| blob | abec78579515c6d4818e3dae187069feef9a3119 |
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
54 /****************************************************************************
55 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
56 path or anything including wildcards.
57 We're assuming here that '/' is not the second byte in any multibyte char
58 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
59 set.
60 ****************************************************************************/
62 /* Custom version for processing POSIX paths. */
67 {
84 }
87 }
89 }
90 }
95 }
96 /* Stream names allow more characters than file names.
97 We're overloading posix_path here to allow a wider
98 range of characters. If stream_started is true this
99 is still a Windows path even if posix_path is true.
100 JRA.
101 */
108 }
109 }
112 /*
113 * Safe to assume is not the second part of a mb char
114 * as this is handled below.
115 */
116 /* Eat multiple '/' or '\\' */
118 s++;
119 }
121 /* We only care about non-leading or trailing '/' or '\\' */
123 }
126 /* New component. */
129 }
133 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
135 /*
136 * No mb char starts with '.' so we're safe checking the directory separator here.
137 */
139 /* If we just added a '/' - delete it */
142 d--;
143 }
145 /* Are we at the start ? Can't go back further if so. */
149 }
150 /* Go back one level... */
151 /* We know this is safe as '/' cannot be part of a mb sequence. */
152 /* NOTE - if this assumption is invalid we are not in good shape... */
153 /* Decrement d first as d points to the *next* char to write into. */
157 }
159 /* We're still at the start of a name component, just the previous one. */
164 /* Eat the '.' */
165 s++;
167 }
168 }
170 }
176 }
187 }
188 }
192 /* Get the size of the next MB character. */
197 FALL_THROUGH;
200 FALL_THROUGH;
203 FALL_THROUGH;
206 FALL_THROUGH;
214 }
215 }
217 }
222 }
224 /****************************************************************************
225 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
226 No wildcards allowed.
227 ****************************************************************************/
230 {
232 }
234 /****************************************************************************
235 Check the path for a POSIX client.
236 We're assuming here that '/' is not the second byte in any multibyte char
237 set (a safe assumption).
238 ****************************************************************************/
241 {
243 }
245 /****************************************************************************
246 Pull a string and check the path allowing a wildcard - provide for error return.
247 Passes in posix flag.
248 ****************************************************************************/
259 {
270 }
273 /*
274 * For a DFS path the function parse_dfs_path()
275 * will do the path processing, just make a copy.
276 */
279 }
285 }
288 }
290 /****************************************************************************
291 Pull a string and check the path - provide for error return.
292 ****************************************************************************/
302 {
304 base_ptr,
305 smb_flags2,
306 pp_dest,
307 src,
308 src_len,
309 flags,
311 err);
312 }
314 /****************************************************************************
315 Pull a string and check the path - provide for error return.
316 posix_pathnames version.
317 ****************************************************************************/
327 {
329 base_ptr,
330 smb_flags2,
331 pp_dest,
332 src,
333 src_len,
334 flags,
336 err);
337 }
343 {
349 }
355 pp_dest,
356 src,
357 bufrem,
358 flags,
360 err);
365 pp_dest,
366 src,
367 bufrem,
368 flags,
370 err);
371 }
372 }
374 /**
375 * pull a string from the smb_buf part of a packet. In this case the
376 * string can either be null terminated or it can be terminated by the
377 * end of the smbbuf area
378 */
381 {
386 }
390 }
392 /****************************************************************************
393 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
394 ****************************************************************************/
398 {
402 }
406 }
408 }
410 /****************************************************************************
411 Check if we have a correct fsp pointing to a file.
412 ****************************************************************************/
416 {
419 }
423 }
427 }
430 }
432 /****************************************************************************
433 Check if we have a correct fsp pointing to a quota fake file. Replacement for
434 the CHECK_NTQUOTA_HANDLE_OK macro.
435 ****************************************************************************/
439 {
442 }
446 }
450 }
454 }
458 }
461 }
463 /****************************************************************************
464 Return the port number we've bound to on a socket.
465 ****************************************************************************/
468 {
471 };
475 }
482 }
484 #if defined(HAVE_IPV6)
487 }
488 #endif
491 }
493 }
497 {
512 }
517 }
521 name_type);
524 }
531 }
534 }
539 }
547 }
554 }
555 }
561 }
566 }
576 NULL)) {
579 }
582 fail:
585 }
588 {
592 }
594 /****************************************************************************
595 Reply to a (netbios-level) special message.
596 ****************************************************************************/
599 {
603 /*
604 * We only really use 4 bytes of the outbuf, but for the smb_setlen
605 * calculation & friends (srv_send_smb uses that) we need the full smb
606 * header.
607 */
616 {
617 /* inbuf_size is guarenteed to be at least 4. */
626 }
631 /* inbuf_size is guaranteed to be at least 4. */
637 }
643 }
654 }
661 }
663 /*
664 * Windows NT/2k uses "*SMBSERVER" and XP uses
665 * "*SMBSERV" arrggg!!!
666 */
675 }
678 }
692 }
694 }
698 name_type2));
701 /* We are being asked for a pathworks session ---
702 no thanks! */
705 }
712 }
715 (some old clients produce this?) */
729 }
736 }
740 }
742 }
744 /****************************************************************************
745 Reply to a tcon.
746 conn POINTER CAN BE NULL HERE !
747 ****************************************************************************/
750 {
757 NTSTATUS nt_status;
770 }
784 }
790 }
800 }
812 }
814 /****************************************************************************
815 Reply to a tcon and X.
816 conn POINTER CAN BE NULL HERE !
817 ****************************************************************************/
820 {
826 /* what the client thinks the device is */
828 /* what the server tells the client the share represents */
830 NTSTATUS nt_status;
848 }
853 /* we might have to close an old one */
856 NTSTATUS status;
862 /*
863 * TODO: cancel all outstanding requests on the tcon
864 */
870 /*
871 * If we hit this case, there is something completely
872 * wrong, so we better disconnect the transport connection.
873 */
877 }
880 /*
881 * This tree id is gone. Make sure we can't re-use it
882 * by accident.
883 */
885 }
891 }
897 }
905 }
907 /*
908 * the service name can be either: \\server\share
909 * or share directly like on the DELL PowerVault 705
910 */
917 }
921 }
931 }
941 }
946 }
951 }
957 }
959 /*
960 * If there is no application key defined yet
961 * we create one.
962 *
963 * This means we setup the application key on the
964 * first tcon that happens via the given session.
965 *
966 * Once the application key is defined, it does not
967 * change any more.
968 */
971 {
981 /*
982 * The application key is truncated/padded to 16 bytes
983 */
985 session_key,
992 }
996 NTSTATUS status;
1006 }
1008 }
1010 /*
1011 * Place the application key into the session_info
1012 */
1021 }
1024 }
1037 }
1041 }
1047 else
1057 }
1059 /* NT sets the fstype of IPC$ to the null string */
1063 /* Return permissions. */
1074 }
1080 }
1089 }
1091 /* what does setting this bit do? It is set by NT4 and
1092 may affect the ability to autorun mounted cdroms */
1094 optional_support |=
1101 }
1104 }
1110 service));
1112 /* set the incoming and outgoing tid to the just created one */
1119 }
1121 /****************************************************************************
1122 Reply to an unknown type.
1123 ****************************************************************************/
1126 {
1131 }
1133 /****************************************************************************
1134 Reply to an ioctl.
1135 conn POINTER CAN BE NULL HERE !
1136 ****************************************************************************/
1139 {
1155 }
1171 }
1183 {
1184 NTSTATUS status;
1192 }
1193 /* Job number */
1203 }
1208 lp_sub,
1215 }
1218 }
1220 }
1221 }
1225 }
1227 /****************************************************************************
1228 Strange checkpath NTSTATUS mapping.
1229 ****************************************************************************/
1232 {
1233 /* Strange DOS error code semantics only for checkpath... */
1236 /* We need to map to ERRbadpath */
1238 }
1239 }
1241 }
1243 /****************************************************************************
1244 Reply to a checkpath.
1245 ****************************************************************************/
1248 {
1252 NTSTATUS status;
1266 }
1271 conn,
1272 name,
1273 ucf_flags,
1283 }
1285 }
1293 }
1299 }
1303 path_err:
1304 /* We special case this - as when a Windows machine
1305 is parsing a path is steps through the components
1306 one at a time - if a component fails it expects
1307 ERRbadpath, not ERRbadfile.
1308 */
1311 /*
1312 * Windows returns different error codes if
1313 * the parent directory is valid but not the
1314 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1315 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1316 * if the path is invalid.
1317 */
1321 }
1325 out:
1329 }
1331 /****************************************************************************
1332 Reply to a getatr.
1333 ****************************************************************************/
1336 {
1344 NTSTATUS status;
1355 }
1357 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1358 under WfWg - weird! */
1363 }
1369 conn,
1370 fname,
1371 ucf_flags,
1379 }
1382 }
1390 }
1404 }
1405 }
1410 }
1411 }
1420 }
1426 }
1431 out:
1436 }
1438 /****************************************************************************
1439 Reply to a setatr.
1440 ****************************************************************************/
1443 {
1451 NTSTATUS status;
1461 }
1468 }
1471 conn,
1472 fname,
1473 ucf_flags,
1481 }
1484 }
1487 /*
1488 * Not sure here is the right place to catch this
1489 * condition. Might be moved to somewhere else later -- vl
1490 */
1493 }
1496 /* Can't set access rights on a symlink. */
1499 }
1507 else
1513 FILE_WRITE_ATTRIBUTES);
1517 }
1523 }
1524 }
1532 }
1537 mode));
1538 out:
1542 }
1544 /****************************************************************************
1545 Reply to a dskattr.
1546 ****************************************************************************/
1549 {
1564 }
1571 }
1573 /*
1574 * Force max to fit in 16 bit fields.
1575 */
1587 }
1588 }
1594 /* we need to scale this to a number that DOS6 can handle. We
1595 use floating point so we can handle large drives on systems
1596 that don't have 64 bit integers
1598 we end up displaying a maximum of 2G to DOS systems
1599 */
1618 }
1624 }
1626 /*
1627 * Utility function to split the filename from the directory.
1628 */
1632 {
1645 }
1651 }
1656 }
1658 /****************************************************************************
1659 Make a dir struct.
1660 ****************************************************************************/
1666 off_t size,
1670 {
1676 }
1680 }
1690 }
1697 /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1698 Strange, but verified on W2K3. Needed for OS/2. JRA. */
1702 }
1704 /****************************************************************************
1705 Reply to a search.
1706 Can be called from SMBsearch, SMBffirst or SMBfunique.
1707 ****************************************************************************/
1710 {
1717 off_t size;
1730 NTSTATUS nt_status;
1746 }
1751 }
1753 /* If we were called as SMBffirst then we must expect close. */
1756 }
1767 }
1772 }
1774 p++;
1778 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1786 path,
1787 ucf_flags,
1795 }
1798 }
1810 }
1815 }
1821 directory,
1822 NULL,
1823 NULL,
1829 }
1831 /*
1832 * As we've cut off the last component from
1833 * smb_fname we need to re-stat smb_dname
1834 * so FILE_OPEN disposition knows the directory
1835 * exists.
1836 */
1842 }
1848 }
1850 /*
1851 * Open an fsp on this directory for the dptr.
1852 */
1858 FILE_SHARE_READ|
1879 }
1884 True,
1885 expect_close,
1887 mask,
1888 dirtype,
1894 /*
1895 * Use NULL here for the first parameter (req)
1896 * as this is not a client visible handle so
1897 * can'tbe part of an SMB1 chain.
1898 */
1903 }
1914 }
1920 }
1925 }
1931 }
1936 }
1938 }
1951 }
1957 }
1963 }
1975 }
1980 mask,
1981 dirtype,
1986 check_descend,
1987 ask_sharemode);
1992 buf,
1993 mask,
1994 fname,
1995 size,
1996 mode,
2001 }
2004 }
2010 }
2011 numentries++;
2012 }
2013 }
2014 }
2016 SearchEmpty:
2018 /* If we were called as SMBffirst with smb_search_id == NULL
2019 and no entries were found then return error and close fsp->dptr
2020 (X/Open spec) */
2027 }
2029 /* Close the dptr - we know it's gone */
2034 }
2035 }
2037 /* If we were called as SMBfunique, then we can close the fsp->dptr now ! */
2040 /* fsp may have been closed above. */
2044 }
2045 }
2050 }
2057 /* The replies here are never long name. */
2064 }
2066 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
2072 mask,
2073 directory,
2074 dirtype,
2075 numentries,
2076 maxentries ));
2077 out:
2083 }
2085 /****************************************************************************
2086 Reply to a fclose (stop directory search).
2087 ****************************************************************************/
2090 {
2096 NTSTATUS err;
2107 }
2116 }
2122 }
2124 p++;
2132 }
2138 }
2144 /* Close the file - we know it's gone */
2148 }
2157 }
2159 /****************************************************************************
2160 Reply to an open.
2161 ****************************************************************************/
2164 {
2181 NTSTATUS status;
2190 }
2201 }
2209 }
2214 conn,
2215 fname,
2216 ucf_flags,
2222 NT_STATUS_PATH_NOT_COVERED,
2225 }
2228 }
2242 private_flags,
2251 /* We have re-scheduled this call. */
2253 }
2258 }
2261 req,
2262 smb_fname,
2263 access_mask,
2264 create_options,
2265 private_flags);
2270 }
2273 }
2274 }
2276 /* Ensure we're pointing at the correct stat struct. */
2292 }
2301 }
2308 }
2313 }
2314 out:
2317 }
2319 /****************************************************************************
2320 Reply to an open and X.
2321 ****************************************************************************/
2324 {
2331 /* Breakout the oplock request bits so we can set the
2332 reply bits separately. */
2336 #if 0
2339 #endif
2345 NTSTATUS status;
2361 }
2372 /* If it's an IPC, pass off the pipe handler. */
2378 }
2380 }
2382 /* XXXX we need to handle passed times, sattr and flags */
2388 }
2391 smb_ofun,
2398 }
2403 conn,
2404 fname,
2405 ucf_flags,
2411 NT_STATUS_PATH_NOT_COVERED,
2414 }
2417 }
2431 private_flags,
2440 /* We have re-scheduled this call. */
2442 }
2447 }
2450 req,
2451 smb_fname,
2452 access_mask,
2453 create_options,
2454 private_flags);
2459 }
2462 }
2466 }
2468 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2469 if the file is truncated or created. */
2470 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2476 }
2482 }
2488 }
2489 }
2496 }
2499 /* If the caller set the extended oplock request bit
2500 and we granted one (by whatever means) - set the
2501 correct bit for extended oplock reply.
2502 */
2506 }
2510 }
2512 /* If the caller set the core oplock request bit
2513 and we granted one (by whatever means) - set the
2514 correct bit for core oplock reply.
2515 */
2521 }
2529 }
2534 }
2542 }
2549 }
2551 out:
2555 }
2557 /****************************************************************************
2558 Reply to a SMBulogoffX.
2559 ****************************************************************************/
2566 {
2570 NTSTATUS status;
2572 /*
2573 * Don't setup the profile charge here, take
2574 * it in reply_ulogoffX_done(). Not strictly correct
2575 * but better than the other SMB1 async
2576 * code that double-charges at the moment.
2577 */
2584 /* Not going async, profile here. */
2593 }
2597 /* Not going async, profile here. */
2602 }
2604 /* We're async. This will complete later. */
2607 }
2612 };
2616 /****************************************************************************
2617 Async SMB1 ulogoffX.
2618 Note, on failure here we deallocate and return NULL to allow the caller to
2619 SMB1 return an error of ERRnomem immediately.
2620 ****************************************************************************/
2624 {
2636 }
2642 }
2645 /*
2646 * Make sure that no new request will be able to use this session.
2647 * This ensures that once all outstanding fsp->aio_requests
2648 * on this session are done, we are safe to close it.
2649 */
2655 }
2656 /*
2657 * Flag the file as close in progress.
2658 * This will prevent any more IO being
2659 * done on it.
2660 */
2664 /*
2665 * Now wait until all aio requests on this fsp are
2666 * finished.
2667 *
2668 * We don't set a callback, as we just want to block the
2669 * wait queue and the talloc_free() of fsp->aio_request
2670 * will remove the item from the wait queue.
2671 */
2678 }
2679 }
2680 }
2682 /*
2683 * Now we add our own waiter to the end of the queue,
2684 * this way we get notified when all pending requests are finished
2685 * and reply to the outstanding SMB1 request.
2686 */
2693 }
2695 /*
2696 * We're really going async - move the SMB1 request from
2697 * a talloc stackframe above us to the sconn talloc-context.
2698 * We need this to stick around until the wait_done
2699 * callback is invoked.
2700 */
2706 }
2709 {
2716 }
2719 {
2721 }
2724 {
2730 NTSTATUS status;
2732 /*
2733 * Take the profile charge here. Not strictly
2734 * correct but better than the other SMB1 async
2735 * code that double-charges at the moment.
2736 */
2746 }
2754 }
2766 /*
2767 * The following call is needed to push the
2768 * reply data back out the socket after async
2769 * return. Plus it frees smb1req.
2770 */
2773 }
2775 /****************************************************************************
2776 Reply to a mknew or a create.
2777 ****************************************************************************/
2780 {
2788 NTSTATUS status;
2802 }
2808 /* We should fail if file exists. */
2811 /* Create if file doesn't exist, truncate if it does. */
2813 }
2815 /* mtime. */
2823 }
2827 conn,
2828 fname,
2829 ucf_flags,
2835 NT_STATUS_PATH_NOT_COVERED,
2838 }
2841 }
2847 }
2870 /* We have re-scheduled this call. */
2872 }
2877 }
2878 }
2881 }
2888 }
2896 }
2901 }
2908 out:
2912 }
2914 /****************************************************************************
2915 Reply to a create temporary file.
2916 ****************************************************************************/
2919 {
2928 NTSTATUS status;
2938 }
2948 }
2954 wire_name,
2960 }
2965 }
2969 fname,
2970 ucf_flags,
2978 }
2981 }
2983 /* Create the file. */
3007 }
3011 /* We have re-scheduled this call. */
3013 }
3019 }
3020 }
3023 }
3026 }
3029 /* Collision after 10 times... */
3032 }
3037 /* the returned filename is relative to the directory */
3042 s++;
3043 }
3045 #if 0
3046 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
3047 thing in the byte section. JRA */
3049 #endif
3054 }
3059 }
3064 }
3069 out:
3074 }
3076 /*******************************************************************
3077 Check if a user is allowed to rename a file.
3078 ********************************************************************/
3082 {
3085 }
3089 /* Only bother to read the DOS attribute if we might deny the
3090 rename on the grounds of attribute mismatch. */
3094 }
3095 }
3100 }
3102 /* If no pathnames are open below this
3103 directory, allow the rename. */
3106 /*
3107 * Strict rename, check open file db.
3108 */
3111 }
3113 /*
3114 * No strict rename, just look in local process.
3115 */
3117 }
3119 }
3123 }
3126 }
3128 /*******************************************************************
3129 * unlink a file with all relevant access checks
3130 *******************************************************************/
3136 {
3140 NTSTATUS status;
3146 dirtype));
3150 }
3155 }
3161 }
3163 dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
3166 }
3171 }
3173 }
3176 /* These will never be set for POSIX. */
3178 }
3180 #if 0
3183 }
3187 }
3190 /* These will never be set for POSIX. */
3192 }
3197 }
3199 /* Can't delete a directory. */
3202 }
3203 #endif
3217 }
3218 }
3220 /* On open checks the open itself will check the share mode, so
3221 don't do it here as we'll get it wrong. */
3223 status = SMB_VFS_CREATE_FILE
3249 }
3259 }
3261 /* The set is across all open files on this dev/inode pair. */
3267 }
3270 }
3272 /****************************************************************************
3273 The guts of the unlink command, split out so it may be called by the NT SMB
3274 code.
3275 ****************************************************************************/
3282 {
3291 /* Split up the directory from the filename/mask. */
3296 }
3298 /*
3299 * We should only check the mangled cache
3300 * here if unix_convert failed. This means
3301 * that the path in 'mask' doesn't exist
3302 * on the file system and so we need to look
3303 * for a possible mangle. This patch from
3304 * Tine Smukavec <valentin.smukavec@hermes.si>.
3305 */
3315 }
3316 }
3320 /*
3321 * Only one file needs to be unlinked. Append the mask back
3322 * onto the directory.
3323 */
3326 /* Ensure we use canonical names on open. */
3329 fname_mask);
3333 fname_dir,
3334 fname_mask);
3335 }
3339 }
3342 }
3347 }
3352 }
3354 count++;
3364 }
3367 }
3375 }
3376 }
3379 fname_dir,
3380 NULL,
3381 NULL,
3387 }
3392 }
3395 dirtype);
3399 }
3401 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
3402 the pattern matches against the long name, otherwise the short name
3403 We don't implement this yet XXXX
3404 */
3414 /* Quick check for "." and ".." */
3419 }
3425 }
3432 }
3435 /* Ensure we use canonical names on open. */
3440 }
3447 }
3449 p,
3450 NULL,
3460 }
3469 }
3475 {
3477 }
3483 }
3489 }
3497 }
3505 }
3507 count++;
3513 }
3515 }
3519 }
3521 out:
3526 }
3528 /****************************************************************************
3529 Reply to a unlink
3530 ****************************************************************************/
3533 {
3538 NTSTATUS status;
3549 }
3558 }
3561 name,
3562 ucf_flags,
3570 }
3573 }
3577 conn,
3578 name,
3579 ucf_flags);
3583 }
3586 }
3593 /* We have re-scheduled this call. */
3595 }
3600 }
3601 }
3604 }
3607 out:
3611 }
3613 /****************************************************************************
3614 Fail for readbraw.
3615 ****************************************************************************/
3618 {
3624 }
3626 }
3628 /****************************************************************************
3629 Fake (read/write) sendfile. Returns -1 on read or write fail.
3630 ****************************************************************************/
3634 {
3641 }
3647 }
3650 ssize_t ret;
3658 }
3660 /* If we had a short read, fill with zeros. */
3663 }
3668 /*
3669 * Try and give an error message saying what
3670 * client failed.
3671 */
3679 }
3682 }
3686 }
3688 /****************************************************************************
3689 Deal with the case of sendfile reading less bytes from the file than
3690 requested. Fill with zeros (all we can do). Returns 0 on success
3691 ****************************************************************************/
3695 ssize_t nread,
3698 {
3699 #define SHORT_SEND_BUFSIZE 1024
3705 }
3716 /*
3717 * We asked for the real file size and told sendfile
3718 * to not go beyond the end of the file. But it can
3719 * happen that in between our fstat call and the
3720 * sendfile call the file was truncated. This is very
3721 * bad because we have already announced the larger
3722 * number of bytes to the client.
3723 *
3724 * The best we can do now is to send 0-bytes, just as
3725 * a read from a hole in a sparse file would do.
3726 *
3727 * This should happen rarely enough that I don't care
3728 * about efficiency here :-)
3729 */
3731 ssize_t ret;
3737 /*
3738 * Try and give an error message saying what
3739 * client failed.
3740 */
3747 }
3749 }
3750 }
3753 }
3755 /****************************************************************************
3756 Return a readbraw error (4 bytes of zero).
3757 ****************************************************************************/
3760 {
3768 /*
3769 * Try and give an error message saying what
3770 * client failed.
3771 */
3779 }
3781 }
3783 /*******************************************************************
3784 Ensure we don't use sendfile if server smb signing is active.
3785 ********************************************************************/
3788 {
3791 /* Using sendfile blows the brains out of any DOS or Win9x TCP stack... JRA. */
3794 }
3797 }
3801 }
3802 /****************************************************************************
3803 Use sendfile in readbraw.
3804 ****************************************************************************/
3809 off_t startpos,
3811 ssize_t mincount)
3812 {
3817 /*
3818 * We can only use sendfile on a non-chained packet
3819 * but we can use on a non-oplocked file. tridge proved this
3820 * on a train in Germany :-). JRA.
3821 * reply_readbraw has already checked the length.
3822 */
3828 DATA_BLOB header_blob;
3835 nread);
3837 /* Returning ENOSYS means no data at all was sent.
3838 * Do this as a normal read. */
3841 }
3843 /*
3844 * Special hack for broken Linux with no working sendfile. If we
3845 * return EINTR we sent the header but not the rest of the data.
3846 * Fake this up by doing read/write calls.
3847 */
3849 /* Ensure we don't do this again. */
3855 "fake_sendfile failed for "
3860 }
3862 }
3869 /*
3870 * Some sendfile implementations return 0 to indicate
3871 * that there was a short read, but nothing was
3872 * actually written to the socket. In this case,
3873 * fallback to the normal read path so the header gets
3874 * the correct byte count.
3875 */
3877 "bytes falling back to the normal read: "
3880 }
3882 /* Deal with possible short send. */
3888 }
3889 }
3891 }
3893 normal_readbraw:
3901 }
3908 #else
3911 #endif
3912 }
3917 /*
3918 * Try and give an error message saying what
3919 * client failed.
3920 */
3927 }
3930 }
3932 /****************************************************************************
3933 Reply to a readbraw (core+ protocol).
3934 ****************************************************************************/
3937 {
3942 off_t startpos;
3946 NTSTATUS status;
3953 }
3959 }
3967 }
3969 /*
3970 * Special check if an oplock break has been issued
3971 * and the readraw request croses on the wire, we must
3972 * return a zero length response here.
3973 */
3977 /*
3978 * We have to do a check_fsp by hand here, as
3979 * we must always return 4 zero bytes on error,
3980 * not a NTSTATUS.
3981 */
3989 {
3990 /*
3991 * fsp could be NULL here so use the value from the packet. JRA.
3992 */
3999 }
4001 /* Do a "by hand" version of CHECK_READ. */
4010 }
4014 /*
4015 * This is a large offset (64 bit) read.
4016 */
4027 }
4028 }
4033 /* ensure we don't overrun the packet size */
4044 }
4049 }
4055 }
4060 #endif
4075 }
4077 #undef DBGC_CLASS
4078 #define DBGC_CLASS DBGC_LOCKING
4080 /****************************************************************************
4081 Reply to a lockread (core+ protocol).
4082 ****************************************************************************/
4087 {
4099 }
4106 }
4112 }
4119 }
4121 /*
4122 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
4123 * protocol request that predates the read/write lock concept.
4124 * Thus instead of asking for a read lock here we need to ask
4125 * for a write lock. JRA.
4126 * Note that the requested lock size is unaffected by max_send.
4127 */
4135 };
4138 fsp,
4141 fsp,
4144 WINDOWS_LOCK,
4146 lck);
4151 }
4154 }
4157 {
4161 NTSTATUS status;
4163 off_t startpos;
4179 }
4185 }
4190 /*
4191 * However the requested READ size IS affected by max_send. Insanity.... JRA.
4192 */
4197 "maximum allowed (%zu/%d). "
4198 "Returning short read of maximum allowed for "
4200 numtoread,
4201 maxtoread,
4204 }
4215 }
4228 send:
4234 NULL);
4237 }
4241 }
4243 #undef DBGC_CLASS
4244 #define DBGC_CLASS DBGC_ALL
4246 /****************************************************************************
4247 Reply to a read.
4248 ****************************************************************************/
4251 {
4257 off_t startpos;
4268 }
4275 }
4281 }
4286 /*
4287 * The requested read size cannot be greater than max_send. JRA.
4288 */
4297 }
4311 }
4319 }
4331 out:
4334 }
4336 /****************************************************************************
4337 Setup readX header.
4338 ****************************************************************************/
4341 {
4345 False);
4360 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
4364 }
4366 /****************************************************************************
4367 Reply to a read and X - possibly using sendfile.
4368 ****************************************************************************/
4373 {
4378 NTSTATUS status;
4387 }
4389 /*
4390 * We can only use sendfile on a non-chained packet
4391 * but we can use on a non-oplocked file. tridge proved this
4392 * on a train in Germany :-). JRA.
4393 */
4400 DATA_BLOB header;
4406 }
4411 /*
4412 * We already know that we would do a short read, so don't
4413 * try the sendfile() path.
4414 */
4416 }
4418 /*
4419 * Set up the packet header before send. We
4420 * assume here the sendfile will work (get the
4421 * correct amount of data).
4422 */
4434 /* Returning ENOSYS means no data at all was sent.
4435 Do this as a normal read. */
4438 }
4440 /*
4441 * Special hack for broken Linux with no working sendfile. If we
4442 * return EINTR we sent the header but not the rest of the data.
4443 * Fake this up by doing read/write calls.
4444 */
4447 /* Ensure we don't do this again. */
4451 smb_maxcnt);
4455 "fake_sendfile failed for "
4456 "file %s (%s) for client %s. "
4463 }
4466 /* No outbuf here means successful sendfile. */
4468 }
4475 /*
4476 * Some sendfile implementations return 0 to indicate
4477 * that there was a short read, but nothing was
4478 * actually written to the socket. In this case,
4479 * fallback to the normal read path so the header gets
4480 * the correct byte count.
4481 */
4486 }
4491 /* Deal with possible short send. */
4493 ssize_t ret;
4503 }
4504 }
4505 /* No outbuf here means successful sendfile. */
4509 }
4511 normal_read:
4515 ssize_t ret;
4520 /*
4521 * We already know that we would do a short
4522 * read, so don't try the sendfile() path.
4523 */
4525 }
4530 /* Send out the header. */
4535 /*
4536 * Try and give an error message saying what
4537 * client failed.
4538 */
4546 }
4557 }
4559 }
4561 nosendfile_read:
4574 }
4582 out:
4585 }
4587 /****************************************************************************
4588 Work out how much space we have for a read return.
4589 ****************************************************************************/
4592 {
4597 }
4601 }
4605 }
4608 /*
4609 * Don't take encrypted traffic up to the
4610 * limit. There are padding considerations
4611 * that make that tricky.
4612 */
4614 }
4618 }
4622 }
4624 /*
4625 * We can do ultra-large POSIX reads.
4626 */
4628 }
4630 /****************************************************************************
4631 Calculate how big a read can be. Copes with all clients. It's always
4632 safe to return a short read - Windows does this.
4633 ****************************************************************************/
4638 {
4645 /*
4646 * Windows explicitly ignores upper size of 0xFFFF.
4647 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4648 * We must do the same as these will never fit even in
4649 * an extended size NetBIOS packet.
4650 */
4653 }
4657 }
4661 /*
4662 * LARGE_READX test shows it's always safe to return
4663 * a short read. Windows does so.
4664 */
4666 }
4668 /****************************************************************************
4669 Reply to a read and X.
4670 ****************************************************************************/
4673 {
4676 off_t startpos;
4680 #if 0
4682 #endif
4689 }
4695 /* If it's an IPC, pass off the pipe handler. */
4700 }
4705 }
4711 }
4716 /*
4717 * This is a heuristic to avoid keeping large
4718 * outgoing buffers around over long-lived aio
4719 * requests.
4720 */
4722 }
4725 /*
4726 * This is a large offset (64 bit) read.
4727 */
4730 }
4734 req,
4735 fsp,
4736 startpos,
4737 smb_maxcnt);
4739 /* Read scheduled - we're done. */
4741 }
4743 /* Real error - report to client. */
4747 }
4748 /* NT_STATUS_RETRY - fall back to sync read. */
4749 }
4755 out:
4758 }
4760 /****************************************************************************
4761 Error replies to writebraw must have smb_wct == 1. Fix this up.
4762 ****************************************************************************/
4765 {
4772 }
4774 /****************************************************************************
4775 Read 4 bytes of a smb packet and return the smb length of the packet.
4776 Store the result in the buffer. This version of the function will
4777 never return a session keepalive (length of zero).
4778 Timeout is in milliseconds.
4779 ****************************************************************************/
4783 {
4787 NTSTATUS status;
4790 len);
4793 /* Try and give an error message
4794 * saying what client failed. */
4800 }
4803 }
4809 }
4811 /****************************************************************************
4812 Reply to a writebraw (core+ or LANMAN1.0 protocol).
4813 ****************************************************************************/
4816 {
4824 off_t startpos;
4829 NTSTATUS status;
4833 /*
4834 * If we ever reply with an error, it must have the SMB command
4835 * type of SMBwritec, not SMBwriteBraw, as this tells the client
4836 * we're finished.
4837 */
4844 }
4851 }
4860 }
4867 }
4874 }
4880 /* We have to deal with slightly different formats depending
4881 on whether we are using the core+ or lanman1.0 protocol */
4889 }
4891 /* Ensure we don't write bytes past the end of this packet. */
4892 /*
4893 * This already protects us against CVE-2017-12163.
4894 */
4900 }
4912 }
4913 }
4917 }
4928 }
4932 /* Allocate a buffer of 64k + length. */
4938 }
4940 /* Return a SMBwritebraw message to the redirector to tell
4941 * it to send more bytes */
4949 buf,
4955 }
4957 /* Now read the raw data into the buffer and write it */
4962 }
4964 /* Set up outbuf to return the correct size */
4974 }
4980 }
4983 numtowrite);
4986 /* Try and give an error message
4987 * saying what client failed. */
4989 "raw read failed (%s) for client %s. "
4993 }
4995 /*
4996 * We are not vulnerable to CVE-2017-12163
4997 * here as we are guaranteed to have numtowrite
4998 * bytes available - we just read from the client.
4999 */
5006 }
5011 }
5015 }
5016 }
5028 }
5035 /* We won't return a status if write through is not selected - this
5036 * follows what WfWg does */
5041 #if RABBIT_PELLET_FIX
5042 /*
5043 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
5044 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
5045 * JRA.
5046 */
5050 }
5051 #endif
5053 }
5056 out:
5059 }
5061 #undef DBGC_CLASS
5062 #define DBGC_CLASS DBGC_LOCKING
5064 /****************************************************************************
5065 Reply to a writeunlock (core+).
5066 ****************************************************************************/
5069 {
5074 off_t startpos;
5087 }
5094 }
5100 }
5106 /*
5107 * Ensure client isn't asking us to write more than
5108 * they sent. CVE-2017-12163.
5109 */
5115 }
5126 }
5127 }
5129 /* The special X/Open SMB protocol handling of
5130 zero length writes is *NOT* done for
5131 this call */
5137 }
5145 }
5150 }
5155 }
5164 };
5169 }
5170 }
5179 out:
5182 }
5184 #undef DBGC_CLASS
5185 #define DBGC_CLASS DBGC_ALL
5187 /****************************************************************************
5188 Reply to a write.
5189 ****************************************************************************/
5192 {
5197 off_t startpos;
5201 NTSTATUS status;
5210 }
5212 /* If it's an IPC, pass off the pipe handler. */
5217 }
5224 }
5230 }
5236 /*
5237 * Ensure client isn't asking us to write more than
5238 * they sent. CVE-2017-12163.
5239 */
5245 }
5256 }
5257 }
5259 /*
5260 * X/Open SMB protocol says that if smb_vwv1 is
5261 * zero then the file size should be extended or
5262 * truncated to the size given in smb_vwv[2-3].
5263 */
5266 /*
5267 * This is actually an allocate call, and set EOF. JRA.
5268 */
5273 }
5278 }
5282 }
5290 }
5295 }
5300 }
5309 }
5313 out:
5316 }
5318 /****************************************************************************
5319 Ensure a buffer is a valid writeX for recvfile purposes.
5320 ****************************************************************************/
5328 {
5335 NTSTATUS status;
5338 /* Can't do this on encrypted
5339 * connections. */
5341 }
5345 }
5352 }
5356 fnum,
5362 }
5367 }
5371 }
5376 }
5380 }
5384 }
5391 }
5396 }
5398 /* Ensure the sizes match up. */
5400 /* no pad byte...old smbclient :-( */
5405 }
5414 }
5423 }
5425 /****************************************************************************
5426 Reply to a write and X.
5427 ****************************************************************************/
5430 {
5435 off_t startpos;
5438 ssize_t nwritten;
5442 NTSTATUS status;
5450 }
5460 }
5463 /* Can't do a recvfile write on IPC$ */
5467 }
5471 }
5473 /*
5474 * This already protects us against CVE-2017-12163.
5475 */
5480 }
5481 }
5483 /* If it's an IPC, pass off the pipe handler. */
5488 }
5491 }
5499 }
5504 }
5509 /*
5510 * This is a large offset (64 bit) write.
5511 */
5514 }
5516 /* X/Open SMB protocol says that, unlike SMBwrite
5517 if the length is zero then NO truncation is
5518 done, just a write of zero. To truncate a file,
5519 use SMBwrite. */
5526 req,
5527 fsp,
5528 data,
5529 startpos,
5530 numtowrite);
5533 /* write scheduled - we're done. */
5535 }
5537 /* Real error - report to client. */
5540 }
5541 /* NT_STATUS_RETRY - fall through to sync write. */
5542 }
5551 }
5555 }
5560 }
5565 }
5582 }
5587 out:
5589 /* writeX failed. drain socket. */
5593 }
5595 }
5599 }
5601 /****************************************************************************
5602 Reply to a lseek.
5603 ****************************************************************************/
5606 {
5608 off_t startpos;
5612 NTSTATUS status;
5620 }
5626 }
5629 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
5648 }
5660 }
5665 }
5666 }
5672 }
5673 }
5685 }
5689 {
5695 }
5698 }
5703 }
5706 }
5708 /****************************************************************************
5709 Reply to a flush.
5710 ****************************************************************************/
5713 {
5723 }
5730 }
5742 }
5745 }
5746 }
5753 }
5755 /****************************************************************************
5756 Reply to a exit.
5757 conn POINTER CAN BE NULL HERE !
5758 ****************************************************************************/
5764 {
5767 /*
5768 * Don't setup the profile charge here, take
5769 * it in reply_exit_done(). Not strictly correct
5770 * but better than the other SMB1 async
5771 * code that double-charges at the moment.
5772 */
5775 /* Not going async, profile here. */
5780 }
5782 /* We're async. This will complete later. */
5785 }
5789 };
5793 /****************************************************************************
5794 Async SMB1 exit.
5795 Note, on failure here we deallocate and return NULL to allow the caller to
5796 SMB1 return an error of ERRnomem immediately.
5797 ****************************************************************************/
5800 {
5811 }
5817 }
5822 }
5825 }
5826 /*
5827 * Flag the file as close in progress.
5828 * This will prevent any more IO being
5829 * done on it.
5830 */
5834 /*
5835 * Now wait until all aio requests on this fsp are
5836 * finished.
5837 *
5838 * We don't set a callback, as we just want to block the
5839 * wait queue and the talloc_free() of fsp->aio_request
5840 * will remove the item from the wait queue.
5841 */
5848 }
5849 }
5850 }
5852 /*
5853 * Now we add our own waiter to the end of the queue,
5854 * this way we get notified when all pending requests are finished
5855 * and reply to the outstanding SMB1 request.
5856 */
5863 }
5865 /*
5866 * We're really going async - move the SMB1 request from
5867 * a talloc stackframe above us to the conn talloc-context.
5868 * We need this to stick around until the wait_done
5869 * callback is invoked.
5870 */
5876 }
5879 {
5886 }
5889 {
5891 }
5894 {
5902 NTSTATUS status;
5904 /*
5905 * Take the profile charge here. Not strictly
5906 * correct but better than the other SMB1 async
5907 * code that double-charges at the moment.
5908 */
5918 }
5920 /*
5921 * Ensure the session is still valid.
5922 */
5925 now,
5931 }
5933 /*
5934 * Ensure the vuid is still valid - no one
5935 * called reply_ulogoffX() in the meantime.
5936 * reply_exit() doesn't have AS_USER set, so
5937 * use set_current_user_info() directly.
5938 * This is the same logic as in switch_message().
5939 */
5945 }
5947 /* No more aio - do the actual closes. */
5954 }
5957 }
5960 }
5962 /*
5963 * reply_exit() has the DO_CHDIR flag set.
5964 */
5970 }
5972 }
5975 /*
5976 * The following call is needed to push the
5977 * reply data back out the socket after async
5978 * return. Plus it frees smb1req.
5979 */
5984 }
5991 {
6001 }
6005 /*
6006 * We can only use check_fsp if we know it's not a directory.
6007 */
6013 }
6024 /*
6025 * Take care of any time sent in the close.
6026 */
6030 }
6039 }
6040 /* We're async. This will complete later. */
6044 }
6046 /*
6047 * close_file() returns the unix errno if an error was detected on
6048 * close - normally this is due to a disk full error. If not then it
6049 * was probably an I/O error.
6050 */
6053 done:
6058 }
6063 }
6068 };
6072 /****************************************************************************
6073 Async SMB1 close.
6074 Note, on failure here we deallocate and return NULL to allow the caller to
6075 SMB1 return an error of ERRnomem immediately.
6076 ****************************************************************************/
6080 {
6090 }
6096 }
6098 /*
6099 * Flag the file as close in progress.
6100 * This will prevent any more IO being
6101 * done on it.
6102 */
6105 /*
6106 * Now wait until all aio requests on this fsp are
6107 * finished.
6108 *
6109 * We don't set a callback, as we just want to block the
6110 * wait queue and the talloc_free() of fsp->aio_request
6111 * will remove the item from the wait queue.
6112 */
6119 }
6121 /*
6122 * Now we add our own waiter to the end of the queue,
6123 * this way we get notified when all pending requests are finished
6124 * and reply to the outstanding SMB1 request.
6125 */
6132 }
6134 /*
6135 * We're really going async - move the SMB1 request from
6136 * a talloc stackframe above us to the conn talloc-context.
6137 * We need this to stick around until the wait_done
6138 * callback is invoked.
6139 */
6145 }
6148 {
6155 }
6158 {
6160 }
6163 {
6168 NTSTATUS status;
6176 }
6183 }
6184 /*
6185 * The following call is needed to push the
6186 * reply data back out the socket after async
6187 * return. Plus it frees smb1req.
6188 */
6190 }
6192 /****************************************************************************
6193 Reply to a writeclose (Core+ protocol).
6194 ****************************************************************************/
6197 {
6203 off_t startpos;
6215 }
6222 }
6227 }
6234 /*
6235 * Ensure client isn't asking us to write more than
6236 * they sent. CVE-2017-12163.
6237 */
6243 }
6254 }
6255 }
6261 /*
6262 * More insanity. W2K only closes the file if writelen > 0.
6263 * JRA.
6264 */
6275 }
6280 }
6285 }
6291 out:
6295 }
6297 #undef DBGC_CLASS
6298 #define DBGC_CLASS DBGC_LOCKING
6300 /****************************************************************************
6301 Reply to a lock.
6302 ****************************************************************************/
6307 {
6319 }
6326 }
6333 }
6341 };
6350 fsp,
6353 fsp,
6356 WINDOWS_LOCK,
6358 lck);
6363 }
6366 }
6369 {
6371 NTSTATUS status;
6386 }
6393 NULL);
6396 }
6399 }
6401 /****************************************************************************
6402 Reply to a unlock.
6403 ****************************************************************************/
6406 {
6408 NTSTATUS status;
6418 }
6425 }
6433 };
6441 }
6453 }
6455 #undef DBGC_CLASS
6456 #define DBGC_CLASS DBGC_ALL
6458 /****************************************************************************
6459 Reply to a tdis.
6460 conn POINTER CAN BE NULL HERE !
6461 ****************************************************************************/
6467 {
6471 /*
6472 * Don't setup the profile charge here, take
6473 * it in reply_tdis_done(). Not strictly correct
6474 * but better than the other SMB1 async
6475 * code that double-charges at the moment.
6476 */
6479 /* Not going async, profile here. */
6485 }
6489 /* Not going async, profile here. */
6494 }
6495 /* We're async. This will complete later. */
6498 }
6502 };
6506 /****************************************************************************
6507 Async SMB1 tdis.
6508 Note, on failure here we deallocate and return NULL to allow the caller to
6509 SMB1 return an error of ERRnomem immediately.
6510 ****************************************************************************/
6513 {
6524 }
6529 }
6531 /*
6532 * Make sure that no new request will be able to use this tcon.
6533 * This ensures that once all outstanding fsp->aio_requests
6534 * on this tcon are done, we are safe to close it.
6535 */
6541 }
6542 /*
6543 * Flag the file as close in progress.
6544 * This will prevent any more IO being
6545 * done on it. Not strictly needed, but
6546 * doesn't hurt to flag it as closing.
6547 */
6551 /*
6552 * Now wait until all aio requests on this fsp are
6553 * finished.
6554 *
6555 * We don't set a callback, as we just want to block the
6556 * wait queue and the talloc_free() of fsp->aio_request
6557 * will remove the item from the wait queue.
6558 */
6565 }
6566 }
6567 }
6569 /*
6570 * Now we add our own waiter to the end of the queue,
6571 * this way we get notified when all pending requests are finished
6572 * and reply to the outstanding SMB1 request.
6573 */
6580 }
6582 /*
6583 * We're really going async - move the SMB1 request from
6584 * a talloc stackframe above us to the sconn talloc-context.
6585 * We need this to stick around until the wait_done
6586 * callback is invoked.
6587 */
6593 }
6596 {
6603 }
6606 {
6608 }
6611 {
6614 NTSTATUS status;
6618 /*
6619 * Take the profile charge here. Not strictly
6620 * correct but better than the other SMB1 async
6621 * code that double-charges at the moment.
6622 */
6632 }
6634 /*
6635 * As we've been awoken, we may have changed
6636 * directory in the meantime.
6637 * reply_tdis() has the DO_CHDIR flag set.
6638 */
6644 }
6653 }
6655 /* smbXsrv_tcon_disconnect frees smb1req->conn. */
6661 /*
6662 * The following call is needed to push the
6663 * reply data back out the socket after async
6664 * return. Plus it frees smb1req.
6665 */
6668 }
6670 /****************************************************************************
6671 Reply to a echo.
6672 conn POINTER CAN BE NULL HERE !
6673 ****************************************************************************/
6676 {
6691 }
6697 /* copy any incoming data back out */
6700 }
6705 }
6709 /* this makes sure we catch the request pcd */
6715 }
6724 cur_pcd))
6726 }
6734 }
6736 /****************************************************************************
6737 Reply to a printopen.
6738 ****************************************************************************/
6741 {
6744 NTSTATUS status;
6752 }
6758 }
6765 }
6767 /* Open for exclusive use, write only. */
6775 }
6785 }
6787 /****************************************************************************
6788 Reply to a printclose.
6789 ****************************************************************************/
6792 {
6795 NTSTATUS status;
6803 }
6810 }
6816 }
6827 }
6833 }
6835 /****************************************************************************
6836 Reply to a printqueue.
6837 ****************************************************************************/
6840 {
6853 }
6858 /* we used to allow the client to get the cnum wrong, but that
6859 is really quite gross and only worked when there was only
6860 one printer - I think we should now only accept it if they
6861 get it right (tridge) */
6866 }
6877 {
6879 NTSTATUS status;
6880 WERROR werr;
6907 }
6913 sharename,
6915 SEC_FLAG_MAXIMUM_ALLOWED,
6921 }
6925 }
6938 }
6944 }
6950 }
6965 }
6977 }
6984 }
6985 }
6993 }
6999 out:
7002 }
7004 }
7008 }
7010 /****************************************************************************
7011 Reply to a printwrite.
7012 ****************************************************************************/
7015 {
7027 }
7034 }
7040 }
7046 }
7050 /*
7051 * This already protects us against CVE-2017-12163.
7052 */
7057 }
7065 }
7073 }
7075 /****************************************************************************
7076 Reply to a mkdir.
7077 ****************************************************************************/
7080 {
7084 NTSTATUS status;
7095 }
7099 directory,
7100 ucf_flags,
7108 }
7111 }
7121 NT_STATUS_OBJECT_NAME_COLLISION)) {
7122 /*
7123 * Yes, in the DOS error code case we get a
7124 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
7125 * samba4 torture test.
7126 */
7128 }
7132 }
7137 out:
7141 }
7143 /****************************************************************************
7144 Reply to a rmdir.
7145 ****************************************************************************/
7148 {
7152 NTSTATUS status;
7165 }
7168 directory,
7169 ucf_flags,
7177 }
7180 }
7185 }
7193 FILE_SHARE_DELETE),
7209 /* We have re-scheduled this call. */
7211 }
7216 }
7217 }
7220 }
7227 }
7235 }
7242 }
7245 out:
7249 }
7251 /*******************************************************************
7252 Resolve wildcards in a filename rename.
7253 ********************************************************************/
7259 {
7270 }
7277 }
7279 /* Truncate the copy of name2 at the last '/' */
7282 /* Now go past the '/' */
7283 pname1++;
7284 pname2++;
7291 }
7299 }
7306 }
7310 }
7316 /* Hmmm. Should this be mb-aware ? */
7318 p2++;
7322 root2,
7323 p);
7326 }
7329 p2++;
7330 }
7332 p++;
7333 }
7334 }
7340 /* Hmmm. Should this be mb-aware ? */
7342 p2++;
7346 ext2,
7347 p);
7350 }
7353 p2++;
7354 }
7356 p++;
7357 }
7358 }
7362 name2_copy,
7363 root2,
7364 ext2);
7367 name2_copy,
7368 root2);
7369 }
7373 }
7376 }
7378 /****************************************************************************
7379 Ensure open files have their names updated. Updated to notify other smbd's
7380 asynchronously.
7381 ****************************************************************************/
7388 {
7391 NTSTATUS status;
7397 /* fsp_name is a relative path under the fsp. To change this for other
7398 sharepaths we need to manipulate relative paths. */
7399 /* TODO - create the absolute path and manipulate the newname
7400 relative to the sharepath. */
7403 }
7406 }
7418 }
7419 }
7427 }
7429 /* Send messages to all smbd's (not ourself) that the name has changed. */
7432 smb_fname_dst);
7434 }
7436 /****************************************************************************
7437 We need to check if the source path is a parent directory of the destination
7438 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
7439 refuse the rename with a sharing violation. Under UNIX the above call can
7440 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
7441 probably need to check that the client is a Windows one before disallowing
7442 this as a UNIX client (one with UNIX extensions) can know the source is a
7443 symlink and make this decision intelligently. Found by an excellent bug
7444 report from <AndyLiebman@aol.com>.
7445 ****************************************************************************/
7449 {
7456 }
7459 }
7462 }
7464 }
7466 /*
7467 * Do the notify calls from a rename
7468 */
7473 {
7486 }
7493 }
7499 }
7501 /* this is a strange one. w2k3 gives an additional event for
7502 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
7503 files, but not directories */
7506 FILE_NOTIFY_CHANGE_ATTRIBUTES
7509 }
7510 out:
7513 }
7515 /****************************************************************************
7516 Returns an error if the parent directory for a filename is open in an
7517 incompatible way.
7518 ****************************************************************************/
7522 {
7527 NTSTATUS status;
7531 smb_fname_dst_in,
7533 NULL);
7536 }
7541 }
7543 /*
7544 * We're only checking on this smbd here, mostly good
7545 * enough.. and will pass tests.
7546 */
7553 }
7554 }
7556 }
7558 /****************************************************************************
7559 Rename an open file - given an fsp.
7560 ****************************************************************************/
7568 {
7582 }
7587 }
7591 }
7593 /* Make a copy of the dst smb_fname structs */
7599 }
7601 /*
7602 * Check for special case with case preserving and not
7603 * case sensitive. If the new last component differs from the original
7604 * last component only by case, then we should allow
7605 * the rename (user is trying to change the case of the
7606 * filename).
7607 */
7617 /*
7618 * Split off the last component of the processed
7619 * destination name. We will compare this to
7620 * the split components of dst_original_lcomp.
7621 */
7628 }
7630 /*
7631 * The dst_original_lcomp component contains
7632 * the last_component of the path + stream
7633 * name (if a stream exists).
7634 *
7635 * Split off the stream name so we
7636 * can check them separately.
7637 */
7640 /* POSIX - no stream component. */
7642 dst_original_lcomp);
7645 }
7648 dst_original_lcomp,
7651 }
7657 }
7659 /* If the base names only differ by case, use original. */
7662 /*
7663 * Replace the modified last component with the
7664 * original.
7665 */
7669 fname_dst_parent,
7670 orig_lcomp_path);
7673 orig_lcomp_path);
7674 }
7681 }
7684 }
7686 /* If the stream_names only differ by case, use original. */
7688 orig_lcomp_stream)) {
7689 /* Use the original stream. */
7691 orig_lcomp_stream);
7698 }
7701 }
7705 }
7707 /*
7708 * If the src and dest names are identical - including case,
7709 * don't do the rename, just return success.
7710 */
7720 }
7725 /* Return the correct error code if both names aren't streams. */
7729 }
7734 }
7744 }
7746 /*
7747 * Drop the pathref fsp on the destination otherwise we trip upon in in
7748 * the below check for open files check.
7749 */
7754 }
7761 /* The file can be open when renaming a stream */
7766 }
7767 }
7769 /* Ensure we have a valid stat struct for the source. */
7773 }
7784 }
7789 }
7791 /* Do we have rights to move into the destination ? */
7793 /* We're moving a directory. */
7795 }
7797 /*
7798 * Get a pathref on the parent directory, so
7799 * we can call check_parent_access_fsp().
7800 */
7803 smb_fname_dst,
7808 }
7811 access_mask);
7818 }
7822 /*
7823 * We have the file open ourselves, so not being able to get the
7824 * corresponding share mode lock is a fatal error.
7825 */
7833 smb_fname_dst);
7844 smb_fname_dst);
7847 smb_fname_dst);
7853 {
7854 /*
7855 * We must set the archive bit on the newly renamed
7856 * file.
7857 */
7862 /*
7863 * We can use fsp->fsp_name here as it has
7864 * already been changed to the new name.
7865 */
7870 NULL,
7872 }
7873 }
7875 /*
7876 * A rename acts as a new file create w.r.t. allowing an initial delete
7877 * on close, probably because in Windows there is a new handle to the
7878 * new file. If initial delete on close was requested but not
7879 * originally set, we need to set it here. This is probably not 100% correct,
7880 * but will work for the CIFSFS client which in non-posix mode
7881 * depends on these semantics. JRA.
7882 */
7888 /* Note that here we set the *initial* delete on close flag,
7889 * not the regular one. The magic gets handled in close. */
7891 }
7892 }
7896 }
7904 }
7910 out:
7914 }
7916 /****************************************************************************
7917 The guts of the rename command, split out so it may be called by the NT SMB
7918 code.
7919 ****************************************************************************/
7931 {
7947 /*
7948 * Split the old name into directory and last component
7949 * strings. Note that unix_convert may have stripped off a
7950 * leading ./ from both name and newname if the rename is
7951 * at the root of the share. We need to make sure either both
7952 * name and newname contain a / character or neither of them do
7953 * as this is checked in resolve_wildcards().
7954 */
7956 /* Split up the directory from the filename/mask. */
7962 }
7965 /*
7966 * Check the wildcard mask *before*
7967 * unmangling. As mangling is done
7968 * for names that can't be returned
7969 * to Windows the unmangled name may
7970 * contain Windows wildcard characters.
7971 */
7974 }
7976 }
7978 /*
7979 * We should only check the mangled cache
7980 * here if unix_convert failed. This means
7981 * that the path in 'mask' doesn't exist
7982 * on the file system and so we need to look
7983 * for a possible mangle. This patch from
7984 * Tine Smukavec <valentin.smukavec@hermes.si>.
7985 */
7995 }
7996 }
8004 }
8005 }
8010 /*
8011 * Only one file needs to be renamed. Append the mask back
8012 * onto the directory.
8013 */
8016 /* Ensure we use canonical names on open. */
8019 fname_src_mask);
8023 fname_src_dir,
8024 fname_src_mask);
8025 }
8029 }
8032 "case_preserve = %d, short case preserve = %d, "
8033 "directory = %s, newname = %s, "
8039 dst_original_lcomp));
8041 /* The dest name still may have wildcards. */
8054 }
8057 }
8065 }
8070 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
8072 }
8073 /*
8074 * Possible symlink src.
8075 */
8078 }
8081 }
8082 }
8086 }
8094 FILE_SHARE_WRITE),
8114 }
8117 fsp,
8118 smb_fname_dst,
8119 dst_original_lcomp,
8120 attrs,
8121 replace_if_exists);
8130 }
8132 /*
8133 * Wildcards - process each file that matches.
8134 */
8141 }
8142 }
8145 fname_src_dir,
8146 NULL,
8147 NULL,
8153 }
8158 }
8161 attrs);
8165 }
8168 /*
8169 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
8170 * - gentest fix. JRA
8171 */
8179 /* Quick check for "." and ".." */
8186 }
8187 }
8192 }
8197 }
8201 /* Ensure we use canonical names on open. */
8204 dname);
8208 fname_src_dir,
8209 dname);
8210 }
8214 }
8223 }
8227 }
8241 }
8246 }
8252 }
8260 FILE_SHARE_WRITE),
8282 }
8288 }
8291 fsp,
8292 smb_fname_dst,
8293 dst_original_lcomp,
8294 attrs,
8295 replace_if_exists);
8305 }
8307 count++;
8313 }
8318 }
8320 out:
8327 }
8329 /****************************************************************************
8330 Reply to a mv.
8331 ****************************************************************************/
8334 {
8340 NTSTATUS status;
8357 }
8367 }
8368 p++;
8374 }
8377 /* The newname must begin with a ':' if the
8378 name contains a ':'. */
8383 }
8385 }
8386 }
8389 conn,
8390 name,
8391 src_ucf_flags,
8400 }
8403 }
8405 /* Get the last component of the source for rename_internals(). */
8407 conn,
8408 name,
8409 dst_ucf_flags);
8413 }
8416 conn,
8417 newname,
8418 dst_ucf_flags,
8427 }
8430 }
8432 /* Get the last component of the destination for rename_internals(). */
8434 conn,
8435 newname,
8436 dst_ucf_flags);
8440 }
8443 /* smb_fname_dst->base_name must be the same as
8444 smb_fname_src->base_name. */
8451 }
8452 }
8458 conn,
8459 req,
8460 smb_fname_src,
8461 src_original_lcomp,
8462 smb_fname_dst,
8463 dst_original_lcomp,
8464 attrs,
8466 DELETE_ACCESS);
8469 /* We have re-scheduled this call. */
8471 }
8476 }
8477 }
8480 }
8483 out:
8488 }
8490 /*******************************************************************
8491 Copy a file as part of a reply_copy.
8492 ******************************************************************/
8494 /*
8495 * TODO: check error codes on all callers
8496 */
8505 {
8511 NTSTATUS status;
8517 }
8519 /*
8520 * If the target is a directory, extract the last component from the
8521 * src filename and append it to the dst filename
8522 */
8526 /* dest/target can't be a stream if it's a directory. */
8531 p++;
8534 }
8537 p);
8541 }
8542 }
8547 }
8552 }
8561 NULL,
8562 NULL)) {
8565 }
8566 }
8568 /* Open the src file for reading. */
8590 }
8596 }
8601 {
8603 }
8605 /* Open the dst file for writing. */
8628 }
8639 }
8640 }
8642 /* Do the actual copy. */
8647 }
8651 /* Ensure the modtime is set correctly on the destination file. */
8654 /*
8655 * As we are opening fsp1 read-only we only expect
8656 * an error on close on fsp2 if we are out of space.
8657 * Thus we don't look at the error return from the
8658 * close of fsp1.
8659 */
8664 }
8669 }
8673 out:
8676 }
8678 /****************************************************************************
8679 Reply to a file copy.
8680 ****************************************************************************/
8683 {
8701 NTSTATUS status;
8713 }
8725 }
8731 }
8736 /* can't currently handle inter share copies XXXX */
8740 }
8743 fname_src,
8744 ucf_flags_src,
8752 }
8755 }
8758 fname_dst,
8759 ucf_flags_dst,
8767 }
8770 }
8777 }
8782 }
8785 /* wants a tree copy! XXXX */
8789 }
8791 /* Split up the directory from the filename/mask. */
8797 }
8802 /*
8803 * Check the wildcard mask *before*
8804 * unmangling. As mangling is done
8805 * for names that can't be returned
8806 * to Windows the unmangled name may
8807 * contain Windows wildcard characters.
8808 */
8810 conn,
8811 fname_src,
8812 ucf_flags_src);
8816 }
8818 conn,
8819 fname_dst,
8820 ucf_flags_dst);
8824 }
8829 }
8831 /*
8832 * We should only check the mangled cache
8833 * here if unix_convert failed. This means
8834 * that the path in 'mask' doesn't exist
8835 * on the file system and so we need to look
8836 * for a possible mangle. This patch from
8837 * Tine Smukavec <valentin.smukavec@hermes.si>.
8838 */
8845 /* Use demangled name if one was successfully found. */
8849 }
8850 }
8854 /*
8855 * Only one file needs to be copied. Append the mask back onto
8856 * the directory.
8857 */
8860 /* Ensure we use canonical names on open. */
8863 fname_src_mask);
8867 fname_src_dir,
8868 fname_src_mask);
8869 }
8873 }
8883 }
8886 }
8892 }
8898 }
8907 count++;
8908 }
8915 /*
8916 * There is a wildcard that requires us to actually read the
8917 * src dir and copy each file matching the mask to the dst.
8918 * Right now streams won't be copied, but this could
8919 * presumably be added with a nested loop for reach dir entry.
8920 */
8933 }
8934 }
8937 fname_src_dir,
8938 NULL,
8939 NULL,
8945 }
8951 }
8954 conn,
8955 smb_fname_src_dir,
8956 fname_src_mask,
8962 }
8966 /* Iterate over the src dir copying each entry to the dst. */
8974 }
8979 }
8985 }
8989 /* Get the src smb_fname struct setup. */
8992 /* Ensure we use canonical names on open. */
8995 dname);
9000 }
9007 }
9014 }
9020 }
9029 smb_fname_src);
9035 }
9040 }
9048 }
9056 }
9064 target_is_directory);
9066 count++;
9067 }
9070 }
9072 }
9077 }
9081 out:
9092 }
9094 #undef DBGC_CLASS
9095 #define DBGC_CLASS DBGC_LOCKING
9097 /****************************************************************************
9098 Get a lock pid, dealing with large count requests.
9099 ****************************************************************************/
9103 {
9106 else
9108 }
9110 /****************************************************************************
9111 Get a lock count, dealing with large count requests.
9112 ****************************************************************************/
9116 {
9122 /*
9123 * No BVAL, this is reversed!
9124 */
9127 }
9130 }
9132 /****************************************************************************
9133 Get a lock offset, dealing with large offset requests.
9134 ****************************************************************************/
9138 {
9144 /*
9145 * No BVAL, this is reversed!
9146 */
9149 }
9152 }
9159 NTSTATUS status;
9160 };
9167 {
9184 /* this can only happen with SMB2 */
9187 }
9197 }
9198 }
9201 }
9208 {
9214 };
9215 NTSTATUS status;
9226 }
9231 }
9234 }
9236 /****************************************************************************
9237 Reply to a lockingX request.
9238 ****************************************************************************/
9243 {
9265 }
9278 }
9283 /* we don't support these - and CANCEL_LOCK makes w2k
9284 and XP reboot so I don't really want to be
9285 compatible! (tridge) */
9289 }
9291 /* Check if this is an oplock break on a file
9292 we have granted an oplock on.
9293 */
9295 /* Client can insist on breaking to none. */
9303 /*
9304 * Make sure we have granted an exclusive or batch oplock on
9305 * this file.
9306 */
9310 /* The Samba4 nbench simulator doesn't understand
9311 the difference between break to level2 and break
9312 to none from level2 - it sends oplock break
9313 replies in both cases. Don't keep logging an error
9314 message here - just ignore it. JRA. */
9317 "client for %s (oplock=%d) and no "
9322 /* if this is a pure oplock break request then don't
9323 * send a reply */
9327 }
9332 }
9339 }
9344 /* Hmmm. Is this panic justified? */
9346 }
9348 /* if this is a pure oplock break request then don't send a
9349 * reply */
9351 /* Sanity check - ensure a pure oplock break is not a
9352 chained request. */
9357 }
9360 }
9361 }
9368 }
9380 }
9382 /*
9383 * Data now points at the beginning of the list of
9384 * smb_unlkrng structs
9385 */
9396 }
9398 /*
9399 * Unlock cancels pending locks
9400 */
9403 fsp,
9404 large_file_format,
9405 WINDOWS_LOCK,
9407 NT_STATUS_OK);
9414 }
9423 }
9424 }
9426 /* Now do any requested locks */
9429 /* Data now points at the beginning of the list
9430 of smb_lkrng structs */
9436 }
9443 }
9451 }
9458 /* See smbtorture3 lock11 test */
9460 /* andx chain ends */
9465 }
9468 fsp,
9469 large_file_format,
9470 WINDOWS_LOCK,
9472 NT_STATUS_FILE_LOCK_CONFLICT);
9478 }
9485 }
9488 fsp,
9491 fsp,
9492 lock_timeout,
9493 large_file_format,
9494 WINDOWS_LOCK,
9495 num_locks,
9496 locks);
9501 }
9504 }
9507 {
9509 NTSTATUS status;
9528 }
9535 NULL);
9538 }
9541 }
9543 #undef DBGC_CLASS
9544 #define DBGC_CLASS DBGC_ALL
9546 /****************************************************************************
9547 Reply to a SMBreadbmpx (read block multiplex) request.
9548 Always reply with an error, if someone has a platform really needs this,
9549 please contact vl@samba.org
9550 ****************************************************************************/
9553 {
9558 }
9560 /****************************************************************************
9561 Reply to a SMBreadbs (read block multiplex secondary) request.
9562 Always reply with an error, if someone has a platform really needs this,
9563 please contact vl@samba.org
9564 ****************************************************************************/
9567 {
9572 }
9574 /****************************************************************************
9575 Reply to a SMBsetattrE.
9576 ****************************************************************************/
9579 {
9583 NTSTATUS status;
9591 }
9598 }
9600 /*
9601 * Convert the DOS times into unix times.
9602 */
9613 /*
9614 * Patch from Ray Frush <frush@engr.colostate.edu>
9615 * Sometimes times are sent as zero - ignore them.
9616 */
9618 /* Ensure we have a valid stat struct for the source. */
9623 }
9628 }
9634 }
9638 }
9646 ));
9647 out:
9650 }
9653 /* Back from the dead for OS/2..... JRA. */
9655 /****************************************************************************
9656 Reply to a SMBwritebmpx (write block multiplex primary) request.
9657 Always reply with an error, if someone has a platform really needs this,
9658 please contact vl@samba.org
9659 ****************************************************************************/
9662 {
9667 }
9669 /****************************************************************************
9670 Reply to a SMBwritebs (write block multiplex secondary) request.
9671 Always reply with an error, if someone has a platform really needs this,
9672 please contact vl@samba.org
9673 ****************************************************************************/
9676 {
9681 }
9683 /****************************************************************************
9684 Reply to a SMBgetattrE.
9685 ****************************************************************************/
9688 {
9693 NTSTATUS status;
9701 }
9709 }
9711 /* Do an fstat on this file */
9717 }
9721 /*
9722 * Convert the times into dos times. Set create
9723 * date to be last modify date as UNIX doesn't save
9724 * this.
9725 */
9733 /* Should we check pending modtime here ? JRA */
9744 }
9751 }