?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r2331: check password script code and example from trunk
[Samba.git] / source / smbd / nttrans.c
blobf717efac63eb9f88b1096621afc0411c57e0ff61
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int Protocol;
25 extern int smb_read_error;
26 extern int global_oplock_break;
27 extern struct current_user current_user;
28
29 static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\spoolss",
41 "\\netdfs",
42 "\\rpcecho",
43 NULL
44 };
45
46 /* Map generic permissions to file object specific permissions */
47
48 struct generic_mapping file_generic_mapping = {
49 FILE_GENERIC_READ,
50 FILE_GENERIC_WRITE,
51 FILE_GENERIC_EXECUTE,
52 FILE_GENERIC_ALL
53 };
54
55 static char *nttrans_realloc(char **ptr, size_t size)
56 {
57 char *tptr = NULL;
58 if (ptr==NULL)
59 smb_panic("nttrans_realloc() called with NULL ptr\n");
60
61 tptr = Realloc_zero(*ptr, size);
62 if(tptr == NULL) {
63 *ptr = NULL;
64 return NULL;
65 }
66
67 *ptr = tptr;
68
69 return tptr;
70 }
71
72
73 /****************************************************************************
74 Send the required number of replies back.
75 We assume all fields other than the data fields are
76 set correctly for the type of call.
77 HACK ! Always assumes smb_setup field is zero.
78 ****************************************************************************/
79
80 static int send_nt_replies(char *inbuf, char *outbuf, int bufsize, NTSTATUS nt_error, char *params,
81 int paramsize, char *pdata, int datasize)
82 {
83 extern int max_send;
84 int data_to_send = datasize;
85 int params_to_send = paramsize;
86 int useable_space;
87 char *pp = params;
88 char *pd = pdata;
89 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
90 int alignment_offset = 3;
91 int data_alignment_offset = 0;
92
93 /*
94 * Initially set the wcnt area to be 18 - this is true for all
95 * transNT replies.
96 */
97
98 set_message(outbuf,18,0,True);
99
100 if (NT_STATUS_V(nt_error))
101 ERROR_NT(nt_error);
102
103 /*
104 * If there genuinely are no parameters or data to send just send
105 * the empty packet.
106 */
107
108 if(params_to_send == 0 && data_to_send == 0) {
109 if (!send_smb(smbd_server_fd(),outbuf))
110 exit_server("send_nt_replies: send_smb failed.");
111 return 0;
112 }
113
114 /*
115 * When sending params and data ensure that both are nicely aligned.
116 * Only do this alignment when there is also data to send - else
117 * can cause NT redirector problems.
118 */
119
120 if (((params_to_send % 4) != 0) && (data_to_send != 0))
121 data_alignment_offset = 4 - (params_to_send % 4);
122
123 /*
124 * Space is bufsize minus Netbios over TCP header minus SMB header.
125 * The alignment_offset is to align the param bytes on a four byte
126 * boundary (2 bytes for data len, one byte pad).
127 * NT needs this to work correctly.
128 */
129
130 useable_space = bufsize - ((smb_buf(outbuf)+
131 alignment_offset+data_alignment_offset) -
132 outbuf);
133
134 /*
135 * useable_space can never be more than max_send minus the
136 * alignment offset.
137 */
138
139 useable_space = MIN(useable_space,
140 max_send - (alignment_offset+data_alignment_offset));
141
142
143 while (params_to_send || data_to_send) {
144
145 /*
146 * Calculate whether we will totally or partially fill this packet.
147 */
148
149 total_sent_thistime = params_to_send + data_to_send +
150 alignment_offset + data_alignment_offset;
151
152 /*
153 * We can never send more than useable_space.
154 */
155
156 total_sent_thistime = MIN(total_sent_thistime, useable_space);
157
158 set_message(outbuf, 18, total_sent_thistime, True);
159
160 /*
161 * Set total params and data to be sent.
162 */
163
164 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
165 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
166
167 /*
168 * Calculate how many parameters and data we can fit into
169 * this packet. Parameters get precedence.
170 */
171
172 params_sent_thistime = MIN(params_to_send,useable_space);
173 data_sent_thistime = useable_space - params_sent_thistime;
174 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
175
176 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
177
178 if(params_sent_thistime == 0) {
179 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
180 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
181 } else {
182 /*
183 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
184 * parameter bytes, however the first 4 bytes of outbuf are
185 * the Netbios over TCP header. Thus use smb_base() to subtract
186 * them from the calculation.
187 */
188
189 SIVAL(outbuf,smb_ntr_ParameterOffset,
190 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
191 /*
192 * Absolute displacement of param bytes sent in this packet.
193 */
194
195 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
196 }
197
198 /*
199 * Deal with the data portion.
200 */
201
202 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
203
204 if(data_sent_thistime == 0) {
205 SIVAL(outbuf,smb_ntr_DataOffset,0);
206 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
207 } else {
208 /*
209 * The offset of the data bytes is the offset of the
210 * parameter bytes plus the number of parameters being sent this time.
211 */
212
213 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
214 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
215 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
216 }
217
218 /*
219 * Copy the param bytes into the packet.
220 */
221
222 if(params_sent_thistime)
223 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
224
225 /*
226 * Copy in the data bytes
227 */
228
229 if(data_sent_thistime)
230 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
231 data_alignment_offset,pd,data_sent_thistime);
232
233 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
234 params_sent_thistime, data_sent_thistime, useable_space));
235 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
236 params_to_send, data_to_send, paramsize, datasize));
237
238 /* Send the packet */
239 if (!send_smb(smbd_server_fd(),outbuf))
240 exit_server("send_nt_replies: send_smb failed.");
241
242 pp += params_sent_thistime;
243 pd += data_sent_thistime;
244
245 params_to_send -= params_sent_thistime;
246 data_to_send -= data_sent_thistime;
247
248 /*
249 * Sanity check
250 */
251
252 if(params_to_send < 0 || data_to_send < 0) {
253 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
254 params_to_send, data_to_send));
255 return -1;
256 }
257 }
258
259 return 0;
260 }
261
262 /****************************************************************************
263 Save case statics.
264 ****************************************************************************/
265
266 static BOOL saved_case_sensitive;
267 static BOOL saved_case_preserve;
268 static BOOL saved_short_case_preserve;
269
270 /****************************************************************************
271 Save case semantics.
272 ****************************************************************************/
273
274 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
275 {
276 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
277 return;
278
279 saved_case_sensitive = conn->case_sensitive;
280 saved_case_preserve = conn->case_preserve;
281 saved_short_case_preserve = conn->short_case_preserve;
282
283 /* Set to POSIX. */
284 conn->case_sensitive = True;
285 conn->case_preserve = True;
286 conn->short_case_preserve = True;
287 }
288
289 /****************************************************************************
290 Restore case semantics.
291 ****************************************************************************/
292
293 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
294 {
295 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS))
296 return;
297
298 conn->case_sensitive = saved_case_sensitive;
299 conn->case_preserve = saved_case_preserve;
300 conn->short_case_preserve = saved_short_case_preserve;
301 }
302
303 /****************************************************************************
304 Utility function to map create disposition.
305 ****************************************************************************/
306
307 static int map_create_disposition( uint32 create_disposition)
308 {
309 int ret;
310
311 switch( create_disposition ) {
312 case FILE_CREATE:
313 /* create if not exist, fail if exist */
314 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL);
315 break;
316 case FILE_SUPERSEDE:
317 case FILE_OVERWRITE_IF:
318 /* create if not exist, trunc if exist */
319 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
320 break;
321 case FILE_OPEN:
322 /* fail if not exist, open if exists */
323 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN);
324 break;
325 case FILE_OPEN_IF:
326 /* create if not exist, open if exists */
327 ret = (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_OPEN);
328 break;
329 case FILE_OVERWRITE:
330 /* fail if not exist, truncate if exists */
331 ret = (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE);
332 break;
333 default:
334 DEBUG(0,("map_create_disposition: Incorrect value for create_disposition = %d\n",
335 create_disposition ));
336 return -1;
337 }
338
339 DEBUG(10,("map_create_disposition: Mapped create_disposition 0x%lx to 0x%x\n",
340 (unsigned long)create_disposition, ret ));
341
342 return ret;
343 }
344
345 /****************************************************************************
346 Utility function to map share modes.
347 ****************************************************************************/
348
349 static int map_share_mode( char *fname, uint32 create_options,
350 uint32 *desired_access, uint32 share_access, uint32 file_attributes)
351 {
352 int smb_open_mode = -1;
353 uint32 original_desired_access = *desired_access;
354
355 /*
356 * Convert GENERIC bits to specific bits.
357 */
358
359 se_map_generic(desired_access, &file_generic_mapping);
360
361 switch( *desired_access & (FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA) ) {
362 case FILE_READ_DATA:
363 smb_open_mode = DOS_OPEN_RDONLY;
364 break;
365 case FILE_WRITE_DATA:
366 case FILE_APPEND_DATA:
367 case FILE_WRITE_DATA|FILE_APPEND_DATA:
368 smb_open_mode = DOS_OPEN_WRONLY;
369 break;
370 case FILE_READ_DATA|FILE_WRITE_DATA:
371 case FILE_READ_DATA|FILE_WRITE_DATA|FILE_APPEND_DATA:
372 case FILE_READ_DATA|FILE_APPEND_DATA:
373 smb_open_mode = DOS_OPEN_RDWR;
374 break;
375 }
376
377 /*
378 * NB. For DELETE_ACCESS we should really check the
379 * directory permissions, as that is what controls
380 * delete, and for WRITE_DAC_ACCESS we should really
381 * check the ownership, as that is what controls the
382 * chmod. Note that this is *NOT* a security hole (this
383 * note is for you, Andrew) as we are not *allowing*
384 * the access at this point, the actual unlink or
385 * chown or chmod call would do this. We are just helping
386 * clients out by telling them if they have a hope
387 * of any of this succeeding. POSIX acls may still
388 * deny the real call. JRA.
389 */
390
391 if (smb_open_mode == -1) {
392
393 if(*desired_access & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS|
394 FILE_EXECUTE|FILE_READ_ATTRIBUTES|
395 FILE_READ_EA|FILE_WRITE_EA|SYSTEM_SECURITY_ACCESS|
396 FILE_WRITE_ATTRIBUTES|READ_CONTROL_ACCESS)) {
397 smb_open_mode = DOS_OPEN_RDONLY;
398 } else if(*desired_access == 0) {
399
400 /*
401 * JRA - NT seems to sometimes send desired_access as zero. play it safe
402 * and map to a stat open.
403 */
404
405 smb_open_mode = DOS_OPEN_RDONLY;
406
407 } else {
408 DEBUG(0,("map_share_mode: Incorrect value 0x%lx for desired_access to file %s\n",
409 (unsigned long)*desired_access, fname));
410 return -1;
411 }
412 }
413
414 /*
415 * Set the special bit that means allow share delete.
416 * This is held outside the normal share mode bits at 1<<15.
417 * JRA.
418 */
419
420 if(share_access & FILE_SHARE_DELETE) {
421 smb_open_mode |= ALLOW_SHARE_DELETE;
422 DEBUG(10,("map_share_mode: FILE_SHARE_DELETE requested. open_mode = 0x%x\n", smb_open_mode));
423 }
424
425 if(*desired_access & DELETE_ACCESS) {
426 DEBUG(10,("map_share_mode: DELETE_ACCESS requested. open_mode = 0x%x\n", smb_open_mode));
427 }
428
429 /*
430 * We need to store the intent to open for Delete. This
431 * is what determines if a delete on close flag can be set.
432 * This is the wrong way (and place) to store this, but for 2.2 this
433 * is the only practical way. JRA.
434 */
435
436 if (create_options & FILE_DELETE_ON_CLOSE) {
437 /*
438 * W2K3 bug compatibility mode... To set delete on close
439 * the redirector must have *specifically* set DELETE_ACCESS
440 * in the desired_access field. Just asking for GENERIC_ALL won't do. JRA.
441 */
442
443 if (!(original_desired_access & DELETE_ACCESS)) {
444 DEBUG(5,("map_share_mode: FILE_DELETE_ON_CLOSE requested without \
445 DELETE_ACCESS for file %s. (desired_access = 0x%lx)\n",
446 fname, (unsigned long)*desired_access));
447 return -1;
448 }
449 /* Implicit delete access is *NOT* requested... */
450 smb_open_mode |= DELETE_ON_CLOSE_FLAG;
451 DEBUG(10,("map_share_mode: FILE_DELETE_ON_CLOSE requested. open_mode = 0x%x\n", smb_open_mode));
452 }
453
454 /* Add in the requested share mode. */
455 switch( share_access & (FILE_SHARE_READ|FILE_SHARE_WRITE)) {
456 case FILE_SHARE_READ:
457 smb_open_mode |= SET_DENY_MODE(DENY_WRITE);
458 break;
459 case FILE_SHARE_WRITE:
460 smb_open_mode |= SET_DENY_MODE(DENY_READ);
461 break;
462 case (FILE_SHARE_READ|FILE_SHARE_WRITE):
463 smb_open_mode |= SET_DENY_MODE(DENY_NONE);
464 break;
465 case FILE_SHARE_NONE:
466 smb_open_mode |= SET_DENY_MODE(DENY_ALL);
467 break;
468 }
469
470 /*
471 * Handle an O_SYNC request.
472 */
473
474 if(file_attributes & FILE_FLAG_WRITE_THROUGH)
475 smb_open_mode |= FILE_SYNC_OPENMODE;
476
477 DEBUG(10,("map_share_mode: Mapped desired access 0x%lx, share access 0x%lx, file attributes 0x%lx \
478 to open_mode 0x%x\n", (unsigned long)*desired_access, (unsigned long)share_access,
479 (unsigned long)file_attributes, smb_open_mode ));
480
481 return smb_open_mode;
482 }
483
484 /****************************************************************************
485 Reply to an NT create and X call on a pipe.
486 ****************************************************************************/
487
488 static int nt_open_pipe(char *fname, connection_struct *conn,
489 char *inbuf, char *outbuf, int *ppnum)
490 {
491 smb_np_struct *p = NULL;
492
493 uint16 vuid = SVAL(inbuf, smb_uid);
494 int i;
495
496 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
497
498 /* See if it is one we want to handle. */
499
500 if (lp_disable_spoolss() && strequal(fname, "\\spoolss"))
501 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
502
503 for( i = 0; known_nt_pipes[i]; i++ )
504 if( strequal(fname,known_nt_pipes[i]))
505 break;
506
507 if ( known_nt_pipes[i] == NULL )
508 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
509
510 /* Strip \\ off the name. */
511 fname++;
512
513 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
514
515 p = open_rpc_pipe_p(fname, conn, vuid);
516 if (!p)
517 return(ERROR_DOS(ERRSRV,ERRnofids));
518
519 *ppnum = p->pnum;
520
521 return 0;
522 }
523
524 /****************************************************************************
525 Reply to an NT create and X call for pipes.
526 ****************************************************************************/
527
528 static int do_ntcreate_pipe_open(connection_struct *conn,
529 char *inbuf,char *outbuf,int length,int bufsize)
530 {
531 pstring fname;
532 int ret;
533 int pnum = -1;
534 char *p = NULL;
535
536 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
537
538 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
539 return ret;
540
541 /*
542 * Deal with pipe return.
543 */
544
545 set_message(outbuf,34,0,True);
546
547 p = outbuf + smb_vwv2;
548 p++;
549 SSVAL(p,0,pnum);
550 p += 2;
551 SIVAL(p,0,FILE_WAS_OPENED);
552 p += 4;
553 p += 32;
554 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
555 p += 20;
556 /* File type. */
557 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
558 /* Device state. */
559 SSVAL(p,2, 0x5FF); /* ? */
560
561 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
562
563 return chain_reply(inbuf,outbuf,length,bufsize);
564 }
565
566 /****************************************************************************
567 Reply to an NT create and X call.
568 ****************************************************************************/
569
570 int reply_ntcreate_and_X(connection_struct *conn,
571 char *inbuf,char *outbuf,int length,int bufsize)
572 {
573 int result;
574 pstring fname;
575 enum FAKE_FILE_TYPE fake_file_type = FAKE_FILE_TYPE_NONE;
576 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
577 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
578 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
579 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
580 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
581 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
582 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
583 SMB_BIG_UINT allocation_size = 0;
584 int smb_ofun;
585 int smb_open_mode;
586 /* Breakout the oplock request bits so we can set the
587 reply bits separately. */
588 int oplock_request = 0;
589 int fmode=0,rmode=0;
590 SMB_OFF_T file_len = 0;
591 SMB_STRUCT_STAT sbuf;
592 int smb_action = 0;
593 BOOL bad_path = False;
594 files_struct *fsp=NULL;
595 char *p = NULL;
596 time_t c_time;
597 BOOL extended_oplock_granted = False;
598 NTSTATUS status;
599
600 START_PROFILE(SMBntcreateX);
601
602 DEBUG(10,("reply_ntcreateX: flags = 0x%x, desired_access = 0x%x \
603 file_attributes = 0x%x, share_access = 0x%x, create_disposition = 0x%x \
604 create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attributes,
605 share_access, create_disposition,
606 create_options, root_dir_fid ));
607
608 /* If it's an IPC, use the pipe handler. */
609
610 if (IS_IPC(conn)) {
611 if (lp_nt_pipe_support()) {
612 END_PROFILE(SMBntcreateX);
613 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
614 } else {
615 END_PROFILE(SMBntcreateX);
616 return(ERROR_DOS(ERRDOS,ERRnoaccess));
617 }
618 }
619
620 if (create_options & FILE_OPEN_BY_FILE_ID) {
621 END_PROFILE(SMBntcreateX);
622 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
623 }
624
625 /*
626 * We need to construct the open_and_X ofun value from the
627 * NT values, as that's what our code is structured to accept.
628 */
629
630 if((smb_ofun = map_create_disposition( create_disposition )) == -1) {
631 END_PROFILE(SMBntcreateX);
632 return(ERROR_DOS(ERRDOS,ERRnoaccess));
633 }
634
635 /*
636 * Get the file name.
637 */
638
639 if(root_dir_fid != 0) {
640 /*
641 * This filename is relative to a directory fid.
642 */
643 pstring rel_fname;
644 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
645 size_t dir_name_len;
646
647 if(!dir_fsp) {
648 END_PROFILE(SMBntcreateX);
649 return(ERROR_DOS(ERRDOS,ERRbadfid));
650 }
651
652 if(!dir_fsp->is_directory) {
653
654 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
655 if (!NT_STATUS_IS_OK(status)) {
656 END_PROFILE(SMBntcreateX);
657 return ERROR_NT(status);
658 }
659
660 /*
661 * Check to see if this is a mac fork of some kind.
662 */
663
664 if( strchr_m(fname, ':')) {
665 END_PROFILE(SMBntcreateX);
666 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
667 }
668
669 /*
670 we need to handle the case when we get a
671 relative open relative to a file and the
672 pathname is blank - this is a reopen!
673 (hint from demyn plantenberg)
674 */
675
676 END_PROFILE(SMBntcreateX);
677 return(ERROR_DOS(ERRDOS,ERRbadfid));
678 }
679
680 /*
681 * Copy in the base directory name.
682 */
683
684 pstrcpy( fname, dir_fsp->fsp_name );
685 dir_name_len = strlen(fname);
686
687 /*
688 * Ensure it ends in a '\'.
689 */
690
691 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
692 pstrcat(fname, "/");
693 dir_name_len++;
694 }
695
696 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status,False);
697 if (!NT_STATUS_IS_OK(status)) {
698 END_PROFILE(SMBntcreateX);
699 return ERROR_NT(status);
700 }
701 pstrcat(fname, rel_fname);
702 } else {
703 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status,False);
704 if (!NT_STATUS_IS_OK(status)) {
705 END_PROFILE(SMBntcreateX);
706 return ERROR_NT(status);
707 }
708
709 /*
710 * Check to see if this is a mac fork of some kind.
711 */
712
713 if( strchr_m(fname, ':')) {
714
715 #ifdef HAVE_SYS_QUOTAS
716 if ((fake_file_type=is_fake_file(fname))!=FAKE_FILE_TYPE_NONE) {
717 /*
718 * here we go! support for changing the disk quotas --metze
719 *
720 * we need to fake up to open this MAGIC QUOTA file
721 * and return a valid FID
722 *
723 * w2k close this file directly after openening
724 * xp also tries a QUERY_FILE_INFO on the file and then close it
725 */
726 } else {
727 #endif
728 END_PROFILE(SMBntcreateX);
729 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
730 #ifdef HAVE_SYS_QUOTAS
731 }
732 #endif
733 }
734 }
735
736 /*
737 * Now contruct the smb_open_mode value from the filename,
738 * desired access and the share access.
739 */
740 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
741
742 if((smb_open_mode = map_share_mode(fname, create_options, &desired_access,
743 share_access,
744 file_attributes)) == -1) {
745 END_PROFILE(SMBntcreateX);
746 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
747 }
748
749 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
750 if (oplock_request) {
751 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
752 }
753
754 /*
755 * Ordinary file or directory.
756 */
757
758 /*
759 * Check if POSIX semantics are wanted.
760 */
761
762 set_posix_case_semantics(conn, file_attributes);
763
764 unix_convert(fname,conn,0,&bad_path,&sbuf);
765 if (bad_path) {
766 restore_case_semantics(conn, file_attributes);
767 END_PROFILE(SMBntcreateX);
768 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
769 }
770 /* All file access must go through check_name() */
771 if (!check_name(fname,conn)) {
772 restore_case_semantics(conn, file_attributes);
773 END_PROFILE(SMBntcreateX);
774 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
775 }
776
777 /*
778 * If it's a request for a directory open, deal with it separately.
779 */
780
781 if(create_options & FILE_DIRECTORY_FILE) {
782 oplock_request = 0;
783
784 /* Can't open a temp directory. IFS kit test. */
785 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
786 END_PROFILE(SMBntcreateX);
787 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
788 }
789
790 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
791
792 restore_case_semantics(conn, file_attributes);
793
794 if(!fsp) {
795 END_PROFILE(SMBntcreateX);
796 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
797 }
798 } else {
799 /*
800 * Ordinary file case.
801 */
802
803 /* NB. We have a potential bug here. If we
804 * cause an oplock break to ourselves, then we
805 * could end up processing filename related
806 * SMB requests whilst we await the oplock
807 * break response. As we may have changed the
808 * filename case semantics to be POSIX-like,
809 * this could mean a filename request could
810 * fail when it should succeed. This is a rare
811 * condition, but eventually we must arrange
812 * to restore the correct case semantics
813 * before issuing an oplock break request to
814 * our client. JRA. */
815
816 if (fake_file_type==FAKE_FILE_TYPE_NONE) {
817 fsp = open_file_shared1(conn,fname,&sbuf,
818 desired_access,
819 smb_open_mode,
820 smb_ofun,file_attributes,oplock_request,
821 &rmode,&smb_action);
822 } else {
823 /* to open a fake_file --metze */
824 fsp = open_fake_file_shared1(fake_file_type,conn,fname,&sbuf,
825 desired_access,
826 smb_open_mode,
827 smb_ofun,file_attributes, oplock_request,
828 &rmode,&smb_action);
829 }
830
831 if (!fsp) {
832 /* We cheat here. There are two cases we
833 * care about. One is a directory rename,
834 * where the NT client will attempt to
835 * open the source directory for
836 * DELETE access. Note that when the
837 * NT client does this it does *not*
838 * set the directory bit in the
839 * request packet. This is translated
840 * into a read/write open
841 * request. POSIX states that any open
842 * for write request on a directory
843 * will generate an EISDIR error, so
844 * we can catch this here and open a
845 * pseudo handle that is flagged as a
846 * directory. The second is an open
847 * for a permissions read only, which
848 * we handle in the open_file_stat case. JRA.
849 */
850
851 if(errno == EISDIR) {
852
853 /*
854 * Fail the open if it was explicitly a non-directory file.
855 */
856
857 if (create_options & FILE_NON_DIRECTORY_FILE) {
858 restore_case_semantics(conn, file_attributes);
859 SSVAL(outbuf, smb_flg2,
860 SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
861 END_PROFILE(SMBntcreateX);
862 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
863 }
864
865 oplock_request = 0;
866 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
867
868 if(!fsp) {
869 restore_case_semantics(conn, file_attributes);
870 END_PROFILE(SMBntcreateX);
871 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
872 }
873 } else {
874
875 restore_case_semantics(conn, file_attributes);
876 END_PROFILE(SMBntcreateX);
877 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
878 /* We have re-scheduled this call. */
879 clear_cached_errors();
880 return -1;
881 }
882 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
883 }
884 }
885 }
886
887 restore_case_semantics(conn, file_attributes);
888
889 file_len = sbuf.st_size;
890 fmode = dos_mode(conn,fname,&sbuf);
891 if(fmode == 0)
892 fmode = FILE_ATTRIBUTE_NORMAL;
893 if (!fsp->is_directory && (fmode & aDIR)) {
894 close_file(fsp,False);
895 END_PROFILE(SMBntcreateX);
896 return ERROR_DOS(ERRDOS,ERRnoaccess);
897 }
898
899 /* Save the requested allocation size. */
900 allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
901 #ifdef LARGE_SMB_OFF_T
902 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
903 #endif
904 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
905 fsp->initial_allocation_size = SMB_ROUNDUP(allocation_size,SMB_ROUNDUP_ALLOCATION_SIZE);
906 if (fsp->is_directory) {
907 close_file(fsp,False);
908 END_PROFILE(SMBntcreateX);
909 /* Can't set allocation size on a directory. */
910 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
911 }
912 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
913 close_file(fsp,False);
914 END_PROFILE(SMBntcreateX);
915 return ERROR_NT(NT_STATUS_DISK_FULL);
916 }
917 } else {
918 fsp->initial_allocation_size = SMB_ROUNDUP(((SMB_BIG_UINT)file_len),SMB_ROUNDUP_ALLOCATION_SIZE);
919 }
920
921 /*
922 * If the caller set the extended oplock request bit
923 * and we granted one (by whatever means) - set the
924 * correct bit for extended oplock reply.
925 */
926
927 if (oplock_request && lp_fake_oplocks(SNUM(conn)))
928 extended_oplock_granted = True;
929
930 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
931 extended_oplock_granted = True;
932
933 #if 0
934 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
935 set_message(outbuf,42,0,True);
936 #else
937 set_message(outbuf,34,0,True);
938 #endif
939
940 p = outbuf + smb_vwv2;
941
942 /*
943 * Currently as we don't support level II oplocks we just report
944 * exclusive & batch here.
945 */
946
947 if (extended_oplock_granted) {
948 if (flags & REQUEST_BATCH_OPLOCK) {
949 SCVAL(p,0, BATCH_OPLOCK_RETURN);
950 } else {
951 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
952 }
953 } else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type)) {
954 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
955 } else {
956 SCVAL(p,0,NO_OPLOCK_RETURN);
957 }
958
959 p++;
960 SSVAL(p,0,fsp->fnum);
961 p += 2;
962 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
963 SIVAL(p,0,FILE_WAS_SUPERSEDED);
964 else
965 SIVAL(p,0,smb_action);
966 p += 4;
967
968 /* Create time. */
969 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
970
971 if (lp_dos_filetime_resolution(SNUM(conn))) {
972 c_time &= ~1;
973 sbuf.st_atime &= ~1;
974 sbuf.st_mtime &= ~1;
975 sbuf.st_mtime &= ~1;
976 }
977
978 put_long_date(p,c_time);
979 p += 8;
980 put_long_date(p,sbuf.st_atime); /* access time */
981 p += 8;
982 put_long_date(p,sbuf.st_mtime); /* write time */
983 p += 8;
984 put_long_date(p,sbuf.st_mtime); /* change time */
985 p += 8;
986 SIVAL(p,0,fmode); /* File Attributes. */
987 p += 4;
988 SOFF_T(p, 0, get_allocation_size(fsp,&sbuf));
989 p += 8;
990 SOFF_T(p,0,file_len);
991 p += 8;
992 if (flags & EXTENDED_RESPONSE_REQUIRED)
993 SSVAL(p,2,0x7);
994 p += 4;
995 SCVAL(p,0,fsp->is_directory ? 1 : 0);
996
997 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
998
999 result = chain_reply(inbuf,outbuf,length,bufsize);
1000 END_PROFILE(SMBntcreateX);
1001 return result;
1002 }
1003
1004 /****************************************************************************
1005 Reply to a NT_TRANSACT_CREATE call to open a pipe.
1006 ****************************************************************************/
1007
1008 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1009 char **ppsetup, uint32 setup_count,
1010 char **ppparams, uint32 parameter_count,
1011 char **ppdata, uint32 data_count)
1012 {
1013 pstring fname;
1014 char *params = *ppparams;
1015 int ret;
1016 int pnum = -1;
1017 char *p = NULL;
1018 NTSTATUS status;
1019
1020 /*
1021 * Ensure minimum number of parameters sent.
1022 */
1023
1024 if(parameter_count < 54) {
1025 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1026 return ERROR_DOS(ERRDOS,ERRnoaccess);
1027 }
1028
1029 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1030 if (!NT_STATUS_IS_OK(status)) {
1031 return ERROR_NT(status);
1032 }
1033
1034 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0)
1035 return ret;
1036
1037 /* Realloc the size of parameters and data we will return */
1038 params = nttrans_realloc(ppparams, 69);
1039 if(params == NULL)
1040 return ERROR_DOS(ERRDOS,ERRnomem);
1041
1042 p = params;
1043 SCVAL(p,0,NO_OPLOCK_RETURN);
1044
1045 p += 2;
1046 SSVAL(p,0,pnum);
1047 p += 2;
1048 SIVAL(p,0,FILE_WAS_OPENED);
1049 p += 8;
1050
1051 p += 32;
1052 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1053 p += 20;
1054 /* File type. */
1055 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1056 /* Device state. */
1057 SSVAL(p,2, 0x5FF); /* ? */
1058
1059 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1060
1061 /* Send the required number of replies */
1062 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1063
1064 return -1;
1065 }
1066
1067 /****************************************************************************
1068 Internal fn to set security descriptors.
1069 ****************************************************************************/
1070
1071 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1072 {
1073 prs_struct pd;
1074 SEC_DESC *psd = NULL;
1075 TALLOC_CTX *mem_ctx;
1076 BOOL ret;
1077
1078 if (sd_len == 0) {
1079 return NT_STATUS_OK;
1080 }
1081
1082 /*
1083 * Init the parse struct we will unmarshall from.
1084 */
1085
1086 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1087 DEBUG(0,("set_sd: talloc_init failed.\n"));
1088 return NT_STATUS_NO_MEMORY;
1089 }
1090
1091 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1092
1093 /*
1094 * Setup the prs_struct to point at the memory we just
1095 * allocated.
1096 */
1097
1098 prs_give_memory( &pd, data, sd_len, False);
1099
1100 /*
1101 * Finally, unmarshall from the data buffer.
1102 */
1103
1104 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1105 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1106 /*
1107 * Return access denied for want of a better error message..
1108 */
1109 talloc_destroy(mem_ctx);
1110 return NT_STATUS_NO_MEMORY;
1111 }
1112
1113 if (psd->off_owner_sid==0)
1114 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1115 if (psd->off_grp_sid==0)
1116 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1117 if (psd->off_sacl==0)
1118 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1119 if (psd->off_dacl==0)
1120 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1121
1122 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fd, security_info_sent, psd);
1123
1124 if (!ret) {
1125 talloc_destroy(mem_ctx);
1126 return NT_STATUS_ACCESS_DENIED;
1127 }
1128
1129 talloc_destroy(mem_ctx);
1130
1131 return NT_STATUS_OK;
1132 }
1133
1134 /****************************************************************************
1135 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1136 ****************************************************************************/
1137
1138 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1139 char **ppsetup, uint32 setup_count,
1140 char **ppparams, uint32 parameter_count,
1141 char **ppdata, uint32 data_count)
1142 {
1143 pstring fname;
1144 char *params = *ppparams;
1145 char *data = *ppdata;
1146 /* Breakout the oplock request bits so we can set the reply bits separately. */
1147 int oplock_request = 0;
1148 int fmode=0,rmode=0;
1149 SMB_OFF_T file_len = 0;
1150 SMB_STRUCT_STAT sbuf;
1151 int smb_action = 0;
1152 BOOL bad_path = False;
1153 files_struct *fsp = NULL;
1154 char *p = NULL;
1155 BOOL extended_oplock_granted = False;
1156 uint32 flags;
1157 uint32 desired_access;
1158 uint32 file_attributes;
1159 uint32 share_access;
1160 uint32 create_disposition;
1161 uint32 create_options;
1162 uint32 sd_len;
1163 uint16 root_dir_fid;
1164 SMB_BIG_UINT allocation_size = 0;
1165 int smb_ofun;
1166 int smb_open_mode;
1167 time_t c_time;
1168 NTSTATUS status;
1169
1170 DEBUG(5,("call_nt_transact_create\n"));
1171
1172 /*
1173 * If it's an IPC, use the pipe handler.
1174 */
1175
1176 if (IS_IPC(conn)) {
1177 if (lp_nt_pipe_support())
1178 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1179 bufsize,
1180 ppsetup, setup_count,
1181 ppparams, parameter_count,
1182 ppdata, data_count);
1183 else
1184 return ERROR_DOS(ERRDOS,ERRnoaccess);
1185 }
1186
1187 /*
1188 * Ensure minimum number of parameters sent.
1189 */
1190
1191 if(parameter_count < 54) {
1192 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1193 return ERROR_DOS(ERRDOS,ERRnoaccess);
1194 }
1195
1196 flags = IVAL(params,0);
1197 desired_access = IVAL(params,8);
1198 file_attributes = IVAL(params,20);
1199 share_access = IVAL(params,24);
1200 create_disposition = IVAL(params,28);
1201 create_options = IVAL(params,32);
1202 sd_len = IVAL(params,36);
1203 root_dir_fid = (uint16)IVAL(params,4);
1204
1205 if (create_options & FILE_OPEN_BY_FILE_ID) {
1206 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1207 }
1208
1209 /*
1210 * We need to construct the open_and_X ofun value from the
1211 * NT values, as that's what our code is structured to accept.
1212 */
1213
1214 if((smb_ofun = map_create_disposition( create_disposition )) == -1)
1215 return ERROR_DOS(ERRDOS,ERRbadmem);
1216
1217 /*
1218 * Get the file name.
1219 */
1220
1221 if(root_dir_fid != 0) {
1222 /*
1223 * This filename is relative to a directory fid.
1224 */
1225 files_struct *dir_fsp = file_fsp(params,4);
1226 size_t dir_name_len;
1227
1228 if(!dir_fsp)
1229 return ERROR_DOS(ERRDOS,ERRbadfid);
1230
1231 if(!dir_fsp->is_directory) {
1232 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1233 if (!NT_STATUS_IS_OK(status)) {
1234 return ERROR_NT(status);
1235 }
1236
1237 /*
1238 * Check to see if this is a mac fork of some kind.
1239 */
1240
1241 if( strchr_m(fname, ':'))
1242 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1243
1244 return ERROR_DOS(ERRDOS,ERRbadfid);
1245 }
1246
1247 /*
1248 * Copy in the base directory name.
1249 */
1250
1251 pstrcpy( fname, dir_fsp->fsp_name );
1252 dir_name_len = strlen(fname);
1253
1254 /*
1255 * Ensure it ends in a '\'.
1256 */
1257
1258 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1259 pstrcat(fname, "/");
1260 dir_name_len++;
1261 }
1262
1263 {
1264 pstring tmpname;
1265 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status, False);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 return ERROR_NT(status);
1268 }
1269 pstrcat(fname, tmpname);
1270 }
1271 } else {
1272 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status, False);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 return ERROR_NT(status);
1275 }
1276
1277 /*
1278 * Check to see if this is a mac fork of some kind.
1279 */
1280
1281 if( strchr_m(fname, ':'))
1282 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1283 }
1284
1285 /*
1286 * Now contruct the smb_open_mode value from the desired access
1287 * and the share access.
1288 */
1289
1290 if((smb_open_mode = map_share_mode( fname, create_options, &desired_access,
1291 share_access, file_attributes)) == -1)
1292 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1293
1294 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1295 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1296
1297 /*
1298 * Check if POSIX semantics are wanted.
1299 */
1300
1301 set_posix_case_semantics(conn, file_attributes);
1302
1303 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1304
1305 unix_convert(fname,conn,0,&bad_path,&sbuf);
1306 if (bad_path) {
1307 restore_case_semantics(conn, file_attributes);
1308 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1309 }
1310 /* All file access must go through check_name() */
1311 if (!check_name(fname,conn)) {
1312 restore_case_semantics(conn, file_attributes);
1313 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
1314 }
1315
1316 /*
1317 * If it's a request for a directory open, deal with it separately.
1318 */
1319
1320 if(create_options & FILE_DIRECTORY_FILE) {
1321
1322 /* Can't open a temp directory. IFS kit test. */
1323 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1324 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1325 }
1326
1327 oplock_request = 0;
1328
1329 /*
1330 * We will get a create directory here if the Win32
1331 * app specified a security descriptor in the
1332 * CreateDirectory() call.
1333 */
1334
1335 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1336
1337 if(!fsp) {
1338 restore_case_semantics(conn, file_attributes);
1339 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1340 }
1341
1342 } else {
1343
1344 /*
1345 * Ordinary file case.
1346 */
1347
1348 fsp = open_file_shared1(conn,fname,&sbuf,desired_access,
1349 smb_open_mode,smb_ofun,file_attributes,
1350 oplock_request,&rmode,&smb_action);
1351
1352 if (!fsp) {
1353
1354 if(errno == EISDIR) {
1355
1356 /*
1357 * Fail the open if it was explicitly a non-directory file.
1358 */
1359
1360 if (create_options & FILE_NON_DIRECTORY_FILE) {
1361 restore_case_semantics(conn, file_attributes);
1362 SSVAL(outbuf, smb_flg2, SVAL(outbuf,smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
1363 return ERROR_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1364 }
1365
1366 oplock_request = 0;
1367 fsp = open_directory(conn, fname, &sbuf, desired_access, smb_open_mode, smb_ofun, &smb_action);
1368
1369 if(!fsp) {
1370 restore_case_semantics(conn, file_attributes);
1371 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1372 }
1373 } else {
1374 restore_case_semantics(conn, file_attributes);
1375 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1376 /* We have re-scheduled this call. */
1377 clear_cached_errors();
1378 return -1;
1379 }
1380 return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
1381 }
1382 }
1383
1384 file_len = sbuf.st_size;
1385 fmode = dos_mode(conn,fname,&sbuf);
1386 if(fmode == 0)
1387 fmode = FILE_ATTRIBUTE_NORMAL;
1388
1389 if (fmode & aDIR) {
1390 close_file(fsp,False);
1391 restore_case_semantics(conn, file_attributes);
1392 return ERROR_DOS(ERRDOS,ERRnoaccess);
1393 }
1394
1395 /*
1396 * If the caller set the extended oplock request bit
1397 * and we granted one (by whatever means) - set the
1398 * correct bit for extended oplock reply.
1399 */
1400
1401 if (oplock_request && lp_fake_oplocks(SNUM(conn)))
1402 extended_oplock_granted = True;
1403
1404 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
1405 extended_oplock_granted = True;
1406 }
1407
1408 /*
1409 * Now try and apply the desired SD.
1410 */
1411
1412 if (sd_len && !NT_STATUS_IS_OK(status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION))) {
1413 close_file(fsp,False);
1414 restore_case_semantics(conn, file_attributes);
1415 return ERROR_NT(status);
1416 }
1417
1418 restore_case_semantics(conn, file_attributes);
1419
1420 /* Save the requested allocation size. */
1421 allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1422 #ifdef LARGE_SMB_OFF_T
1423 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1424 #endif
1425 if (allocation_size && (allocation_size > file_len)) {
1426 fsp->initial_allocation_size = SMB_ROUNDUP(allocation_size,SMB_ROUNDUP_ALLOCATION_SIZE);
1427 if (fsp->is_directory) {
1428 close_file(fsp,False);
1429 END_PROFILE(SMBntcreateX);
1430 /* Can't set allocation size on a directory. */
1431 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1432 }
1433 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1434 close_file(fsp,False);
1435 return ERROR_NT(NT_STATUS_DISK_FULL);
1436 }
1437 } else {
1438 fsp->initial_allocation_size = SMB_ROUNDUP(((SMB_BIG_UINT)file_len),SMB_ROUNDUP_ALLOCATION_SIZE);
1439 }
1440
1441 /* Realloc the size of parameters and data we will return */
1442 params = nttrans_realloc(ppparams, 69);
1443 if(params == NULL)
1444 return ERROR_DOS(ERRDOS,ERRnomem);
1445
1446 p = params;
1447 if (extended_oplock_granted)
1448 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1449 else if (LEVEL_II_OPLOCK_TYPE(fsp->oplock_type))
1450 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1451 else
1452 SCVAL(p,0,NO_OPLOCK_RETURN);
1453
1454 p += 2;
1455 SSVAL(p,0,fsp->fnum);
1456 p += 2;
1457 if ((create_disposition == FILE_SUPERSEDE) && (smb_action == FILE_WAS_OVERWRITTEN))
1458 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1459 else
1460 SIVAL(p,0,smb_action);
1461 p += 8;
1462
1463 /* Create time. */
1464 c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1465
1466 if (lp_dos_filetime_resolution(SNUM(conn))) {
1467 c_time &= ~1;
1468 sbuf.st_atime &= ~1;
1469 sbuf.st_mtime &= ~1;
1470 sbuf.st_mtime &= ~1;
1471 }
1472
1473 put_long_date(p,c_time);
1474 p += 8;
1475 put_long_date(p,sbuf.st_atime); /* access time */
1476 p += 8;
1477 put_long_date(p,sbuf.st_mtime); /* write time */
1478 p += 8;
1479 put_long_date(p,sbuf.st_mtime); /* change time */
1480 p += 8;
1481 SIVAL(p,0,fmode); /* File Attributes. */
1482 p += 4;
1483 SOFF_T(p, 0, get_allocation_size(fsp,&sbuf));
1484 p += 8;
1485 SOFF_T(p,0,file_len);
1486 p += 8;
1487 if (flags & EXTENDED_RESPONSE_REQUIRED)
1488 SSVAL(p,2,0x7);
1489 p += 4;
1490 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1491
1492 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1493
1494 /* Send the required number of replies */
1495 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1496
1497 return -1;
1498 }
1499
1500 /****************************************************************************
1501 Reply to a NT CANCEL request.
1502 ****************************************************************************/
1503
1504 int reply_ntcancel(connection_struct *conn,
1505 char *inbuf,char *outbuf,int length,int bufsize)
1506 {
1507 /*
1508 * Go through and cancel any pending change notifies.
1509 */
1510
1511 int mid = SVAL(inbuf,smb_mid);
1512 START_PROFILE(SMBntcancel);
1513 remove_pending_change_notify_requests_by_mid(mid);
1514 remove_pending_lock_requests_by_mid(mid);
1515 srv_cancel_sign_response(mid);
1516
1517 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1518
1519 END_PROFILE(SMBntcancel);
1520 return(-1);
1521 }
1522
1523 /****************************************************************************
1524 Copy a file.
1525 ****************************************************************************/
1526
1527 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint16 attrs)
1528 {
1529 BOOL bad_path_oldname = False;
1530 BOOL bad_path_newname = False;
1531 SMB_STRUCT_STAT sbuf1, sbuf2;
1532 pstring last_component_oldname;
1533 pstring last_component_newname;
1534 files_struct *fsp1,*fsp2;
1535 uint16 fmode;
1536 int access_mode;
1537 int smb_action;
1538 SMB_OFF_T ret=-1;
1539 int close_ret;
1540 NTSTATUS status = NT_STATUS_OK;
1541
1542 ZERO_STRUCT(sbuf1);
1543 ZERO_STRUCT(sbuf2);
1544
1545 /* No wildcards. */
1546 if (ms_has_wild(newname) || ms_has_wild(oldname)) {
1547 return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1548 }
1549
1550 if (!CAN_WRITE(conn))
1551 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1552
1553 unix_convert(oldname,conn,last_component_oldname,&bad_path_oldname,&sbuf1);
1554 if (bad_path_oldname) {
1555 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1556 }
1557
1558 /* Quick check for "." and ".." */
1559 if (last_component_oldname[0] == '.') {
1560 if (!last_component_oldname[1] || (last_component_oldname[1] == '.' && !last_component_oldname[2])) {
1561 return NT_STATUS_OBJECT_NAME_INVALID;
1562 }
1563 }
1564
1565 /* Source must already exist. */
1566 if (!VALID_STAT(sbuf1)) {
1567 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1568 }
1569 if (!check_name(oldname,conn)) {
1570 return NT_STATUS_ACCESS_DENIED;
1571 }
1572
1573 /* Ensure attributes match. */
1574 fmode = dos_mode(conn,oldname,&sbuf1);
1575 if ((fmode & ~attrs) & (aHIDDEN | aSYSTEM))
1576 return NT_STATUS_NO_SUCH_FILE;
1577
1578 unix_convert(newname,conn,last_component_newname,&bad_path_newname,&sbuf2);
1579 if (bad_path_newname) {
1580 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1581 }
1582
1583 /* Quick check for "." and ".." */
1584 if (last_component_newname[0] == '.') {
1585 if (!last_component_newname[1] || (last_component_newname[1] == '.' && !last_component_newname[2])) {
1586 return NT_STATUS_OBJECT_NAME_INVALID;
1587 }
1588 }
1589
1590 /* Disallow if newname already exists. */
1591 if (VALID_STAT(sbuf2)) {
1592 return NT_STATUS_OBJECT_NAME_COLLISION;
1593 }
1594
1595 if (!check_name(newname,conn)) {
1596 return NT_STATUS_ACCESS_DENIED;
1597 }
1598
1599 /* No links from a directory. */
1600 if (S_ISDIR(sbuf1.st_mode)) {
1601 return NT_STATUS_FILE_IS_A_DIRECTORY;
1602 }
1603
1604 /* Ensure this is within the share. */
1605 if (!reduce_name(conn, oldname) != 0) {
1606 return NT_STATUS_ACCESS_DENIED;
1607 }
1608
1609 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1610
1611 fsp1 = open_file_shared1(conn,oldname,&sbuf1,FILE_READ_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
1612 (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,0,
1613 &access_mode,&smb_action);
1614
1615 if (!fsp1) {
1616 status = NT_STATUS_ACCESS_DENIED;
1617 if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
1618 status = NT_STATUS_SHARING_VIOLATION;
1619 unix_ERR_class = 0;
1620 unix_ERR_code = 0;
1621 unix_ERR_ntstatus = NT_STATUS_OK;
1622 return status;
1623 }
1624
1625 fsp2 = open_file_shared1(conn,newname,&sbuf2,FILE_WRITE_DATA,SET_DENY_MODE(DENY_ALL)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
1626 (FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_FAIL),fmode,INTERNAL_OPEN_ONLY,
1627 &access_mode,&smb_action);
1628
1629 if (!fsp2) {
1630 status = NT_STATUS_ACCESS_DENIED;
1631 if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
1632 status = NT_STATUS_SHARING_VIOLATION;
1633 unix_ERR_class = 0;
1634 unix_ERR_code = 0;
1635 unix_ERR_ntstatus = NT_STATUS_OK;
1636 close_file(fsp1,False);
1637 return status;
1638 }
1639
1640 if (sbuf1.st_size)
1641 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1642
1643 /*
1644 * As we are opening fsp1 read-only we only expect
1645 * an error on close on fsp2 if we are out of space.
1646 * Thus we don't look at the error return from the
1647 * close of fsp1.
1648 */
1649 close_file(fsp1,False);
1650
1651 /* Ensure the modtime is set correctly on the destination file. */
1652 fsp2->pending_modtime = sbuf1.st_mtime;
1653
1654 close_ret = close_file(fsp2,False);
1655
1656 /* Grrr. We have to do this as open_file_shared1 adds aARCH when it
1657 creates the file. This isn't the correct thing to do in the copy case. JRA */
1658 file_set_dosmode(conn, newname, fmode, &sbuf2);
1659
1660 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1661 return NT_STATUS_DISK_FULL;
1662 }
1663
1664 if (close_ret != 0) {
1665 status = map_nt_error_from_unix(close_ret);
1666 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1667 nt_errstr(status), oldname, newname));
1668 }
1669 return status;
1670 }
1671
1672 /****************************************************************************
1673 Reply to a NT rename request.
1674 ****************************************************************************/
1675
1676 int reply_ntrename(connection_struct *conn,
1677 char *inbuf,char *outbuf,int length,int bufsize)
1678 {
1679 int outsize = 0;
1680 pstring oldname;
1681 pstring newname;
1682 char *p;
1683 NTSTATUS status;
1684 uint16 attrs = SVAL(inbuf,smb_vwv0);
1685 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1686
1687 START_PROFILE(SMBntrename);
1688
1689 p = smb_buf(inbuf) + 1;
1690 p += srvstr_get_path(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, True);
1691 if (!NT_STATUS_IS_OK(status)) {
1692 END_PROFILE(SMBntrename);
1693 return ERROR_NT(status);
1694 }
1695
1696 if( strchr_m(oldname, ':')) {
1697 /* Can't rename a stream. */
1698 END_PROFILE(SMBntrename);
1699 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1700 }
1701
1702 if (ms_has_wild(oldname)) {
1703 END_PROFILE(SMBntrename);
1704 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1705 }
1706
1707 p++;
1708 p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, False);
1709 if (!NT_STATUS_IS_OK(status)) {
1710 END_PROFILE(SMBntrename);
1711 return ERROR_NT(status);
1712 }
1713
1714 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1715 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1716
1717 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1718
1719 switch(rename_type) {
1720 case RENAME_FLAG_RENAME:
1721 status = rename_internals(conn, oldname, newname, attrs, False);
1722 break;
1723 case RENAME_FLAG_HARD_LINK:
1724 status = hardlink_internals(conn, oldname, newname);
1725 break;
1726 case RENAME_FLAG_COPY:
1727 status = copy_internals(conn, oldname, newname, attrs);
1728 break;
1729 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1730 status = NT_STATUS_INVALID_PARAMETER;
1731 break;
1732 default:
1733 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1734 break;
1735 }
1736
1737 if (!NT_STATUS_IS_OK(status)) {
1738 END_PROFILE(SMBntrename);
1739 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1740 /* We have re-scheduled this call. */
1741 clear_cached_errors();
1742 return -1;
1743 }
1744 return ERROR_NT(status);
1745 }
1746
1747 /*
1748 * Win2k needs a changenotify request response before it will
1749 * update after a rename..
1750 */
1751 process_pending_change_notify_queue((time_t)0);
1752 outsize = set_message(outbuf,0,0,True);
1753
1754 END_PROFILE(SMBntrename);
1755 return(outsize);
1756 }
1757
1758 /****************************************************************************
1759 Reply to an unsolicited SMBNTtranss - just ignore it!
1760 ****************************************************************************/
1761
1762 int reply_nttranss(connection_struct *conn,
1763 char *inbuf,char *outbuf,int length,int bufsize)
1764 {
1765 START_PROFILE(SMBnttranss);
1766 DEBUG(4,("Ignoring nttranss of length %d\n",length));
1767 END_PROFILE(SMBnttranss);
1768 return(-1);
1769 }
1770
1771 /****************************************************************************
1772 Reply to a notify change - queue the request and
1773 don't allow a directory to be opened.
1774 ****************************************************************************/
1775
1776 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1777 char **ppsetup, uint32 setup_count,
1778 char **ppparams, uint32 parameter_count,
1779 char **ppdata, uint32 data_count)
1780 {
1781 char *setup = *ppsetup;
1782 files_struct *fsp;
1783 uint32 flags;
1784
1785 if(setup_count < 6)
1786 return ERROR_DOS(ERRDOS,ERRbadfunc);
1787
1788 fsp = file_fsp(setup,4);
1789 flags = IVAL(setup, 0);
1790
1791 DEBUG(3,("call_nt_transact_notify_change\n"));
1792
1793 if(!fsp)
1794 return ERROR_DOS(ERRDOS,ERRbadfid);
1795
1796 if((!fsp->is_directory) || (conn != fsp->conn))
1797 return ERROR_DOS(ERRDOS,ERRbadfid);
1798
1799 if (!change_notify_set(inbuf, fsp, conn, flags))
1800 return(UNIXERROR(ERRDOS,ERRbadfid));
1801
1802 DEBUG(3,("call_nt_transact_notify_change: notify change called on directory \
1803 name = %s\n", fsp->fsp_name ));
1804
1805 return -1;
1806 }
1807
1808 /****************************************************************************
1809 Reply to an NT transact rename command.
1810 ****************************************************************************/
1811
1812 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1813 char **ppsetup, uint32 setup_count,
1814 char **ppparams, uint32 parameter_count,
1815 char **ppdata, uint32 data_count)
1816 {
1817 char *params = *ppparams;
1818 pstring new_name;
1819 files_struct *fsp = NULL;
1820 BOOL replace_if_exists = False;
1821 NTSTATUS status;
1822
1823 if(parameter_count < 4)
1824 return ERROR_DOS(ERRDOS,ERRbadfunc);
1825
1826 fsp = file_fsp(params, 0);
1827 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1828 CHECK_FSP(fsp, conn);
1829 srvstr_get_path(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE, &status, True);
1830 if (!NT_STATUS_IS_OK(status)) {
1831 return ERROR_NT(status);
1832 }
1833
1834 status = rename_internals(conn, fsp->fsp_name,
1835 new_name, 0, replace_if_exists);
1836 if (!NT_STATUS_IS_OK(status))
1837 return ERROR_NT(status);
1838
1839 /*
1840 * Rename was successful.
1841 */
1842 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1843
1844 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1845 fsp->fsp_name, new_name));
1846
1847 /*
1848 * Win2k needs a changenotify request response before it will
1849 * update after a rename..
1850 */
1851
1852 process_pending_change_notify_queue((time_t)0);
1853
1854 return -1;
1855 }
1856
1857 /******************************************************************************
1858 Fake up a completely empty SD.
1859 *******************************************************************************/
1860
1861 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1862 {
1863 extern DOM_SID global_sid_World;
1864 size_t sd_size;
1865
1866 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1867 if(!*ppsd) {
1868 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1869 sd_size = 0;
1870 }
1871
1872 return sd_size;
1873 }
1874
1875 /****************************************************************************
1876 Reply to query a security descriptor.
1877 ****************************************************************************/
1878
1879 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1880 char **ppsetup, uint32 setup_count,
1881 char **ppparams, uint32 parameter_count,
1882 char **ppdata, uint32 data_count)
1883 {
1884 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
1885 char *params = *ppparams;
1886 char *data = *ppdata;
1887 prs_struct pd;
1888 SEC_DESC *psd = NULL;
1889 size_t sd_size;
1890 uint32 security_info_wanted;
1891 TALLOC_CTX *mem_ctx;
1892 files_struct *fsp = NULL;
1893
1894 if(parameter_count < 8)
1895 return ERROR_DOS(ERRDOS,ERRbadfunc);
1896
1897 fsp = file_fsp(params,0);
1898 if(!fsp)
1899 return ERROR_DOS(ERRDOS,ERRbadfid);
1900
1901 security_info_wanted = IVAL(params,4);
1902
1903 DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp->fsp_name ));
1904
1905 params = nttrans_realloc(ppparams, 4);
1906 if(params == NULL)
1907 return ERROR_DOS(ERRDOS,ERRnomem);
1908
1909 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
1910 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
1911 return ERROR_DOS(ERRDOS,ERRnomem);
1912 }
1913
1914 /*
1915 * Get the permissions to return.
1916 */
1917
1918 if (!lp_nt_acl_support(SNUM(conn)))
1919 sd_size = get_null_nt_acl(mem_ctx, &psd);
1920 else
1921 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, security_info_wanted, &psd);
1922
1923 if (sd_size == 0) {
1924 talloc_destroy(mem_ctx);
1925 return(UNIXERROR(ERRDOS,ERRnoaccess));
1926 }
1927
1928 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %d.\n",(int)sd_size));
1929
1930 SIVAL(params,0,(uint32)sd_size);
1931
1932 if(max_data_count < sd_size) {
1933
1934 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
1935 params, 4, *ppdata, 0);
1936 talloc_destroy(mem_ctx);
1937 return -1;
1938 }
1939
1940 /*
1941 * Allocate the data we will point this at.
1942 */
1943
1944 data = nttrans_realloc(ppdata, sd_size);
1945 if(data == NULL) {
1946 talloc_destroy(mem_ctx);
1947 return ERROR_DOS(ERRDOS,ERRnomem);
1948 }
1949
1950 /*
1951 * Init the parse struct we will marshall into.
1952 */
1953
1954 prs_init(&pd, 0, mem_ctx, MARSHALL);
1955
1956 /*
1957 * Setup the prs_struct to point at the memory we just
1958 * allocated.
1959 */
1960
1961 prs_give_memory( &pd, data, (uint32)sd_size, False);
1962
1963 /*
1964 * Finally, linearize into the outgoing buffer.
1965 */
1966
1967 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1968 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
1969 security descriptor.\n"));
1970 /*
1971 * Return access denied for want of a better error message..
1972 */
1973 talloc_destroy(mem_ctx);
1974 return(UNIXERROR(ERRDOS,ERRnoaccess));
1975 }
1976
1977 /*
1978 * Now we can delete the security descriptor.
1979 */
1980
1981 talloc_destroy(mem_ctx);
1982
1983 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data, (int)sd_size);
1984 return -1;
1985 }
1986
1987 /****************************************************************************
1988 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1989 ****************************************************************************/
1990
1991 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1992 char **ppsetup, uint32 setup_count,
1993 char **ppparams, uint32 parameter_count,
1994 char **ppdata, uint32 data_count)
1995 {
1996 char *params= *ppparams;
1997 char *data = *ppdata;
1998 files_struct *fsp = NULL;
1999 uint32 security_info_sent = 0;
2000 NTSTATUS nt_status;
2001
2002 if(parameter_count < 8)
2003 return ERROR_DOS(ERRDOS,ERRbadfunc);
2004
2005 if((fsp = file_fsp(params,0)) == NULL)
2006 return ERROR_DOS(ERRDOS,ERRbadfid);
2007
2008 if(!lp_nt_acl_support(SNUM(conn)))
2009 goto done;
2010
2011 security_info_sent = IVAL(params,4);
2012
2013 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2014 (unsigned int)security_info_sent ));
2015
2016 if (data_count == 0)
2017 return ERROR_DOS(ERRDOS, ERRnoaccess);
2018
2019 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent)))
2020 return ERROR_NT(nt_status);
2021
2022 done:
2023
2024 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2025 return -1;
2026 }
2027
2028 /****************************************************************************
2029 Reply to NT IOCTL
2030 ****************************************************************************/
2031
2032 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2033 char **ppsetup, uint32 setup_count,
2034 char **ppparams, uint32 parameter_count,
2035 char **ppdata, uint32 data_count)
2036 {
2037 uint32 function;
2038 uint16 fidnum;
2039 files_struct *fsp;
2040 uint8 isFSctl;
2041 uint8 compfilter;
2042 static BOOL logged_message;
2043 char *pdata = *ppdata;
2044
2045 if (setup_count != 8) {
2046 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2047 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2048 }
2049
2050 function = IVAL(*ppsetup, 0);
2051 fidnum = SVAL(*ppsetup, 4);
2052 isFSctl = CVAL(*ppsetup, 6);
2053 compfilter = CVAL(*ppsetup, 7);
2054
2055 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2056 function, fidnum, isFSctl, compfilter));
2057
2058 fsp=file_fsp(*ppsetup, 4);
2059 /* this check is done in each implemented function case for now
2060 because I don't want to break anything... --metze
2061 FSP_BELONGS_CONN(fsp,conn);*/
2062
2063 switch (function) {
2064 case FSCTL_SET_SPARSE:
2065 /* pretend this succeeded - tho strictly we should
2066 mark the file sparse (if the local fs supports it)
2067 so we can know if we need to pre-allocate or not */
2068
2069 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2070 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2071 return -1;
2072
2073 case FSCTL_0x000900C0:
2074 /* pretend this succeeded - don't know what this really is
2075 but works ok like this --metze
2076 */
2077
2078 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2079 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2080 return -1;
2081
2082 case FSCTL_GET_REPARSE_POINT:
2083 /* pretend this fail - my winXP does it like this
2084 * --metze
2085 */
2086
2087 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2088 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2089 return -1;
2090
2091 case FSCTL_SET_REPARSE_POINT:
2092 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2093 * --metze
2094 */
2095
2096 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2097 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
2098 return -1;
2099
2100 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2101 {
2102 /*
2103 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2104 * and return their volume names. If max_data_count is 16, then it is just
2105 * asking for the number of volumes and length of the combined names.
2106 *
2107 * pdata is the data allocated by our caller, but that uses
2108 * total_data_count (which is 0 in our case) rather than max_data_count.
2109 * Allocate the correct amount and return the pointer to let
2110 * it be deallocated when we return.
2111 */
2112 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2113 SHADOW_COPY_DATA *shadow_data = NULL;
2114 TALLOC_CTX *shadow_mem_ctx = NULL;
2115 BOOL labels = False;
2116 uint32 labels_data_count = 0;
2117 uint32 i;
2118 char *cur_pdata;
2119
2120 FSP_BELONGS_CONN(fsp,conn);
2121
2122 if (max_data_count < 16) {
2123 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2124 max_data_count));
2125 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2126 }
2127
2128 if (max_data_count > 16) {
2129 labels = True;
2130 }
2131
2132 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2133 if (shadow_mem_ctx == NULL) {
2134 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2135 return ERROR_NT(NT_STATUS_NO_MEMORY);
2136 }
2137
2138 shadow_data = (SHADOW_COPY_DATA *)talloc_zero(shadow_mem_ctx,sizeof(SHADOW_COPY_DATA));
2139 if (shadow_data == NULL) {
2140 DEBUG(0,("talloc_zero() failed!\n"));
2141 return ERROR_NT(NT_STATUS_NO_MEMORY);
2142 }
2143
2144 shadow_data->mem_ctx = shadow_mem_ctx;
2145
2146 /*
2147 * Call the VFS routine to actually do the work.
2148 */
2149 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2150 talloc_destroy(shadow_data->mem_ctx);
2151 if (errno == ENOSYS) {
2152 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2153 conn->connectpath));
2154 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2155 } else {
2156 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2157 conn->connectpath));
2158 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2159 }
2160 }
2161
2162 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2163
2164 if (!labels) {
2165 data_count = 16;
2166 } else {
2167 data_count = 12+labels_data_count+4;
2168 }
2169
2170 if (max_data_count<data_count) {
2171 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2172 max_data_count,data_count));
2173 talloc_destroy(shadow_data->mem_ctx);
2174 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2175 }
2176
2177 pdata = nttrans_realloc(ppdata, data_count);
2178 if (pdata == NULL) {
2179 talloc_destroy(shadow_data->mem_ctx);
2180 return ERROR_NT(NT_STATUS_NO_MEMORY);
2181 }
2182
2183 cur_pdata = pdata;
2184
2185 /* num_volumes 4 bytes */
2186 SIVAL(pdata,0,shadow_data->num_volumes);
2187
2188 if (labels) {
2189 /* num_labels 4 bytes */
2190 SIVAL(pdata,4,shadow_data->num_volumes);
2191 }
2192
2193 /* needed_data_count 4 bytes */
2194 SIVAL(pdata,8,labels_data_count);
2195
2196 cur_pdata+=12;
2197
2198 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2199 shadow_data->num_volumes,fsp->fsp_name));
2200 if (labels && shadow_data->labels) {
2201 for (i=0;i<shadow_data->num_volumes;i++) {
2202 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2203 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2204 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2205 }
2206 }
2207
2208 talloc_destroy(shadow_data->mem_ctx);
2209
2210 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2211
2212 return -1;
2213 }
2214
2215 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2216 {
2217 /* pretend this succeeded -
2218 *
2219 * we have to send back a list with all files owned by this SID
2220 *
2221 * but I have to check that --metze
2222 */
2223 DOM_SID sid;
2224 uid_t uid;
2225 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2226
2227 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2228
2229 FSP_BELONGS_CONN(fsp,conn);
2230
2231 /* unknown 4 bytes: this is not the length of the sid :-( */
2232 /*unknown = IVAL(pdata,0);*/
2233
2234 sid_parse(pdata+4,sid_len,&sid);
2235 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2236
2237 if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) {
2238 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2239 sid_string_static(&sid),(unsigned long)sid_len));
2240 uid = (-1);
2241 }
2242
2243 /* we can take a look at the find source :-)
2244 *
2245 * find ./ -uid $uid -name '*' is what we need here
2246 *
2247 *
2248 * and send 4bytes len and then NULL terminated unicode strings
2249 * for each file
2250 *
2251 * but I don't know how to deal with the paged results
2252 * (maybe we can hang the result anywhere in the fsp struct)
2253 *
2254 * we don't send all files at once
2255 * and at the next we should *not* start from the beginning,
2256 * so we have to cache the result
2257 *
2258 * --metze
2259 */
2260
2261 /* this works for now... */
2262 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2263 return -1;
2264 }
2265 default:
2266 if (!logged_message) {
2267 logged_message = True; /* Only print this once... */
2268 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2269 function));
2270 }
2271 }
2272
2273 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2274 }
2275
2276
2277 #ifdef HAVE_SYS_QUOTAS
2278 /****************************************************************************
2279 Reply to get user quota
2280 ****************************************************************************/
2281
2282 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2283 char **ppsetup, uint32 setup_count,
2284 char **ppparams, uint32 parameter_count,
2285 char **ppdata, uint32 data_count)
2286 {
2287 NTSTATUS nt_status = NT_STATUS_OK;
2288 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2289 char *params = *ppparams;
2290 char *pdata = *ppdata;
2291 char *entry;
2292 int data_len=0,param_len=0;
2293 int qt_len=0;
2294 int entry_len = 0;
2295 files_struct *fsp = NULL;
2296 uint16 level = 0;
2297 size_t sid_len;
2298 DOM_SID sid;
2299 BOOL start_enum = True;
2300 SMB_NTQUOTA_STRUCT qt;
2301 SMB_NTQUOTA_LIST *tmp_list;
2302 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2303 extern struct current_user current_user;
2304
2305 ZERO_STRUCT(qt);
2306
2307 /* access check */
2308 if (current_user.uid != 0) {
2309 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2310 lp_servicename(SNUM(conn)),conn->user));
2311 return ERROR_DOS(ERRDOS,ERRnoaccess);
2312 }
2313
2314 /*
2315 * Ensure minimum number of parameters sent.
2316 */
2317
2318 if (parameter_count < 4) {
2319 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2320 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2321 }
2322
2323 /* maybe we can check the quota_fnum */
2324 fsp = file_fsp(params,0);
2325 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2326 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2327 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2328 }
2329
2330 /* the NULL pointer cheking for fsp->fake_file_handle->pd
2331 * is done by CHECK_NTQUOTA_HANDLE_OK()
2332 */
2333 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2334
2335 level = SVAL(params,2);
2336
2337 /* unknown 12 bytes leading in params */
2338
2339 switch (level) {
2340 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2341 /* seems that we should continue with the enum here --metze */
2342
2343 if (qt_handle->quota_list!=NULL &&
2344 qt_handle->tmp_list==NULL) {
2345
2346 /* free the list */
2347 free_ntquota_list(&(qt_handle->quota_list));
2348
2349 /* Realloc the size of parameters and data we will return */
2350 param_len = 4;
2351 params = nttrans_realloc(ppparams, param_len);
2352 if(params == NULL)
2353 return ERROR_DOS(ERRDOS,ERRnomem);
2354
2355 data_len = 0;
2356 SIVAL(params,0,data_len);
2357
2358 break;
2359 }
2360
2361 start_enum = False;
2362
2363 case TRANSACT_GET_USER_QUOTA_LIST_START:
2364
2365 if (qt_handle->quota_list==NULL &&
2366 qt_handle->tmp_list==NULL) {
2367 start_enum = True;
2368 }
2369
2370 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2371 return ERROR_DOS(ERRSRV,ERRerror);
2372
2373 /* Realloc the size of parameters and data we will return */
2374 param_len = 4;
2375 params = nttrans_realloc(ppparams, param_len);
2376 if(params == NULL)
2377 return ERROR_DOS(ERRDOS,ERRnomem);
2378
2379 /* we should not trust the value in max_data_count*/
2380 max_data_count = MIN(max_data_count,2048);
2381
2382 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2383 if(pdata == NULL)
2384 return ERROR_DOS(ERRDOS,ERRnomem);
2385
2386 entry = pdata;
2387
2388
2389 /* set params Size of returned Quota Data 4 bytes*/
2390 /* but set it later when we know it */
2391
2392 /* for each entry push the data */
2393
2394 if (start_enum) {
2395 qt_handle->tmp_list = qt_handle->quota_list;
2396 }
2397
2398 tmp_list = qt_handle->tmp_list;
2399
2400 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2401 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2402
2403 sid_len = sid_size(&tmp_list->quotas->sid);
2404 entry_len = 40 + sid_len;
2405
2406 /* nextoffset entry 4 bytes */
2407 SIVAL(entry,0,entry_len);
2408
2409 /* then the len of the SID 4 bytes */
2410 SIVAL(entry,4,sid_len);
2411
2412 /* unknown data 8 bytes SMB_BIG_UINT */
2413 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2414
2415 /* the used disk space 8 bytes SMB_BIG_UINT */
2416 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2417
2418 /* the soft quotas 8 bytes SMB_BIG_UINT */
2419 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2420
2421 /* the hard quotas 8 bytes SMB_BIG_UINT */
2422 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2423
2424 /* and now the SID */
2425 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2426 }
2427
2428 qt_handle->tmp_list = tmp_list;
2429
2430 /* overwrite the offset of the last entry */
2431 SIVAL(entry-entry_len,0,0);
2432
2433 data_len = 4+qt_len;
2434 /* overwrite the params quota_data_len */
2435 SIVAL(params,0,data_len);
2436
2437 break;
2438
2439 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2440
2441 /* unknown 4 bytes IVAL(pdata,0) */
2442
2443 if (data_count < 8) {
2444 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2445 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2446 }
2447
2448 sid_len = IVAL(pdata,4);
2449
2450 if (data_count < 8+sid_len) {
2451 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2452 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2453 }
2454
2455 data_len = 4+40+sid_len;
2456
2457 if (max_data_count < data_len) {
2458 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2459 max_data_count, data_len));
2460 param_len = 4;
2461 SIVAL(params,0,data_len);
2462 data_len = 0;
2463 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2464 break;
2465 }
2466
2467 sid_parse(pdata+8,sid_len,&sid);
2468
2469
2470 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2471 ZERO_STRUCT(qt);
2472 /*
2473 * we have to return zero's in all fields
2474 * instead of returning an error here
2475 * --metze
2476 */
2477 }
2478
2479 /* Realloc the size of parameters and data we will return */
2480 param_len = 4;
2481 params = nttrans_realloc(ppparams, param_len);
2482 if(params == NULL)
2483 return ERROR_DOS(ERRDOS,ERRnomem);
2484
2485 pdata = nttrans_realloc(ppdata, data_len);
2486 if(pdata == NULL)
2487 return ERROR_DOS(ERRDOS,ERRnomem);
2488
2489 entry = pdata;
2490
2491 /* set params Size of returned Quota Data 4 bytes*/
2492 SIVAL(params,0,data_len);
2493
2494 /* nextoffset entry 4 bytes */
2495 SIVAL(entry,0,0);
2496
2497 /* then the len of the SID 4 bytes */
2498 SIVAL(entry,4,sid_len);
2499
2500 /* unknown data 8 bytes SMB_BIG_UINT */
2501 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2502
2503 /* the used disk space 8 bytes SMB_BIG_UINT */
2504 SBIG_UINT(entry,16,qt.usedspace);
2505
2506 /* the soft quotas 8 bytes SMB_BIG_UINT */
2507 SBIG_UINT(entry,24,qt.softlim);
2508
2509 /* the hard quotas 8 bytes SMB_BIG_UINT */
2510 SBIG_UINT(entry,32,qt.hardlim);
2511
2512 /* and now the SID */
2513 sid_linearize(entry+40, sid_len, &sid);
2514
2515 break;
2516
2517 default:
2518 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2519 return ERROR_DOS(ERRSRV,ERRerror);
2520 break;
2521 }
2522
2523 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len);
2524
2525 return -1;
2526 }
2527
2528 /****************************************************************************
2529 Reply to set user quota
2530 ****************************************************************************/
2531
2532 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2533 char **ppsetup, uint32 setup_count,
2534 char **ppparams, uint32 parameter_count,
2535 char **ppdata, uint32 data_count)
2536 {
2537 char *params = *ppparams;
2538 char *pdata = *ppdata;
2539 int data_len=0,param_len=0;
2540 SMB_NTQUOTA_STRUCT qt;
2541 size_t sid_len;
2542 DOM_SID sid;
2543 files_struct *fsp = NULL;
2544
2545 ZERO_STRUCT(qt);
2546
2547 /* access check */
2548 if (current_user.uid != 0) {
2549 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2550 lp_servicename(SNUM(conn)),conn->user));
2551 return ERROR_DOS(ERRDOS,ERRnoaccess);
2552 }
2553
2554 /*
2555 * Ensure minimum number of parameters sent.
2556 */
2557
2558 if (parameter_count < 2) {
2559 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2560 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2561 }
2562
2563 /* maybe we can check the quota_fnum */
2564 fsp = file_fsp(params,0);
2565 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2566 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2567 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2568 }
2569
2570 if (data_count < 40) {
2571 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2572 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2573 }
2574
2575 /* offset to next quota record.
2576 * 4 bytes IVAL(pdata,0)
2577 * unused here...
2578 */
2579
2580 /* sid len */
2581 sid_len = IVAL(pdata,4);
2582
2583 if (data_count < 40+sid_len) {
2584 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2585 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2586 }
2587
2588 /* unknown 8 bytes in pdata
2589 * maybe its the change time in NTTIME
2590 */
2591
2592 /* the used space 8 bytes (SMB_BIG_UINT)*/
2593 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2594 #ifdef LARGE_SMB_OFF_T
2595 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2596 #else /* LARGE_SMB_OFF_T */
2597 if ((IVAL(pdata,20) != 0)&&
2598 ((qt.usedspace != 0xFFFFFFFF)||
2599 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2600 /* more than 32 bits? */
2601 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2602 }
2603 #endif /* LARGE_SMB_OFF_T */
2604
2605 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2606 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2607 #ifdef LARGE_SMB_OFF_T
2608 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2609 #else /* LARGE_SMB_OFF_T */
2610 if ((IVAL(pdata,28) != 0)&&
2611 ((qt.softlim != 0xFFFFFFFF)||
2612 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2613 /* more than 32 bits? */
2614 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2615 }
2616 #endif /* LARGE_SMB_OFF_T */
2617
2618 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2619 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2620 #ifdef LARGE_SMB_OFF_T
2621 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2622 #else /* LARGE_SMB_OFF_T */
2623 if ((IVAL(pdata,36) != 0)&&
2624 ((qt.hardlim != 0xFFFFFFFF)||
2625 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2626 /* more than 32 bits? */
2627 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2628 }
2629 #endif /* LARGE_SMB_OFF_T */
2630
2631 sid_parse(pdata+40,sid_len,&sid);
2632 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2633
2634 /* 44 unknown bytes left... */
2635
2636 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2637 return ERROR_DOS(ERRSRV,ERRerror);
2638 }
2639
2640 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len);
2641
2642 return -1;
2643 }
2644 #endif /* HAVE_SYS_QUOTAS */
2645
2646 /****************************************************************************
2647 Reply to a SMBNTtrans.
2648 ****************************************************************************/
2649
2650 int reply_nttrans(connection_struct *conn,
2651 char *inbuf,char *outbuf,int length,int bufsize)
2652 {
2653 int outsize = 0;
2654 #if 0 /* Not used. */
2655 uint16 max_setup_count = CVAL(inbuf, smb_nt_MaxSetupCount);
2656 uint32 max_parameter_count = IVAL(inbuf, smb_nt_MaxParameterCount);
2657 uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount);
2658 #endif /* Not used. */
2659 uint32 total_parameter_count = IVAL(inbuf, smb_nt_TotalParameterCount);
2660 uint32 total_data_count = IVAL(inbuf, smb_nt_TotalDataCount);
2661 uint32 parameter_count = IVAL(inbuf,smb_nt_ParameterCount);
2662 uint32 parameter_offset = IVAL(inbuf,smb_nt_ParameterOffset);
2663 uint32 data_count = IVAL(inbuf,smb_nt_DataCount);
2664 uint32 data_offset = IVAL(inbuf,smb_nt_DataOffset);
2665 uint16 setup_count = 2*CVAL(inbuf,smb_nt_SetupCount); /* setup count is in *words* */
2666 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2667 char *params = NULL, *data = NULL, *setup = NULL;
2668 uint32 num_params_sofar, num_data_sofar;
2669 START_PROFILE(SMBnttrans);
2670
2671 if(global_oplock_break &&
2672 ((function_code == NT_TRANSACT_CREATE) ||
2673 (function_code == NT_TRANSACT_RENAME))) {
2674 /*
2675 * Queue this open message as we are the process of an oplock break.
2676 */
2677
2678 DEBUG(2,("reply_nttrans: queueing message code 0x%x \
2679 due to being in oplock break state.\n", (unsigned int)function_code ));
2680
2681 push_oplock_pending_smb_message( inbuf, length);
2682 END_PROFILE(SMBnttrans);
2683 return -1;
2684 }
2685
2686 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2687 END_PROFILE(SMBnttrans);
2688 return ERROR_DOS(ERRSRV,ERRaccess);
2689 }
2690
2691 outsize = set_message(outbuf,0,0,True);
2692
2693 /*
2694 * All nttrans messages we handle have smb_wct == 19 + setup_count.
2695 * Ensure this is so as a sanity check.
2696 */
2697
2698 if(CVAL(inbuf, smb_wct) != 19 + (setup_count/2)) {
2699 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2700 CVAL(inbuf, smb_wct), 19 + (setup_count/2)));
2701 goto bad_param;
2702 }
2703
2704 /* Allocate the space for the setup, the maximum needed parameters and data */
2705
2706 if(setup_count > 0)
2707 setup = (char *)malloc(setup_count);
2708 if (total_parameter_count > 0)
2709 params = (char *)malloc(total_parameter_count);
2710 if (total_data_count > 0)
2711 data = (char *)malloc(total_data_count);
2712
2713 if ((total_parameter_count && !params) || (total_data_count && !data) ||
2714 (setup_count && !setup)) {
2715 SAFE_FREE(setup);
2716 SAFE_FREE(params);
2717 SAFE_FREE(data);
2718 DEBUG(0,("reply_nttrans : Out of memory\n"));
2719 END_PROFILE(SMBnttrans);
2720 return ERROR_DOS(ERRDOS,ERRnomem);
2721 }
2722
2723 /* Copy the param and data bytes sent with this request into the params buffer */
2724 num_params_sofar = parameter_count;
2725 num_data_sofar = data_count;
2726
2727 if (parameter_count > total_parameter_count || data_count > total_data_count)
2728 goto bad_param;
2729
2730 if(setup) {
2731 DEBUG(10,("reply_nttrans: setup_count = %d\n", setup_count));
2732 if ((smb_nt_SetupStart + setup_count < smb_nt_SetupStart) ||
2733 (smb_nt_SetupStart + setup_count < setup_count))
2734 goto bad_param;
2735 if (smb_nt_SetupStart + setup_count > length)
2736 goto bad_param;
2737
2738 memcpy( setup, &inbuf[smb_nt_SetupStart], setup_count);
2739 dump_data(10, setup, setup_count);
2740 }
2741 if(params) {
2742 DEBUG(10,("reply_nttrans: parameter_count = %d\n", parameter_count));
2743 if ((parameter_offset + parameter_count < parameter_offset) ||
2744 (parameter_offset + parameter_count < parameter_count))
2745 goto bad_param;
2746 if ((smb_base(inbuf) + parameter_offset + parameter_count > inbuf + length)||
2747 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2748 goto bad_param;
2749
2750 memcpy( params, smb_base(inbuf) + parameter_offset, parameter_count);
2751 dump_data(10, params, parameter_count);
2752 }
2753 if(data) {
2754 DEBUG(10,("reply_nttrans: data_count = %d\n",data_count));
2755 if ((data_offset + data_count < data_offset) || (data_offset + data_count < data_count))
2756 goto bad_param;
2757 if ((smb_base(inbuf) + data_offset + data_count > inbuf + length) ||
2758 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2759 goto bad_param;
2760
2761 memcpy( data, smb_base(inbuf) + data_offset, data_count);
2762 dump_data(10, data, data_count);
2763 }
2764
2765 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2766
2767 if(num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2768 /* We need to send an interim response then receive the rest
2769 of the parameter/data bytes */
2770 outsize = set_message(outbuf,0,0,True);
2771 srv_signing_trans_stop();
2772 if (!send_smb(smbd_server_fd(),outbuf))
2773 exit_server("reply_nttrans: send_smb failed.");
2774
2775 while( num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) {
2776 BOOL ret;
2777 uint32 parameter_displacement;
2778 uint32 data_displacement;
2779
2780 ret = receive_next_smb(inbuf,bufsize,SMB_SECONDARY_WAIT);
2781
2782 /*
2783 * The sequence number for the trans reply is always
2784 * based on the last secondary received.
2785 */
2786
2787 srv_signing_trans_start(SVAL(inbuf,smb_mid));
2788
2789 if((ret && (CVAL(inbuf, smb_com) != SMBnttranss)) || !ret) {
2790 outsize = set_message(outbuf,0,0,True);
2791 if(ret) {
2792 DEBUG(0,("reply_nttrans: Invalid secondary nttrans packet\n"));
2793 } else {
2794 DEBUG(0,("reply_nttrans: %s in getting secondary nttrans response.\n",
2795 (smb_read_error == READ_ERROR) ? "error" : "timeout" ));
2796 }
2797 goto bad_param;
2798 }
2799
2800 /* Revise total_params and total_data in case they have changed downwards */
2801 if (IVAL(inbuf, smb_nts_TotalParameterCount) < total_parameter_count)
2802 total_parameter_count = IVAL(inbuf, smb_nts_TotalParameterCount);
2803 if (IVAL(inbuf, smb_nts_TotalDataCount) < total_data_count)
2804 total_data_count = IVAL(inbuf, smb_nts_TotalDataCount);
2805
2806 parameter_count = IVAL(inbuf,smb_nts_ParameterCount);
2807 parameter_offset = IVAL(inbuf, smb_nts_ParameterOffset);
2808 parameter_displacement = IVAL(inbuf, smb_nts_ParameterDisplacement);
2809 num_params_sofar += parameter_count;
2810
2811 data_count = IVAL(inbuf, smb_nts_DataCount);
2812 data_displacement = IVAL(inbuf, smb_nts_DataDisplacement);
2813 data_offset = IVAL(inbuf, smb_nts_DataOffset);
2814 num_data_sofar += data_count;
2815
2816 if (num_params_sofar > total_parameter_count || num_data_sofar > total_data_count) {
2817 DEBUG(0,("reply_nttrans2: data overflow in secondary nttrans packet"));
2818 goto bad_param;
2819 }
2820
2821 if (parameter_count) {
2822 if (parameter_displacement + parameter_count >= total_parameter_count)
2823 goto bad_param;
2824 if ((parameter_displacement + parameter_count < parameter_displacement) ||
2825 (parameter_displacement + parameter_count < parameter_count))
2826 goto bad_param;
2827 if (parameter_displacement > total_parameter_count)
2828 goto bad_param;
2829 if ((smb_base(inbuf) + parameter_offset + parameter_count >= inbuf + bufsize) ||
2830 (smb_base(inbuf) + parameter_offset + parameter_count < smb_base(inbuf)))
2831 goto bad_param;
2832 if (parameter_displacement + params < params)
2833 goto bad_param;
2834
2835 memcpy( &params[parameter_displacement], smb_base(inbuf) + parameter_offset, parameter_count);
2836 }
2837
2838 if (data_count) {
2839 if (data_displacement + data_count >= total_data_count)
2840 goto bad_param;
2841 if ((data_displacement + data_count < data_displacement) ||
2842 (data_displacement + data_count < data_count))
2843 goto bad_param;
2844 if (data_displacement > total_data_count)
2845 goto bad_param;
2846 if ((smb_base(inbuf) + data_offset + data_count >= inbuf + bufsize) ||
2847 (smb_base(inbuf) + data_offset + data_count < smb_base(inbuf)))
2848 goto bad_param;
2849 if (data_displacement + data < data)
2850 goto bad_param;
2851
2852 memcpy( &data[data_displacement], smb_base(inbuf)+ data_offset, data_count);
2853 }
2854 }
2855 }
2856
2857 if (Protocol >= PROTOCOL_NT1)
2858 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | FLAGS2_IS_LONG_NAME);
2859
2860 /* Now we must call the relevant NT_TRANS function */
2861 switch(function_code) {
2862 case NT_TRANSACT_CREATE:
2863 START_PROFILE_NESTED(NT_transact_create);
2864 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2865 length, bufsize,
2866 &setup, setup_count,
2867 &params, total_parameter_count,
2868 &data, total_data_count);
2869 END_PROFILE_NESTED(NT_transact_create);
2870 break;
2871 case NT_TRANSACT_IOCTL:
2872 START_PROFILE_NESTED(NT_transact_ioctl);
2873 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2874 length, bufsize,
2875 &setup, setup_count,
2876 &params, total_parameter_count,
2877 &data, total_data_count);
2878 END_PROFILE_NESTED(NT_transact_ioctl);
2879 break;
2880 case NT_TRANSACT_SET_SECURITY_DESC:
2881 START_PROFILE_NESTED(NT_transact_set_security_desc);
2882 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2883 length, bufsize,
2884 &setup, setup_count,
2885 &params, total_parameter_count,
2886 &data, total_data_count);
2887 END_PROFILE_NESTED(NT_transact_set_security_desc);
2888 break;
2889 case NT_TRANSACT_NOTIFY_CHANGE:
2890 START_PROFILE_NESTED(NT_transact_notify_change);
2891 outsize = call_nt_transact_notify_change(conn, inbuf, outbuf,
2892 length, bufsize,
2893 &setup, setup_count,
2894 &params, total_parameter_count,
2895 &data, total_data_count);
2896 END_PROFILE_NESTED(NT_transact_notify_change);
2897 break;
2898 case NT_TRANSACT_RENAME:
2899 START_PROFILE_NESTED(NT_transact_rename);
2900 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2901 length, bufsize,
2902 &setup, setup_count,
2903 &params, total_parameter_count,
2904 &data, total_data_count);
2905 END_PROFILE_NESTED(NT_transact_rename);
2906 break;
2907
2908 case NT_TRANSACT_QUERY_SECURITY_DESC:
2909 START_PROFILE_NESTED(NT_transact_query_security_desc);
2910 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2911 length, bufsize,
2912 &setup, setup_count,
2913 &params, total_parameter_count,
2914 &data, total_data_count);
2915 END_PROFILE_NESTED(NT_transact_query_security_desc);
2916 break;
2917 #ifdef HAVE_SYS_QUOTAS
2918 case NT_TRANSACT_GET_USER_QUOTA:
2919 START_PROFILE_NESTED(NT_transact_get_user_quota);
2920 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2921 length, bufsize,
2922 &setup, setup_count,
2923 &params, total_parameter_count,
2924 &data, total_data_count);
2925 END_PROFILE_NESTED(NT_transact_get_user_quota);
2926 break;
2927 case NT_TRANSACT_SET_USER_QUOTA:
2928 START_PROFILE_NESTED(NT_transact_set_user_quota);
2929 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2930 length, bufsize,
2931 &setup, setup_count,
2932 &params, total_parameter_count,
2933 &data, total_data_count);
2934 END_PROFILE_NESTED(NT_transact_set_user_quota);
2935 break;
2936 #endif /* HAVE_SYS_QUOTAS */
2937 default:
2938 /* Error in request */
2939 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code));
2940 SAFE_FREE(setup);
2941 SAFE_FREE(params);
2942 SAFE_FREE(data);
2943 END_PROFILE(SMBnttrans);
2944 srv_signing_trans_stop();
2945 return ERROR_DOS(ERRSRV,ERRerror);
2946 }
2947
2948 /* As we do not know how many data packets will need to be
2949 returned here the various call_nt_transact_xxxx calls
2950 must send their own. Thus a call_nt_transact_xxxx routine only
2951 returns a value other than -1 when it wants to send
2952 an error packet.
2953 */
2954
2955 srv_signing_trans_stop();
2956
2957 SAFE_FREE(setup);
2958 SAFE_FREE(params);
2959 SAFE_FREE(data);
2960 END_PROFILE(SMBnttrans);
2961 return outsize; /* If a correct response was needed the call_nt_transact_xxxx
2962 calls have already sent it. If outsize != -1 then it is
2963 returning an error packet. */
2964
2965 bad_param:
2966
2967 srv_signing_trans_stop();
2968 SAFE_FREE(params);
2969 SAFE_FREE(data);
2970 SAFE_FREE(setup);
2971 END_PROFILE(SMBnttrans);
2972 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2973 }
Samba GIT mirror