;
800 }
801 TALLOC_FREE(streams);
802 SSVAL(p,2,file_status);
803 }
804 p += 4;
805 SCVAL(p,0,fsp->fsp_flags.is_directory ? 1 : 0);
806
807 if (flags & EXTENDED_RESPONSE_REQUIRED) {
808 uint32_t perms = 0;
809 p += 25;
810 if (fsp->fsp_flags.is_directory ||
811 fsp->fsp_flags.can_write ||
812 can_write_to_fsp(fsp))
813 {
814 perms = FILE_GENERIC_ALL;
815 } else {
816 perms = FILE_GENERIC_READ|FILE_EXECUTE;
817 }
818 SIVAL(p,0,perms);
819 }
820
821 DEBUG(5,("reply_ntcreate_and_X: %s, open name = %s\n",
822 fsp_fnum_dbg(fsp), smb_fname_str_dbg(smb_fname)));
823
824 out:
825 END_PROFILE(SMBntcreateX);
826 return;
827 }
828
829 /****************************************************************************
830 Reply to a NT_TRANSACT_CREATE call to open a pipe.
831 ****************************************************************************/
832
833 static void do_nt_transact_create_pipe(connection_struct *conn,
834 struct smb_request *req,
835 uint16_t **ppsetup, uint32_t setup_count,
836 char **ppparams, uint32_t parameter_count,
837 char **ppdata, uint32_t data_count)
838 {
839 char *fname = NULL;
840 char *params = *ppparams;
841 uint16_t pnum = FNUM_FIELD_INVALID;
842 char *p = NULL;
843 NTSTATUS status;
844 size_t param_len;
845 uint32_t flags;
846 TALLOC_CTX *ctx = talloc_tos();
847
848 /*
849 * Ensure minimum number of parameters sent.
850 */
851
852 if(parameter_count < 54) {
853 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
854 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
855 return;
856 }
857
858 flags = IVAL(params,0);
859
860 if (req->posix_pathnames) {
861 srvstr_get_path_posix(ctx,
862 params,
863 req->flags2,
864 &fname,
865 params+53,
866 parameter_count-53,
867 STR_TERMINATE,
868 &status);
869 } else {
870 srvstr_get_path(ctx,
871 params,
872 req->flags2,
873 &fname,
874 params+53,
875 parameter_count-53,
876 STR_TERMINATE,
877 &status);
878 }
879 if (!NT_STATUS_IS_OK(status)) {
880 reply_nterror(req, status);
881 return;
882 }
883
884 nt_open_pipe(fname, conn, req, &pnum);
885
886 if (req->outbuf) {
887 /* Error return */
888 return;
889 }
890
891 /* Realloc the size of parameters and data we will return */
892 if (flags & EXTENDED_RESPONSE_REQUIRED) {
893 /* Extended response is 32 more byyes. */
894 param_len = 101;
895 } else {
896 param_len = 69;
897 }
898 params = nttrans_realloc(ppparams, param_len);
899 if(params == NULL) {
900 reply_nterror(req, NT_STATUS_NO_MEMORY);
901 return;
902 }
903
904 p = params;
905 SCVAL(p,0,NO_OPLOCK_RETURN);
906
907 p += 2;
908 SSVAL(p,0,pnum);
909 p += 2;
910 SIVAL(p,0,FILE_WAS_OPENED);
911 p += 8;
912
913 p += 32;
914 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
915 p += 20;
916 /* File type. */
917 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
918 /* Device state. */
919 SSVAL(p,2, 0x5FF); /* ? */
920 p += 4;
921
922 if (flags & EXTENDED_RESPONSE_REQUIRED) {
923 p += 25;
924 SIVAL(p,0,FILE_GENERIC_ALL);
925 /*
926 * For pipes W2K3 seems to return
927 * 0x12019B next.
928 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
929 */
930 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
931 }
932
933 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
934
935 /* Send the required number of replies */
936 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
937
938 return;
939 }
940
941 /****************************************************************************
942 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
943 ****************************************************************************/
944
945 static void call_nt_transact_create(connection_struct *conn,
946 struct smb_request *req,
947 uint16_t **ppsetup, uint32_t setup_count,
948 char **ppparams, uint32_t parameter_count,
949 char **ppdata, uint32_t data_count,
950 uint32_t max_data_count)
951 {
952 struct smb_filename *smb_fname = NULL;
953 char *fname = NULL;
954 char *params = *ppparams;
955 char *data = *ppdata;
956 /* Breakout the oplock request bits so we can set the reply bits separately. */
957 uint32_t fattr=0;
958 off_t file_len = 0;
959 int info = 0;
960 files_struct *fsp = NULL;
961 char *p = NULL;
962 uint32_t flags;
963 uint32_t access_mask;
964 uint32_t file_attributes;
965 uint32_t share_access;
966 uint32_t create_disposition;
967 uint32_t create_options;
968 uint32_t sd_len;
969 struct security_descriptor *sd = NULL;
970 uint32_t ea_len;
971 uint16_t root_dir_fid;
972 struct timespec create_timespec;
973 struct timespec c_timespec;
974 struct timespec a_timespec;
975 struct timespec m_timespec;
976 struct ea_list *ea_list = NULL;
977 NTSTATUS status;
978 size_t param_len;
979 uint64_t allocation_size;
980 int oplock_request;
981 uint8_t oplock_granted;
982 struct case_semantics_state *case_state = NULL;
983 uint32_t ucf_flags;
984 TALLOC_CTX *ctx = talloc_tos();
985
986 DEBUG(5,("call_nt_transact_create\n"));
987
988 /*
989 * If it's an IPC, use the pipe handler.
990 */
991
992 if (IS_IPC(conn)) {
993 if (lp_nt_pipe_support()) {
994 do_nt_transact_create_pipe(
995 conn, req,
996 ppsetup, setup_count,
997 ppparams, parameter_count,
998 ppdata, data_count);
999 goto out;
1000 }
1001 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1002 goto out;
1003 }
1004
1005 /*
1006 * Ensure minimum number of parameters sent.
1007 */
1008
1009 if(parameter_count < 54) {
1010 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1011 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1012 goto out;
1013 }
1014
1015 flags = IVAL(params,0);
1016 access_mask = IVAL(params,8);
1017 file_attributes = IVAL(params,20);
1018 share_access = IVAL(params,24);
1019 create_disposition = IVAL(params,28);
1020 create_options = IVAL(params,32);
1021 sd_len = IVAL(params,36);
1022 ea_len = IVAL(params,40);
1023 root_dir_fid = (uint16_t)IVAL(params,4);
1024 allocation_size = BVAL(params,12);
1025
1026 /*
1027 * we need to remove ignored bits when they come directly from the client
1028 * because we reuse some of them for internal stuff
1029 */
1030 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
1031
1032 if (req->posix_pathnames) {
1033 srvstr_get_path_posix(ctx,
1034 params,
1035 req->flags2,
1036 &fname,
1037 params+53,
1038 parameter_count-53,
1039 STR_TERMINATE,
1040 &status);
1041 } else {
1042 srvstr_get_path(ctx,
1043 params,
1044 req->flags2,
1045 &fname,
1046 params+53,
1047 parameter_count-53,
1048 STR_TERMINATE,
1049 &status);
1050 }
1051 if (!NT_STATUS_IS_OK(status)) {
1052 reply_nterror(req, status);
1053 goto out;
1054 }
1055
1056 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1057 case_state = set_posix_case_semantics(ctx, conn);
1058 if (!case_state) {
1059 reply_nterror(req, NT_STATUS_NO_MEMORY);
1060 goto out;
1061 }
1062 }
1063
1064 if (root_dir_fid != 0) {
1065 char *new_fname = NULL;
1066
1067 status = get_relative_fid_filename(conn,
1068 req,
1069 root_dir_fid,
1070 fname,
1071 &new_fname);
1072 if (!NT_STATUS_IS_OK(status)) {
1073 reply_nterror(req, status);
1074 goto out;
1075 }
1076 fname = new_fname;
1077 }
1078
1079 ucf_flags = filename_create_ucf_flags(req, create_disposition);
1080 status = filename_convert(ctx,
1081 conn,
1082 fname,
1083 ucf_flags,
1084 0,
1085 &smb_fname);
1086
1087 TALLOC_FREE(case_state);
1088
1089 if (!NT_STATUS_IS_OK(status)) {
1090 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1091 reply_botherror(req,
1092 NT_STATUS_PATH_NOT_COVERED,
1093 ERRSRV, ERRbadpath);
1094 goto out;
1095 }
1096 reply_nterror(req, status);
1097 goto out;
1098 }
1099
1100 /* Ensure the data_len is correct for the sd and ea values given. */
1101 if ((ea_len + sd_len > data_count)
1102 || (ea_len > data_count) || (sd_len > data_count)
1103 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1104 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1105 "%u, data_count = %u\n", (unsigned int)ea_len,
1106 (unsigned int)sd_len, (unsigned int)data_count));
1107 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1108 goto out;
1109 }
1110
1111 if (sd_len) {
1112 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
1113 sd_len));
1114
1115 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1116 &sd);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 DEBUG(10, ("call_nt_transact_create: "
1119 "unmarshall_sec_desc failed: %s\n",
1120 nt_errstr(status)));
1121 reply_nterror(req, status);
1122 goto out;
1123 }
1124 }
1125
1126 if (ea_len) {
1127 if (!lp_ea_support(SNUM(conn))) {
1128 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1129 "EA's not supported.\n",
1130 (unsigned int)ea_len));
1131 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1132 goto out;
1133 }
1134
1135 if (ea_len < 10) {
1136 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1137 "too small (should be more than 10)\n",
1138 (unsigned int)ea_len ));
1139 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1140 goto out;
1141 }
1142
1143 /* We have already checked that ea_len <= data_count here. */
1144 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1145 ea_len);
1146 if (ea_list == NULL) {
1147 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1148 goto out;
1149 }
1150
1151 if (!req->posix_pathnames &&
1152 ea_list_has_invalid_name(ea_list)) {
1153 /* Realloc the size of parameters and data we will return */
1154 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1155 /* Extended response is 32 more bytes. */
1156 param_len = 101;
1157 } else {
1158 param_len = 69;
1159 }
1160 params = nttrans_realloc(ppparams, param_len);
1161 if(params == NULL) {
1162 reply_nterror(req, NT_STATUS_NO_MEMORY);
1163 goto out;
1164 }
1165
1166 memset(params, '\0', param_len);
1167 send_nt_replies(conn, req, STATUS_INVALID_EA_NAME,
1168 params, param_len, NULL, 0);
1169 goto out;
1170 }
1171 }
1172
1173 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1174 if (oplock_request) {
1175 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
1176 ? BATCH_OPLOCK : 0;
1177 }
1178
1179 /*
1180 * Bug #6898 - clients using Windows opens should
1181 * never be able to set this attribute into the
1182 * VFS.
1183 */
1184 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1185
1186 status = SMB_VFS_CREATE_FILE(
1187 conn, /* conn */
1188 req, /* req */
1189 smb_fname, /* fname */
1190 access_mask, /* access_mask */
1191 share_access, /* share_access */
1192 create_disposition, /* create_disposition*/
1193 create_options, /* create_options */
1194 file_attributes, /* file_attributes */
1195 oplock_request, /* oplock_request */
1196 NULL, /* lease */
1197 allocation_size, /* allocation_size */
1198 0, /* private_flags */
1199 sd, /* sd */
1200 ea_list, /* ea_list */
1201 &fsp, /* result */
1202 &info, /* pinfo */
1203 NULL, NULL); /* create context */
1204
1205 if(!NT_STATUS_IS_OK(status)) {
1206 if (open_was_deferred(req->xconn, req->mid)) {
1207 /* We have re-scheduled this call, no error. */
1208 return;
1209 }
1210 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
1211 bool ok = defer_smb1_sharing_violation(req);
1212 if (ok) {
1213 return;
1214 }
1215 }
1216 reply_openerror(req, status);
1217 goto out;
1218 }
1219
1220 /* Ensure we're pointing at the correct stat struct. */
1221 TALLOC_FREE(smb_fname);
1222 smb_fname = fsp->fsp_name;
1223
1224 /*
1225 * If the caller set the extended oplock request bit
1226 * and we granted one (by whatever means) - set the
1227 * correct bit for extended oplock reply.
1228 */
1229
1230 if (oplock_request &&
1231 (lp_fake_oplocks(SNUM(conn))
1232 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1233
1234 /*
1235 * Exclusive oplock granted
1236 */
1237
1238 if (flags & REQUEST_BATCH_OPLOCK) {
1239 oplock_granted = BATCH_OPLOCK_RETURN;
1240 } else {
1241 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1242 }
1243 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1244 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1245 } else {
1246 oplock_granted = NO_OPLOCK_RETURN;
1247 }
1248
1249 file_len = smb_fname->st.st_ex_size;
1250
1251 /* Realloc the size of parameters and data we will return */
1252 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1253 /* Extended response is 32 more byyes. */
1254 param_len = 101;
1255 } else {
1256 param_len = 69;
1257 }
1258 params = nttrans_realloc(ppparams, param_len);
1259 if(params == NULL) {
1260 reply_nterror(req, NT_STATUS_NO_MEMORY);
1261 goto out;
1262 }
1263
1264 p = params;
1265 SCVAL(p, 0, oplock_granted);
1266
1267 p += 2;
1268 SSVAL(p,0,fsp->fnum);
1269 p += 2;
1270 if ((create_disposition == FILE_SUPERSEDE)
1271 && (info == FILE_WAS_OVERWRITTEN)) {
1272 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1273 } else {
1274 SIVAL(p,0,info);
1275 }
1276 p += 8;
1277
1278 fattr = fdos_mode(fsp);
1279 if (fattr == 0) {
1280 fattr = FILE_ATTRIBUTE_NORMAL;
1281 }
1282
1283 /* Create time. */
1284 create_timespec = get_create_timespec(conn, fsp, smb_fname);
1285 a_timespec = smb_fname->st.st_ex_atime;
1286 m_timespec = smb_fname->st.st_ex_mtime;
1287 c_timespec = get_change_timespec(conn, fsp, smb_fname);
1288
1289 if (lp_dos_filetime_resolution(SNUM(conn))) {
1290 dos_filetime_timespec(&create_timespec);
1291 dos_filetime_timespec(&a_timespec);
1292 dos_filetime_timespec(&m_timespec);
1293 dos_filetime_timespec(&c_timespec);
1294 }
1295
1296 put_long_date_full_timespec(conn->ts_res, p, &create_timespec); /* create time. */
1297 p += 8;
1298 put_long_date_full_timespec(conn->ts_res, p, &a_timespec); /* access time */
1299 p += 8;
1300 put_long_date_full_timespec(conn->ts_res, p, &m_timespec); /* write time */
1301 p += 8;
1302 put_long_date_full_timespec(conn->ts_res, p, &c_timespec); /* change time */
1303 p += 8;
1304 SIVAL(p,0,fattr); /* File Attributes. */
1305 p += 4;
1306 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1307 p += 8;
1308 SOFF_T(p,0,file_len);
1309 p += 8;
1310 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1311 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
1312 unsigned int num_streams = 0;
1313 struct stream_struct *streams = NULL;
1314
1315 if (lp_ea_support(SNUM(conn))) {
1316 size_t num_names = 0;
1317 /* Do we have any EA's ? */
1318 status = get_ea_names_from_fsp(
1319 ctx, smb_fname->fsp, NULL, &num_names);
1320 if (NT_STATUS_IS_OK(status) && num_names) {
1321 file_status &= ~NO_EAS;
1322 }
1323 }
1324
1325 status = vfs_fstreaminfo(smb_fname->fsp, ctx,
1326 &num_streams, &streams);
1327 /* There is always one stream, ::$DATA. */
1328 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
1329 file_status &= ~NO_SUBSTREAMS;
1330 }
1331 TALLOC_FREE(streams);
1332 SSVAL(p,2,file_status);
1333 }
1334 p += 4;
1335 SCVAL(p,0,fsp->fsp_flags.is_directory ? 1 : 0);
1336
1337 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1338 uint32_t perms = 0;
1339 p += 25;
1340 if (fsp->fsp_flags.is_directory ||
1341 fsp->fsp_flags.can_write ||
1342 can_write_to_fsp(fsp))
1343 {
1344 perms = FILE_GENERIC_ALL;
1345 } else {
1346 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1347 }
1348 SIVAL(p,0,perms);
1349 }
1350
1351 DEBUG(5,("call_nt_transact_create: open name = %s\n",
1352 smb_fname_str_dbg(smb_fname)));
1353
1354 /* Send the required number of replies */
1355 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1356 out:
1357 return;
1358 }
1359
1360 /****************************************************************************
1361 Reply to a NT CANCEL request.
1362 conn POINTER CAN BE NULL HERE !
1363 ****************************************************************************/
1364
1365 void reply_ntcancel(struct smb_request *req)
1366 {
1367 struct smbXsrv_connection *xconn = req->xconn;
1368 struct smbd_server_connection *sconn = req->sconn;
1369 bool found;
1370
1371 /*
1372 * Go through and cancel any pending change notifies.
1373 */
1374
1375 START_PROFILE(SMBntcancel);
1376 smb1_srv_cancel_sign_response(xconn);
1377 found = remove_pending_change_notify_requests_by_mid(sconn, req->mid);
1378 if (!found) {
1379 smbd_smb1_brl_finish_by_mid(sconn, req->mid);
1380 }
1381
1382 DEBUG(3,("reply_ntcancel: cancel called on mid = %llu.\n",
1383 (unsigned long long)req->mid));
1384
1385 END_PROFILE(SMBntcancel);
1386 return;
1387 }
1388
1389 /****************************************************************************
1390 Reply to a NT rename request.
1391 ****************************************************************************/
1392
1393 void reply_ntrename(struct smb_request *req)
1394 {
1395 connection_struct *conn = req->conn;
1396 struct smb_filename *smb_fname_old = NULL;
1397 struct smb_filename *smb_fname_new = NULL;
1398 char *oldname = NULL;
1399 char *newname = NULL;
1400 const char *dst_original_lcomp = NULL;
1401 const char *p;
1402 NTSTATUS status;
1403 uint32_t attrs;
1404 uint32_t ucf_flags_src = ucf_flags_from_smb_request(req);
1405 uint32_t ucf_flags_dst = ucf_flags_from_smb_request(req);
1406 uint16_t rename_type;
1407 TALLOC_CTX *ctx = talloc_tos();
1408 bool stream_rename = false;
1409
1410 START_PROFILE(SMBntrename);
1411
1412 if (req->wct < 4) {
1413 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1414 goto out;
1415 }
1416
1417 attrs = SVAL(req->vwv+0, 0);
1418 rename_type = SVAL(req->vwv+1, 0);
1419
1420 p = (const char *)req->buf + 1;
1421 p += srvstr_get_path_req(ctx, req, &oldname, p, STR_TERMINATE,
1422 &status);
1423 if (!NT_STATUS_IS_OK(status)) {
1424 reply_nterror(req, status);
1425 goto out;
1426 }
1427
1428 if (!req->posix_pathnames && ms_has_wild(oldname)) {
1429 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1430 goto out;
1431 }
1432
1433 p++;
1434 p += srvstr_get_path_req(ctx, req, &newname, p, STR_TERMINATE,
1435 &status);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 reply_nterror(req, status);
1438 goto out;
1439 }
1440
1441 if (!req->posix_pathnames && ms_has_wild(newname)) {
1442 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1443 goto out;
1444 }
1445
1446 if (!req->posix_pathnames) {
1447 /* The newname must begin with a ':' if the
1448 oldname contains a ':'. */
1449 if (strchr_m(oldname, ':')) {
1450 if (newname[0] != ':') {
1451 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1452 goto out;
1453 }
1454 stream_rename = true;
1455 }
1456 }
1457
1458 /* rename_internals() calls unix_convert(), so don't call it here. */
1459 status = filename_convert(ctx, conn,
1460 oldname,
1461 ucf_flags_src,
1462 0,
1463 &smb_fname_old);
1464 if (!NT_STATUS_IS_OK(status)) {
1465 if (NT_STATUS_EQUAL(status,
1466 NT_STATUS_PATH_NOT_COVERED)) {
1467 reply_botherror(req,
1468 NT_STATUS_PATH_NOT_COVERED,
1469 ERRSRV, ERRbadpath);
1470 goto out;
1471 }
1472 reply_nterror(req, status);
1473 goto out;
1474 }
1475
1476 /* Get the last component of the destination for rename_internals(). */
1477 dst_original_lcomp = get_original_lcomp(ctx,
1478 conn,
1479 newname,
1480 ucf_flags_dst);
1481 if (dst_original_lcomp == NULL) {
1482 reply_nterror(req, NT_STATUS_NO_MEMORY);
1483 goto out;
1484 }
1485
1486 status = filename_convert(ctx, conn,
1487 newname,
1488 ucf_flags_dst,
1489 0,
1490 &smb_fname_new);
1491 if (!NT_STATUS_IS_OK(status)) {
1492 if (NT_STATUS_EQUAL(status,
1493 NT_STATUS_PATH_NOT_COVERED)) {
1494 reply_botherror(req,
1495 NT_STATUS_PATH_NOT_COVERED,
1496 ERRSRV, ERRbadpath);
1497 goto out;
1498 }
1499 reply_nterror(req, status);
1500 goto out;
1501 }
1502
1503 if (stream_rename) {
1504 /* smb_fname_new must be the same as smb_fname_old. */
1505 TALLOC_FREE(smb_fname_new->base_name);
1506 smb_fname_new->base_name = talloc_strdup(smb_fname_new,
1507 smb_fname_old->base_name);
1508 if (!smb_fname_new->base_name) {
1509 reply_nterror(req, NT_STATUS_NO_MEMORY);
1510 goto out;
1511 }
1512 }
1513
1514 DEBUG(3,("reply_ntrename: %s -> %s\n",
1515 smb_fname_str_dbg(smb_fname_old),
1516 smb_fname_str_dbg(smb_fname_new)));
1517
1518 switch(rename_type) {
1519 case RENAME_FLAG_RENAME:
1520 status = rename_internals(ctx,
1521 conn,
1522 req,
1523 smb_fname_old,
1524 smb_fname_new,
1525 dst_original_lcomp,
1526 attrs,
1527 false,
1528 DELETE_ACCESS);
1529 break;
1530 case RENAME_FLAG_HARD_LINK:
1531 status = hardlink_internals(ctx,
1532 conn,
1533 req,
1534 false,
1535 smb_fname_old,
1536 smb_fname_new);
1537 break;
1538 case RENAME_FLAG_COPY:
1539 status = copy_internals(ctx,
1540 conn,
1541 req,
1542 smb_fname_old,
1543 smb_fname_new,
1544 attrs);
1545 break;
1546 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1547 status = NT_STATUS_INVALID_PARAMETER;
1548 break;
1549 default:
1550 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1551 break;
1552 }
1553
1554 if (!NT_STATUS_IS_OK(status)) {
1555 if (open_was_deferred(req->xconn, req->mid)) {
1556 /* We have re-scheduled this call. */
1557 goto out;
1558 }
1559 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
1560 bool ok = defer_smb1_sharing_violation(req);
1561 if (ok) {
1562 goto out;
1563 }
1564 }
1565
1566 reply_nterror(req, status);
1567 goto out;
1568 }
1569
1570 reply_smb1_outbuf(req, 0, 0);
1571 out:
1572 END_PROFILE(SMBntrename);
1573 return;
1574 }
1575
1576 /****************************************************************************
1577 Reply to a notify change - queue the request and
1578 don't allow a directory to be opened.
1579 ****************************************************************************/
1580
1581 static void smbd_smb1_notify_reply(struct smb_request *req,
1582 NTSTATUS error_code,
1583 uint8_t *buf, size_t len)
1584 {
1585 send_nt_replies(req->conn, req, error_code, (char *)buf, len, NULL, 0);
1586 }
1587
1588 static void call_nt_transact_notify_change(connection_struct *conn,
1589 struct smb_request *req,
1590 uint16_t **ppsetup,
1591 uint32_t setup_count,
1592 char **ppparams,
1593 uint32_t parameter_count,
1594 char **ppdata, uint32_t data_count,
1595 uint32_t max_data_count,
1596 uint32_t max_param_count)
1597 {
1598 uint16_t *setup = *ppsetup;
1599 files_struct *fsp;
1600 uint32_t filter;
1601 NTSTATUS status;
1602 bool recursive;
1603
1604 if(setup_count < 6) {
1605 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1606 return;
1607 }
1608
1609 fsp = file_fsp(req, SVAL(setup,4));
1610 filter = IVAL(setup, 0);
1611 recursive = (SVAL(setup, 6) != 0) ? True : False;
1612
1613 DEBUG(3,("call_nt_transact_notify_change\n"));
1614
1615 if(!fsp) {
1616 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1617 return;
1618 }
1619
1620 {
1621 char *filter_string;
1622
1623 if (!(filter_string = notify_filter_string(NULL, filter))) {
1624 reply_nterror(req,NT_STATUS_NO_MEMORY);
1625 return;
1626 }
1627
1628 DEBUG(3,("call_nt_transact_notify_change: notify change "
1629 "called on %s, filter = %s, recursive = %d\n",
1630 fsp_str_dbg(fsp), filter_string, recursive));
1631
1632 TALLOC_FREE(filter_string);
1633 }
1634
1635 if((!fsp->fsp_flags.is_directory) || (conn != fsp->conn)) {
1636 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1637 return;
1638 }
1639
1640 if (fsp->notify == NULL) {
1641
1642 status = change_notify_create(fsp,
1643 max_param_count,
1644 filter,
1645 recursive);
1646 if (!NT_STATUS_IS_OK(status)) {
1647 DEBUG(10, ("change_notify_create returned %s\n",
1648 nt_errstr(status)));
1649 reply_nterror(req, status);
1650 return;
1651 }
1652 }
1653
1654 if (change_notify_fsp_has_changes(fsp)) {
1655
1656 /*
1657 * We've got changes pending, respond immediately
1658 */
1659
1660 /*
1661 * TODO: write a torture test to check the filtering behaviour
1662 * here.
1663 */
1664
1665 change_notify_reply(req,
1666 NT_STATUS_OK,
1667 max_param_count,
1668 fsp->notify,
1669 smbd_smb1_notify_reply);
1670
1671 /*
1672 * change_notify_reply() above has independently sent its
1673 * results
1674 */
1675 return;
1676 }
1677
1678 /*
1679 * No changes pending, queue the request
1680 */
1681
1682 status = change_notify_add_request(req,
1683 max_param_count,
1684 filter,
1685 recursive, fsp,
1686 smbd_smb1_notify_reply);
1687 if (!NT_STATUS_IS_OK(status)) {
1688 reply_nterror(req, status);
1689 }
1690 return;
1691 }
1692
1693 /****************************************************************************
1694 Reply to an NT transact rename command.
1695 ****************************************************************************/
1696
1697 static void call_nt_transact_rename(connection_struct *conn,
1698 struct smb_request *req,
1699 uint16_t **ppsetup, uint32_t setup_count,
1700 char **ppparams, uint32_t parameter_count,
1701 char **ppdata, uint32_t data_count,
1702 uint32_t max_data_count)
1703 {
1704 char *params = *ppparams;
1705 char *new_name = NULL;
1706 files_struct *fsp = NULL;
1707 NTSTATUS status;
1708 TALLOC_CTX *ctx = talloc_tos();
1709
1710 if(parameter_count < 5) {
1711 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1712 return;
1713 }
1714
1715 fsp = file_fsp(req, SVAL(params, 0));
1716 if (!check_fsp(conn, req, fsp)) {
1717 return;
1718 }
1719 if (req->posix_pathnames) {
1720 srvstr_get_path_posix(ctx,
1721 params,
1722 req->flags2,
1723 &new_name,
1724 params+4,
1725 parameter_count - 4,
1726 STR_TERMINATE,
1727 &status);
1728 } else {
1729 srvstr_get_path(ctx,
1730 params,
1731 req->flags2,
1732 &new_name,
1733 params+4,
1734 parameter_count - 4,
1735 STR_TERMINATE,
1736 &status);
1737 }
1738
1739 if (!NT_STATUS_IS_OK(status)) {
1740 reply_nterror(req, status);
1741 return;
1742 }
1743
1744 /*
1745 * W2K3 ignores this request as the RAW-RENAME test
1746 * demonstrates, so we do.
1747 */
1748 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1749
1750 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1751 fsp_str_dbg(fsp), new_name));
1752
1753 return;
1754 }
1755
1756 /****************************************************************************
1757 SMB1 reply to query a security descriptor.
1758 ****************************************************************************/
1759
1760 static void call_nt_transact_query_security_desc(connection_struct *conn,
1761 struct smb_request *req,
1762 uint16_t **ppsetup,
1763 uint32_t setup_count,
1764 char **ppparams,
1765 uint32_t parameter_count,
1766 char **ppdata,
1767 uint32_t data_count,
1768 uint32_t max_data_count)
1769 {
1770 char *params = *ppparams;
1771 char *data = *ppdata;
1772 size_t sd_size = 0;
1773 uint32_t security_info_wanted;
1774 files_struct *fsp = NULL;
1775 NTSTATUS status;
1776 uint8_t *marshalled_sd = NULL;
1777
1778 if(parameter_count < 8) {
1779 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1780 return;
1781 }
1782
1783 fsp = file_fsp(req, SVAL(params,0));
1784 if(!fsp) {
1785 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1786 return;
1787 }
1788
1789 security_info_wanted = IVAL(params,4);
1790
1791 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, "
1792 "info_wanted = 0x%x\n", fsp_str_dbg(fsp),
1793 (unsigned int)security_info_wanted));
1794
1795 params = nttrans_realloc(ppparams, 4);
1796 if(params == NULL) {
1797 reply_nterror(req, NT_STATUS_NO_MEMORY);
1798 return;
1799 }
1800
1801 /*
1802 * Get the permissions to return.
1803 */
1804
1805 status = smbd_do_query_security_desc(conn,
1806 talloc_tos(),
1807 fsp,
1808 security_info_wanted &
1809 SMB_SUPPORTED_SECINFO_FLAGS,
1810 max_data_count,
1811 &marshalled_sd,
1812 &sd_size);
1813
1814 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
1815 SIVAL(params,0,(uint32_t)sd_size);
1816 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1817 params, 4, NULL, 0);
1818 return;
1819 }
1820
1821 if (!NT_STATUS_IS_OK(status)) {
1822 reply_nterror(req, status);
1823 return;
1824 }
1825
1826 SMB_ASSERT(sd_size > 0);
1827
1828 SIVAL(params,0,(uint32_t)sd_size);
1829
1830 if (max_data_count < sd_size) {
1831 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1832 params, 4, NULL, 0);
1833 return;
1834 }
1835
1836 /*
1837 * Allocate the data we will return.
1838 */
1839
1840 data = nttrans_realloc(ppdata, sd_size);
1841 if(data == NULL) {
1842 reply_nterror(req, NT_STATUS_NO_MEMORY);
1843 return;
1844 }
1845
1846 memcpy(data, marshalled_sd, sd_size);
1847
1848 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1849
1850 return;
1851 }
1852
1853 /****************************************************************************
1854 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1855 ****************************************************************************/
1856
1857 static void call_nt_transact_set_security_desc(connection_struct *conn,
1858 struct smb_request *req,
1859 uint16_t **ppsetup,
1860 uint32_t setup_count,
1861 char **ppparams,
1862 uint32_t parameter_count,
1863 char **ppdata,
1864 uint32_t data_count,
1865 uint32_t max_data_count)
1866 {
1867 char *params= *ppparams;
1868 char *data = *ppdata;
1869 files_struct *fsp = NULL;
1870 uint32_t security_info_sent = 0;
1871 NTSTATUS status;
1872
1873 if(parameter_count < 8) {
1874 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1875 return;
1876 }
1877
1878 if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1879 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1880 return;
1881 }
1882
1883 if (!CAN_WRITE(fsp->conn)) {
1884 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1885 return;
1886 }
1887
1888 if(!lp_nt_acl_support(SNUM(conn))) {
1889 goto done;
1890 }
1891
1892 security_info_sent = IVAL(params,4);
1893
1894 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n",
1895 fsp_str_dbg(fsp), (unsigned int)security_info_sent));
1896
1897 if (data_count == 0) {
1898 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1899 return;
1900 }
1901
1902 status = set_sd_blob(fsp, (uint8_t *)data, data_count,
1903 security_info_sent & SMB_SUPPORTED_SECINFO_FLAGS);
1904 if (!NT_STATUS_IS_OK(status)) {
1905 reply_nterror(req, status);
1906 return;
1907 }
1908
1909 done:
1910 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1911 return;
1912 }
1913
1914 /****************************************************************************
1915 Reply to NT IOCTL
1916 ****************************************************************************/
1917
1918 static void call_nt_transact_ioctl(connection_struct *conn,
1919 struct smb_request *req,
1920 uint16_t **ppsetup, uint32_t setup_count,
1921 char **ppparams, uint32_t parameter_count,
1922 char **ppdata, uint32_t data_count,
1923 uint32_t max_data_count)
1924 {
1925 NTSTATUS status;
1926 uint32_t function;
1927 uint16_t fidnum;
1928 files_struct *fsp;
1929 uint8_t isFSctl;
1930 uint8_t compfilter;
1931 char *out_data = NULL;
1932 uint32_t out_data_len = 0;
1933 char *pdata = *ppdata;
1934 TALLOC_CTX *ctx = talloc_tos();
1935
1936 if (setup_count != 8) {
1937 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1938 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1939 return;
1940 }
1941
1942 function = IVAL(*ppsetup, 0);
1943 fidnum = SVAL(*ppsetup, 4);
1944 isFSctl = CVAL(*ppsetup, 6);
1945 compfilter = CVAL(*ppsetup, 7);
1946
1947 DEBUG(10, ("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
1948 function, fidnum, isFSctl, compfilter));
1949
1950 fsp=file_fsp(req, fidnum);
1951
1952 /*
1953 * We don't really implement IOCTLs, especially on files.
1954 */
1955 if (!isFSctl) {
1956 DEBUG(10, ("isFSctl: 0x%02X indicates IOCTL, not FSCTL!\n",
1957 isFSctl));
1958 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1959 return;
1960 }
1961
1962 /* Has to be for an open file! */
1963 if (!check_fsp_open(conn, req, fsp)) {
1964 return;
1965 }
1966
1967 SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
1968
1969 /*
1970 * out_data might be allocated by the VFS module, but talloc should be
1971 * used, and should be cleaned up when the request ends.
1972 */
1973 status = SMB_VFS_FSCTL(fsp,
1974 ctx,
1975 function,
1976 req->flags2,
1977 (uint8_t *)pdata,
1978 data_count,
1979 (uint8_t **)&out_data,
1980 max_data_count,
1981 &out_data_len);
1982 if (!NT_STATUS_IS_OK(status)) {
1983 reply_nterror(req, status);
1984 } else {
1985 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, out_data, out_data_len);
1986 }
1987 }
1988
1989
1990 #ifdef HAVE_SYS_QUOTAS
1991 /****************************************************************************
1992 Reply to get user quota
1993 ****************************************************************************/
1994
1995 static void call_nt_transact_get_user_quota(connection_struct *conn,
1996 struct smb_request *req,
1997 uint16_t **ppsetup,
1998 uint32_t setup_count,
1999 char **ppparams,
2000 uint32_t parameter_count,
2001 char **ppdata,
2002 uint32_t data_count,
2003 uint32_t max_data_count)
2004 {
2005 const struct loadparm_substitution *lp_sub =
2006 loadparm_s3_global_substitution();
2007 NTSTATUS nt_status = NT_STATUS_OK;
2008 char *params = *ppparams;
2009 char *pdata = *ppdata;
2010 int data_len = 0;
2011 int param_len = 0;
2012 files_struct *fsp = NULL;
2013 DATA_BLOB blob = data_blob_null;
2014 struct nttrans_query_quota_params info = {0};
2015 enum ndr_err_code err;
2016 TALLOC_CTX *tmp_ctx = NULL;
2017 uint32_t resp_len = 0;
2018 uint8_t *resp_data = 0;
2019
2020 tmp_ctx = talloc_init("ntquota_list");
2021 if (!tmp_ctx) {
2022 nt_status = NT_STATUS_NO_MEMORY;
2023 goto error;
2024 }
2025
2026 /* access check */
2027 if (get_current_uid(conn) != sec_initial_uid()) {
2028 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2029 "[%s]\n", lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
2030 conn->session_info->unix_info->unix_name));
2031 nt_status = NT_STATUS_ACCESS_DENIED;
2032 goto error;
2033 }
2034
2035 blob.data = (uint8_t*)params;
2036 blob.length = parameter_count;
2037
2038 err = ndr_pull_struct_blob(&blob, tmp_ctx, &info,
2039 (ndr_pull_flags_fn_t)ndr_pull_nttrans_query_quota_params);
2040
2041 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2042 DEBUG(0,("TRANSACT_GET_USER_QUOTA: failed to pull "
2043 "query_quota_params."));
2044 nt_status = NT_STATUS_INVALID_PARAMETER;
2045 goto error;
2046 }
2047 DBG_DEBUG("info.return_single_entry = %u, info.restart_scan = %u, "
2048 "info.sid_list_length = %u, info.start_sid_length = %u, "
2049 "info.start_sid_offset = %u\n",
2050 (unsigned int)info.return_single_entry,
2051 (unsigned int)info.restart_scan,
2052 (unsigned int)info.sid_list_length,
2053 (unsigned int)info.start_sid_length,
2054 (unsigned int)info.start_sid_offset);
2055
2056 /* set blob to point at data for further parsing */
2057 blob.data = (uint8_t*)pdata;
2058 blob.length = data_count;
2059 /*
2060 * Although MS-SMB ref is ambiguous here, a microsoft client will
2061 * only ever send a start sid (as part of a list) with
2062 * sid_list_length & start_sid_offset both set to the actual list
2063 * length. Note: Only a single result is returned in this case
2064 * In the case where either start_sid_offset or start_sid_length
2065 * are set alone or if both set (but have different values) then
2066 * it seems windows will return a number of entries from the start
2067 * of the list of users with quotas set. This behaviour is undocumented
2068 * and windows clients do not send messages of that type. As such we
2069 * currently will reject these requests.
2070 */
2071 if (info.start_sid_length
2072 || (info.sid_list_length != info.start_sid_offset)) {
2073 DBG_ERR("TRANSACT_GET_USER_QUOTA: unsupported single or "
2074 "compound sid format\n");
2075 nt_status = NT_STATUS_INVALID_PARAMETER;
2076 goto error;
2077 }
2078
2079 /* maybe we can check the quota_fnum */
2080 fsp = file_fsp(req, info.fid);
2081 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2082 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2083 nt_status = NT_STATUS_INVALID_HANDLE;
2084 goto error;
2085 }
2086 nt_status = smbd_do_query_getinfo_quota(tmp_ctx,
2087 fsp,
2088 info.restart_scan,
2089 info.return_single_entry,
2090 info.sid_list_length,
2091 &blob,
2092 max_data_count,
2093 &resp_data,
2094 &resp_len);
2095 if (!NT_STATUS_IS_OK(nt_status)) {
2096 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
2097 goto error;
2098 }
2099 nt_status = NT_STATUS_OK;
2100 }
2101
2102 param_len = 4;
2103 params = nttrans_realloc(ppparams, param_len);
2104 if(params == NULL) {
2105 nt_status = NT_STATUS_NO_MEMORY;
2106 goto error;
2107 }
2108
2109 data_len = resp_len;
2110 SIVAL(params, 0, data_len);
2111 pdata = nttrans_realloc(ppdata, data_len);
2112 memcpy(pdata, resp_data, data_len);
2113
2114 TALLOC_FREE(tmp_ctx);
2115 send_nt_replies(conn, req, nt_status, params, param_len,
2116 pdata, data_len);
2117 return;
2118 error:
2119 TALLOC_FREE(tmp_ctx);
2120 reply_nterror(req, nt_status);
2121 }
2122
2123 /****************************************************************************
2124 Reply to set user quota
2125 ****************************************************************************/
2126
2127 static void call_nt_transact_set_user_quota(connection_struct *conn,
2128 struct smb_request *req,
2129 uint16_t **ppsetup,
2130 uint32_t setup_count,
2131 char **ppparams,
2132 uint32_t parameter_count,
2133 char **ppdata,
2134 uint32_t data_count,
2135 uint32_t max_data_count)
2136 {
2137 const struct loadparm_substitution *lp_sub =
2138 loadparm_s3_global_substitution();
2139 char *params = *ppparams;
2140 char *pdata = *ppdata;
2141 int data_len=0,param_len=0;
2142 SMB_NTQUOTA_STRUCT qt;
2143 struct file_quota_information info = {0};
2144 enum ndr_err_code err;
2145 struct dom_sid sid;
2146 DATA_BLOB inblob;
2147 files_struct *fsp = NULL;
2148 TALLOC_CTX *ctx = NULL;
2149 NTSTATUS status = NT_STATUS_OK;
2150 ZERO_STRUCT(qt);
2151
2152 /* access check */
2153 if (get_current_uid(conn) != sec_initial_uid()) {
2154 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2155 "[%s]\n", lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
2156 conn->session_info->unix_info->unix_name));
2157 status = NT_STATUS_ACCESS_DENIED;
2158 goto error;
2159 }
2160
2161 /*
2162 * Ensure minimum number of parameters sent.
2163 */
2164
2165 if (parameter_count < 2) {
2166 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2167 status = NT_STATUS_INVALID_PARAMETER;
2168 goto error;
2169 }
2170
2171 /* maybe we can check the quota_fnum */
2172 fsp = file_fsp(req, SVAL(params,0));
2173 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2174 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2175 status = NT_STATUS_INVALID_HANDLE;
2176 goto error;
2177 }
2178
2179 ctx = talloc_init("set_user_quota");
2180 if (!ctx) {
2181 status = NT_STATUS_NO_MEMORY;
2182 goto error;
2183 }
2184 inblob.data = (uint8_t*)pdata;
2185 inblob.length = data_count;
2186
2187 err = ndr_pull_struct_blob(
2188 &inblob,
2189 ctx,
2190 &info,
2191 (ndr_pull_flags_fn_t)ndr_pull_file_quota_information);
2192
2193 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2194 DEBUG(0,("TRANSACT_SET_USER_QUOTA: failed to pull "
2195 "file_quota_information\n"));
2196 status = NT_STATUS_INVALID_PARAMETER;
2197 goto error;
2198 }
2199 qt.usedspace = info.quota_used;
2200
2201 qt.softlim = info.quota_threshold;
2202
2203 qt.hardlim = info.quota_limit;
2204
2205 sid = info.sid;
2206
2207 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2208 status = NT_STATUS_INTERNAL_ERROR;
2209 goto error;
2210 }
2211
2212 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2213 pdata, data_len);
2214 TALLOC_FREE(ctx);
2215 return;
2216 error:
2217 TALLOC_FREE(ctx);
2218 reply_nterror(req, status);
2219 }
2220 #endif /* HAVE_SYS_QUOTAS */
2221
2222 static void handle_nttrans(connection_struct *conn,
2223 struct trans_state *state,
2224 struct smb_request *req)
2225 {
2226 if (get_Protocol() >= PROTOCOL_NT1) {
2227 req->flags2 |= 0x40; /* IS_LONG_NAME */
2228 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_flg2,req->flags2);
2229 }
2230
2231
2232 SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2233
2234 /* Now we must call the relevant NT_TRANS function */
2235 switch(state->call) {
2236 case NT_TRANSACT_CREATE:
2237 {
2238 START_PROFILE(NT_transact_create);
2239 call_nt_transact_create(
2240 conn, req,
2241 &state->setup, state->setup_count,
2242 &state->param, state->total_param,
2243 &state->data, state->total_data,
2244 state->max_data_return);
2245 END_PROFILE(NT_transact_create);
2246 break;
2247 }
2248
2249 case NT_TRANSACT_IOCTL:
2250 {
2251 START_PROFILE(NT_transact_ioctl);
2252 call_nt_transact_ioctl(
2253 conn, req,
2254 &state->setup, state->setup_count,
2255 &state->param, state->total_param,
2256 &state->data, state->total_data,
2257 state->max_data_return);
2258 END_PROFILE(NT_transact_ioctl);
2259 break;
2260 }
2261
2262 case NT_TRANSACT_SET_SECURITY_DESC:
2263 {
2264 START_PROFILE(NT_transact_set_security_desc);
2265 call_nt_transact_set_security_desc(
2266 conn, req,
2267 &state->setup, state->setup_count,
2268 &state->param, state->total_param,
2269 &state->data, state->total_data,
2270 state->max_data_return);
2271 END_PROFILE(NT_transact_set_security_desc);
2272 break;
2273 }
2274
2275 case NT_TRANSACT_NOTIFY_CHANGE:
2276 {
2277 START_PROFILE(NT_transact_notify_change);
2278 call_nt_transact_notify_change(
2279 conn, req,
2280 &state->setup, state->setup_count,
2281 &state->param, state->total_param,
2282 &state->data, state->total_data,
2283 state->max_data_return,
2284 state->max_param_return);
2285 END_PROFILE(NT_transact_notify_change);
2286 break;
2287 }
2288
2289 case NT_TRANSACT_RENAME:
2290 {
2291 START_PROFILE(NT_transact_rename);
2292 call_nt_transact_rename(
2293 conn, req,
2294 &state->setup, state->setup_count,
2295 &state->param, state->total_param,
2296 &state->data, state->total_data,
2297 state->max_data_return);
2298 END_PROFILE(NT_transact_rename);
2299 break;
2300 }
2301
2302 case NT_TRANSACT_QUERY_SECURITY_DESC:
2303 {
2304 START_PROFILE(NT_transact_query_security_desc);
2305 call_nt_transact_query_security_desc(
2306 conn, req,
2307 &state->setup, state->setup_count,
2308 &state->param, state->total_param,
2309 &state->data, state->total_data,
2310 state->max_data_return);
2311 END_PROFILE(NT_transact_query_security_desc);
2312 break;
2313 }
2314
2315 #ifdef HAVE_SYS_QUOTAS
2316 case NT_TRANSACT_GET_USER_QUOTA:
2317 {
2318 START_PROFILE(NT_transact_get_user_quota);
2319 call_nt_transact_get_user_quota(
2320 conn, req,
2321 &state->setup, state->setup_count,
2322 &state->param, state->total_param,
2323 &state->data, state->total_data,
2324 state->max_data_return);
2325 END_PROFILE(NT_transact_get_user_quota);
2326 break;
2327 }
2328
2329 case NT_TRANSACT_SET_USER_QUOTA:
2330 {
2331 START_PROFILE(NT_transact_set_user_quota);
2332 call_nt_transact_set_user_quota(
2333 conn, req,
2334 &state->setup, state->setup_count,
2335 &state->param, state->total_param,
2336 &state->data, state->total_data,
2337 state->max_data_return);
2338 END_PROFILE(NT_transact_set_user_quota);
2339 break;
2340 }
2341 #endif /* HAVE_SYS_QUOTAS */
2342
2343 default:
2344 /* Error in request */
2345 DEBUG(0,("handle_nttrans: Unknown request %d in "
2346 "nttrans call\n", state->call));
2347 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2348 return;
2349 }
2350 return;
2351 }
2352
2353 /****************************************************************************
2354 Reply to a SMBNTtrans.
2355 ****************************************************************************/
2356
2357 void reply_nttrans(struct smb_request *req)
2358 {
2359 connection_struct *conn = req->conn;
2360 uint32_t pscnt;
2361 uint32_t psoff;
2362 uint32_t dscnt;
2363 uint32_t dsoff;
2364 uint16_t function_code;
2365 NTSTATUS result;
2366 struct trans_state *state;
2367
2368 START_PROFILE(SMBnttrans);
2369
2370 if (req->wct < 19) {
2371 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2372 END_PROFILE(SMBnttrans);
2373 return;
2374 }
2375
2376 pscnt = IVAL(req->vwv+9, 1);
2377 psoff = IVAL(req->vwv+11, 1);
2378 dscnt = IVAL(req->vwv+13, 1);
2379 dsoff = IVAL(req->vwv+15, 1);
2380 function_code = SVAL(req->vwv+18, 0);
2381
2382 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2383 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2384 END_PROFILE(SMBnttrans);
2385 return;
2386 }
2387
2388 result = allow_new_trans(conn->pending_trans, req->mid);
2389 if (!NT_STATUS_IS_OK(result)) {
2390 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2391 reply_nterror(req, result);
2392 END_PROFILE(SMBnttrans);
2393 return;
2394 }
2395
2396 if ((state = talloc(conn, struct trans_state)) == NULL) {
2397 reply_nterror(req, NT_STATUS_NO_MEMORY);
2398 END_PROFILE(SMBnttrans);
2399 return;
2400 }
2401
2402 state->cmd = SMBnttrans;
2403
2404 state->mid = req->mid;
2405 state->vuid = req->vuid;
2406 state->total_data = IVAL(req->vwv+3, 1);
2407 state->data = NULL;
2408 state->total_param = IVAL(req->vwv+1, 1);
2409 state->param = NULL;
2410 state->max_data_return = IVAL(req->vwv+7, 1);
2411 state->max_param_return = IVAL(req->vwv+5, 1);
2412
2413 /* setup count is in *words* */
2414 state->setup_count = 2*CVAL(req->vwv+17, 1);
2415 state->setup = NULL;
2416 state->call = function_code;
2417
2418 DEBUG(10, ("num_setup=%u, "
2419 "param_total=%u, this_param=%u, max_param=%u, "
2420 "data_total=%u, this_data=%u, max_data=%u, "
2421 "param_offset=%u, data_offset=%u\n",
2422 (unsigned)state->setup_count,
2423 (unsigned)state->total_param, (unsigned)pscnt,
2424 (unsigned)state->max_param_return,
2425 (unsigned)state->total_data, (unsigned)dscnt,
2426 (unsigned)state->max_data_return,
2427 (unsigned)psoff, (unsigned)dsoff));
2428
2429 /*
2430 * All nttrans messages we handle have smb_wct == 19 +
2431 * state->setup_count. Ensure this is so as a sanity check.
2432 */
2433
2434 if(req->wct != 19 + (state->setup_count/2)) {
2435 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2436 req->wct, 19 + (state->setup_count/2)));
2437 goto bad_param;
2438 }
2439
2440 /* Don't allow more than 128mb for each value. */
2441 if ((state->total_data > (1024*1024*128)) ||
2442 (state->total_param > (1024*1024*128))) {
2443 reply_nterror(req, NT_STATUS_NO_MEMORY);
2444 END_PROFILE(SMBnttrans);
2445 return;
2446 }
2447
2448 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2449 goto bad_param;
2450
2451 if (state->total_data) {
2452
2453 if (smb_buffer_oob(state->total_data, 0, dscnt)
2454 || smb_buffer_oob(smb_len(req->inbuf), dsoff, dscnt)) {
2455 goto bad_param;
2456 }
2457
2458 /* Can't use talloc here, the core routines do realloc on the
2459 * params and data. */
2460 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2461 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2462 "bytes !\n", (unsigned int)state->total_data));
2463 TALLOC_FREE(state);
2464 reply_nterror(req, NT_STATUS_NO_MEMORY);
2465 END_PROFILE(SMBnttrans);
2466 return;
2467 }
2468
2469 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2470 }
2471
2472 if (state->total_param) {
2473
2474 if (smb_buffer_oob(state->total_param, 0, pscnt)
2475 || smb_buffer_oob(smb_len(req->inbuf), psoff, pscnt)) {
2476 goto bad_param;
2477 }
2478
2479 /* Can't use talloc here, the core routines do realloc on the
2480 * params and data. */
2481 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2482 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2483 "bytes !\n", (unsigned int)state->total_param));
2484 SAFE_FREE(state->data);
2485 TALLOC_FREE(state);
2486 reply_nterror(req, NT_STATUS_NO_MEMORY);
2487 END_PROFILE(SMBnttrans);
2488 return;
2489 }
2490
2491 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2492 }
2493
2494 state->received_data = dscnt;
2495 state->received_param = pscnt;
2496
2497 if(state->setup_count > 0) {
2498 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2499 state->setup_count));
2500
2501 /*
2502 * No overflow possible here, state->setup_count is an
2503 * unsigned int, being filled by a single byte from
2504 * CVAL(req->vwv+13, 0) above. The cast in the comparison
2505 * below is not necessary, it's here to clarify things. The
2506 * validity of req->vwv and req->wct has been checked in
2507 * init_smb1_request already.
2508 */
2509 if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
2510 goto bad_param;
2511 }
2512
2513 state->setup = (uint16_t *)TALLOC(state, state->setup_count);
2514 if (state->setup == NULL) {
2515 DEBUG(0,("reply_nttrans : Out of memory\n"));
2516 SAFE_FREE(state->data);
2517 SAFE_FREE(state->param);
2518 TALLOC_FREE(state);
2519 reply_nterror(req, NT_STATUS_NO_MEMORY);
2520 END_PROFILE(SMBnttrans);
2521 return;
2522 }
2523
2524 memcpy(state->setup, req->vwv+19, state->setup_count);
2525 dump_data(10, (uint8_t *)state->setup, state->setup_count);
2526 }
2527
2528 if ((state->received_data == state->total_data) &&
2529 (state->received_param == state->total_param)) {
2530 handle_nttrans(conn, state, req);
2531 SAFE_FREE(state->param);
2532 SAFE_FREE(state->data);
2533 TALLOC_FREE(state);
2534 END_PROFILE(SMBnttrans);
2535 return;
2536 }
2537
2538 DLIST_ADD(conn->pending_trans, state);
2539
2540 /* We need to send an interim response then receive the rest
2541 of the parameter/data bytes */
2542 reply_smb1_outbuf(req, 0, 0);
2543 show_msg((char *)req->outbuf);
2544 END_PROFILE(SMBnttrans);
2545 return;
2546
2547 bad_param:
2548
2549 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2550 SAFE_FREE(state->data);
2551 SAFE_FREE(state->param);
2552 TALLOC_FREE(state);
2553 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2554 END_PROFILE(SMBnttrans);
2555 return;
2556 }
2557
2558 /****************************************************************************
2559 Reply to a SMBnttranss
2560 ****************************************************************************/
2561
2562 void reply_nttranss(struct smb_request *req)
2563 {
2564 connection_struct *conn = req->conn;
2565 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2566 struct trans_state *state;
2567
2568 START_PROFILE(SMBnttranss);
2569
2570 show_msg((const char *)req->inbuf);
2571
2572 /* Windows clients expect all replies to
2573 an NT transact secondary (SMBnttranss 0xA1)
2574 to have a command code of NT transact
2575 (SMBnttrans 0xA0). See bug #8989 for details. */
2576 req->cmd = SMBnttrans;
2577
2578 if (req->wct < 18) {
2579 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2580 END_PROFILE(SMBnttranss);
2581 return;
2582 }
2583
2584 for (state = conn->pending_trans; state != NULL;
2585 state = state->next) {
2586 if (state->mid == req->mid) {
2587 break;
2588 }
2589 }
2590
2591 if ((state == NULL) || (state->cmd != SMBnttrans)) {
2592 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2593 END_PROFILE(SMBnttranss);
2594 return;
2595 }
2596
2597 /* Revise state->total_param and state->total_data in case they have
2598 changed downwards */
2599 if (IVAL(req->vwv+1, 1) < state->total_param) {
2600 state->total_param = IVAL(req->vwv+1, 1);
2601 }
2602 if (IVAL(req->vwv+3, 1) < state->total_data) {
2603 state->total_data = IVAL(req->vwv+3, 1);
2604 }
2605
2606 pcnt = IVAL(req->vwv+5, 1);
2607 poff = IVAL(req->vwv+7, 1);
2608 pdisp = IVAL(req->vwv+9, 1);
2609
2610 dcnt = IVAL(req->vwv+11, 1);
2611 doff = IVAL(req->vwv+13, 1);
2612 ddisp = IVAL(req->vwv+15, 1);
2613
2614 state->received_param += pcnt;
2615 state->received_data += dcnt;
2616
2617 if ((state->received_data > state->total_data) ||
2618 (state->received_param > state->total_param))
2619 goto bad_param;
2620
2621 if (pcnt) {
2622 if (smb_buffer_oob(state->total_param, pdisp, pcnt)
2623 || smb_buffer_oob(smb_len(req->inbuf), poff, pcnt)) {
2624 goto bad_param;
2625 }
2626 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
2627 }
2628
2629 if (dcnt) {
2630 if (smb_buffer_oob(state->total_data, ddisp, dcnt)
2631 || smb_buffer_oob(smb_len(req->inbuf), doff, dcnt)) {
2632 goto bad_param;
2633 }
2634 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
2635 }
2636
2637 if ((state->received_param < state->total_param) ||
2638 (state->received_data < state->total_data)) {
2639 END_PROFILE(SMBnttranss);
2640 return;
2641 }
2642
2643 handle_nttrans(conn, state, req);
2644
2645 DLIST_REMOVE(conn->pending_trans, state);
2646 SAFE_FREE(state->data);
2647 SAFE_FREE(state->param);
2648 TALLOC_FREE(state);
2649 END_PROFILE(SMBnttranss);
2650 return;
2651
2652 bad_param:
2653
2654 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2655 DLIST_REMOVE(conn->pending_trans, state);
2656 SAFE_FREE(state->data);
2657 SAFE_FREE(state->param);
2658 TALLOC_FREE(state);
2659 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2660 END_PROFILE(SMBnttranss);
2661 return;
2662 }
Samba GIT mirror