| blob | 06eeaa346768cbac4149e844b0249e06e6cf59f8 |
1 /*
2 Unix SMB/CIFS implementation.
3 file opening and share modes
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2001-2004
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Ralph Boehme 2017
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
53 /*
54 * Timer for async opens, needed because they don't use a watch on
55 * a locking.tdb record. This is currently only used for real async
56 * opens and just terminates smbd if the async open times out.
57 */
60 /*
61 * For the samba kernel oplock case we use both a timeout and
62 * a watch on locking.tdb. This way in case it's smbd holding
63 * the kernel oplock we get directly notified for the retry
64 * once the kernel oplock is properly broken. Store the req
65 * here so that it can be timely discarded once the timer
66 * above fires.
67 */
69 };
71 /****************************************************************************
72 If the requester wanted DELETE_ACCESS and was rejected because
73 the file ACL didn't include DELETE_ACCESS, see if the parent ACL
74 overrides this.
75 ****************************************************************************/
82 {
86 dirfsp,
87 smb_fname))
88 {
90 }
92 }
94 /****************************************************************************
95 Check if we have open rights.
96 ****************************************************************************/
104 {
113 access_mask,
115 rejected_share_access);
117 }
125 }
128 /* I'm sorry sir, I didn't know you were root... */
133 }
137 {
141 access_mask);
143 }
148 {
149 /* We can always delete a symlink. */
153 }
156 }
166 {
168 NTSTATUS status;
172 }
176 use_privs,
183 access_mask,
184 rejected_mask,
192 }
193 }
199 {
201 }
203 /* Here we know status == NT_STATUS_ACCESS_DENIED. */
205 access_denied:
214 {
219 }
222 dirfsp,
223 smb_fname,
224 access_mask,
225 rejected_mask))
226 {
227 /*
228 * Were we trying to do an open for delete and didn't get DELETE
229 * access. Check if the directory allows DELETE_CHILD.
230 * See here:
231 * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
232 * for details.
233 */
239 }
243 }
245 }
251 {
254 NTSTATUS status;
256 /* Cope with fake/printer fsp's. */
260 }
262 }
265 /*
266 * This is a POSIX open on a symlink. For the pathname
267 * version of this function we used to return the st_mode
268 * bits turned into an NT ACL. For a symlink the mode bits
269 * are always rwxrwxrwx which means the pathname version always
270 * returned NT_STATUS_OK for a symlink. For the handle reference
271 * to a symlink use the handle access bits.
272 */
275 }
277 }
279 /*
280 * If we can access the path to this file, by
281 * default we have FILE_READ_ATTRIBUTES from the
282 * containing directory. See the section:
283 * "Algorithm to Check Access to an Existing File"
284 * in MS-FSA.pdf.
285 *
286 * se_file_access_check() also takes care of
287 * owner WRITE_DAC and READ_CONTROL.
288 */
291 /*
292 * Samba 3.6 and earlier granted execute access even
293 * if the ACL did not contain execute rights.
294 * Samba 4.0 is more correct and checks it.
295 * The compatibilty mode allows one to skip this check
296 * to smoothen upgrades.
297 */
300 }
304 use_privs,
305 access_mask,
306 do_not_check_mask);
309 }
313 SECINFO_GROUP |
314 SECINFO_DACL),
322 }
325 dirfsp,
327 sd,
328 use_privs,
329 access_mask,
330 do_not_check_mask);
331 }
333 /*
334 * Given an fsp that represents a parent directory,
335 * check if the requested access can be granted.
336 */
339 {
340 NTSTATUS status;
349 /* I'm sorry sir, I didn't know you were root... */
355 }
358 SECINFO_DACL,
359 frame,
368 }
370 /*
371 * If we can access the path to this file, by
372 * default we have FILE_READ_ATTRIBUTES from the
373 * containing directory. See the section:
374 * "Algorithm to Check Access to an Existing File"
375 * in MS-FSA.pdf.
376 *
377 * se_file_access_check() also takes care of
378 * owner WRITE_DAC and READ_CONTROL.
379 */
389 access_mask,
390 access_granted,
393 }
398 }
402 }
404 /* Check if the directory has delete-on-close set */
410 }
412 /*
413 * Don't take a lock here. We just need a snapshot
414 * of the current state of delete on close and this is
415 * called in a codepath where we may already have a lock
416 * (and we explicitly can't hold 2 locks at the same time
417 * as that may deadlock).
418 */
423 }
429 }
433 out:
436 }
438 /****************************************************************************
439 Ensure when opening a base file for a stream open that we have permissions
440 to do so given the access mask on the base file.
441 ****************************************************************************/
445 {
446 NTSTATUS status;
449 fsp,
451 access_mask,
459 }
465 }
469 }
470 }
473 fsp,
475 access_mask);
476 }
478 /*
479 * Take two absolute paths, figure out if "subdir" is a proper
480 * subdirectory of "parent". Return the component relative to the
481 * "parent" without the potential "/". Take care of "parent"
482 * possibly ending in "/".
483 */
490 {
498 /*
499 * Everything is below "/"
500 */
503 }
507 }
512 }
519 }
522 /* End of parent must match a '/' in subdir. */
525 }
528 }
537 {
542 NTSTATUS status;
552 }
554 /* Pin parent directory in place. */
562 }
563 }
568 NULL,
569 NULL,
575 }
584 }
588 connectpath_len,
595 }
602 connectpath,
608 out:
613 }
616 }
618 /*
619 * Get the symlink target of dirfsp/symlink_name, making sure the
620 * target is below connection_path.
621 */
631 {
635 NTSTATUS status;
639 /*
640 * fsp is an O_PATH open, Linux does a "freadlink"
641 * with an empty name argument to readlinkat
642 */
645 };
651 }
656 }
662 connection_path,
664 target);
670 }
672 }
681 }
683 /*
684 * We're doing the "below connection_path" here because it's
685 * cheap. It might be that we get a symlink out of the share,
686 * pointing to yet another symlink getting us back into the
687 * share. If we need that, we would have to remove the check
688 * here.
689 */
691 connection_path,
692 connection_path_len,
693 absolute,
701 connection_path,
702 absolute);
705 }
708 /*
709 * special case symlink to share root: "." is our
710 * share root filename
711 */
716 }
720 }
722 /****************************************************************************
723 Non-widelink open.
724 ****************************************************************************/
731 {
749 /*
750 * This can happen with shadow_copy2 if the snapshot
751 * path is not found
752 */
754 }
757 again:
765 }
766 }
767 }
773 smb_fname,
778 }
782 conn,
783 connpath,
784 connpath_len,
785 parent_dir_fname,
789 }
791 /* Setup fsp->fsp_name to be relative to cwd */
794 /*
795 * fsp->fsp_name is unchanged as it is already correctly
796 * relative to conn->cwd.
797 */
799 }
801 {
802 /*
803 * Assert nobody can step in with a symlink on the
804 * path, there is no path anymore and we'll use
805 * O_NOFOLLOW to open.
806 */
809 }
814 dirfsp,
815 smb_fname_rel,
816 fsp,
825 }
827 /*
828 * ENOENT makes it worthless retrying with a
829 * stat, we know for sure the file does not
830 * exist. For everything else we want to know
831 * what's there.
832 */
835 dirfsp,
836 smb_fname_rel,
838 AT_SYMLINK_NOFOLLOW);
841 }
849 }
856 }
858 /*
859 * Found a symlink to follow in user space
860 */
863 /* Never follow symlinks on posix open. */
866 }
868 /* Explicitly no symlinks. */
871 }
877 }
883 connpath,
884 connpath_len,
885 fsp,
887 smb_fname_rel,
894 }
896 /*
897 * Close what openat(O_PATH) potentially left behind
898 */
903 }
910 }
912 }
914 /*
915 * And do it all again... As smb_fname is not relative to the passed in
916 * dirfsp anymore, we pass conn->cwd_fsp as dirfsp to
917 * non_widelink_open() to trigger the chdir(parentdir) logic.
918 */
923 out:
931 }
937 }
939 }
941 }
943 /****************************************************************************
944 fd support routines - attempt to do a dos_open.
945 ****************************************************************************/
951 {
960 /*
961 * Never follow symlinks on a POSIX client. The
962 * client should be doing this.
963 */
967 }
973 conn,
975 smb_fname,
976 fsp,
980 }
989 }
990 }
993 }
995 /*
996 * Only follow symlinks within a share
997 * definition.
998 */
1006 "to open more! smbd's max "
1010 }
1011 }
1020 }
1029 }
1031 /****************************************************************************
1032 Close the file associated with a fsp.
1033 ****************************************************************************/
1036 {
1037 NTSTATUS status;
1042 }
1048 }
1049 }
1053 }
1055 /*
1056 * Either a directory where the dptr_CloseDir() already closed
1057 * the fd or a stat open.
1058 */
1060 }
1063 }
1069 }
1071 }
1073 /****************************************************************************
1074 Change the ownership of a file to that of the parent directory.
1075 Do this by fd if possible.
1076 ****************************************************************************/
1080 {
1084 /* Already this uid - no need to change. */
1089 }
1098 "file %s to parent directory uid %u. Error "
1108 /* Ensure the uid entry is updated. */
1111 }
1112 }
1116 {
1117 NTSTATUS status;
1121 /* Already this uid - no need to change. */
1126 }
1136 "directory %s to parent directory uid %u. "
1142 }
1149 /* Ensure the uid entry is updated. */
1153 }
1155 /****************************************************************************
1156 Open a file - returning a guaranteed ATOMIC indication of if the
1157 file was created or not.
1158 ****************************************************************************/
1164 mode_t mode,
1166 {
1169 NTSTATUS retry_status;
1173 /*
1174 * We're not creating the file, just pass through.
1175 */
1179 }
1182 /*
1183 * Fail if already exists, just pass through.
1184 */
1187 /*
1188 * Here we've opened with O_CREAT|O_EXCL. If that went
1189 * NT_STATUS_OK, we *know* we created this file.
1190 */
1194 }
1196 /*
1197 * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1198 * To know absolutely if we created the file or not,
1199 * we can never call O_CREAT without O_EXCL. So if
1200 * we think the file existed, try without O_CREAT|O_EXCL.
1201 * If we think the file didn't exist, try with
1202 * O_CREAT|O_EXCL.
1203 *
1204 * The big problem here is dangling symlinks. Opening
1205 * without O_NOFOLLOW means both bad symlink
1206 * and missing path return -1, ENOENT from open(). As POSIX
1207 * is pathname based it's not possible to tell
1208 * the difference between these two cases in a
1209 * non-racy way, so change to try only two attempts before
1210 * giving up.
1211 *
1212 * We don't have this problem for the O_NOFOLLOW
1213 * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1214 * mapped from the ELOOP POSIX error.
1215 */
1223 }
1229 }
1242 }
1245 }
1249 }
1253 mode_t mode)
1254 {
1261 NTSTATUS status;
1265 }
1270 }
1275 #ifdef DEVELOPER
1277 #endif
1279 }
1284 }
1288 };
1295 fsp,
1301 }
1306 }
1310 }
1316 mode_t mode,
1318 {
1320 NTSTATUS status;
1324 }
1326 /*
1327 * TODO: should we move this to the VFS layer?
1328 * SMB_VFS_REOPEN_FSP()?
1329 */
1332 flags,
1333 mode);
1336 }
1338 /*
1339 * Close the existing pathref fd and set the fsp flag
1340 * is_pathref to false so we get a "normal" fd this time.
1341 */
1345 }
1350 dirfsp,
1351 smb_fname,
1352 fsp,
1353 flags,
1354 mode,
1355 p_file_created);
1357 }
1359 /****************************************************************************
1360 Open a file.
1361 ****************************************************************************/
1368 mode_t unx_mode,
1373 {
1381 FILE_READ_DATA |
1382 FILE_WRITE_DATA |
1383 FILE_APPEND_DATA |
1384 FILE_EXECUTE |
1385 SEC_FLAG_SYSTEM_SECURITY;
1391 /*
1392 * Catch early an attempt to open an existing
1393 * directory as a file.
1394 */
1397 }
1399 /* Check permissions */
1401 /*
1402 * This code was changed after seeing a client open request
1403 * containing the open mode of (DENY_WRITE/read-only) with
1404 * the 'create if not exist' bit set. The previous code
1405 * would fail to open the file read only on a read-only share
1406 * as it was checking the flags parameter directly against O_RDONLY,
1407 * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1408 * JRA.
1409 */
1412 /* It's a read-only share - fail if we wanted to write. */
1417 }
1419 /* We don't want to write - but we must make sure that
1420 O_CREAT doesn't create the file if we have write
1421 access into the directory.
1422 */
1425 }
1426 }
1428 /*
1429 * This little piece of insanity is inspired by the
1430 * fact that an NT client can open a file for O_RDONLY,
1431 * but set the create disposition to FILE_EXISTS_TRUNCATE.
1432 * If the client *can* write to the file, then it expects to
1433 * truncate the file, even though it is opening for readonly.
1434 * Quicken uses this stupid trick in backup file creation...
1435 * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1436 * for helping track this one down. It didn't bite us in 2.0.x
1437 * as we always opened files read-write in that release. JRA.
1438 */
1444 }
1448 }
1454 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1455 /*
1456 * We would block on opening a FIFO with no one else on the
1457 * other end. Do what we used to do and add O_NONBLOCK to the
1458 * open flags. JRA.
1459 */
1465 }
1466 #endif
1468 /* Don't create files with Microsoft wildcard characters. */
1470 /*
1471 * wildcard characters are allowed in stream names
1472 * only test the basefilename
1473 */
1477 }
1482 }
1484 /* Can we access this file ? */
1486 /* Only do this check on non-stream open. */
1489 dirfsp,
1490 fsp,
1492 access_mask);
1499 }
1503 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1504 {
1506 }
1509 NT_STATUS_OBJECT_NAME_NOT_FOUND))
1510 {
1512 "file %s vanished since we "
1517 }
1518 }
1522 /* File didn't exist and no O_CREAT. */
1524 }
1527 dirfsp,
1528 SEC_DIR_ADD_FILE);
1531 "directory %s for file %s "
1538 }
1539 }
1540 }
1542 /*
1543 * Actually do the open - if O_TRUNC is needed handle it
1544 * below under the share mode lock.
1545 */
1547 smb_fname_atname,
1548 fsp,
1550 unx_mode,
1551 p_file_created);
1553 /*
1554 * POSIX client that hit a symlink. We don't want to
1555 * return NT_STATUS_STOPPED_ON_SYMLINK to avoid handling
1556 * this special error code in all callers, so we map
1557 * this to NT_STATUS_OBJECT_NAME_NOT_FOUND to match
1558 * openat_pathref_fsp().
1559 */
1561 }
1567 }
1570 /*
1571 * GPFS can return ETIMEDOUT for pread on
1572 * nonblocking file descriptors when files
1573 * migrated to tape need to be recalled. I
1574 * could imagine this happens elsewhere
1575 * too. With blocking file descriptors this
1576 * does not happen.
1577 */
1585 }
1586 }
1589 /* We created this file. */
1592 /* Do all inheritance work after we've
1593 done a successful fstat call and filled
1594 in the stat struct in fsp->fsp_name. */
1596 /* Inherit the ACL if required */
1599 dirfsp,
1600 smb_fname,
1601 unx_mode);
1603 }
1605 /* Change the owner if required. */
1609 }
1613 /*
1614 * If we have an fd, this stat should succeed.
1615 */
1623 }
1624 }
1627 FILE_NOTIFY_CHANGE_FILE_NAME,
1629 }
1632 /* File must exist for a stat open. */
1634 }
1638 {
1639 /*
1640 * Don't allow stat opens on symlinks directly unless
1641 * it's a POSIX open. Match the return code from
1642 * openat_pathref_fsp().
1643 */
1645 }
1648 /*
1649 * There is only one legit case where end up here:
1650 * openat_pathref_fsp() failed to open a symlink, so the
1651 * fsp was created by fsp_new() which doesn't set
1652 * is_pathref. Other then that, we should always have a
1653 * pathref fsp at this point. The subsequent checks
1654 * assert this.
1655 */
1660 }
1665 }
1671 }
1672 }
1674 /*
1675 * Access to streams is checked by checking the basefile and
1676 * that has alreay been checked by check_base_file_access()
1677 * in create_file_unixpath().
1678 */
1681 fsp,
1683 access_mask);
1686 posix_open &&
1688 /* This is a POSIX stat open for delete
1689 * or rename on a symlink that points
1690 * nowhere. Allow. */
1695 }
1703 }
1704 }
1705 }
1723 }
1733 }
1742 {
1751 new_access,
1752 access_mask,
1753 existing_sharemode,
1754 sharemode_mask);
1756 }
1760 new_sharemode,
1761 sharemode_mask,
1762 existing_access,
1763 access_mask);
1765 }
1767 }
1769 /****************************************************************************
1770 Check if we can open a file with a share mode.
1771 Returns True if conflict, False if not.
1772 ****************************************************************************/
1775 FILE_WRITE_DATA|
1776 FILE_APPEND_DATA|
1777 FILE_READ_DATA|
1778 FILE_EXECUTE|
1779 DELETE_ACCESS;
1785 {
1792 e_access_mask,
1793 e_share_access,
1794 access_mask,
1795 share_access);
1800 e_access_mask);
1802 }
1805 access_mask);
1807 }
1821 }
1823 #if defined(DEVELOPER)
1829 };
1835 {
1841 }
1844 /* INTERNAL_OPEN_ONLY */
1846 }
1854 }
1858 }
1862 panic:
1863 {
1868 "validate_my_share_entries: "
1874 }
1877 }
1878 #endif
1880 /**
1881 * Allowed access mask for stat opens relevant to oplocks
1882 **/
1884 {
1887 FILE_READ_ATTRIBUTES|
1888 FILE_WRITE_ATTRIBUTES);
1892 }
1894 /**
1895 * Allowed access mask for stat opens relevant to leases
1896 **/
1898 {
1901 FILE_READ_ATTRIBUTES|
1902 FILE_WRITE_ATTRIBUTES|
1903 READ_CONTROL_ACCESS);
1907 }
1911 };
1917 {
1921 }
1925 {
1931 }
1937 }
1939 }
1946 {
1951 lck,
1959 }
1963 lck,
1964 existing_access_mask,
1965 existing_share_mode,
1966 existing_lease_type,
1967 NULL);
1968 }
1970 /****************************************************************************
1971 Deal with share modes
1972 Invariant: Share mode must be locked on entry and exit.
1973 Returns -1 on error, or number of share modes on success (may be zero).
1974 ****************************************************************************/
1981 };
1987 {
1995 }
2001 }
2008 }
2013 }
2020 }
2027 {
2033 /* Stat open that doesn't trigger oplock breaks or share mode
2034 * checks... ! JRA. */
2036 }
2038 /*
2039 * Check if the share modes will give us access.
2040 */
2042 #if defined(DEVELOPER)
2043 {
2048 };
2052 }
2053 #endif
2061 access_mask,
2062 share_access);
2066 }
2071 FILE_SHARE_WRITE|
2072 FILE_SHARE_DELETE),
2073 };
2075 /*
2076 * Walk the share mode array to recalculate d->flags
2077 */
2083 }
2086 lck,
2092 /*
2093 * We only end up here if we had a sharing violation
2094 * from d->flags and have recalculated it.
2095 */
2097 }
2102 access_mask,
2103 share_access);
2107 }
2110 }
2112 /*
2113 * Send a break message to the oplock holder and delay the open for
2114 * our client.
2115 */
2121 {
2126 };
2128 DATA_BLOB blob;
2129 NTSTATUS status;
2136 }
2147 }
2155 }
2158 }
2167 };
2173 {
2177 /* INTERNAL_OPEN_ONLY */
2179 }
2182 /*
2183 * We ignore stat opens in the table - they always
2184 * have NO_OPLOCK and never get or cause breaks. JRA.
2185 */
2187 }
2192 /* batch - can only be one. */
2196 }
2204 }
2206 }
2212 }
2213 /* Exclusive or batch - can only be one. */
2220 }
2222 }
2229 }
2233 }
2235 }
2242 }
2246 }
2248 }
2251 }
2253 /*
2254 * Do internal consistency checks on the share mode for a file.
2255 */
2258 {
2266 }
2273 }
2279 }
2283 }
2293 }
2296 }
2301 {
2304 }
2307 }
2313 }
2316 {
2324 }
2331 {
2334 /*
2335 * TODO: Measure how expensive this loop is with thousands of open
2336 * handles...
2337 */
2345 }
2348 }
2352 }
2353 }
2355 /* Not found - must be leased in another smbd. */
2359 }
2364 /*
2365 * We internally treat all leases as V2 and update
2366 * the epoch, but when sending breaks it matters if
2367 * the requesting lease was v1 or v2.
2368 */
2372 }
2379 {
2385 NTSTATUS status;
2388 client_guid,
2399 }
2402 fsp,
2404 current_state,
2405 lease_version,
2406 epoch);
2411 }
2413 /*
2414 * Upgrade only if the requested lease is a strict upgrade.
2415 */
2419 /*
2420 * Tricky: This test makes sure that "requested" is a
2421 * strict bitwise superset of "existing".
2422 */
2425 /*
2426 * Upgrade only if there's a change.
2427 */
2430 /*
2431 * Upgrade only if other leases don't prevent what was asked
2432 * for.
2433 */
2436 /*
2437 * only upgrade if we are not in breaking state
2438 */
2446 NTSTATUS set_status;
2452 client_guid,
2454 current_state,
2455 breaking,
2456 breaking_to_requested,
2457 breaking_to_required,
2458 lease_version,
2459 epoch);
2465 }
2466 }
2471 }
2478 {
2479 NTSTATUS status;
2484 }
2506 }
2508 /*
2509 * We used to set lck->data->modified=true here without
2510 * actually modifying lck->data, triggering a needless
2511 * writeback of lck->data.
2512 *
2513 * Apart from that writeback, setting modified=true has the
2514 * effect of triggering all waiters for this file to
2515 * retry. This only makes sense if any blocking condition
2516 * (i.e. waiting for a lease to be downgraded or removed) is
2517 * gone. This routine here only adds a lease, so it will never
2518 * free up resources that blocked waiters can now claim. So
2519 * that second effect also does not matter in this
2520 * routine. Thus setting lck->data->modified=true does not
2521 * need to be done here.
2522 */
2525 }
2531 {
2533 NTSTATUS status;
2540 }
2543 }
2546 {
2560 }
2563 }
2575 };
2581 {
2591 NTSTATUS status;
2598 }
2599 }
2612 /*
2613 * leases_db_get() can return NT_STATUS_NOT_FOUND
2614 * if the share_mode_entry e is stale and the
2615 * lease record was already removed. In this case return
2616 * false so the traverse continues.
2617 */
2621 {
2626 "file_id [%s] failed for stale "
2633 }
2646 }
2649 }
2655 }
2661 }
2667 }
2671 }
2677 }
2686 }
2688 }
2692 }
2695 /*
2696 * If we break anyway break to NONE directly.
2697 * Otherwise vfs_set_filelen() will trigger the
2698 * break.
2699 */
2701 }
2704 /*
2705 * Oplocks only support breaking to R or NONE.
2706 */
2708 }
2717 }
2720 }
2723 };
2734 {
2739 };
2749 /*
2750 * No directory leases yet
2751 */
2755 }
2757 }
2761 /*
2762 * The SMB2 layer should have checked this
2763 */
2765 }
2771 }
2775 }
2789 }
2794 }
2798 }
2800 grant:
2803 }
2811 }
2815 }
2819 }
2823 }
2824 }
2830 }
2833 /*
2834 * Can grant only one writer
2835 */
2837 }
2846 }
2847 }
2852 }
2858 }
2860 /*
2861 * Reflect possible downgrades from:
2862 * - map_lease_type_to_oplock() => "RH" to just LEVEL_II
2863 */
2866 }
2873 }
2881 granted,
2883 oplock_request,
2887 requested);
2892 }
2905 {
2907 NTSTATUS status;
2917 }
2921 }
2927 }
2929 /*
2930 * Internal opens never do oplocks or leases. We don't
2931 * need to go through delay_for_oplock().
2932 */
2934 }
2937 fsp,
2938 oplock_request,
2939 lease,
2940 lck,
2941 sharing_violation,
2942 create_disposition,
2943 first_open_attempt,
2944 poplock_type,
2945 pgranted);
2948 }
2951 }
2954 {
2959 }
2964 };
2968 /**
2969 * Defer an open and watch a locking.tdb record
2970 *
2971 * This defers an open that gets rescheduled once the locking.tdb record watch
2972 * is triggered by a change to the record.
2973 *
2974 * It is used to defer opens that triggered an oplock break and for the SMB1
2975 * sharing violation delay.
2976 **/
2981 {
3003 }
3008 }
3015 watch_state,
3017 lck,
3021 }
3027 }
3033 }
3034 }
3037 {
3040 NTSTATUS status;
3048 /*
3049 * Even if it failed, retry anyway. TODO: We need a way to
3050 * tell a re-scheduled open about that error.
3051 */
3052 }
3059 }
3061 /**
3062 * Actually attempt the kernel oplock polling open.
3063 */
3069 {
3080 }
3082 }
3090 };
3094 {
3100 }
3105 lck,
3110 }
3111 }
3113 /**
3114 * Reschedule an open for 1 second from now, if not timed out.
3115 **/
3121 {
3130 }
3136 }
3140 /*
3141 * Make sure open_rec->te does not come later than the
3142 * request's maximum endtime.
3143 */
3151 open_rec,
3152 next_interval,
3153 poll_open_fn,
3154 open_rec);
3159 }
3165 };
3166 NTSTATUS status;
3169 poll_open_setup_watcher_fn,
3176 }
3179 poll_open_done,
3180 open_rec);
3186 }
3189 }
3196 }
3204 }
3207 {
3210 NTSTATUS status;
3225 }
3226 }
3229 {
3235 }
3237 /*
3238 * Try every 200msec up to (by default) one second. To be
3239 * precise, according to behaviour note <247> in [MS-CIFS],
3240 * the server tries 5 times. But up to one second should be
3241 * close enough.
3242 */
3248 SHARING_VIOLATION_USEC_WAIT);
3251 req,
3252 NULL,
3256 }
3258 /****************************************************************************
3259 On overwrite open ensure that the attributes match.
3260 ****************************************************************************/
3265 mode_t new_unx_mode,
3267 {
3274 (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
3278 }
3281 "new_dos_attr = 0x%x "
3287 /* If we're mapping SYSTEM and HIDDEN ensure they match. */
3292 }
3293 }
3298 }
3299 }
3301 }
3306 {
3307 /* This is a relative time, added to the absolute
3308 request_time value to get the absolute timeout time.
3309 Note that if this is the second or greater time we enter
3310 this codepath for this particular request mid then
3311 request_time is left as the absolute time of the *first*
3312 time this request mid was processed. This is what allows
3313 the request to eventually time out. */
3317 /* Normally the smbd we asked should respond within
3318 * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
3319 * the client did, give twice the timeout as a safety
3320 * measure here in case the other smbd is stuck
3321 * somewhere else. */
3327 }
3330 }
3332 /****************************************************************************
3333 Reschedule an open call that went asynchronous.
3334 ****************************************************************************/
3340 {
3342 }
3345 {
3352 }
3357 }
3364 }
3367 req,
3369 schedule_async_open_timer,
3370 open_rec);
3373 }
3374 }
3376 /****************************************************************************
3377 Work out what access_mask to use from what the client sent us.
3378 ****************************************************************************/
3385 {
3389 NTSTATUS status;
3391 /* Cope with symlinks */
3395 }
3397 /* Cope with fake/printer fsp's. */
3401 }
3406 }
3410 SECINFO_GROUP |
3411 SECINFO_DACL),
3416 /*
3417 * File did not exist
3418 */
3421 }
3427 }
3429 /*
3430 * If we can access the path to this file, by
3431 * default we have FILE_READ_ATTRIBUTES from the
3432 * containing directory. See the section:
3433 * "Algorithm to Check Access to an Existing File"
3434 * in MS-FSA.pdf.
3435 *
3436 * se_file_access_check()
3437 * also takes care of owner WRITE_DAC and READ_CONTROL.
3438 */
3441 use_privs,
3453 }
3459 dirfsp,
3462 }
3463 }
3468 }
3471 }
3478 {
3479 NTSTATUS status;
3485 access_mask);
3487 }
3489 /*
3490 * Convert GENERIC bits to specific bits.
3491 */
3495 /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
3499 dirfsp,
3500 fsp,
3501 use_privs,
3506 }
3509 }
3515 "rejected by share access mask[0x%08X] "
3520 rejected_share_access);
3522 }
3526 }
3528 /****************************************************************************
3529 Remove the deferred open entry under lock.
3530 ****************************************************************************/
3532 /****************************************************************************
3533 Return true if this is a state pointer to an asynchronous create.
3534 ****************************************************************************/
3537 {
3539 }
3542 {
3553 }
3555 }
3558 {
3561 /*
3562 * Currently we're using FILE_SUPERSEDE as the same as
3563 * FILE_OVERWRITE_IF but they really are
3564 * different. FILE_SUPERSEDE deletes an existing file
3565 * (requiring delete access) then recreates it.
3566 */
3571 /*
3572 * If file exists replace/overwrite. If file doesn't
3573 * exist create.
3574 */
3579 /*
3580 * If file exists open. If file doesn't exist error.
3581 */
3586 /*
3587 * If file exists overwrite. If file doesn't exist
3588 * error.
3589 */
3594 /*
3595 * If file exists error. If file doesn't exist create.
3596 */
3601 /*
3602 * If file exists open. If file doesn't exist create.
3603 */
3606 }
3608 }
3612 {
3615 /*
3616 * Note that we ignore the append flag as append does not
3617 * mean the same thing under DOS and Unix.
3618 */
3623 }
3625 /* DENY_DOS opens are always underlying read-write on the
3626 file handle, no matter what the requested access mask
3627 says. */
3629 need_read =
3636 }
3638 }
3640 /****************************************************************************
3641 Open a file with a share mode. Passed in an already created files_struct *.
3642 ****************************************************************************/
3653 /* Information (FILE_EXISTS etc.) */
3659 {
3678 NTSTATUS status;
3685 /*
3686 * Printers are handled completely differently.
3687 * Most of the passed parameters are ignored.
3688 */
3692 }
3701 }
3705 }
3712 /* Windows allows a new file to be created and
3713 silently removes a FILE_ATTRIBUTE_DIRECTORY
3714 sent by the client. Do the same. */
3718 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3719 * created new. */
3721 conn,
3723 smb_fname,
3725 }
3728 "access_mask=0x%x share_access=0x%x "
3729 "create_disposition = 0x%x create_options=0x%x "
3737 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3740 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3742 }
3744 /*
3745 * Only non-internal opens can be deferred at all
3746 */
3752 /* If it was an async create retry, the file
3753 didn't exist. */
3758 }
3760 /* Ensure we don't reprocess this message. */
3764 }
3765 }
3770 /*
3771 * Only use stored DOS attributes for checks
3772 * against requested attributes (below via
3773 * open_match_attributes()), cf bug #11992
3774 * for details. -slow
3775 */
3781 }
3782 }
3783 }
3785 /* ignore any oplock requests if oplocks are disabled */
3788 /* Mask off everything except the private Samba bits. */
3790 }
3792 /* this is for OS/2 long file names - say we don't support them */
3795 /* OS/2 Workplace shell fix may be main code stream in a later
3796 * release. */
3801 }
3803 }
3807 /* If file exists open. If file doesn't exist error. */
3810 "requested for file %s and file "
3814 }
3818 /* If file exists overwrite. If file doesn't exist
3819 * error. */
3822 "requested for file %s and file "
3826 }
3830 /* If file exists error. If file doesn't exist
3831 * create. */
3834 "requested for file %s and file "
3839 }
3841 }
3850 }
3854 /* We only care about matching attributes on file exists and
3855 * overwrite. */
3861 new_dos_attributes,
3866 existing_dos_attributes,
3867 new_dos_attributes,
3871 }
3872 }
3877 access_mask,
3885 }
3891 }
3894 /*
3895 * stat opens on existing files don't get oplocks.
3896 * They can get leases.
3897 *
3898 * Note that we check for stat open on the *open_access_mask*,
3899 * i.e. the access mask we actually used to do the open,
3900 * not the one the client asked for (which is in
3901 * fsp->access_mask). This is due to the fact that
3902 * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
3903 * which adds FILE_WRITE_DATA to open_access_mask.
3904 */
3907 }
3908 }
3912 access_mask));
3914 /*
3915 * Note that we ignore the append flag as append does not
3916 * mean the same thing under DOS and Unix.
3917 */
3921 /*
3922 * Currently we only look at FILE_WRITE_THROUGH for create options.
3923 */
3925 #if defined(O_SYNC)
3928 }
3933 }
3936 /*
3937 * We should really return a permission denied error if either
3938 * O_CREAT or O_TRUNC are set, but for compatibility with
3939 * older versions of Samba we just AND them out.
3940 */
3942 }
3944 /*
3945 * With kernel oplocks the open breaking an oplock
3946 * blocks until the oplock holder has given up the
3947 * oplock or closed the file. We prevent this by always
3948 * trying to open the file with O_NONBLOCK (see "man
3949 * fcntl" on Linux).
3950 *
3951 * If a process that doesn't use the smbd open files
3952 * database or communication methods holds a kernel
3953 * oplock we must periodically poll for available open
3954 * using O_NONBLOCK.
3955 */
3958 /*
3959 * Ensure we can't write on a read-only share or file.
3960 */
3969 }
3972 /*
3973 * Only try and create a file id before open
3974 * for an existing file. For a file being created
3975 * this won't do anything useful until the file
3976 * exists and has a valid stat struct.
3977 */
3979 }
3982 * requested access_mask after
3983 * the open is done. */
3986 }
3991 /* Delete on close semantics for new files. */
3993 new_dos_attributes);
3997 }
3998 }
4000 /*
4001 * Ensure we pay attention to default ACLs on directories if required.
4002 */
4006 {
4008 }
4018 smb_fname_atname,
4019 fsp,
4021 unx_mode,
4022 access_mask,
4023 open_access_mask,
4024 private_flags,
4030 }
4034 }
4035 /*
4036 * This handles the kernel oplock case:
4037 *
4038 * the file has an active kernel oplock and the open() returned
4039 * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
4040 *
4041 * "Samba locking.tdb oplocks" are handled below after acquiring
4042 * the sharemode lock with get_share_mode_lock().
4043 */
4045 }
4048 /*
4049 * EINTR from the open(2) syscall. Just setup a retry
4050 * in a bit. We can't use the sys_write() tight retry
4051 * loop here, as we might have to actually deal with
4052 * lease-break signals to avoid a deadlock.
4053 */
4055 }
4058 /*
4059 * Retry once a second. If there's a share_mode_lock
4060 * around, also wait for it in case it was smbd
4061 * holding that kernel oplock that can quickly tell us
4062 * the oplock got removed.
4063 */
4066 req,
4072 }
4079 }
4081 }
4084 /*
4085 * As we atomically create using O_CREAT|O_EXCL,
4086 * then if new_file_created is true, then
4087 * file_existed *MUST* have been false (even
4088 * if the file was previously detected as being
4089 * there).
4090 */
4092 }
4095 /*
4096 * The file did exist, but some other (local or NFS)
4097 * process either renamed/unlinked and re-created the
4098 * file with different dev/ino after we walked the path,
4099 * but before we did the open. We could retry the
4100 * open but it's a rare enough case it's easier to
4101 * just fail the open to prevent creating any problems
4102 * in the open file db having the wrong dev/ino key.
4103 */
4106 "Old (dev=%ju, ino=%ju). "
4107 "New (dev=%ju, ino=%ju). Failing open "
4115 }
4119 /*
4120 * Deal with the race condition where two smbd's detect the
4121 * file doesn't exist and do the create at the same time. One
4122 * of them will win and set a share mode, the other (ie. this
4123 * one) should check if the requested share mode for this
4124 * create is allowed.
4125 */
4127 /*
4128 * Now the file exists and fsp is successfully opened,
4129 * fsp->dev and fsp->inode are valid and should replace the
4130 * dev=0,inode=0 from a non existent file. Spotted by
4131 * Nadav Danieli <nadavd@exanet.com>. JRA.
4132 */
4144 }
4146 /* Get the types we need to examine. */
4149 }
4155 }
4158 fsp,
4159 lck,
4160 create_disposition,
4161 access_mask,
4162 share_access,
4163 oplock_request,
4164 lease,
4165 first_open_attempt,
4174 }
4180 }
4184 }
4189 lck,
4190 fsp,
4193 oplock_type,
4194 lease_key,
4195 share_access,
4196 access_mask);
4201 }
4210 }
4213 }
4218 /*
4219 * Now ask for kernel oplocks
4220 * and cleanup on failure.
4221 */
4224 /*
4225 * Could not get the kernel oplock
4226 */
4229 }
4230 }
4232 /* Should we atomically (to the client at least) truncate ? */
4245 }
4247 FILE_NOTIFY_CHANGE_SIZE
4250 }
4252 /*
4253 * We have the share entry *locked*.....
4254 */
4256 /* Delete streams if create_disposition requires it */
4266 }
4267 }
4272 {
4274 /*
4275 * Beware: streams implementing VFS modules may
4276 * implement streams in a way that fsp will have the
4277 * basefile open in the fsp fd, so lacking a distinct
4278 * fd for the stream the file-system sharemode will
4279 * apply on the basefile which is wrong. The actual
4280 * check is deferred to the VFS module implementing
4281 * the file-system sharemode call.
4282 */
4284 share_access,
4285 access_mask);
4292 }
4295 }
4297 /*
4298 * At this point onwards, we can guarantee that the share entry
4299 * is locked, whether we created the file or not, and that the
4300 * deny mode is compatible with all current opens.
4301 */
4303 /*
4304 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4305 * but we don't have to store this - just ignore it on access check.
4306 */
4308 /*
4309 * SMB2 doesn't return it (according to Microsoft tests).
4310 * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
4311 * File created with access = 0x7 (Read, Write, Delete)
4312 * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
4313 */
4316 /* But SMB1 does. */
4318 }
4327 }
4328 }
4332 }
4334 /* Handle strange delete on close create semantics. */
4338 existing_dos_attributes);
4341 /* Remember to delete the mode we just added. */
4346 }
4347 }
4348 /* Note that here we set the *initial* delete on close flag,
4349 not the regular one. The magic gets handled in close. */
4351 }
4354 /* Overwritten files should be initially set as archive */
4363 }
4364 }
4365 }
4366 }
4368 /* Determine sparse flag. */
4370 /* POSIX opens are sparse by default. */
4375 }
4377 /*
4378 * Take care of inherited ACLs on created files - if default ACL not
4379 * selected.
4380 */
4390 }
4391 }
4394 /*
4395 * We only get here in the case of:
4396 *
4397 * a). Not a POSIX open.
4398 * b). File already existed.
4399 * c). File was overwritten.
4400 * d). Requested DOS attributes didn't match
4401 * the DOS attributes on the existing file.
4402 *
4403 * In that case new_unx_mode has been set
4404 * equal to the calculated mode (including
4405 * possible inheritance of the mode from the
4406 * containing directory).
4407 *
4408 * Note this mode was calculated with the
4409 * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
4410 * so the mode change here is suitable for
4411 * an overwritten file.
4412 */
4421 }
4422 }
4423 }
4425 {
4426 /*
4427 * Deal with other opens having a modified write time.
4428 */
4433 }
4434 }
4439 }
4447 {
4450 mode_t mode;
4451 NTSTATUS status;
4462 }
4469 FILE_ATTRIBUTE_DIRECTORY,
4470 smb_dname,
4472 }
4482 }
4487 }
4488 }
4492 smb_fname_atname,
4493 mode);
4496 }
4498 /*
4499 * Make this a pathref fsp for now. open_directory() will reopen as a
4500 * full fsp.
4501 */
4507 }
4509 /* Ensure we're checking for a symlink here.... */
4510 /* We don't want to get caught by a symlink racer. */
4517 }
4523 }
4527 smb_dname,
4529 parent_dir_fname,
4531 }
4537 }
4540 /*
4541 * Check if high bits should have been set,
4542 * then (if bits are missing): add them.
4543 * Consider bits automagically set by UNIX, i.e. SGID bit from parent
4544 * dir.
4545 */
4552 }
4553 }
4555 /* Change the owner if required. */
4558 fsp);
4560 }
4568 }
4569 }
4575 }
4577 /****************************************************************************
4578 Open a directory from an NT SMB call.
4579 ****************************************************************************/
4592 {
4598 NTSTATUS status;
4608 }
4611 /* Ensure we have a directory attribute. */
4613 }
4620 access_mask,
4621 share_access,
4622 create_options,
4623 create_disposition,
4624 file_attributes);
4629 access_mask,
4637 }
4641 SEC_PRIV_SECURITY)) {
4646 }
4653 }
4660 /* If directory exists error. If directory doesn't
4661 * exist create. */
4670 }
4673 parent_dir_fname,
4674 smb_fname_atname,
4675 smb_dname,
4676 file_attributes,
4677 fsp);
4685 }
4691 /*
4692 * If directory exists open. If directory doesn't
4693 * exist create.
4694 */
4701 parent_dir_fname,
4702 smb_fname_atname,
4703 smb_dname,
4704 file_attributes,
4705 fsp);
4710 /* Cope with create race. */
4712 NT_STATUS_OBJECT_NAME_COLLISION)) {
4718 }
4720 /*
4721 * If mkdir_internal() returned
4722 * NT_STATUS_OBJECT_NAME_COLLISION
4723 * we still must lstat the path.
4724 */
4729 "directory '%s' just "
4732 smb_dname),
4735 errno);
4736 }
4739 }
4740 }
4753 }
4759 }
4761 /*
4762 * Setup the files_struct for it.
4763 */
4773 /*
4774 * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4775 */
4784 }
4786 /* Don't store old timestamps for directory
4787 handles in the internal database. We don't
4788 update them in there if new objects
4789 are created in the directory. Currently
4790 we only update timestamps on file writes.
4791 See bug #9870.
4792 */
4795 /*
4796 * Obviously for FILE_LIST_DIRECTORY we need to reopen to get an fd
4797 * usable for reading a directory. SMB2_FLUSH may be called on
4798 * directories opened with FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY so
4799 * for those we need to reopen as well.
4800 */
4801 need_fd_access =
4802 FILE_LIST_DIRECTORY |
4803 FILE_ADD_FILE |
4804 FILE_ADD_SUBDIRECTORY;
4810 fsp,
4813 NULL);
4819 }
4820 }
4826 }
4833 }
4835 /* Ensure there was no race condition. We need to check
4836 * dev/inode but not permissions, as these can change
4837 * legitimately */
4844 }
4848 fsp,
4850 access_mask);
4858 }
4859 }
4870 }
4876 }
4879 fsp,
4880 lck,
4881 create_disposition,
4882 access_mask,
4883 share_access,
4884 NO_OPLOCK,
4893 }
4898 lck,
4899 fsp,
4902 oplock_type,
4903 NULL,
4904 share_access,
4910 }
4912 /* For directories the delete on close bit at open time seems
4913 always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
4921 }
4924 /* Note that here we set the *initial* delete on close flag,
4925 not the regular one. The magic gets handled in close. */
4927 }
4928 }
4930 {
4931 /*
4932 * Deal with other opens having a modified write time. Is this
4933 * possible for directories?
4934 */
4939 }
4940 }
4946 }
4949 }
4955 {
4956 NTSTATUS status;
4981 }
4984 }
4986 /****************************************************************************
4987 Receive notification that one of our open files has been renamed by another
4988 smbd process.
4989 ****************************************************************************/
4996 {
5009 }
5012 data,
5013 msg,
5014 msg,
5020 }
5026 }
5028 /* stream_name must always be NULL if there is no stream. */
5031 }
5036 NULL,
5042 }
5048 }
5051 SMB_STRUCT_STAT fsp_orig_sbuf;
5052 NTSTATUS status;
5058 /*
5059 * The incoming smb_fname here has an
5060 * invalid stat struct from synthetic_smb_fname()
5061 * above.
5062 * Preserve the existing stat from the
5063 * open fsp after fsp_set_smb_fname()
5064 * overwrites with the invalid stat.
5065 *
5066 * (We could just copy this into
5067 * smb_fname->st, but keep this code
5068 * identical to the fix in rename_open_files()
5069 * for clarity.
5070 *
5071 * We will do an fstat before returning
5072 * any of this metadata to the client anyway.
5073 */
5079 }
5082 /* TODO. JRA. */
5083 /*
5084 * Now we have the complete path we can work out if
5085 * this is actually within this share and adjust
5086 * newname accordingly.
5087 */
5095 }
5096 out:
5098 }
5100 /*
5101 * If a main file is opened for delete, all streams need to be checked for
5102 * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
5103 * If that works, delete them all by setting the delete on close and close.
5104 */
5108 {
5115 NTSTATUS status;
5122 NULL,
5123 NULL,
5130 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
5134 }
5138 }
5142 }
5151 }
5157 }
5160 num_streams));
5165 }
5172 }
5180 }
5185 NULL,
5192 }
5201 }
5231 }
5233 }
5235 /*
5236 * don't touch the variable "status" beyond this point :-)
5237 */
5242 }
5247 }
5249 fail:
5252 }
5254 /*********************************************************************
5255 Create a default ACL by inheriting from the parent. If no inheritance
5256 from the parent available, don't set anything. This will leave the actual
5257 permissions the new file or directory already got from the filesystem
5258 as the NT ACL when read.
5259 *********************************************************************/
5262 {
5285 frame,
5290 }
5297 /* Nothing to inherit and not setting owner. */
5299 }
5301 /* Create an inherited descriptor from the parent. */
5307 }
5309 /* Inherit from parent descriptor if "inherit owner" set. */
5313 }
5321 }
5322 }
5326 {
5330 }
5331 }
5351 }
5352 }
5353 }
5373 }
5374 }
5375 }
5379 }
5383 }
5387 }
5391 }
5395 }
5401 }
5402 }
5407 parent_desc,
5408 owner_sid,
5409 group_sid,
5414 }
5416 /* If inheritable_components == false,
5417 se_create_child_secdesc()
5418 creates a security descriptor with a NULL dacl
5419 entry, but with SEC_DESC_DACL_PRESENT. We need
5420 to remove that flag. */
5425 }
5431 }
5434 /* We need to be root to force this. */
5436 }
5438 security_info_sent,
5439 psd);
5442 }
5445 }
5447 /*
5448 * If we already have a lease, it must match the new file id. [MS-SMB2]
5449 * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
5450 * used for a different file name.
5451 */
5454 /* Input parameters. */
5460 /* Return parameters. */
5463 NTSTATUS match_status;
5464 };
5466 /*************************************************************
5467 File doesn't exist but this lease key+guid is already in use.
5469 This is only allowable in the dynamic share case where the
5470 service path must be different.
5472 There is a small race condition here in the multi-connection
5473 case where a client sends two create calls on different connections,
5474 where the file doesn't exist and one smbd creates the leases_db
5475 entry first, but this will get fixed by the multichannel cleanup
5476 when all identical client_guids get handled by a single smbd.
5477 **************************************************************/
5483 {
5491 }
5492 }
5494 /* Dynamic share case. Break leases on all other files. */
5496 num_files,
5497 files,
5501 }
5506 }
5512 {
5518 /*
5519 * Deal with name mismatch or
5520 * possible dynamic share case separately
5521 * to make code clearer.
5522 */
5524 files,
5525 state);
5527 }
5529 /* File existed. */
5535 /* Everything should be the same. */
5537 /*
5538 * The client asked for a lease on a
5539 * file that doesn't match the file_id
5540 * in the database.
5541 *
5542 * Maybe this is a dynamic share, i.e.
5543 * a share where the servicepath is
5544 * different for different users (e.g.
5545 * the [HOMES] share.
5546 *
5547 * If the servicepath is different, but the requested
5548 * file name + stream name is the same then this is
5549 * a dynamic share, the client is using the same share
5550 * name and doesn't know that the underlying servicepath
5551 * is different. It was expecting a lease on the
5552 * same file. Return NT_STATUS_OPLOCK_NOT_GRANTED
5553 * to break leases
5554 *
5555 * Otherwise the client has messed up, or is
5556 * testing our error codes, so return
5557 * NT_STATUS_INVALID_PARAMETER.
5558 */
5562 {
5563 /*
5564 * Name is the same but servicepath is
5565 * different, dynamic share. Break leases.
5566 */
5568 NT_STATUS_OPLOCK_NOT_GRANTED;
5571 NT_STATUS_INVALID_PARAMETER;
5572 }
5574 }
5578 }
5582 }
5586 }
5587 }
5590 /*
5591 * Common case - just opening another handle on a
5592 * file on a non-dynamic share.
5593 */
5595 }
5598 /* Mismatched path. Error back to client. */
5600 }
5602 /*
5603 * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
5604 * Don't allow leases.
5605 */
5608 num_files,
5609 files,
5613 }
5618 }
5628 };
5633 {
5637 NTSTATUS status;
5642 }
5647 }
5665 }
5669 }
5672 /*
5673 * Windows 7 and 8 lease clients are broken in that they will
5674 * not respond to lease break requests whilst waiting for an
5675 * outstanding open request on that lease handle on the same
5676 * TCP connection, due to holding an internal inode lock.
5677 *
5678 * This means we can't reschedule ourselves here, but must
5679 * return from the create.
5680 *
5681 * Work around:
5682 *
5683 * Send the breaks and then return SMB2_LEASE_NONE in the
5684 * lease handle to cause them to acknowledge the lease
5685 * break. Consultation with Microsoft engineering confirmed
5686 * this approach is safe.
5687 */
5690 }
5694 {
5700 }
5701 }
5710 {
5718 };
5720 NTSTATUS status;
5725 }
5730 /*
5731 * Not found or error means okay: We can make the lease pass
5732 */
5734 }
5736 /*
5737 * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
5738 * deal with it.
5739 */
5741 }
5743 /* We have to break all existing leases. */
5748 };
5751 /* Don't need to break our own file. */
5753 }
5758 lease_match_fid_fn,
5761 /* Race condition - file already closed. */
5763 }
5768 }
5769 }
5770 /*
5771 * Ensure we don't grant anything more so we
5772 * never upgrade.
5773 */
5775 }
5777 /*
5778 * Wrapper around open_file_ntcreate and open_directory
5779 */
5799 {
5805 NTSTATUS status;
5817 "ea_list = %p, "
5818 "sd = %p, "
5820 access_mask,
5821 file_attributes,
5822 share_access,
5823 create_disposition,
5824 create_options,
5825 oplock_request,
5826 private_flags,
5827 ea_list,
5828 sd,
5834 }
5839 }
5843 }
5853 }
5856 req,
5859 smb_fname,
5863 /* Dynamic share file. No leases and update epoch... */
5871 }
5872 }
5877 /*
5878 * We can't open a file with DELETE access if any of the
5879 * streams is open without FILE_SHARE_DELETE
5880 */
5885 }
5886 }
5892 SEC_PRIV_SECURITY);
5899 }
5903 {
5904 /*
5905 * No other bits set. Windows SMB2 refuses this.
5906 * See smbtorture3 SMB2-SACL test.
5907 *
5908 * Note this is an SMB2-only behavior,
5909 * smbtorture3 SMB1-SYSTEM-SECURITY already tests
5910 * that SMB1 allows this.
5911 */
5914 }
5915 }
5917 /*
5918 * Files or directories can't be opened DELETE_ON_CLOSE without
5919 * delete access.
5920 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
5921 */
5926 }
5927 }
5931 {
5940 }
5949 }
5957 }
5959 /*
5960 * We may be creating the basefile as part of creating the
5961 * stream, so it's legal if the basefile doesn't exist at this
5962 * point, the create_file_unixpath() below will create it. But
5963 * if the basefile exists we want a handle so we can fstat() it.
5964 */
5971 }
5974 smb_fname_base);
5981 }
5983 /*
5984 * https://bugzilla.samba.org/show_bug.cgi?id=10229
5985 * We need to check if the requested access mask
5986 * could be used to open the underlying file (if
5987 * it existed), as we're passing in zero for the
5988 * access mask to the base filename.
5989 */
5991 access_mask);
5995 "for base %s failed: "
6000 }
6001 }
6005 /* Open the base file. */
6007 NULL,
6008 dirfsp,
6009 smb_fname_base,
6011 FILE_SHARE_READ
6012 | FILE_SHARE_WRITE
6014 base_create_disposition,
6018 NULL,
6020 base_privflags,
6021 NULL,
6022 NULL,
6024 NULL);
6032 }
6033 }
6039 /*
6040 * We're about to use smb_fname->fsp for the fresh open.
6041 *
6042 * Every fsp passed in via smb_fname->fsp already
6043 * holds a fsp->fsp_name. If it is already this
6044 * fsp->fsp_name that we got passed in as our input
6045 * argument smb_fname, these two are assumed to have
6046 * the same lifetime: Every fsp hangs of "conn", and
6047 * fsp->fsp_name is its talloc child.
6048 */
6051 /*
6052 * "smb_fname" is temporary in this case, but
6053 * the destructor of smb_fname would also tear
6054 * down the fsp we're about to use. Unlink
6055 * them from each other.
6056 */
6059 /*
6060 * "fsp" is ours now
6061 */
6063 }
6068 }
6077 }
6079 /*
6080 * No fsp passed in that we can use, create one
6081 */
6085 }
6091 }
6092 }
6098 /*
6099 * We're opening the stream element of a
6100 * base_fsp we already opened. Set up the
6101 * base_fsp pointer.
6102 */
6104 }
6108 conn,
6110 smb_fname,
6115 }
6117 /*
6118 * Get a pathref on the parent. We can re-use this for
6119 * multiple calls to check parent ACLs etc. to avoid
6120 * pathname calls.
6121 */
6124 smb_fname,
6129 }
6135 }
6136 }
6138 /*
6139 * If it's a request for a directory open, deal with it separately.
6140 */
6147 }
6149 /* Can't open a temp directory. IFS kit test. */
6154 }
6156 /*
6157 * We will get a create directory here if the Win32
6158 * app specified a security descriptor in the
6159 * CreateDirectory() call.
6160 */
6164 req,
6165 access_mask,
6166 share_access,
6167 create_disposition,
6168 create_options,
6169 file_attributes,
6171 smb_fname_atname,
6173 fsp);
6176 /*
6177 * Ordinary file case.
6178 */
6182 allocation_size);
6183 }
6186 req,
6187 access_mask,
6188 share_access,
6189 create_disposition,
6190 create_options,
6191 file_attributes,
6192 oplock_request,
6193 lease,
6194 private_flags,
6196 smb_fname_atname,
6198 fsp);
6201 /* A stream open never opens a directory */
6206 }
6208 /*
6209 * Fail the open if it was explicitly a non-directory
6210 * file.
6211 */
6216 }
6220 req,
6221 access_mask,
6222 share_access,
6223 create_disposition,
6224 create_options,
6225 file_attributes,
6227 smb_fname_atname,
6229 fsp);
6230 }
6231 }
6235 }
6244 }
6245 }
6249 {
6252 }
6254 /* Save the requested allocation size. */
6258 {
6265 }
6269 }
6272 }
6278 /*
6279 * According to the MS documentation, the only time the security
6280 * descriptor is applied to the opened file is iff we *created* the
6281 * file; an existing file stays the same.
6282 *
6283 * Also, it seems (from observation) that you can open the file with
6284 * any access mask but you can still write the sd. We need to override
6285 * the granted access before we call set_sd
6286 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
6287 */
6297 SECINFO_GROUP|
6298 SECINFO_DACL|
6299 SECINFO_SACL)) {
6301 }
6307 }
6309 /* Inherit from parent. Errors here are not fatal. */
6315 }
6316 }
6317 }
6323 COMPRESSION_FORMAT_NONE);
6327 }
6328 }
6335 }
6343 fail:
6347 /*
6348 * The close_file below will close
6349 * fsp->base_fsp.
6350 */
6356 }
6357 }
6360 }
6365 }
6386 {
6389 NTSTATUS status;
6394 "file_attributes = 0x%x, share_access = 0x%x, "
6395 "create_disposition = 0x%x create_options = 0x%x "
6396 "oplock_request = 0x%x "
6397 "private_flags = 0x%x "
6398 "ea_list = %p, sd = %p, "
6407 ea_list,
6408 sd,
6412 /*
6413 * Remember the absolute time of the original request
6414 * with this mid. We'll use it later to see if this
6415 * has timed out.
6416 */
6418 }
6420 /*
6421 * Check to see if this is a mac fork of some kind.
6422 */
6432 /*
6433 * Here we go! support for changing the disk quotas
6434 * --metze
6435 *
6436 * We need to fake up to open this MAGIC QUOTA file
6437 * and return a valid FID.
6438 *
6439 * w2k close this file directly after openening xp
6440 * also tries a QUERY_FILE_INFO on the file and then
6441 * close it
6442 */
6448 }
6452 }
6457 }
6458 }
6462 /* We have to handle this error here. */
6466 }
6471 }
6472 }
6487 }
6494 }
6495 /*
6496 * Remove type info from mode, leaving only the
6497 * permissions and setuid/gid bits.
6498 */
6502 }
6505 req,
6506 dirfsp,
6507 smb_fname,
6508 access_mask,
6509 share_access,
6510 create_disposition,
6511 create_options,
6512 file_attributes,
6513 oplock_request,
6514 lease,
6515 allocation_size,
6516 private_flags,
6517 sd,
6518 ea_list,
6523 }
6525 done:
6531 }
6534 fail:
6539 }
6541 }