?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Final part of fix for bug 6793 - winbindd crash with "INTERNAL ERROR: Signal 6"
[Samba.git] / source3 / smbd / reply.c
blob2365ed1da1446daf7f0ff185f6d84ab55760d66e
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 break;
69 }
70 }
71
72 if (!posix_path && !stream_started && *s == ':') {
73 if (*p_last_component_contains_wcard) {
74 return NT_STATUS_OBJECT_NAME_INVALID;
75 }
76 /* Stream names allow more characters than file names.
77 We're overloading posix_path here to allow a wider
78 range of characters. If stream_started is true this
79 is still a Windows path even if posix_path is true.
80 JRA.
81 */
82 stream_started = true;
83 start_of_name_component = false;
84 posix_path = true;
85
86 if (s[1] == '\0') {
87 return NT_STATUS_OBJECT_NAME_INVALID;
88 }
89 }
90
91 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
92 /*
93 * Safe to assume is not the second part of a mb char
94 * as this is handled below.
95 */
96 /* Eat multiple '/' or '\\' */
97 while (IS_PATH_SEP(*s,posix_path)) {
98 s++;
99 }
100 if ((d != path) && (*s != '\0')) {
101 /* We only care about non-leading or trailing '/' or '\\' */
102 *d++ = '/';
103 }
104
105 start_of_name_component = True;
106 /* New component. */
107 *p_last_component_contains_wcard = False;
108 continue;
109 }
110
111 if (start_of_name_component) {
112 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
113 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
114
115 /*
116 * No mb char starts with '.' so we're safe checking the directory separator here.
117 */
118
119 /* If we just added a '/' - delete it */
120 if ((d > path) && (*(d-1) == '/')) {
121 *(d-1) = '\0';
122 d--;
123 }
124
125 /* Are we at the start ? Can't go back further if so. */
126 if (d <= path) {
127 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
128 break;
129 }
130 /* Go back one level... */
131 /* We know this is safe as '/' cannot be part of a mb sequence. */
132 /* NOTE - if this assumption is invalid we are not in good shape... */
133 /* Decrement d first as d points to the *next* char to write into. */
134 for (d--; d > path; d--) {
135 if (*d == '/')
136 break;
137 }
138 s += 2; /* Else go past the .. */
139 /* We're still at the start of a name component, just the previous one. */
140 continue;
141
142 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
143 if (posix_path) {
144 /* Eat the '.' */
145 s++;
146 continue;
147 }
148 }
149
150 }
151
152 if (!(*s & 0x80)) {
153 if (!posix_path) {
154 if (*s <= 0x1f || *s == '|') {
155 return NT_STATUS_OBJECT_NAME_INVALID;
156 }
157 switch (*s) {
158 case '*':
159 case '?':
160 case '<':
161 case '>':
162 case '"':
163 *p_last_component_contains_wcard = True;
164 break;
165 default:
166 break;
167 }
168 }
169 *d++ = *s++;
170 } else {
171 size_t siz;
172 /* Get the size of the next MB character. */
173 next_codepoint(s,&siz);
174 switch(siz) {
175 case 5:
176 *d++ = *s++;
177 /*fall through*/
178 case 4:
179 *d++ = *s++;
180 /*fall through*/
181 case 3:
182 *d++ = *s++;
183 /*fall through*/
184 case 2:
185 *d++ = *s++;
186 /*fall through*/
187 case 1:
188 *d++ = *s++;
189 break;
190 default:
191 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
192 *d = '\0';
193 return NT_STATUS_INVALID_PARAMETER;
194 }
195 }
196 start_of_name_component = False;
197 }
198
199 *d = '\0';
200
201 return ret;
202 }
203
204 /****************************************************************************
205 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
206 No wildcards allowed.
207 ****************************************************************************/
208
209 NTSTATUS check_path_syntax(char *path)
210 {
211 bool ignore;
212 return check_path_syntax_internal(path, False, &ignore);
213 }
214
215 /****************************************************************************
216 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
217 Wildcards allowed - p_contains_wcard returns true if the last component contained
218 a wildcard.
219 ****************************************************************************/
220
221 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
222 {
223 return check_path_syntax_internal(path, False, p_contains_wcard);
224 }
225
226 /****************************************************************************
227 Check the path for a POSIX client.
228 We're assuming here that '/' is not the second byte in any multibyte char
229 set (a safe assumption).
230 ****************************************************************************/
231
232 NTSTATUS check_path_syntax_posix(char *path)
233 {
234 bool ignore;
235 return check_path_syntax_internal(path, True, &ignore);
236 }
237
238 /****************************************************************************
239 Pull a string and check the path allowing a wilcard - provide for error return.
240 ****************************************************************************/
241
242 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
243 const char *base_ptr,
244 uint16 smb_flags2,
245 char **pp_dest,
246 const char *src,
247 size_t src_len,
248 int flags,
249 NTSTATUS *err,
250 bool *contains_wcard)
251 {
252 size_t ret;
253
254 *pp_dest = NULL;
255
256 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
257 src_len, flags);
258
259 if (!*pp_dest) {
260 *err = NT_STATUS_INVALID_PARAMETER;
261 return ret;
262 }
263
264 *contains_wcard = False;
265
266 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
267 /*
268 * For a DFS path the function parse_dfs_path()
269 * will do the path processing, just make a copy.
270 */
271 *err = NT_STATUS_OK;
272 return ret;
273 }
274
275 if (lp_posix_pathnames()) {
276 *err = check_path_syntax_posix(*pp_dest);
277 } else {
278 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
279 }
280
281 return ret;
282 }
283
284 /****************************************************************************
285 Pull a string and check the path - provide for error return.
286 ****************************************************************************/
287
288 size_t srvstr_get_path(TALLOC_CTX *ctx,
289 const char *base_ptr,
290 uint16 smb_flags2,
291 char **pp_dest,
292 const char *src,
293 size_t src_len,
294 int flags,
295 NTSTATUS *err)
296 {
297 bool ignore;
298 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
299 src_len, flags, err, &ignore);
300 }
301
302 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
303 char **pp_dest, const char *src, int flags,
304 NTSTATUS *err, bool *contains_wcard)
305 {
306 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
307 pp_dest, src, smbreq_bufrem(req, src),
308 flags, err, contains_wcard);
309 }
310
311 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
312 char **pp_dest, const char *src, int flags,
313 NTSTATUS *err)
314 {
315 bool ignore;
316 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
317 flags, err, &ignore);
318 }
319
320 /****************************************************************************
321 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
322 ****************************************************************************/
323
324 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
325 files_struct *fsp)
326 {
327 if (!(fsp) || !(conn)) {
328 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
329 return False;
330 }
331 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
332 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
333 return False;
334 }
335 return True;
336 }
337
338 /****************************************************************************
339 Check if we have a correct fsp pointing to a file.
340 ****************************************************************************/
341
342 bool check_fsp(connection_struct *conn, struct smb_request *req,
343 files_struct *fsp)
344 {
345 if (!check_fsp_open(conn, req, fsp)) {
346 return False;
347 }
348 if ((fsp)->is_directory) {
349 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
350 return False;
351 }
352 if ((fsp)->fh->fd == -1) {
353 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
354 return False;
355 }
356 (fsp)->num_smb_operations++;
357 return True;
358 }
359
360 /****************************************************************************
361 Check if we have a correct fsp pointing to a quota fake file. Replacement for
362 the CHECK_NTQUOTA_HANDLE_OK macro.
363 ****************************************************************************/
364
365 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
366 files_struct *fsp)
367 {
368 if (!check_fsp_open(conn, req, fsp)) {
369 return false;
370 }
371
372 if (fsp->is_directory) {
373 return false;
374 }
375
376 if (fsp->fake_file_handle == NULL) {
377 return false;
378 }
379
380 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
381 return false;
382 }
383
384 if (fsp->fake_file_handle->private_data == NULL) {
385 return false;
386 }
387
388 return true;
389 }
390
391 /****************************************************************************
392 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
393 ****************************************************************************/
394
395 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
396 files_struct *fsp)
397 {
398 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
399 && (req->vuid == (fsp)->vuid)) {
400 return True;
401 }
402
403 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
404 return False;
405 }
406
407 static bool netbios_session_retarget(const char *name, int name_type)
408 {
409 char *trim_name;
410 char *trim_name_type;
411 const char *retarget_parm;
412 char *retarget;
413 char *p;
414 int retarget_type = 0x20;
415 int retarget_port = 139;
416 struct sockaddr_storage retarget_addr;
417 struct sockaddr_in *in_addr;
418 bool ret = false;
419 uint8_t outbuf[10];
420
421 if (get_socket_port(smbd_server_fd()) != 139) {
422 return false;
423 }
424
425 trim_name = talloc_strdup(talloc_tos(), name);
426 if (trim_name == NULL) {
427 goto fail;
428 }
429 trim_char(trim_name, ' ', ' ');
430
431 trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
432 name_type);
433 if (trim_name_type == NULL) {
434 goto fail;
435 }
436
437 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
438 trim_name_type, NULL);
439 if (retarget_parm == NULL) {
440 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
441 trim_name, NULL);
442 }
443 if (retarget_parm == NULL) {
444 goto fail;
445 }
446
447 retarget = talloc_strdup(trim_name, retarget_parm);
448 if (retarget == NULL) {
449 goto fail;
450 }
451
452 DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
453
454 p = strchr(retarget, ':');
455 if (p != NULL) {
456 *p++ = '\0';
457 retarget_port = atoi(p);
458 }
459
460 p = strchr_m(retarget, '#');
461 if (p != NULL) {
462 *p++ = '\0';
463 sscanf(p, "%x", &retarget_type);
464 }
465
466 ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
467 if (!ret) {
468 DEBUG(10, ("could not resolve %s\n", retarget));
469 goto fail;
470 }
471
472 if (retarget_addr.ss_family != AF_INET) {
473 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
474 goto fail;
475 }
476
477 in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
478
479 _smb_setlen(outbuf, 6);
480 SCVAL(outbuf, 0, 0x84);
481 *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
482 *(uint16_t *)(outbuf+8) = htons(retarget_port);
483
484 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
485 NULL)) {
486 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
487 "failed.");
488 }
489
490 ret = true;
491 fail:
492 TALLOC_FREE(trim_name);
493 return ret;
494 }
495
496 /****************************************************************************
497 Reply to a (netbios-level) special message.
498 ****************************************************************************/
499
500 void reply_special(char *inbuf)
501 {
502 int msg_type = CVAL(inbuf,0);
503 int msg_flags = CVAL(inbuf,1);
504 fstring name1,name2;
505 char name_type1, name_type2;
506 struct smbd_server_connection *sconn = smbd_server_conn;
507
508 /*
509 * We only really use 4 bytes of the outbuf, but for the smb_setlen
510 * calculation & friends (srv_send_smb uses that) we need the full smb
511 * header.
512 */
513 char outbuf[smb_size];
514
515 *name1 = *name2 = 0;
516
517 memset(outbuf, '\0', sizeof(outbuf));
518
519 smb_setlen(outbuf,0);
520
521 switch (msg_type) {
522 case 0x81: /* session request */
523
524 if (sconn->nbt.got_session) {
525 exit_server_cleanly("multiple session request not permitted");
526 }
527
528 SCVAL(outbuf,0,0x82);
529 SCVAL(outbuf,3,0);
530 if (name_len(inbuf+4) > 50 ||
531 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
532 DEBUG(0,("Invalid name length in session request\n"));
533 return;
534 }
535 name_type1 = name_extract(inbuf,4,name1);
536 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
537 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
538 name1, name_type1, name2, name_type2));
539
540 if (netbios_session_retarget(name1, name_type1)) {
541 exit_server_cleanly("retargeted client");
542 }
543
544 set_local_machine_name(name1, True);
545 set_remote_machine_name(name2, True);
546
547 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
548 get_local_machine_name(), get_remote_machine_name(),
549 name_type2));
550
551 if (name_type2 == 'R') {
552 /* We are being asked for a pathworks session ---
553 no thanks! */
554 SCVAL(outbuf, 0,0x83);
555 break;
556 }
557
558 /* only add the client's machine name to the list
559 of possibly valid usernames if we are operating
560 in share mode security */
561 if (lp_security() == SEC_SHARE) {
562 add_session_user(sconn, get_remote_machine_name());
563 }
564
565 reload_services(True);
566 reopen_logs();
567
568 sconn->nbt.got_session = true;
569 break;
570
571 case 0x89: /* session keepalive request
572 (some old clients produce this?) */
573 SCVAL(outbuf,0,SMBkeepalive);
574 SCVAL(outbuf,3,0);
575 break;
576
577 case 0x82: /* positive session response */
578 case 0x83: /* negative session response */
579 case 0x84: /* retarget session response */
580 DEBUG(0,("Unexpected session response\n"));
581 break;
582
583 case SMBkeepalive: /* session keepalive */
584 default:
585 return;
586 }
587
588 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
589 msg_type, msg_flags));
590
591 srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
592 return;
593 }
594
595 /****************************************************************************
596 Reply to a tcon.
597 conn POINTER CAN BE NULL HERE !
598 ****************************************************************************/
599
600 void reply_tcon(struct smb_request *req)
601 {
602 connection_struct *conn = req->conn;
603 const char *service;
604 char *service_buf = NULL;
605 char *password = NULL;
606 char *dev = NULL;
607 int pwlen=0;
608 NTSTATUS nt_status;
609 const char *p;
610 DATA_BLOB password_blob;
611 TALLOC_CTX *ctx = talloc_tos();
612 struct smbd_server_connection *sconn = smbd_server_conn;
613
614 START_PROFILE(SMBtcon);
615
616 if (req->buflen < 4) {
617 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
618 END_PROFILE(SMBtcon);
619 return;
620 }
621
622 p = (const char *)req->buf + 1;
623 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
624 p += 1;
625 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
626 p += pwlen+1;
627 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
628 p += 1;
629
630 if (service_buf == NULL || password == NULL || dev == NULL) {
631 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
632 END_PROFILE(SMBtcon);
633 return;
634 }
635 p = strrchr_m(service_buf,'\\');
636 if (p) {
637 service = p+1;
638 } else {
639 service = service_buf;
640 }
641
642 password_blob = data_blob(password, pwlen+1);
643
644 conn = make_connection(sconn,service,password_blob,dev,
645 req->vuid,&nt_status);
646 req->conn = conn;
647
648 data_blob_clear_free(&password_blob);
649
650 if (!conn) {
651 reply_nterror(req, nt_status);
652 END_PROFILE(SMBtcon);
653 return;
654 }
655
656 reply_outbuf(req, 2, 0);
657 SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
658 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
659 SSVAL(req->outbuf,smb_tid,conn->cnum);
660
661 DEBUG(3,("tcon service=%s cnum=%d\n",
662 service, conn->cnum));
663
664 END_PROFILE(SMBtcon);
665 return;
666 }
667
668 /****************************************************************************
669 Reply to a tcon and X.
670 conn POINTER CAN BE NULL HERE !
671 ****************************************************************************/
672
673 void reply_tcon_and_X(struct smb_request *req)
674 {
675 connection_struct *conn = req->conn;
676 const char *service = NULL;
677 DATA_BLOB password;
678 TALLOC_CTX *ctx = talloc_tos();
679 /* what the cleint thinks the device is */
680 char *client_devicetype = NULL;
681 /* what the server tells the client the share represents */
682 const char *server_devicetype;
683 NTSTATUS nt_status;
684 int passlen;
685 char *path = NULL;
686 const char *p, *q;
687 uint16 tcon_flags;
688 struct smbd_server_connection *sconn = smbd_server_conn;
689
690 START_PROFILE(SMBtconX);
691
692 if (req->wct < 4) {
693 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
694 END_PROFILE(SMBtconX);
695 return;
696 }
697
698 passlen = SVAL(req->vwv+3, 0);
699 tcon_flags = SVAL(req->vwv+2, 0);
700
701 /* we might have to close an old one */
702 if ((tcon_flags & 0x1) && conn) {
703 close_cnum(conn,req->vuid);
704 req->conn = NULL;
705 conn = NULL;
706 }
707
708 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
709 reply_doserror(req, ERRDOS, ERRbuftoosmall);
710 END_PROFILE(SMBtconX);
711 return;
712 }
713
714 if (sconn->smb1.negprot.encrypted_passwords) {
715 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
716 if (lp_security() == SEC_SHARE) {
717 /*
718 * Security = share always has a pad byte
719 * after the password.
720 */
721 p = (const char *)req->buf + passlen + 1;
722 } else {
723 p = (const char *)req->buf + passlen;
724 }
725 } else {
726 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
727 /* Ensure correct termination */
728 password.data[passlen]=0;
729 p = (const char *)req->buf + passlen + 1;
730 }
731
732 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
733
734 if (path == NULL) {
735 data_blob_clear_free(&password);
736 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
737 END_PROFILE(SMBtconX);
738 return;
739 }
740
741 /*
742 * the service name can be either: \\server\share
743 * or share directly like on the DELL PowerVault 705
744 */
745 if (*path=='\\') {
746 q = strchr_m(path+2,'\\');
747 if (!q) {
748 data_blob_clear_free(&password);
749 reply_doserror(req, ERRDOS, ERRnosuchshare);
750 END_PROFILE(SMBtconX);
751 return;
752 }
753 service = q+1;
754 } else {
755 service = path;
756 }
757
758 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
759 &client_devicetype, p,
760 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
761
762 if (client_devicetype == NULL) {
763 data_blob_clear_free(&password);
764 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
765 END_PROFILE(SMBtconX);
766 return;
767 }
768
769 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
770
771 conn = make_connection(sconn, service, password, client_devicetype,
772 req->vuid, &nt_status);
773 req->conn =conn;
774
775 data_blob_clear_free(&password);
776
777 if (!conn) {
778 reply_nterror(req, nt_status);
779 END_PROFILE(SMBtconX);
780 return;
781 }
782
783 if ( IS_IPC(conn) )
784 server_devicetype = "IPC";
785 else if ( IS_PRINT(conn) )
786 server_devicetype = "LPT1:";
787 else
788 server_devicetype = "A:";
789
790 if (Protocol < PROTOCOL_NT1) {
791 reply_outbuf(req, 2, 0);
792 if (message_push_string(&req->outbuf, server_devicetype,
793 STR_TERMINATE|STR_ASCII) == -1) {
794 reply_nterror(req, NT_STATUS_NO_MEMORY);
795 END_PROFILE(SMBtconX);
796 return;
797 }
798 } else {
799 /* NT sets the fstype of IPC$ to the null string */
800 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
801
802 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
803 /* Return permissions. */
804 uint32 perm1 = 0;
805 uint32 perm2 = 0;
806
807 reply_outbuf(req, 7, 0);
808
809 if (IS_IPC(conn)) {
810 perm1 = FILE_ALL_ACCESS;
811 perm2 = FILE_ALL_ACCESS;
812 } else {
813 perm1 = CAN_WRITE(conn) ?
814 SHARE_ALL_ACCESS :
815 SHARE_READ_ONLY;
816 }
817
818 SIVAL(req->outbuf, smb_vwv3, perm1);
819 SIVAL(req->outbuf, smb_vwv5, perm2);
820 } else {
821 reply_outbuf(req, 3, 0);
822 }
823
824 if ((message_push_string(&req->outbuf, server_devicetype,
825 STR_TERMINATE|STR_ASCII) == -1)
826 || (message_push_string(&req->outbuf, fstype,
827 STR_TERMINATE) == -1)) {
828 reply_nterror(req, NT_STATUS_NO_MEMORY);
829 END_PROFILE(SMBtconX);
830 return;
831 }
832
833 /* what does setting this bit do? It is set by NT4 and
834 may affect the ability to autorun mounted cdroms */
835 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
836 (lp_csc_policy(SNUM(conn)) << 2));
837
838 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
839 DEBUG(2,("Serving %s as a Dfs root\n",
840 lp_servicename(SNUM(conn)) ));
841 SSVAL(req->outbuf, smb_vwv2,
842 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
843 }
844 }
845
846
847 DEBUG(3,("tconX service=%s \n",
848 service));
849
850 /* set the incoming and outgoing tid to the just created one */
851 SSVAL(req->inbuf,smb_tid,conn->cnum);
852 SSVAL(req->outbuf,smb_tid,conn->cnum);
853
854 END_PROFILE(SMBtconX);
855
856 req->tid = conn->cnum;
857 chain_reply(req);
858 return;
859 }
860
861 /****************************************************************************
862 Reply to an unknown type.
863 ****************************************************************************/
864
865 void reply_unknown_new(struct smb_request *req, uint8 type)
866 {
867 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
868 smb_fn_name(type), type, type));
869 reply_doserror(req, ERRSRV, ERRunknownsmb);
870 return;
871 }
872
873 /****************************************************************************
874 Reply to an ioctl.
875 conn POINTER CAN BE NULL HERE !
876 ****************************************************************************/
877
878 void reply_ioctl(struct smb_request *req)
879 {
880 connection_struct *conn = req->conn;
881 uint16 device;
882 uint16 function;
883 uint32 ioctl_code;
884 int replysize;
885 char *p;
886
887 START_PROFILE(SMBioctl);
888
889 if (req->wct < 3) {
890 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
891 END_PROFILE(SMBioctl);
892 return;
893 }
894
895 device = SVAL(req->vwv+1, 0);
896 function = SVAL(req->vwv+2, 0);
897 ioctl_code = (device << 16) + function;
898
899 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
900
901 switch (ioctl_code) {
902 case IOCTL_QUERY_JOB_INFO:
903 replysize = 32;
904 break;
905 default:
906 reply_doserror(req, ERRSRV, ERRnosupport);
907 END_PROFILE(SMBioctl);
908 return;
909 }
910
911 reply_outbuf(req, 8, replysize+1);
912 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
913 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
914 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
915 p = smb_buf(req->outbuf);
916 memset(p, '\0', replysize+1); /* valgrind-safe. */
917 p += 1; /* Allow for alignment */
918
919 switch (ioctl_code) {
920 case IOCTL_QUERY_JOB_INFO:
921 {
922 files_struct *fsp = file_fsp(
923 req, SVAL(req->vwv+0, 0));
924 if (!fsp) {
925 reply_doserror(req, ERRDOS, ERRbadfid);
926 END_PROFILE(SMBioctl);
927 return;
928 }
929 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
930 srvstr_push((char *)req->outbuf, req->flags2, p+2,
931 global_myname(), 15,
932 STR_TERMINATE|STR_ASCII);
933 if (conn) {
934 srvstr_push((char *)req->outbuf, req->flags2,
935 p+18, lp_servicename(SNUM(conn)),
936 13, STR_TERMINATE|STR_ASCII);
937 } else {
938 memset(p+18, 0, 13);
939 }
940 break;
941 }
942 }
943
944 END_PROFILE(SMBioctl);
945 return;
946 }
947
948 /****************************************************************************
949 Strange checkpath NTSTATUS mapping.
950 ****************************************************************************/
951
952 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
953 {
954 /* Strange DOS error code semantics only for checkpath... */
955 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
956 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
957 /* We need to map to ERRbadpath */
958 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
959 }
960 }
961 return status;
962 }
963
964 /****************************************************************************
965 Reply to a checkpath.
966 ****************************************************************************/
967
968 void reply_checkpath(struct smb_request *req)
969 {
970 connection_struct *conn = req->conn;
971 struct smb_filename *smb_fname = NULL;
972 char *name = NULL;
973 NTSTATUS status;
974 TALLOC_CTX *ctx = talloc_tos();
975
976 START_PROFILE(SMBcheckpath);
977
978 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
979 STR_TERMINATE, &status);
980
981 if (!NT_STATUS_IS_OK(status)) {
982 status = map_checkpath_error(req->flags2, status);
983 reply_nterror(req, status);
984 END_PROFILE(SMBcheckpath);
985 return;
986 }
987
988 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
989
990 status = filename_convert(ctx,
991 conn,
992 req->flags2 & FLAGS2_DFS_PATHNAMES,
993 name,
994 0,
995 NULL,
996 &smb_fname);
997
998 if (!NT_STATUS_IS_OK(status)) {
999 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1000 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1001 ERRSRV, ERRbadpath);
1002 END_PROFILE(SMBcheckpath);
1003 return;
1004 }
1005 goto path_err;
1006 }
1007
1008 if (!VALID_STAT(smb_fname->st) &&
1009 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1010 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1011 smb_fname_str_dbg(smb_fname), strerror(errno)));
1012 status = map_nt_error_from_unix(errno);
1013 goto path_err;
1014 }
1015
1016 if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1017 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1018 ERRDOS, ERRbadpath);
1019 goto out;
1020 }
1021
1022 reply_outbuf(req, 0, 0);
1023
1024 path_err:
1025 /* We special case this - as when a Windows machine
1026 is parsing a path is steps through the components
1027 one at a time - if a component fails it expects
1028 ERRbadpath, not ERRbadfile.
1029 */
1030 status = map_checkpath_error(req->flags2, status);
1031 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1032 /*
1033 * Windows returns different error codes if
1034 * the parent directory is valid but not the
1035 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1036 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1037 * if the path is invalid.
1038 */
1039 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1040 ERRDOS, ERRbadpath);
1041 goto out;
1042 }
1043
1044 reply_nterror(req, status);
1045
1046 out:
1047 TALLOC_FREE(smb_fname);
1048 END_PROFILE(SMBcheckpath);
1049 return;
1050 }
1051
1052 /****************************************************************************
1053 Reply to a getatr.
1054 ****************************************************************************/
1055
1056 void reply_getatr(struct smb_request *req)
1057 {
1058 connection_struct *conn = req->conn;
1059 struct smb_filename *smb_fname = NULL;
1060 char *fname = NULL;
1061 int mode=0;
1062 SMB_OFF_T size=0;
1063 time_t mtime=0;
1064 const char *p;
1065 NTSTATUS status;
1066 TALLOC_CTX *ctx = talloc_tos();
1067 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1068
1069 START_PROFILE(SMBgetatr);
1070
1071 p = (const char *)req->buf + 1;
1072 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1073 if (!NT_STATUS_IS_OK(status)) {
1074 reply_nterror(req, status);
1075 goto out;
1076 }
1077
1078 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1079 under WfWg - weird! */
1080 if (*fname == '\0') {
1081 mode = aHIDDEN | aDIR;
1082 if (!CAN_WRITE(conn)) {
1083 mode |= aRONLY;
1084 }
1085 size = 0;
1086 mtime = 0;
1087 } else {
1088 status = filename_convert(ctx,
1089 conn,
1090 req->flags2 & FLAGS2_DFS_PATHNAMES,
1091 fname,
1092 0,
1093 NULL,
1094 &smb_fname);
1095 if (!NT_STATUS_IS_OK(status)) {
1096 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1097 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1098 ERRSRV, ERRbadpath);
1099 goto out;
1100 }
1101 reply_nterror(req, status);
1102 goto out;
1103 }
1104 if (!VALID_STAT(smb_fname->st) &&
1105 (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1106 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1107 smb_fname_str_dbg(smb_fname),
1108 strerror(errno)));
1109 reply_nterror(req, map_nt_error_from_unix(errno));
1110 goto out;
1111 }
1112
1113 mode = dos_mode(conn, smb_fname);
1114 size = smb_fname->st.st_ex_size;
1115
1116 if (ask_sharemode) {
1117 struct timespec write_time_ts;
1118 struct file_id fileid;
1119
1120 ZERO_STRUCT(write_time_ts);
1121 fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1122 get_file_infos(fileid, NULL, &write_time_ts);
1123 if (!null_timespec(write_time_ts)) {
1124 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1125 }
1126 }
1127
1128 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1129 if (mode & aDIR) {
1130 size = 0;
1131 }
1132 }
1133
1134 reply_outbuf(req, 10, 0);
1135
1136 SSVAL(req->outbuf,smb_vwv0,mode);
1137 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1138 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1139 } else {
1140 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1141 }
1142 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1143
1144 if (Protocol >= PROTOCOL_NT1) {
1145 SSVAL(req->outbuf, smb_flg2,
1146 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1147 }
1148
1149 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1150 smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1151
1152 out:
1153 TALLOC_FREE(smb_fname);
1154 TALLOC_FREE(fname);
1155 END_PROFILE(SMBgetatr);
1156 return;
1157 }
1158
1159 /****************************************************************************
1160 Reply to a setatr.
1161 ****************************************************************************/
1162
1163 void reply_setatr(struct smb_request *req)
1164 {
1165 struct smb_file_time ft;
1166 connection_struct *conn = req->conn;
1167 struct smb_filename *smb_fname = NULL;
1168 char *fname = NULL;
1169 int mode;
1170 time_t mtime;
1171 const char *p;
1172 NTSTATUS status;
1173 TALLOC_CTX *ctx = talloc_tos();
1174
1175 START_PROFILE(SMBsetatr);
1176
1177 ZERO_STRUCT(ft);
1178
1179 if (req->wct < 2) {
1180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1181 goto out;
1182 }
1183
1184 p = (const char *)req->buf + 1;
1185 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1186 if (!NT_STATUS_IS_OK(status)) {
1187 reply_nterror(req, status);
1188 goto out;
1189 }
1190
1191 status = filename_convert(ctx,
1192 conn,
1193 req->flags2 & FLAGS2_DFS_PATHNAMES,
1194 fname,
1195 0,
1196 NULL,
1197 &smb_fname);
1198 if (!NT_STATUS_IS_OK(status)) {
1199 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1200 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1201 ERRSRV, ERRbadpath);
1202 goto out;
1203 }
1204 reply_nterror(req, status);
1205 goto out;
1206 }
1207
1208 if (smb_fname->base_name[0] == '.' &&
1209 smb_fname->base_name[1] == '\0') {
1210 /*
1211 * Not sure here is the right place to catch this
1212 * condition. Might be moved to somewhere else later -- vl
1213 */
1214 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1215 goto out;
1216 }
1217
1218 mode = SVAL(req->vwv+0, 0);
1219 mtime = srv_make_unix_date3(req->vwv+1);
1220
1221 ft.mtime = convert_time_t_to_timespec(mtime);
1222 status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1223 if (!NT_STATUS_IS_OK(status)) {
1224 reply_nterror(req, status);
1225 goto out;
1226 }
1227
1228 if (mode != FILE_ATTRIBUTE_NORMAL) {
1229 if (VALID_STAT_OF_DIR(smb_fname->st))
1230 mode |= aDIR;
1231 else
1232 mode &= ~aDIR;
1233
1234 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1235 false) != 0) {
1236 reply_nterror(req, map_nt_error_from_unix(errno));
1237 goto out;
1238 }
1239 }
1240
1241 reply_outbuf(req, 0, 0);
1242
1243 DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1244 mode));
1245 out:
1246 TALLOC_FREE(smb_fname);
1247 END_PROFILE(SMBsetatr);
1248 return;
1249 }
1250
1251 /****************************************************************************
1252 Reply to a dskattr.
1253 ****************************************************************************/
1254
1255 void reply_dskattr(struct smb_request *req)
1256 {
1257 connection_struct *conn = req->conn;
1258 uint64_t dfree,dsize,bsize;
1259 START_PROFILE(SMBdskattr);
1260
1261 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1262 reply_nterror(req, map_nt_error_from_unix(errno));
1263 END_PROFILE(SMBdskattr);
1264 return;
1265 }
1266
1267 reply_outbuf(req, 5, 0);
1268
1269 if (Protocol <= PROTOCOL_LANMAN2) {
1270 double total_space, free_space;
1271 /* we need to scale this to a number that DOS6 can handle. We
1272 use floating point so we can handle large drives on systems
1273 that don't have 64 bit integers
1274
1275 we end up displaying a maximum of 2G to DOS systems
1276 */
1277 total_space = dsize * (double)bsize;
1278 free_space = dfree * (double)bsize;
1279
1280 dsize = (uint64_t)((total_space+63*512) / (64*512));
1281 dfree = (uint64_t)((free_space+63*512) / (64*512));
1282
1283 if (dsize > 0xFFFF) dsize = 0xFFFF;
1284 if (dfree > 0xFFFF) dfree = 0xFFFF;
1285
1286 SSVAL(req->outbuf,smb_vwv0,dsize);
1287 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1288 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1289 SSVAL(req->outbuf,smb_vwv3,dfree);
1290 } else {
1291 SSVAL(req->outbuf,smb_vwv0,dsize);
1292 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1293 SSVAL(req->outbuf,smb_vwv2,512);
1294 SSVAL(req->outbuf,smb_vwv3,dfree);
1295 }
1296
1297 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1298
1299 END_PROFILE(SMBdskattr);
1300 return;
1301 }
1302
1303 /*
1304 * Utility function to split the filename from the directory.
1305 */
1306 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1307 char **fname_dir_out,
1308 char **fname_mask_out)
1309 {
1310 const char *p = NULL;
1311 char *fname_dir = NULL;
1312 char *fname_mask = NULL;
1313
1314 p = strrchr_m(fname_in, '/');
1315 if (!p) {
1316 fname_dir = talloc_strdup(ctx, ".");
1317 fname_mask = talloc_strdup(ctx, fname_in);
1318 } else {
1319 fname_dir = talloc_strndup(ctx, fname_in,
1320 PTR_DIFF(p, fname_in));
1321 fname_mask = talloc_strdup(ctx, p+1);
1322 }
1323
1324 if (!fname_dir || !fname_mask) {
1325 TALLOC_FREE(fname_dir);
1326 TALLOC_FREE(fname_mask);
1327 return NT_STATUS_NO_MEMORY;
1328 }
1329
1330 *fname_dir_out = fname_dir;
1331 *fname_mask_out = fname_mask;
1332 return NT_STATUS_OK;
1333 }
1334
1335 /****************************************************************************
1336 Reply to a search.
1337 Can be called from SMBsearch, SMBffirst or SMBfunique.
1338 ****************************************************************************/
1339
1340 void reply_search(struct smb_request *req)
1341 {
1342 connection_struct *conn = req->conn;
1343 char *path = NULL;
1344 const char *mask = NULL;
1345 char *directory = NULL;
1346 struct smb_filename *smb_fname = NULL;
1347 char *fname = NULL;
1348 SMB_OFF_T size;
1349 uint32 mode;
1350 struct timespec date;
1351 uint32 dirtype;
1352 unsigned int numentries = 0;
1353 unsigned int maxentries = 0;
1354 bool finished = False;
1355 const char *p;
1356 int status_len;
1357 char status[21];
1358 int dptr_num= -1;
1359 bool check_descend = False;
1360 bool expect_close = False;
1361 NTSTATUS nt_status;
1362 bool mask_contains_wcard = False;
1363 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1364 TALLOC_CTX *ctx = talloc_tos();
1365 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1366 struct dptr_struct *dirptr = NULL;
1367 struct smbd_server_connection *sconn = smbd_server_conn;
1368
1369 START_PROFILE(SMBsearch);
1370
1371 if (req->wct < 2) {
1372 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1373 goto out;
1374 }
1375
1376 if (lp_posix_pathnames()) {
1377 reply_unknown_new(req, req->cmd);
1378 goto out;
1379 }
1380
1381 /* If we were called as SMBffirst then we must expect close. */
1382 if(req->cmd == SMBffirst) {
1383 expect_close = True;
1384 }
1385
1386 reply_outbuf(req, 1, 3);
1387 maxentries = SVAL(req->vwv+0, 0);
1388 dirtype = SVAL(req->vwv+1, 0);
1389 p = (const char *)req->buf + 1;
1390 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1391 &nt_status, &mask_contains_wcard);
1392 if (!NT_STATUS_IS_OK(nt_status)) {
1393 reply_nterror(req, nt_status);
1394 goto out;
1395 }
1396
1397 p++;
1398 status_len = SVAL(p, 0);
1399 p += 2;
1400
1401 /* dirtype &= ~aDIR; */
1402
1403 if (status_len == 0) {
1404 nt_status = filename_convert(ctx, conn,
1405 req->flags2 & FLAGS2_DFS_PATHNAMES,
1406 path,
1407 UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1408 &mask_contains_wcard,
1409 &smb_fname);
1410 if (!NT_STATUS_IS_OK(nt_status)) {
1411 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1412 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1413 ERRSRV, ERRbadpath);
1414 goto out;
1415 }
1416 reply_nterror(req, nt_status);
1417 goto out;
1418 }
1419
1420 directory = smb_fname->base_name;
1421
1422 p = strrchr_m(directory,'/');
1423 if ((p != NULL) && (*directory != '/')) {
1424 mask = p + 1;
1425 directory = talloc_strndup(ctx, directory,
1426 PTR_DIFF(p, directory));
1427 } else {
1428 mask = directory;
1429 directory = talloc_strdup(ctx,".");
1430 }
1431
1432 if (!directory) {
1433 reply_nterror(req, NT_STATUS_NO_MEMORY);
1434 goto out;
1435 }
1436
1437 memset((char *)status,'\0',21);
1438 SCVAL(status,0,(dirtype & 0x1F));
1439
1440 nt_status = dptr_create(conn,
1441 directory,
1442 True,
1443 expect_close,
1444 req->smbpid,
1445 mask,
1446 mask_contains_wcard,
1447 dirtype,
1448 &dirptr);
1449 if (!NT_STATUS_IS_OK(nt_status)) {
1450 reply_nterror(req, nt_status);
1451 goto out;
1452 }
1453 dptr_num = dptr_dnum(dirptr);
1454 } else {
1455 int status_dirtype;
1456 const char *dirpath;
1457
1458 memcpy(status,p,21);
1459 status_dirtype = CVAL(status,0) & 0x1F;
1460 if (status_dirtype != (dirtype & 0x1F)) {
1461 dirtype = status_dirtype;
1462 }
1463
1464 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1465 if (!dirptr) {
1466 goto SearchEmpty;
1467 }
1468 dirpath = dptr_path(sconn, dptr_num);
1469 directory = talloc_strdup(ctx, dirpath);
1470 if (!directory) {
1471 reply_nterror(req, NT_STATUS_NO_MEMORY);
1472 goto out;
1473 }
1474
1475 mask = dptr_wcard(sconn, dptr_num);
1476 if (!mask) {
1477 goto SearchEmpty;
1478 }
1479 /*
1480 * For a 'continue' search we have no string. So
1481 * check from the initial saved string.
1482 */
1483 mask_contains_wcard = ms_has_wild(mask);
1484 dirtype = dptr_attr(sconn, dptr_num);
1485 }
1486
1487 DEBUG(4,("dptr_num is %d\n",dptr_num));
1488
1489 /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1490 dptr_init_search_op(dirptr);
1491
1492 if ((dirtype&0x1F) == aVOLID) {
1493 char buf[DIR_STRUCT_SIZE];
1494 memcpy(buf,status,21);
1495 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1496 0,aVOLID,0,!allow_long_path_components)) {
1497 reply_nterror(req, NT_STATUS_NO_MEMORY);
1498 goto out;
1499 }
1500 dptr_fill(sconn, buf+12,dptr_num);
1501 if (dptr_zero(buf+12) && (status_len==0)) {
1502 numentries = 1;
1503 } else {
1504 numentries = 0;
1505 }
1506 if (message_push_blob(&req->outbuf,
1507 data_blob_const(buf, sizeof(buf)))
1508 == -1) {
1509 reply_nterror(req, NT_STATUS_NO_MEMORY);
1510 goto out;
1511 }
1512 } else {
1513 unsigned int i;
1514 maxentries = MIN(
1515 maxentries,
1516 ((BUFFER_SIZE -
1517 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1518 /DIR_STRUCT_SIZE));
1519
1520 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1521 directory,lp_dontdescend(SNUM(conn))));
1522 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1523 check_descend = True;
1524 }
1525
1526 for (i=numentries;(i<maxentries) && !finished;i++) {
1527 finished = !get_dir_entry(ctx,
1528 dirptr,
1529 mask,
1530 dirtype,
1531 &fname,
1532 &size,
1533 &mode,
1534 &date,
1535 check_descend,
1536 ask_sharemode);
1537 if (!finished) {
1538 char buf[DIR_STRUCT_SIZE];
1539 memcpy(buf,status,21);
1540 if (!make_dir_struct(ctx,
1541 buf,
1542 mask,
1543 fname,
1544 size,
1545 mode,
1546 convert_timespec_to_time_t(date),
1547 !allow_long_path_components)) {
1548 reply_nterror(req, NT_STATUS_NO_MEMORY);
1549 goto out;
1550 }
1551 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1552 break;
1553 }
1554 if (message_push_blob(&req->outbuf,
1555 data_blob_const(buf, sizeof(buf)))
1556 == -1) {
1557 reply_nterror(req, NT_STATUS_NO_MEMORY);
1558 goto out;
1559 }
1560 numentries++;
1561 }
1562 }
1563 }
1564
1565 SearchEmpty:
1566
1567 /* If we were called as SMBffirst with smb_search_id == NULL
1568 and no entries were found then return error and close dirptr
1569 (X/Open spec) */
1570
1571 if (numentries == 0) {
1572 dptr_close(sconn, &dptr_num);
1573 } else if(expect_close && status_len == 0) {
1574 /* Close the dptr - we know it's gone */
1575 dptr_close(sconn, &dptr_num);
1576 }
1577
1578 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1579 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1580 dptr_close(sconn, &dptr_num);
1581 }
1582
1583 if ((numentries == 0) && !mask_contains_wcard) {
1584 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1585 goto out;
1586 }
1587
1588 SSVAL(req->outbuf,smb_vwv0,numentries);
1589 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1590 SCVAL(smb_buf(req->outbuf),0,5);
1591 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1592
1593 /* The replies here are never long name. */
1594 SSVAL(req->outbuf, smb_flg2,
1595 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1596 if (!allow_long_path_components) {
1597 SSVAL(req->outbuf, smb_flg2,
1598 SVAL(req->outbuf, smb_flg2)
1599 & (~FLAGS2_LONG_PATH_COMPONENTS));
1600 }
1601
1602 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1603 SSVAL(req->outbuf, smb_flg2,
1604 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1605
1606 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1607 smb_fn_name(req->cmd),
1608 mask,
1609 directory,
1610 dirtype,
1611 numentries,
1612 maxentries ));
1613 out:
1614 TALLOC_FREE(directory);
1615 TALLOC_FREE(smb_fname);
1616 END_PROFILE(SMBsearch);
1617 return;
1618 }
1619
1620 /****************************************************************************
1621 Reply to a fclose (stop directory search).
1622 ****************************************************************************/
1623
1624 void reply_fclose(struct smb_request *req)
1625 {
1626 int status_len;
1627 char status[21];
1628 int dptr_num= -2;
1629 const char *p;
1630 char *path = NULL;
1631 NTSTATUS err;
1632 bool path_contains_wcard = False;
1633 TALLOC_CTX *ctx = talloc_tos();
1634 struct smbd_server_connection *sconn = smbd_server_conn;
1635
1636 START_PROFILE(SMBfclose);
1637
1638 if (lp_posix_pathnames()) {
1639 reply_unknown_new(req, req->cmd);
1640 END_PROFILE(SMBfclose);
1641 return;
1642 }
1643
1644 p = (const char *)req->buf + 1;
1645 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1646 &err, &path_contains_wcard);
1647 if (!NT_STATUS_IS_OK(err)) {
1648 reply_nterror(req, err);
1649 END_PROFILE(SMBfclose);
1650 return;
1651 }
1652 p++;
1653 status_len = SVAL(p,0);
1654 p += 2;
1655
1656 if (status_len == 0) {
1657 reply_doserror(req, ERRSRV, ERRsrverror);
1658 END_PROFILE(SMBfclose);
1659 return;
1660 }
1661
1662 memcpy(status,p,21);
1663
1664 if(dptr_fetch(sconn, status+12,&dptr_num)) {
1665 /* Close the dptr - we know it's gone */
1666 dptr_close(sconn, &dptr_num);
1667 }
1668
1669 reply_outbuf(req, 1, 0);
1670 SSVAL(req->outbuf,smb_vwv0,0);
1671
1672 DEBUG(3,("search close\n"));
1673
1674 END_PROFILE(SMBfclose);
1675 return;
1676 }
1677
1678 /****************************************************************************
1679 Reply to an open.
1680 ****************************************************************************/
1681
1682 void reply_open(struct smb_request *req)
1683 {
1684 connection_struct *conn = req->conn;
1685 struct smb_filename *smb_fname = NULL;
1686 char *fname = NULL;
1687 uint32 fattr=0;
1688 SMB_OFF_T size = 0;
1689 time_t mtime=0;
1690 int info;
1691 files_struct *fsp;
1692 int oplock_request;
1693 int deny_mode;
1694 uint32 dos_attr;
1695 uint32 access_mask;
1696 uint32 share_mode;
1697 uint32 create_disposition;
1698 uint32 create_options = 0;
1699 NTSTATUS status;
1700 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1701 TALLOC_CTX *ctx = talloc_tos();
1702
1703 START_PROFILE(SMBopen);
1704
1705 if (req->wct < 2) {
1706 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1707 goto out;
1708 }
1709
1710 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1711 deny_mode = SVAL(req->vwv+0, 0);
1712 dos_attr = SVAL(req->vwv+1, 0);
1713
1714 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1715 STR_TERMINATE, &status);
1716 if (!NT_STATUS_IS_OK(status)) {
1717 reply_nterror(req, status);
1718 goto out;
1719 }
1720
1721 status = filename_convert(ctx,
1722 conn,
1723 req->flags2 & FLAGS2_DFS_PATHNAMES,
1724 fname,
1725 0,
1726 NULL,
1727 &smb_fname);
1728 if (!NT_STATUS_IS_OK(status)) {
1729 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1730 reply_botherror(req,
1731 NT_STATUS_PATH_NOT_COVERED,
1732 ERRSRV, ERRbadpath);
1733 goto out;
1734 }
1735 reply_nterror(req, status);
1736 goto out;
1737 }
1738
1739 if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1740 OPENX_FILE_EXISTS_OPEN, &access_mask,
1741 &share_mode, &create_disposition,
1742 &create_options)) {
1743 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1744 goto out;
1745 }
1746
1747 status = SMB_VFS_CREATE_FILE(
1748 conn, /* conn */
1749 req, /* req */
1750 0, /* root_dir_fid */
1751 smb_fname, /* fname */
1752 access_mask, /* access_mask */
1753 share_mode, /* share_access */
1754 create_disposition, /* create_disposition*/
1755 create_options, /* create_options */
1756 dos_attr, /* file_attributes */
1757 oplock_request, /* oplock_request */
1758 0, /* allocation_size */
1759 NULL, /* sd */
1760 NULL, /* ea_list */
1761 &fsp, /* result */
1762 &info); /* pinfo */
1763
1764 if (!NT_STATUS_IS_OK(status)) {
1765 if (open_was_deferred(req->mid)) {
1766 /* We have re-scheduled this call. */
1767 goto out;
1768 }
1769 reply_openerror(req, status);
1770 goto out;
1771 }
1772
1773 size = smb_fname->st.st_ex_size;
1774 fattr = dos_mode(conn, smb_fname);
1775
1776 /* Deal with other possible opens having a modified
1777 write time. JRA. */
1778 if (ask_sharemode) {
1779 struct timespec write_time_ts;
1780
1781 ZERO_STRUCT(write_time_ts);
1782 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1783 if (!null_timespec(write_time_ts)) {
1784 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1785 }
1786 }
1787
1788 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1789
1790 if (fattr & aDIR) {
1791 DEBUG(3,("attempt to open a directory %s\n",
1792 fsp_str_dbg(fsp)));
1793 close_file(req, fsp, ERROR_CLOSE);
1794 reply_doserror(req, ERRDOS,ERRnoaccess);
1795 goto out;
1796 }
1797
1798 reply_outbuf(req, 7, 0);
1799 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1800 SSVAL(req->outbuf,smb_vwv1,fattr);
1801 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1802 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1803 } else {
1804 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1805 }
1806 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1807 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1808
1809 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1810 SCVAL(req->outbuf,smb_flg,
1811 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1812 }
1813
1814 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1815 SCVAL(req->outbuf,smb_flg,
1816 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1817 }
1818 out:
1819 TALLOC_FREE(smb_fname);
1820 END_PROFILE(SMBopen);
1821 return;
1822 }
1823
1824 /****************************************************************************
1825 Reply to an open and X.
1826 ****************************************************************************/
1827
1828 void reply_open_and_X(struct smb_request *req)
1829 {
1830 connection_struct *conn = req->conn;
1831 struct smb_filename *smb_fname = NULL;
1832 char *fname = NULL;
1833 uint16 open_flags;
1834 int deny_mode;
1835 uint32 smb_attr;
1836 /* Breakout the oplock request bits so we can set the
1837 reply bits separately. */
1838 int ex_oplock_request;
1839 int core_oplock_request;
1840 int oplock_request;
1841 #if 0
1842 int smb_sattr = SVAL(req->vwv+4, 0);
1843 uint32 smb_time = make_unix_date3(req->vwv+6);
1844 #endif
1845 int smb_ofun;
1846 uint32 fattr=0;
1847 int mtime=0;
1848 int smb_action = 0;
1849 files_struct *fsp;
1850 NTSTATUS status;
1851 uint64_t allocation_size;
1852 ssize_t retval = -1;
1853 uint32 access_mask;
1854 uint32 share_mode;
1855 uint32 create_disposition;
1856 uint32 create_options = 0;
1857 TALLOC_CTX *ctx = talloc_tos();
1858
1859 START_PROFILE(SMBopenX);
1860
1861 if (req->wct < 15) {
1862 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1863 goto out;
1864 }
1865
1866 open_flags = SVAL(req->vwv+2, 0);
1867 deny_mode = SVAL(req->vwv+3, 0);
1868 smb_attr = SVAL(req->vwv+5, 0);
1869 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1870 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1871 oplock_request = ex_oplock_request | core_oplock_request;
1872 smb_ofun = SVAL(req->vwv+8, 0);
1873 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1874
1875 /* If it's an IPC, pass off the pipe handler. */
1876 if (IS_IPC(conn)) {
1877 if (lp_nt_pipe_support()) {
1878 reply_open_pipe_and_X(conn, req);
1879 } else {
1880 reply_doserror(req, ERRSRV, ERRaccess);
1881 }
1882 goto out;
1883 }
1884
1885 /* XXXX we need to handle passed times, sattr and flags */
1886 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1887 STR_TERMINATE, &status);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 reply_nterror(req, status);
1890 goto out;
1891 }
1892
1893 status = filename_convert(ctx,
1894 conn,
1895 req->flags2 & FLAGS2_DFS_PATHNAMES,
1896 fname,
1897 0,
1898 NULL,
1899 &smb_fname);
1900 if (!NT_STATUS_IS_OK(status)) {
1901 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1902 reply_botherror(req,
1903 NT_STATUS_PATH_NOT_COVERED,
1904 ERRSRV, ERRbadpath);
1905 goto out;
1906 }
1907 reply_nterror(req, status);
1908 goto out;
1909 }
1910
1911 if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1912 &access_mask, &share_mode,
1913 &create_disposition,
1914 &create_options)) {
1915 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1916 goto out;
1917 }
1918
1919 status = SMB_VFS_CREATE_FILE(
1920 conn, /* conn */
1921 req, /* req */
1922 0, /* root_dir_fid */
1923 smb_fname, /* fname */
1924 access_mask, /* access_mask */
1925 share_mode, /* share_access */
1926 create_disposition, /* create_disposition*/
1927 create_options, /* create_options */
1928 smb_attr, /* file_attributes */
1929 oplock_request, /* oplock_request */
1930 0, /* allocation_size */
1931 NULL, /* sd */
1932 NULL, /* ea_list */
1933 &fsp, /* result */
1934 &smb_action); /* pinfo */
1935
1936 if (!NT_STATUS_IS_OK(status)) {
1937 if (open_was_deferred(req->mid)) {
1938 /* We have re-scheduled this call. */
1939 goto out;
1940 }
1941 reply_openerror(req, status);
1942 goto out;
1943 }
1944
1945 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1946 if the file is truncated or created. */
1947 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1948 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1949 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1950 close_file(req, fsp, ERROR_CLOSE);
1951 reply_nterror(req, NT_STATUS_DISK_FULL);
1952 goto out;
1953 }
1954 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1955 if (retval < 0) {
1956 close_file(req, fsp, ERROR_CLOSE);
1957 reply_nterror(req, NT_STATUS_DISK_FULL);
1958 goto out;
1959 }
1960 smb_fname->st.st_ex_size =
1961 SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1962 }
1963
1964 fattr = dos_mode(conn, smb_fname);
1965 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1966 if (fattr & aDIR) {
1967 close_file(req, fsp, ERROR_CLOSE);
1968 reply_doserror(req, ERRDOS, ERRnoaccess);
1969 goto out;
1970 }
1971
1972 /* If the caller set the extended oplock request bit
1973 and we granted one (by whatever means) - set the
1974 correct bit for extended oplock reply.
1975 */
1976
1977 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1978 smb_action |= EXTENDED_OPLOCK_GRANTED;
1979 }
1980
1981 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1982 smb_action |= EXTENDED_OPLOCK_GRANTED;
1983 }
1984
1985 /* If the caller set the core oplock request bit
1986 and we granted one (by whatever means) - set the
1987 correct bit for core oplock reply.
1988 */
1989
1990 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1991 reply_outbuf(req, 19, 0);
1992 } else {
1993 reply_outbuf(req, 15, 0);
1994 }
1995
1996 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1997 SCVAL(req->outbuf, smb_flg,
1998 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1999 }
2000
2001 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2002 SCVAL(req->outbuf, smb_flg,
2003 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2004 }
2005
2006 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2007 SSVAL(req->outbuf,smb_vwv3,fattr);
2008 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2009 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2010 } else {
2011 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2012 }
2013 SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2014 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2015 SSVAL(req->outbuf,smb_vwv11,smb_action);
2016
2017 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2018 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2019 }
2020
2021 chain_reply(req);
2022 out:
2023 TALLOC_FREE(smb_fname);
2024 END_PROFILE(SMBopenX);
2025 return;
2026 }
2027
2028 /****************************************************************************
2029 Reply to a SMBulogoffX.
2030 ****************************************************************************/
2031
2032 void reply_ulogoffX(struct smb_request *req)
2033 {
2034 struct smbd_server_connection *sconn = smbd_server_conn;
2035 user_struct *vuser;
2036
2037 START_PROFILE(SMBulogoffX);
2038
2039 vuser = get_valid_user_struct(sconn, req->vuid);
2040
2041 if(vuser == NULL) {
2042 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2043 req->vuid));
2044 }
2045
2046 /* in user level security we are supposed to close any files
2047 open by this user */
2048 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2049 file_close_user(req->vuid);
2050 }
2051
2052 invalidate_vuid(sconn, req->vuid);
2053
2054 reply_outbuf(req, 2, 0);
2055
2056 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2057
2058 END_PROFILE(SMBulogoffX);
2059 req->vuid = UID_FIELD_INVALID;
2060 chain_reply(req);
2061 }
2062
2063 /****************************************************************************
2064 Reply to a mknew or a create.
2065 ****************************************************************************/
2066
2067 void reply_mknew(struct smb_request *req)
2068 {
2069 connection_struct *conn = req->conn;
2070 struct smb_filename *smb_fname = NULL;
2071 char *fname = NULL;
2072 uint32 fattr = 0;
2073 struct smb_file_time ft;
2074 files_struct *fsp;
2075 int oplock_request = 0;
2076 NTSTATUS status;
2077 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2078 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2079 uint32 create_disposition;
2080 uint32 create_options = 0;
2081 TALLOC_CTX *ctx = talloc_tos();
2082
2083 START_PROFILE(SMBcreate);
2084 ZERO_STRUCT(ft);
2085
2086 if (req->wct < 3) {
2087 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2088 goto out;
2089 }
2090
2091 fattr = SVAL(req->vwv+0, 0);
2092 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2093
2094 /* mtime. */
2095 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2096
2097 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2098 STR_TERMINATE, &status);
2099 if (!NT_STATUS_IS_OK(status)) {
2100 reply_nterror(req, status);
2101 goto out;
2102 }
2103
2104 status = filename_convert(ctx,
2105 conn,
2106 req->flags2 & FLAGS2_DFS_PATHNAMES,
2107 fname,
2108 0,
2109 NULL,
2110 &smb_fname);
2111 if (!NT_STATUS_IS_OK(status)) {
2112 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2113 reply_botherror(req,
2114 NT_STATUS_PATH_NOT_COVERED,
2115 ERRSRV, ERRbadpath);
2116 goto out;
2117 }
2118 reply_nterror(req, status);
2119 goto out;
2120 }
2121
2122 if (fattr & aVOLID) {
2123 DEBUG(0,("Attempt to create file (%s) with volid set - "
2124 "please report this\n",
2125 smb_fname_str_dbg(smb_fname)));
2126 }
2127
2128 if(req->cmd == SMBmknew) {
2129 /* We should fail if file exists. */
2130 create_disposition = FILE_CREATE;
2131 } else {
2132 /* Create if file doesn't exist, truncate if it does. */
2133 create_disposition = FILE_OVERWRITE_IF;
2134 }
2135
2136 status = SMB_VFS_CREATE_FILE(
2137 conn, /* conn */
2138 req, /* req */
2139 0, /* root_dir_fid */
2140 smb_fname, /* fname */
2141 access_mask, /* access_mask */
2142 share_mode, /* share_access */
2143 create_disposition, /* create_disposition*/
2144 create_options, /* create_options */
2145 fattr, /* file_attributes */
2146 oplock_request, /* oplock_request */
2147 0, /* allocation_size */
2148 NULL, /* sd */
2149 NULL, /* ea_list */
2150 &fsp, /* result */
2151 NULL); /* pinfo */
2152
2153 if (!NT_STATUS_IS_OK(status)) {
2154 if (open_was_deferred(req->mid)) {
2155 /* We have re-scheduled this call. */
2156 goto out;
2157 }
2158 reply_openerror(req, status);
2159 goto out;
2160 }
2161
2162 ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2163 status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2164 if (!NT_STATUS_IS_OK(status)) {
2165 END_PROFILE(SMBcreate);
2166 goto out;
2167 }
2168
2169 reply_outbuf(req, 1, 0);
2170 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2171
2172 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2173 SCVAL(req->outbuf,smb_flg,
2174 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2175 }
2176
2177 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2178 SCVAL(req->outbuf,smb_flg,
2179 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2180 }
2181
2182 DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2183 DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2184 smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2185 (unsigned int)fattr));
2186
2187 out:
2188 TALLOC_FREE(smb_fname);
2189 END_PROFILE(SMBcreate);
2190 return;
2191 }
2192
2193 /****************************************************************************
2194 Reply to a create temporary file.
2195 ****************************************************************************/
2196
2197 void reply_ctemp(struct smb_request *req)
2198 {
2199 connection_struct *conn = req->conn;
2200 struct smb_filename *smb_fname = NULL;
2201 char *fname = NULL;
2202 uint32 fattr;
2203 files_struct *fsp;
2204 int oplock_request;
2205 int tmpfd;
2206 char *s;
2207 NTSTATUS status;
2208 TALLOC_CTX *ctx = talloc_tos();
2209
2210 START_PROFILE(SMBctemp);
2211
2212 if (req->wct < 3) {
2213 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2214 goto out;
2215 }
2216
2217 fattr = SVAL(req->vwv+0, 0);
2218 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2219
2220 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2221 STR_TERMINATE, &status);
2222 if (!NT_STATUS_IS_OK(status)) {
2223 reply_nterror(req, status);
2224 goto out;
2225 }
2226 if (*fname) {
2227 fname = talloc_asprintf(ctx,
2228 "%s/TMXXXXXX",
2229 fname);
2230 } else {
2231 fname = talloc_strdup(ctx, "TMXXXXXX");
2232 }
2233
2234 if (!fname) {
2235 reply_nterror(req, NT_STATUS_NO_MEMORY);
2236 goto out;
2237 }
2238
2239 status = filename_convert(ctx, conn,
2240 req->flags2 & FLAGS2_DFS_PATHNAMES,
2241 fname,
2242 0,
2243 NULL,
2244 &smb_fname);
2245 if (!NT_STATUS_IS_OK(status)) {
2246 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2247 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2248 ERRSRV, ERRbadpath);
2249 goto out;
2250 }
2251 reply_nterror(req, status);
2252 goto out;
2253 }
2254
2255 tmpfd = mkstemp(smb_fname->base_name);
2256 if (tmpfd == -1) {
2257 reply_nterror(req, map_nt_error_from_unix(errno));
2258 goto out;
2259 }
2260
2261 SMB_VFS_STAT(conn, smb_fname);
2262
2263 /* We should fail if file does not exist. */
2264 status = SMB_VFS_CREATE_FILE(
2265 conn, /* conn */
2266 req, /* req */
2267 0, /* root_dir_fid */
2268 smb_fname, /* fname */
2269 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2270 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2271 FILE_OPEN, /* create_disposition*/
2272 0, /* create_options */
2273 fattr, /* file_attributes */
2274 oplock_request, /* oplock_request */
2275 0, /* allocation_size */
2276 NULL, /* sd */
2277 NULL, /* ea_list */
2278 &fsp, /* result */
2279 NULL); /* pinfo */
2280
2281 /* close fd from mkstemp() */
2282 close(tmpfd);
2283
2284 if (!NT_STATUS_IS_OK(status)) {
2285 if (open_was_deferred(req->mid)) {
2286 /* We have re-scheduled this call. */
2287 goto out;
2288 }
2289 reply_openerror(req, status);
2290 goto out;
2291 }
2292
2293 reply_outbuf(req, 1, 0);
2294 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2295
2296 /* the returned filename is relative to the directory */
2297 s = strrchr_m(fsp->fsp_name->base_name, '/');
2298 if (!s) {
2299 s = fsp->fsp_name->base_name;
2300 } else {
2301 s++;
2302 }
2303
2304 #if 0
2305 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2306 thing in the byte section. JRA */
2307 SSVALS(p, 0, -1); /* what is this? not in spec */
2308 #endif
2309 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2310 == -1) {
2311 reply_nterror(req, NT_STATUS_NO_MEMORY);
2312 goto out;
2313 }
2314
2315 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2316 SCVAL(req->outbuf, smb_flg,
2317 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2318 }
2319
2320 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2321 SCVAL(req->outbuf, smb_flg,
2322 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2323 }
2324
2325 DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2326 DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2327 fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2328 out:
2329 TALLOC_FREE(smb_fname);
2330 END_PROFILE(SMBctemp);
2331 return;
2332 }
2333
2334 /*******************************************************************
2335 Check if a user is allowed to rename a file.
2336 ********************************************************************/
2337
2338 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2339 uint16 dirtype, SMB_STRUCT_STAT *pst)
2340 {
2341 uint32 fmode;
2342
2343 if (!CAN_WRITE(conn)) {
2344 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2345 }
2346
2347 fmode = dos_mode(conn, fsp->fsp_name);
2348 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2349 return NT_STATUS_NO_SUCH_FILE;
2350 }
2351
2352 if (S_ISDIR(pst->st_ex_mode)) {
2353 if (fsp->posix_open) {
2354 return NT_STATUS_OK;
2355 }
2356
2357 /* If no pathnames are open below this
2358 directory, allow the rename. */
2359
2360 if (file_find_subpath(fsp)) {
2361 return NT_STATUS_ACCESS_DENIED;
2362 }
2363 return NT_STATUS_OK;
2364 }
2365
2366 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2367 return NT_STATUS_OK;
2368 }
2369
2370 return NT_STATUS_ACCESS_DENIED;
2371 }
2372
2373 /*******************************************************************
2374 * unlink a file with all relevant access checks
2375 *******************************************************************/
2376
2377 static NTSTATUS do_unlink(connection_struct *conn,
2378 struct smb_request *req,
2379 struct smb_filename *smb_fname,
2380 uint32 dirtype)
2381 {
2382 uint32 fattr;
2383 files_struct *fsp;
2384 uint32 dirtype_orig = dirtype;
2385 NTSTATUS status;
2386 int ret;
2387 bool posix_paths = lp_posix_pathnames();
2388
2389 DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2390 smb_fname_str_dbg(smb_fname),
2391 dirtype));
2392
2393 if (!CAN_WRITE(conn)) {
2394 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2395 }
2396
2397 if (posix_paths) {
2398 ret = SMB_VFS_LSTAT(conn, smb_fname);
2399 } else {
2400 ret = SMB_VFS_LSTAT(conn, smb_fname);
2401 }
2402 if (ret != 0) {
2403 return map_nt_error_from_unix(errno);
2404 }
2405
2406 fattr = dos_mode(conn, smb_fname);
2407
2408 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2409 dirtype = aDIR|aARCH|aRONLY;
2410 }
2411
2412 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2413 if (!dirtype) {
2414 return NT_STATUS_NO_SUCH_FILE;
2415 }
2416
2417 if (!dir_check_ftype(conn, fattr, dirtype)) {
2418 if (fattr & aDIR) {
2419 return NT_STATUS_FILE_IS_A_DIRECTORY;
2420 }
2421 return NT_STATUS_NO_SUCH_FILE;
2422 }
2423
2424 if (dirtype_orig & 0x8000) {
2425 /* These will never be set for POSIX. */
2426 return NT_STATUS_NO_SUCH_FILE;
2427 }
2428
2429 #if 0
2430 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2431 return NT_STATUS_FILE_IS_A_DIRECTORY;
2432 }
2433
2434 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2435 return NT_STATUS_NO_SUCH_FILE;
2436 }
2437
2438 if (dirtype & 0xFF00) {
2439 /* These will never be set for POSIX. */
2440 return NT_STATUS_NO_SUCH_FILE;
2441 }
2442
2443 dirtype &= 0xFF;
2444 if (!dirtype) {
2445 return NT_STATUS_NO_SUCH_FILE;
2446 }
2447
2448 /* Can't delete a directory. */
2449 if (fattr & aDIR) {
2450 return NT_STATUS_FILE_IS_A_DIRECTORY;
2451 }
2452 #endif
2453
2454 #if 0 /* JRATEST */
2455 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2456 return NT_STATUS_OBJECT_NAME_INVALID;
2457 #endif /* JRATEST */
2458
2459 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2460
2461 On a Windows share, a file with read-only dosmode can be opened with
2462 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2463 fails with NT_STATUS_CANNOT_DELETE error.
2464
2465 This semantic causes a problem that a user can not
2466 rename a file with read-only dosmode on a Samba share
2467 from a Windows command prompt (i.e. cmd.exe, but can rename
2468 from Windows Explorer).
2469 */
2470
2471 if (!lp_delete_readonly(SNUM(conn))) {
2472 if (fattr & aRONLY) {
2473 return NT_STATUS_CANNOT_DELETE;
2474 }
2475 }
2476
2477 /* On open checks the open itself will check the share mode, so
2478 don't do it here as we'll get it wrong. */
2479
2480 status = SMB_VFS_CREATE_FILE
2481 (conn, /* conn */
2482 req, /* req */
2483 0, /* root_dir_fid */
2484 smb_fname, /* fname */
2485 DELETE_ACCESS, /* access_mask */
2486 FILE_SHARE_NONE, /* share_access */
2487 FILE_OPEN, /* create_disposition*/
2488 FILE_NON_DIRECTORY_FILE, /* create_options */
2489 /* file_attributes */
2490 posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2491 FILE_ATTRIBUTE_NORMAL,
2492 0, /* oplock_request */
2493 0, /* allocation_size */
2494 NULL, /* sd */
2495 NULL, /* ea_list */
2496 &fsp, /* result */
2497 NULL); /* pinfo */
2498
2499 if (!NT_STATUS_IS_OK(status)) {
2500 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2501 nt_errstr(status)));
2502 return status;
2503 }
2504
2505 /* The set is across all open files on this dev/inode pair. */
2506 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2507 close_file(req, fsp, NORMAL_CLOSE);
2508 return NT_STATUS_ACCESS_DENIED;
2509 }
2510
2511 return close_file(req, fsp, NORMAL_CLOSE);
2512 }
2513
2514 /****************************************************************************
2515 The guts of the unlink command, split out so it may be called by the NT SMB
2516 code.
2517 ****************************************************************************/
2518
2519 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2520 uint32 dirtype, struct smb_filename *smb_fname,
2521 bool has_wild)
2522 {
2523 char *fname_dir = NULL;
2524 char *fname_mask = NULL;
2525 int count=0;
2526 NTSTATUS status = NT_STATUS_OK;
2527 TALLOC_CTX *ctx = talloc_tos();
2528
2529 /* Split up the directory from the filename/mask. */
2530 status = split_fname_dir_mask(ctx, smb_fname->base_name,
2531 &fname_dir, &fname_mask);
2532 if (!NT_STATUS_IS_OK(status)) {
2533 goto out;
2534 }
2535
2536 /*
2537 * We should only check the mangled cache
2538 * here if unix_convert failed. This means
2539 * that the path in 'mask' doesn't exist
2540 * on the file system and so we need to look
2541 * for a possible mangle. This patch from
2542 * Tine Smukavec <valentin.smukavec@hermes.si>.
2543 */
2544
2545 if (!VALID_STAT(smb_fname->st) &&
2546 mangle_is_mangled(fname_mask, conn->params)) {
2547 char *new_mask = NULL;
2548 mangle_lookup_name_from_8_3(ctx, fname_mask,
2549 &new_mask, conn->params);
2550 if (new_mask) {
2551 TALLOC_FREE(fname_mask);
2552 fname_mask = new_mask;
2553 }
2554 }
2555
2556 if (!has_wild) {
2557
2558 /*
2559 * Only one file needs to be unlinked. Append the mask back
2560 * onto the directory.
2561 */
2562 TALLOC_FREE(smb_fname->base_name);
2563 smb_fname->base_name = talloc_asprintf(smb_fname,
2564 "%s/%s",
2565 fname_dir,
2566 fname_mask);
2567 if (!smb_fname->base_name) {
2568 status = NT_STATUS_NO_MEMORY;
2569 goto out;
2570 }
2571 if (dirtype == 0) {
2572 dirtype = FILE_ATTRIBUTE_NORMAL;
2573 }
2574
2575 status = check_name(conn, smb_fname->base_name);
2576 if (!NT_STATUS_IS_OK(status)) {
2577 goto out;
2578 }
2579
2580 status = do_unlink(conn, req, smb_fname, dirtype);
2581 if (!NT_STATUS_IS_OK(status)) {
2582 goto out;
2583 }
2584
2585 count++;
2586 } else {
2587 struct smb_Dir *dir_hnd = NULL;
2588 long offset = 0;
2589 char *dname = NULL;
2590
2591 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2592 status = NT_STATUS_OBJECT_NAME_INVALID;
2593 goto out;
2594 }
2595
2596 if (strequal(fname_mask,"????????.???")) {
2597 TALLOC_FREE(fname_mask);
2598 fname_mask = talloc_strdup(ctx, "*");
2599 if (!fname_mask) {
2600 status = NT_STATUS_NO_MEMORY;
2601 goto out;
2602 }
2603 }
2604
2605 status = check_name(conn, fname_dir);
2606 if (!NT_STATUS_IS_OK(status)) {
2607 goto out;
2608 }
2609
2610 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2611 dirtype);
2612 if (dir_hnd == NULL) {
2613 status = map_nt_error_from_unix(errno);
2614 goto out;
2615 }
2616
2617 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2618 the pattern matches against the long name, otherwise the short name
2619 We don't implement this yet XXXX
2620 */
2621
2622 status = NT_STATUS_NO_SUCH_FILE;
2623
2624 while ((dname = ReadDirName(dir_hnd, &offset,
2625 &smb_fname->st))) {
2626 TALLOC_CTX *frame = talloc_stackframe();
2627
2628 if (!is_visible_file(conn, fname_dir, dname,
2629 &smb_fname->st, true)) {
2630 TALLOC_FREE(frame);
2631 TALLOC_FREE(dname);
2632 continue;
2633 }
2634
2635 /* Quick check for "." and ".." */
2636 if (ISDOT(dname) || ISDOTDOT(dname)) {
2637 TALLOC_FREE(frame);
2638 TALLOC_FREE(dname);
2639 continue;
2640 }
2641
2642 if(!mask_match(dname, fname_mask,
2643 conn->case_sensitive)) {
2644 TALLOC_FREE(frame);
2645 TALLOC_FREE(dname);
2646 continue;
2647 }
2648
2649 TALLOC_FREE(smb_fname->base_name);
2650 smb_fname->base_name =
2651 talloc_asprintf(smb_fname, "%s/%s",
2652 fname_dir, dname);
2653
2654 if (!smb_fname->base_name) {
2655 TALLOC_FREE(dir_hnd);
2656 status = NT_STATUS_NO_MEMORY;
2657 TALLOC_FREE(frame);
2658 TALLOC_FREE(dname);
2659 goto out;
2660 }
2661
2662 status = check_name(conn, smb_fname->base_name);
2663 if (!NT_STATUS_IS_OK(status)) {
2664 TALLOC_FREE(dir_hnd);
2665 TALLOC_FREE(frame);
2666 TALLOC_FREE(dname);
2667 goto out;
2668 }
2669
2670 status = do_unlink(conn, req, smb_fname, dirtype);
2671 if (!NT_STATUS_IS_OK(status)) {
2672 TALLOC_FREE(frame);
2673 TALLOC_FREE(dname);
2674 continue;
2675 }
2676
2677 count++;
2678 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2679 smb_fname->base_name));
2680
2681 TALLOC_FREE(frame);
2682 TALLOC_FREE(dname);
2683 }
2684 TALLOC_FREE(dir_hnd);
2685 }
2686
2687 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2688 status = map_nt_error_from_unix(errno);
2689 }
2690
2691 out:
2692 TALLOC_FREE(fname_dir);
2693 TALLOC_FREE(fname_mask);
2694 return status;
2695 }
2696
2697 /****************************************************************************
2698 Reply to a unlink
2699 ****************************************************************************/
2700
2701 void reply_unlink(struct smb_request *req)
2702 {
2703 connection_struct *conn = req->conn;
2704 char *name = NULL;
2705 struct smb_filename *smb_fname = NULL;
2706 uint32 dirtype;
2707 NTSTATUS status;
2708 bool path_contains_wcard = False;
2709 TALLOC_CTX *ctx = talloc_tos();
2710
2711 START_PROFILE(SMBunlink);
2712
2713 if (req->wct < 1) {
2714 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2715 goto out;
2716 }
2717
2718 dirtype = SVAL(req->vwv+0, 0);
2719
2720 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2721 STR_TERMINATE, &status,
2722 &path_contains_wcard);
2723 if (!NT_STATUS_IS_OK(status)) {
2724 reply_nterror(req, status);
2725 goto out;
2726 }
2727
2728 status = filename_convert(ctx, conn,
2729 req->flags2 & FLAGS2_DFS_PATHNAMES,
2730 name,
2731 UCF_COND_ALLOW_WCARD_LCOMP,
2732 &path_contains_wcard,
2733 &smb_fname);
2734 if (!NT_STATUS_IS_OK(status)) {
2735 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2736 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2737 ERRSRV, ERRbadpath);
2738 goto out;
2739 }
2740 reply_nterror(req, status);
2741 goto out;
2742 }
2743
2744 DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2745
2746 status = unlink_internals(conn, req, dirtype, smb_fname,
2747 path_contains_wcard);
2748 if (!NT_STATUS_IS_OK(status)) {
2749 if (open_was_deferred(req->mid)) {
2750 /* We have re-scheduled this call. */
2751 goto out;
2752 }
2753 reply_nterror(req, status);
2754 goto out;
2755 }
2756
2757 reply_outbuf(req, 0, 0);
2758 out:
2759 TALLOC_FREE(smb_fname);
2760 END_PROFILE(SMBunlink);
2761 return;
2762 }
2763
2764 /****************************************************************************
2765 Fail for readbraw.
2766 ****************************************************************************/
2767
2768 static void fail_readraw(void)
2769 {
2770 const char *errstr = talloc_asprintf(talloc_tos(),
2771 "FAIL ! reply_readbraw: socket write fail (%s)",
2772 strerror(errno));
2773 if (!errstr) {
2774 errstr = "";
2775 }
2776 exit_server_cleanly(errstr);
2777 }
2778
2779 /****************************************************************************
2780 Fake (read/write) sendfile. Returns -1 on read or write fail.
2781 ****************************************************************************/
2782
2783 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2784 size_t nread)
2785 {
2786 size_t bufsize;
2787 size_t tosend = nread;
2788 char *buf;
2789
2790 if (nread == 0) {
2791 return 0;
2792 }
2793
2794 bufsize = MIN(nread, 65536);
2795
2796 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2797 return -1;
2798 }
2799
2800 while (tosend > 0) {
2801 ssize_t ret;
2802 size_t cur_read;
2803
2804 if (tosend > bufsize) {
2805 cur_read = bufsize;
2806 } else {
2807 cur_read = tosend;
2808 }
2809 ret = read_file(fsp,buf,startpos,cur_read);
2810 if (ret == -1) {
2811 SAFE_FREE(buf);
2812 return -1;
2813 }
2814
2815 /* If we had a short read, fill with zeros. */
2816 if (ret < cur_read) {
2817 memset(buf + ret, '\0', cur_read - ret);
2818 }
2819
2820 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2821 SAFE_FREE(buf);
2822 return -1;
2823 }
2824 tosend -= cur_read;
2825 startpos += cur_read;
2826 }
2827
2828 SAFE_FREE(buf);
2829 return (ssize_t)nread;
2830 }
2831
2832 #if defined(WITH_SENDFILE)
2833 /****************************************************************************
2834 Deal with the case of sendfile reading less bytes from the file than
2835 requested. Fill with zeros (all we can do).
2836 ****************************************************************************/
2837
2838 static void sendfile_short_send(files_struct *fsp,
2839 ssize_t nread,
2840 size_t headersize,
2841 size_t smb_maxcnt)
2842 {
2843 #define SHORT_SEND_BUFSIZE 1024
2844 if (nread < headersize) {
2845 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2846 "header for file %s (%s). Terminating\n",
2847 fsp_str_dbg(fsp), strerror(errno)));
2848 exit_server_cleanly("sendfile_short_send failed");
2849 }
2850
2851 nread -= headersize;
2852
2853 if (nread < smb_maxcnt) {
2854 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2855 if (!buf) {
2856 exit_server_cleanly("sendfile_short_send: "
2857 "malloc failed");
2858 }
2859
2860 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2861 "with zeros !\n", fsp_str_dbg(fsp)));
2862
2863 while (nread < smb_maxcnt) {
2864 /*
2865 * We asked for the real file size and told sendfile
2866 * to not go beyond the end of the file. But it can
2867 * happen that in between our fstat call and the
2868 * sendfile call the file was truncated. This is very
2869 * bad because we have already announced the larger
2870 * number of bytes to the client.
2871 *
2872 * The best we can do now is to send 0-bytes, just as
2873 * a read from a hole in a sparse file would do.
2874 *
2875 * This should happen rarely enough that I don't care
2876 * about efficiency here :-)
2877 */
2878 size_t to_write;
2879
2880 to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2881 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2882 exit_server_cleanly("sendfile_short_send: "
2883 "write_data failed");
2884 }
2885 nread += to_write;
2886 }
2887 SAFE_FREE(buf);
2888 }
2889 }
2890 #endif /* defined WITH_SENDFILE */
2891
2892 /****************************************************************************
2893 Return a readbraw error (4 bytes of zero).
2894 ****************************************************************************/
2895
2896 static void reply_readbraw_error(void)
2897 {
2898 char header[4];
2899 SIVAL(header,0,0);
2900 if (write_data(smbd_server_fd(),header,4) != 4) {
2901 fail_readraw();
2902 }
2903 }
2904
2905 /****************************************************************************
2906 Use sendfile in readbraw.
2907 ****************************************************************************/
2908
2909 static void send_file_readbraw(connection_struct *conn,
2910 struct smb_request *req,
2911 files_struct *fsp,
2912 SMB_OFF_T startpos,
2913 size_t nread,
2914 ssize_t mincount)
2915 {
2916 char *outbuf = NULL;
2917 ssize_t ret=0;
2918
2919 #if defined(WITH_SENDFILE)
2920 /*
2921 * We can only use sendfile on a non-chained packet
2922 * but we can use on a non-oplocked file. tridge proved this
2923 * on a train in Germany :-). JRA.
2924 * reply_readbraw has already checked the length.
2925 */
2926
2927 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2928 (fsp->wcp == NULL) &&
2929 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2930 ssize_t sendfile_read = -1;
2931 char header[4];
2932 DATA_BLOB header_blob;
2933
2934 _smb_setlen(header,nread);
2935 header_blob = data_blob_const(header, 4);
2936
2937 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2938 &header_blob, startpos, nread)) == -1) {
2939 /* Returning ENOSYS means no data at all was sent.
2940 * Do this as a normal read. */
2941 if (errno == ENOSYS) {
2942 goto normal_readbraw;
2943 }
2944
2945 /*
2946 * Special hack for broken Linux with no working sendfile. If we
2947 * return EINTR we sent the header but not the rest of the data.
2948 * Fake this up by doing read/write calls.
2949 */
2950 if (errno == EINTR) {
2951 /* Ensure we don't do this again. */
2952 set_use_sendfile(SNUM(conn), False);
2953 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2954
2955 if (fake_sendfile(fsp, startpos, nread) == -1) {
2956 DEBUG(0,("send_file_readbraw: "
2957 "fake_sendfile failed for "
2958 "file %s (%s).\n",
2959 fsp_str_dbg(fsp),
2960 strerror(errno)));
2961 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2962 }
2963 return;
2964 }
2965
2966 DEBUG(0,("send_file_readbraw: sendfile failed for "
2967 "file %s (%s). Terminating\n",
2968 fsp_str_dbg(fsp), strerror(errno)));
2969 exit_server_cleanly("send_file_readbraw sendfile failed");
2970 } else if (sendfile_read == 0) {
2971 /*
2972 * Some sendfile implementations return 0 to indicate
2973 * that there was a short read, but nothing was
2974 * actually written to the socket. In this case,
2975 * fallback to the normal read path so the header gets
2976 * the correct byte count.
2977 */
2978 DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2979 "bytes falling back to the normal read: "
2980 "%s\n", fsp_str_dbg(fsp)));
2981 goto normal_readbraw;
2982 }
2983
2984 /* Deal with possible short send. */
2985 if (sendfile_read != 4+nread) {
2986 sendfile_short_send(fsp, sendfile_read, 4, nread);
2987 }
2988 return;
2989 }
2990
2991 normal_readbraw:
2992 #endif
2993
2994 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2995 if (!outbuf) {
2996 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2997 (unsigned)(nread+4)));
2998 reply_readbraw_error();
2999 return;
3000 }
3001
3002 if (nread > 0) {
3003 ret = read_file(fsp,outbuf+4,startpos,nread);
3004 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3005 if (ret < mincount)
3006 ret = 0;
3007 #else
3008 if (ret < nread)
3009 ret = 0;
3010 #endif
3011 }
3012
3013 _smb_setlen(outbuf,ret);
3014 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3015 fail_readraw();
3016
3017 TALLOC_FREE(outbuf);
3018 }
3019
3020 /****************************************************************************
3021 Reply to a readbraw (core+ protocol).
3022 ****************************************************************************/
3023
3024 void reply_readbraw(struct smb_request *req)
3025 {
3026 connection_struct *conn = req->conn;
3027 ssize_t maxcount,mincount;
3028 size_t nread = 0;
3029 SMB_OFF_T startpos;
3030 files_struct *fsp;
3031 struct lock_struct lock;
3032 SMB_STRUCT_STAT st;
3033 SMB_OFF_T size = 0;
3034
3035 START_PROFILE(SMBreadbraw);
3036
3037 if (srv_is_signing_active(smbd_server_conn) ||
3038 is_encrypted_packet(req->inbuf)) {
3039 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3040 "raw reads/writes are disallowed.");
3041 }
3042
3043 if (req->wct < 8) {
3044 reply_readbraw_error();
3045 END_PROFILE(SMBreadbraw);
3046 return;
3047 }
3048
3049 /*
3050 * Special check if an oplock break has been issued
3051 * and the readraw request croses on the wire, we must
3052 * return a zero length response here.
3053 */
3054
3055 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3056
3057 /*
3058 * We have to do a check_fsp by hand here, as
3059 * we must always return 4 zero bytes on error,
3060 * not a NTSTATUS.
3061 */
3062
3063 if (!fsp || !conn || conn != fsp->conn ||
3064 req->vuid != fsp->vuid ||
3065 fsp->is_directory || fsp->fh->fd == -1) {
3066 /*
3067 * fsp could be NULL here so use the value from the packet. JRA.
3068 */
3069 DEBUG(3,("reply_readbraw: fnum %d not valid "
3070 "- cache prime?\n",
3071 (int)SVAL(req->vwv+0, 0)));
3072 reply_readbraw_error();
3073 END_PROFILE(SMBreadbraw);
3074 return;
3075 }
3076
3077 /* Do a "by hand" version of CHECK_READ. */
3078 if (!(fsp->can_read ||
3079 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3080 (fsp->access_mask & FILE_EXECUTE)))) {
3081 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3082 (int)SVAL(req->vwv+0, 0)));
3083 reply_readbraw_error();
3084 END_PROFILE(SMBreadbraw);
3085 return;
3086 }
3087
3088 flush_write_cache(fsp, READRAW_FLUSH);
3089
3090 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3091 if(req->wct == 10) {
3092 /*
3093 * This is a large offset (64 bit) read.
3094 */
3095 #ifdef LARGE_SMB_OFF_T
3096
3097 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3098
3099 #else /* !LARGE_SMB_OFF_T */
3100
3101 /*
3102 * Ensure we haven't been sent a >32 bit offset.
3103 */
3104
3105 if(IVAL(req->vwv+8, 0) != 0) {
3106 DEBUG(0,("reply_readbraw: large offset "
3107 "(%x << 32) used and we don't support "
3108 "64 bit offsets.\n",
3109 (unsigned int)IVAL(req->vwv+8, 0) ));
3110 reply_readbraw_error();
3111 END_PROFILE(SMBreadbraw);
3112 return;
3113 }
3114
3115 #endif /* LARGE_SMB_OFF_T */
3116
3117 if(startpos < 0) {
3118 DEBUG(0,("reply_readbraw: negative 64 bit "
3119 "readraw offset (%.0f) !\n",
3120 (double)startpos ));
3121 reply_readbraw_error();
3122 END_PROFILE(SMBreadbraw);
3123 return;
3124 }
3125 }
3126
3127 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3128 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3129
3130 /* ensure we don't overrun the packet size */
3131 maxcount = MIN(65535,maxcount);
3132
3133 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3134 (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3135 &lock);
3136
3137 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3138 reply_readbraw_error();
3139 END_PROFILE(SMBreadbraw);
3140 return;
3141 }
3142
3143 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3144 size = st.st_ex_size;
3145 }
3146
3147 if (startpos >= size) {
3148 nread = 0;
3149 } else {
3150 nread = MIN(maxcount,(size - startpos));
3151 }
3152
3153 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3154 if (nread < mincount)
3155 nread = 0;
3156 #endif
3157
3158 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3159 "min=%lu nread=%lu\n",
3160 fsp->fnum, (double)startpos,
3161 (unsigned long)maxcount,
3162 (unsigned long)mincount,
3163 (unsigned long)nread ) );
3164
3165 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3166
3167 DEBUG(5,("reply_readbraw finished\n"));
3168
3169 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3170
3171 END_PROFILE(SMBreadbraw);
3172 return;
3173 }
3174
3175 #undef DBGC_CLASS
3176 #define DBGC_CLASS DBGC_LOCKING
3177
3178 /****************************************************************************
3179 Reply to a lockread (core+ protocol).
3180 ****************************************************************************/
3181
3182 void reply_lockread(struct smb_request *req)
3183 {
3184 connection_struct *conn = req->conn;
3185 ssize_t nread = -1;
3186 char *data;
3187 SMB_OFF_T startpos;
3188 size_t numtoread;
3189 NTSTATUS status;
3190 files_struct *fsp;
3191 struct byte_range_lock *br_lck = NULL;
3192 char *p = NULL;
3193 struct smbd_server_connection *sconn = smbd_server_conn;
3194
3195 START_PROFILE(SMBlockread);
3196
3197 if (req->wct < 5) {
3198 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3199 END_PROFILE(SMBlockread);
3200 return;
3201 }
3202
3203 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3204
3205 if (!check_fsp(conn, req, fsp)) {
3206 END_PROFILE(SMBlockread);
3207 return;
3208 }
3209
3210 if (!CHECK_READ(fsp,req)) {
3211 reply_doserror(req, ERRDOS, ERRbadaccess);
3212 END_PROFILE(SMBlockread);
3213 return;
3214 }
3215
3216 numtoread = SVAL(req->vwv+1, 0);
3217 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3218
3219 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3220
3221 reply_outbuf(req, 5, numtoread + 3);
3222
3223 data = smb_buf(req->outbuf) + 3;
3224
3225 /*
3226 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3227 * protocol request that predates the read/write lock concept.
3228 * Thus instead of asking for a read lock here we need to ask
3229 * for a write lock. JRA.
3230 * Note that the requested lock size is unaffected by max_recv.
3231 */
3232
3233 br_lck = do_lock(smbd_messaging_context(),
3234 fsp,
3235 req->smbpid,
3236 (uint64_t)numtoread,
3237 (uint64_t)startpos,
3238 WRITE_LOCK,
3239 WINDOWS_LOCK,
3240 False, /* Non-blocking lock. */
3241 &status,
3242 NULL,
3243 NULL);
3244 TALLOC_FREE(br_lck);
3245
3246 if (NT_STATUS_V(status)) {
3247 reply_nterror(req, status);
3248 END_PROFILE(SMBlockread);
3249 return;
3250 }
3251
3252 /*
3253 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3254 */
3255
3256 if (numtoread > sconn->smb1.negprot.max_recv) {
3257 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3258 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3259 (unsigned int)numtoread,
3260 (unsigned int)sconn->smb1.negprot.max_recv));
3261 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3262 }
3263 nread = read_file(fsp,data,startpos,numtoread);
3264
3265 if (nread < 0) {
3266 reply_nterror(req, map_nt_error_from_unix(errno));
3267 END_PROFILE(SMBlockread);
3268 return;
3269 }
3270
3271 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3272
3273 SSVAL(req->outbuf,smb_vwv0,nread);
3274 SSVAL(req->outbuf,smb_vwv5,nread+3);
3275 p = smb_buf(req->outbuf);
3276 SCVAL(p,0,0); /* pad byte. */
3277 SSVAL(p,1,nread);
3278
3279 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3280 fsp->fnum, (int)numtoread, (int)nread));
3281
3282 END_PROFILE(SMBlockread);
3283 return;
3284 }
3285
3286 #undef DBGC_CLASS
3287 #define DBGC_CLASS DBGC_ALL
3288
3289 /****************************************************************************
3290 Reply to a read.
3291 ****************************************************************************/
3292
3293 void reply_read(struct smb_request *req)
3294 {
3295 connection_struct *conn = req->conn;
3296 size_t numtoread;
3297 ssize_t nread = 0;
3298 char *data;
3299 SMB_OFF_T startpos;
3300 int outsize = 0;
3301 files_struct *fsp;
3302 struct lock_struct lock;
3303 struct smbd_server_connection *sconn = smbd_server_conn;
3304
3305 START_PROFILE(SMBread);
3306
3307 if (req->wct < 3) {
3308 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3309 END_PROFILE(SMBread);
3310 return;
3311 }
3312
3313 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3314
3315 if (!check_fsp(conn, req, fsp)) {
3316 END_PROFILE(SMBread);
3317 return;
3318 }
3319
3320 if (!CHECK_READ(fsp,req)) {
3321 reply_doserror(req, ERRDOS, ERRbadaccess);
3322 END_PROFILE(SMBread);
3323 return;
3324 }
3325
3326 numtoread = SVAL(req->vwv+1, 0);
3327 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3328
3329 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3330
3331 /*
3332 * The requested read size cannot be greater than max_recv. JRA.
3333 */
3334 if (numtoread > sconn->smb1.negprot.max_recv) {
3335 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3336 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3337 (unsigned int)numtoread,
3338 (unsigned int)sconn->smb1.negprot.max_recv));
3339 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3340 }
3341
3342 reply_outbuf(req, 5, numtoread+3);
3343
3344 data = smb_buf(req->outbuf) + 3;
3345
3346 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3347 (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3348 &lock);
3349
3350 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3351 reply_doserror(req, ERRDOS,ERRlock);
3352 END_PROFILE(SMBread);
3353 return;
3354 }
3355
3356 if (numtoread > 0)
3357 nread = read_file(fsp,data,startpos,numtoread);
3358
3359 if (nread < 0) {
3360 reply_nterror(req, map_nt_error_from_unix(errno));
3361 goto strict_unlock;
3362 }
3363
3364 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3365
3366 SSVAL(req->outbuf,smb_vwv0,nread);
3367 SSVAL(req->outbuf,smb_vwv5,nread+3);
3368 SCVAL(smb_buf(req->outbuf),0,1);
3369 SSVAL(smb_buf(req->outbuf),1,nread);
3370
3371 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3372 fsp->fnum, (int)numtoread, (int)nread ) );
3373
3374 strict_unlock:
3375 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3376
3377 END_PROFILE(SMBread);
3378 return;
3379 }
3380
3381 /****************************************************************************
3382 Setup readX header.
3383 ****************************************************************************/
3384
3385 static int setup_readX_header(struct smb_request *req, char *outbuf,
3386 size_t smb_maxcnt)
3387 {
3388 int outsize;
3389 char *data;
3390
3391 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3392 data = smb_buf(outbuf);
3393
3394 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3395
3396 SCVAL(outbuf,smb_vwv0,0xFF);
3397 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3398 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3399 SSVAL(outbuf,smb_vwv6,
3400 req_wct_ofs(req)
3401 + 1 /* the wct field */
3402 + 12 * sizeof(uint16_t) /* vwv */
3403 + 2); /* the buflen field */
3404 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3405 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3406 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3407 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3408 return outsize;
3409 }
3410
3411 /****************************************************************************
3412 Reply to a read and X - possibly using sendfile.
3413 ****************************************************************************/
3414
3415 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3416 files_struct *fsp, SMB_OFF_T startpos,
3417 size_t smb_maxcnt)
3418 {
3419 SMB_STRUCT_STAT sbuf;
3420 ssize_t nread = -1;
3421 struct lock_struct lock;
3422 int saved_errno = 0;
3423
3424 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3425 reply_nterror(req, map_nt_error_from_unix(errno));
3426 return;
3427 }
3428
3429 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3430 (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3431 &lock);
3432
3433 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3434 reply_doserror(req, ERRDOS, ERRlock);
3435 return;
3436 }
3437
3438 if (!S_ISREG(sbuf.st_ex_mode) || (startpos > sbuf.st_ex_size)
3439 || (smb_maxcnt > (sbuf.st_ex_size - startpos))) {
3440 /*
3441 * We already know that we would do a short read, so don't
3442 * try the sendfile() path.
3443 */
3444 goto nosendfile_read;
3445 }
3446
3447 #if defined(WITH_SENDFILE)
3448 /*
3449 * We can only use sendfile on a non-chained packet
3450 * but we can use on a non-oplocked file. tridge proved this
3451 * on a train in Germany :-). JRA.
3452 */
3453
3454 if (!req_is_in_chain(req) &&
3455 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3456 (fsp->wcp == NULL) &&
3457 lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3458 uint8 headerbuf[smb_size + 12 * 2];
3459 DATA_BLOB header;
3460
3461 /*
3462 * Set up the packet header before send. We
3463 * assume here the sendfile will work (get the
3464 * correct amount of data).
3465 */
3466
3467 header = data_blob_const(headerbuf, sizeof(headerbuf));
3468
3469 construct_reply_common_req(req, (char *)headerbuf);
3470 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3471
3472 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3473 /* Returning ENOSYS means no data at all was sent.
3474 Do this as a normal read. */
3475 if (errno == ENOSYS) {
3476 goto normal_read;
3477 }
3478
3479 /*
3480 * Special hack for broken Linux with no working sendfile. If we
3481 * return EINTR we sent the header but not the rest of the data.
3482 * Fake this up by doing read/write calls.
3483 */
3484
3485 if (errno == EINTR) {
3486 /* Ensure we don't do this again. */
3487 set_use_sendfile(SNUM(conn), False);
3488 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3489 nread = fake_sendfile(fsp, startpos,
3490 smb_maxcnt);
3491 if (nread == -1) {
3492 DEBUG(0,("send_file_readX: "
3493 "fake_sendfile failed for "
3494 "file %s (%s).\n",
3495 fsp_str_dbg(fsp),
3496 strerror(errno)));
3497 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3498 }
3499 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3500 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3501 /* No outbuf here means successful sendfile. */
3502 goto strict_unlock;
3503 }
3504
3505 DEBUG(0,("send_file_readX: sendfile failed for file "
3506 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3507 strerror(errno)));
3508 exit_server_cleanly("send_file_readX sendfile failed");
3509 } else if (nread == 0) {
3510 /*
3511 * Some sendfile implementations return 0 to indicate
3512 * that there was a short read, but nothing was
3513 * actually written to the socket. In this case,
3514 * fallback to the normal read path so the header gets
3515 * the correct byte count.
3516 */
3517 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3518 "falling back to the normal read: %s\n",
3519 fsp_str_dbg(fsp)));
3520 goto normal_read;
3521 }
3522
3523 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3524 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3525
3526 /* Deal with possible short send. */
3527 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3528 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3529 }
3530 /* No outbuf here means successful sendfile. */
3531 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3532 SMB_PERFCOUNT_END(&req->pcd);
3533 goto strict_unlock;
3534 }
3535
3536 normal_read:
3537
3538 #endif
3539
3540 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3541 uint8 headerbuf[smb_size + 2*12];
3542
3543 construct_reply_common_req(req, (char *)headerbuf);
3544 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3545
3546 /* Send out the header. */
3547 if (write_data(smbd_server_fd(), (char *)headerbuf,
3548 sizeof(headerbuf)) != sizeof(headerbuf)) {
3549 DEBUG(0,("send_file_readX: write_data failed for file "
3550 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3551 strerror(errno)));
3552 exit_server_cleanly("send_file_readX sendfile failed");
3553 }
3554 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3555 if (nread == -1) {
3556 DEBUG(0,("send_file_readX: fake_sendfile failed for "
3557 "file %s (%s).\n", fsp_str_dbg(fsp),
3558 strerror(errno)));
3559 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3560 }
3561 goto strict_unlock;
3562 }
3563
3564 nosendfile_read:
3565
3566 reply_outbuf(req, 12, smb_maxcnt);
3567
3568 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3569 saved_errno = errno;
3570
3571 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3572
3573 if (nread < 0) {
3574 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3575 return;
3576 }
3577
3578 setup_readX_header(req, (char *)req->outbuf, nread);
3579
3580 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3581 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3582
3583 chain_reply(req);
3584 return;
3585
3586 strict_unlock:
3587 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3588 TALLOC_FREE(req->outbuf);
3589 return;
3590 }
3591
3592 /****************************************************************************
3593 Reply to a read and X.
3594 ****************************************************************************/
3595
3596 void reply_read_and_X(struct smb_request *req)
3597 {
3598 connection_struct *conn = req->conn;
3599 files_struct *fsp;
3600 SMB_OFF_T startpos;
3601 size_t smb_maxcnt;
3602 bool big_readX = False;
3603 #if 0
3604 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3605 #endif
3606
3607 START_PROFILE(SMBreadX);
3608
3609 if ((req->wct != 10) && (req->wct != 12)) {
3610 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3611 return;
3612 }
3613
3614 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3615 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3616 smb_maxcnt = SVAL(req->vwv+5, 0);
3617
3618 /* If it's an IPC, pass off the pipe handler. */
3619 if (IS_IPC(conn)) {
3620 reply_pipe_read_and_X(req);
3621 END_PROFILE(SMBreadX);
3622 return;
3623 }
3624
3625 if (!check_fsp(conn, req, fsp)) {
3626 END_PROFILE(SMBreadX);
3627 return;
3628 }
3629
3630 if (!CHECK_READ(fsp,req)) {
3631 reply_doserror(req, ERRDOS,ERRbadaccess);
3632 END_PROFILE(SMBreadX);
3633 return;
3634 }
3635
3636 if (global_client_caps & CAP_LARGE_READX) {
3637 size_t upper_size = SVAL(req->vwv+7, 0);
3638 smb_maxcnt |= (upper_size<<16);
3639 if (upper_size > 1) {
3640 /* Can't do this on a chained packet. */
3641 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3642 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3643 END_PROFILE(SMBreadX);
3644 return;
3645 }
3646 /* We currently don't do this on signed or sealed data. */
3647 if (srv_is_signing_active(smbd_server_conn) ||
3648 is_encrypted_packet(req->inbuf)) {
3649 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3650 END_PROFILE(SMBreadX);
3651 return;
3652 }
3653 /* Is there room in the reply for this data ? */
3654 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3655 reply_nterror(req,
3656 NT_STATUS_INVALID_PARAMETER);
3657 END_PROFILE(SMBreadX);
3658 return;
3659 }
3660 big_readX = True;
3661 }
3662 }
3663
3664 if (req->wct == 12) {
3665 #ifdef LARGE_SMB_OFF_T
3666 /*
3667 * This is a large offset (64 bit) read.
3668 */
3669 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3670
3671 #else /* !LARGE_SMB_OFF_T */
3672
3673 /*
3674 * Ensure we haven't been sent a >32 bit offset.
3675 */
3676
3677 if(IVAL(req->vwv+10, 0) != 0) {
3678 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3679 "used and we don't support 64 bit offsets.\n",
3680 (unsigned int)IVAL(req->vwv+10, 0) ));
3681 END_PROFILE(SMBreadX);
3682 reply_doserror(req, ERRDOS, ERRbadaccess);
3683 return;
3684 }
3685
3686 #endif /* LARGE_SMB_OFF_T */
3687
3688 }
3689
3690 if (!big_readX &&
3691 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3692 goto out;
3693 }
3694
3695 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3696
3697 out:
3698 END_PROFILE(SMBreadX);
3699 return;
3700 }
3701
3702 /****************************************************************************
3703 Error replies to writebraw must have smb_wct == 1. Fix this up.
3704 ****************************************************************************/
3705
3706 void error_to_writebrawerr(struct smb_request *req)
3707 {
3708 uint8 *old_outbuf = req->outbuf;
3709
3710 reply_outbuf(req, 1, 0);
3711
3712 memcpy(req->outbuf, old_outbuf, smb_size);
3713 TALLOC_FREE(old_outbuf);
3714 }
3715
3716 /****************************************************************************
3717 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3718 ****************************************************************************/
3719
3720 void reply_writebraw(struct smb_request *req)
3721 {
3722 connection_struct *conn = req->conn;
3723 char *buf = NULL;
3724 ssize_t nwritten=0;
3725 ssize_t total_written=0;
3726 size_t numtowrite=0;
3727 size_t tcount;
3728 SMB_OFF_T startpos;
3729 char *data=NULL;
3730 bool write_through;
3731 files_struct *fsp;
3732 struct lock_struct lock;
3733 NTSTATUS status;
3734
3735 START_PROFILE(SMBwritebraw);
3736
3737 /*
3738 * If we ever reply with an error, it must have the SMB command
3739 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3740 * we're finished.
3741 */
3742 SCVAL(req->inbuf,smb_com,SMBwritec);
3743
3744 if (srv_is_signing_active(smbd_server_conn)) {
3745 END_PROFILE(SMBwritebraw);
3746 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3747 "raw reads/writes are disallowed.");
3748 }
3749
3750 if (req->wct < 12) {
3751 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3752 error_to_writebrawerr(req);
3753 END_PROFILE(SMBwritebraw);
3754 return;
3755 }
3756
3757 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3758 if (!check_fsp(conn, req, fsp)) {
3759 error_to_writebrawerr(req);
3760 END_PROFILE(SMBwritebraw);
3761 return;
3762 }
3763
3764 if (!CHECK_WRITE(fsp)) {
3765 reply_doserror(req, ERRDOS, ERRbadaccess);
3766 error_to_writebrawerr(req);
3767 END_PROFILE(SMBwritebraw);
3768 return;
3769 }
3770
3771 tcount = IVAL(req->vwv+1, 0);
3772 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3773 write_through = BITSETW(req->vwv+7,0);
3774
3775 /* We have to deal with slightly different formats depending
3776 on whether we are using the core+ or lanman1.0 protocol */
3777
3778 if(Protocol <= PROTOCOL_COREPLUS) {
3779 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3780 data = smb_buf(req->inbuf);
3781 } else {
3782 numtowrite = SVAL(req->vwv+10, 0);
3783 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3784 }
3785
3786 /* Ensure we don't write bytes past the end of this packet. */
3787 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3788 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3789 error_to_writebrawerr(req);
3790 END_PROFILE(SMBwritebraw);
3791 return;
3792 }
3793
3794 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3795 (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3796 &lock);
3797
3798 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3799 reply_doserror(req, ERRDOS, ERRlock);
3800 error_to_writebrawerr(req);
3801 END_PROFILE(SMBwritebraw);
3802 return;
3803 }
3804
3805 if (numtowrite>0) {
3806 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3807 }
3808
3809 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3810 "wrote=%d sync=%d\n",
3811 fsp->fnum, (double)startpos, (int)numtowrite,
3812 (int)nwritten, (int)write_through));
3813
3814 if (nwritten < (ssize_t)numtowrite) {
3815 reply_doserror(req, ERRHRD, ERRdiskfull);
3816 error_to_writebrawerr(req);
3817 goto strict_unlock;
3818 }
3819
3820 total_written = nwritten;
3821
3822 /* Allocate a buffer of 64k + length. */
3823 buf = TALLOC_ARRAY(NULL, char, 65540);
3824 if (!buf) {
3825 reply_doserror(req, ERRDOS, ERRnomem);
3826 error_to_writebrawerr(req);
3827 goto strict_unlock;
3828 }
3829
3830 /* Return a SMBwritebraw message to the redirector to tell
3831 * it to send more bytes */
3832
3833 memcpy(buf, req->inbuf, smb_size);
3834 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3835 SCVAL(buf,smb_com,SMBwritebraw);
3836 SSVALS(buf,smb_vwv0,0xFFFF);
3837 show_msg(buf);
3838 if (!srv_send_smb(smbd_server_fd(),
3839 buf,
3840 false, 0, /* no signing */
3841 IS_CONN_ENCRYPTED(conn),
3842 &req->pcd)) {
3843 exit_server_cleanly("reply_writebraw: srv_send_smb "
3844 "failed.");
3845 }
3846
3847 /* Now read the raw data into the buffer and write it */
3848 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3849 &numtowrite);
3850 if (!NT_STATUS_IS_OK(status)) {
3851 exit_server_cleanly("secondary writebraw failed");
3852 }
3853
3854 /* Set up outbuf to return the correct size */
3855 reply_outbuf(req, 1, 0);
3856
3857 if (numtowrite != 0) {
3858
3859 if (numtowrite > 0xFFFF) {
3860 DEBUG(0,("reply_writebraw: Oversize secondary write "
3861 "raw requested (%u). Terminating\n",
3862 (unsigned int)numtowrite ));
3863 exit_server_cleanly("secondary writebraw failed");
3864 }
3865
3866 if (tcount > nwritten+numtowrite) {
3867 DEBUG(3,("reply_writebraw: Client overestimated the "
3868 "write %d %d %d\n",
3869 (int)tcount,(int)nwritten,(int)numtowrite));
3870 }
3871
3872 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3873
3874 if (!NT_STATUS_IS_OK(status)) {
3875 DEBUG(0,("reply_writebraw: Oversize secondary write "
3876 "raw read failed (%s). Terminating\n",
3877 nt_errstr(status)));
3878 exit_server_cleanly("secondary writebraw failed");
3879 }
3880
3881 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3882 if (nwritten == -1) {
3883 TALLOC_FREE(buf);
3884 reply_nterror(req, map_nt_error_from_unix(errno));
3885 error_to_writebrawerr(req);
3886 goto strict_unlock;
3887 }
3888
3889 if (nwritten < (ssize_t)numtowrite) {
3890 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3891 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3892 }
3893
3894 if (nwritten > 0) {
3895 total_written += nwritten;
3896 }
3897 }
3898
3899 TALLOC_FREE(buf);
3900 SSVAL(req->outbuf,smb_vwv0,total_written);
3901
3902 status = sync_file(conn, fsp, write_through);
3903 if (!NT_STATUS_IS_OK(status)) {
3904 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3905 fsp_str_dbg(fsp), nt_errstr(status)));
3906 reply_nterror(req, status);
3907 error_to_writebrawerr(req);
3908 goto strict_unlock;
3909 }
3910
3911 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3912 "wrote=%d\n",
3913 fsp->fnum, (double)startpos, (int)numtowrite,
3914 (int)total_written));
3915
3916 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3917
3918 /* We won't return a status if write through is not selected - this
3919 * follows what WfWg does */
3920 END_PROFILE(SMBwritebraw);
3921
3922 if (!write_through && total_written==tcount) {
3923
3924 #if RABBIT_PELLET_FIX
3925 /*
3926 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3927 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3928 * JRA.
3929 */
3930 if (!send_keepalive(smbd_server_fd())) {
3931 exit_server_cleanly("reply_writebraw: send of "
3932 "keepalive failed");
3933 }
3934 #endif
3935 TALLOC_FREE(req->outbuf);
3936 }
3937 return;
3938
3939 strict_unlock:
3940 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3941
3942 END_PROFILE(SMBwritebraw);
3943 return;
3944 }
3945
3946 #undef DBGC_CLASS
3947 #define DBGC_CLASS DBGC_LOCKING
3948
3949 /****************************************************************************
3950 Reply to a writeunlock (core+).
3951 ****************************************************************************/
3952
3953 void reply_writeunlock(struct smb_request *req)
3954 {
3955 connection_struct *conn = req->conn;
3956 ssize_t nwritten = -1;
3957 size_t numtowrite;
3958 SMB_OFF_T startpos;
3959 const char *data;
3960 NTSTATUS status = NT_STATUS_OK;
3961 files_struct *fsp;
3962 struct lock_struct lock;
3963 int saved_errno = 0;
3964
3965 START_PROFILE(SMBwriteunlock);
3966
3967 if (req->wct < 5) {
3968 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3969 END_PROFILE(SMBwriteunlock);
3970 return;
3971 }
3972
3973 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3974
3975 if (!check_fsp(conn, req, fsp)) {
3976 END_PROFILE(SMBwriteunlock);
3977 return;
3978 }
3979
3980 if (!CHECK_WRITE(fsp)) {
3981 reply_doserror(req, ERRDOS,ERRbadaccess);
3982 END_PROFILE(SMBwriteunlock);
3983 return;
3984 }
3985
3986 numtowrite = SVAL(req->vwv+1, 0);
3987 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3988 data = (const char *)req->buf + 3;
3989
3990 if (numtowrite) {
3991 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3992 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3993 &lock);
3994
3995 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3996 reply_doserror(req, ERRDOS, ERRlock);
3997 END_PROFILE(SMBwriteunlock);
3998 return;
3999 }
4000 }
4001
4002 /* The special X/Open SMB protocol handling of
4003 zero length writes is *NOT* done for
4004 this call */
4005 if(numtowrite == 0) {
4006 nwritten = 0;
4007 } else {
4008 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4009 saved_errno = errno;
4010 }
4011
4012 status = sync_file(conn, fsp, False /* write through */);
4013 if (!NT_STATUS_IS_OK(status)) {
4014 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4015 fsp_str_dbg(fsp), nt_errstr(status)));
4016 reply_nterror(req, status);
4017 goto strict_unlock;
4018 }
4019
4020 if(nwritten < 0) {
4021 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4022 goto strict_unlock;
4023 }
4024
4025 if((nwritten < numtowrite) && (numtowrite != 0)) {
4026 reply_doserror(req, ERRHRD, ERRdiskfull);
4027 goto strict_unlock;
4028 }
4029
4030 if (numtowrite) {
4031 status = do_unlock(smbd_messaging_context(),
4032 fsp,
4033 req->smbpid,
4034 (uint64_t)numtowrite,
4035 (uint64_t)startpos,
4036 WINDOWS_LOCK);
4037
4038 if (NT_STATUS_V(status)) {
4039 reply_nterror(req, status);
4040 goto strict_unlock;
4041 }
4042 }
4043
4044 reply_outbuf(req, 1, 0);
4045
4046 SSVAL(req->outbuf,smb_vwv0,nwritten);
4047
4048 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4049 fsp->fnum, (int)numtowrite, (int)nwritten));
4050
4051 strict_unlock:
4052 if (numtowrite) {
4053 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4054 }
4055
4056 END_PROFILE(SMBwriteunlock);
4057 return;
4058 }
4059
4060 #undef DBGC_CLASS
4061 #define DBGC_CLASS DBGC_ALL
4062
4063 /****************************************************************************
4064 Reply to a write.
4065 ****************************************************************************/
4066
4067 void reply_write(struct smb_request *req)
4068 {
4069 connection_struct *conn = req->conn;
4070 size_t numtowrite;
4071 ssize_t nwritten = -1;
4072 SMB_OFF_T startpos;
4073 const char *data;
4074 files_struct *fsp;
4075 struct lock_struct lock;
4076 NTSTATUS status;
4077 int saved_errno = 0;
4078
4079 START_PROFILE(SMBwrite);
4080
4081 if (req->wct < 5) {
4082 END_PROFILE(SMBwrite);
4083 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4084 return;
4085 }
4086
4087 /* If it's an IPC, pass off the pipe handler. */
4088 if (IS_IPC(conn)) {
4089 reply_pipe_write(req);
4090 END_PROFILE(SMBwrite);
4091 return;
4092 }
4093
4094 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4095
4096 if (!check_fsp(conn, req, fsp)) {
4097 END_PROFILE(SMBwrite);
4098 return;
4099 }
4100
4101 if (!CHECK_WRITE(fsp)) {
4102 reply_doserror(req, ERRDOS, ERRbadaccess);
4103 END_PROFILE(SMBwrite);
4104 return;
4105 }
4106
4107 numtowrite = SVAL(req->vwv+1, 0);
4108 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4109 data = (const char *)req->buf + 3;
4110
4111 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4112 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4113 &lock);
4114
4115 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4116 reply_doserror(req, ERRDOS, ERRlock);
4117 END_PROFILE(SMBwrite);
4118 return;
4119 }
4120
4121 /*
4122 * X/Open SMB protocol says that if smb_vwv1 is
4123 * zero then the file size should be extended or
4124 * truncated to the size given in smb_vwv[2-3].
4125 */
4126
4127 if(numtowrite == 0) {
4128 /*
4129 * This is actually an allocate call, and set EOF. JRA.
4130 */
4131 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4132 if (nwritten < 0) {
4133 reply_nterror(req, NT_STATUS_DISK_FULL);
4134 goto strict_unlock;
4135 }
4136 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4137 if (nwritten < 0) {
4138 reply_nterror(req, NT_STATUS_DISK_FULL);
4139 goto strict_unlock;
4140 }
4141 trigger_write_time_update_immediate(fsp);
4142 } else {
4143 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4144 }
4145
4146 status = sync_file(conn, fsp, False);
4147 if (!NT_STATUS_IS_OK(status)) {
4148 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4149 fsp_str_dbg(fsp), nt_errstr(status)));
4150 reply_nterror(req, status);
4151 goto strict_unlock;
4152 }
4153
4154 if(nwritten < 0) {
4155 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4156 goto strict_unlock;
4157 }
4158
4159 if((nwritten == 0) && (numtowrite != 0)) {
4160 reply_doserror(req, ERRHRD, ERRdiskfull);
4161 goto strict_unlock;
4162 }
4163
4164 reply_outbuf(req, 1, 0);
4165
4166 SSVAL(req->outbuf,smb_vwv0,nwritten);
4167
4168 if (nwritten < (ssize_t)numtowrite) {
4169 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4170 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4171 }
4172
4173 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4174
4175 strict_unlock:
4176 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4177
4178 END_PROFILE(SMBwrite);
4179 return;
4180 }
4181
4182 /****************************************************************************
4183 Ensure a buffer is a valid writeX for recvfile purposes.
4184 ****************************************************************************/
4185
4186 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4187 (2*14) + /* word count (including bcc) */ \
4188 1 /* pad byte */)
4189
4190 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4191 {
4192 size_t numtowrite;
4193 connection_struct *conn = NULL;
4194 unsigned int doff = 0;
4195 size_t len = smb_len_large(inbuf);
4196 struct smbd_server_connection *sconn = smbd_server_conn;
4197
4198 if (is_encrypted_packet(inbuf)) {
4199 /* Can't do this on encrypted
4200 * connections. */
4201 return false;
4202 }
4203
4204 if (CVAL(inbuf,smb_com) != SMBwriteX) {
4205 return false;
4206 }
4207
4208 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4209 CVAL(inbuf,smb_wct) != 14) {
4210 DEBUG(10,("is_valid_writeX_buffer: chained or "
4211 "invalid word length.\n"));
4212 return false;
4213 }
4214
4215 conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4216 if (conn == NULL) {
4217 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4218 return false;
4219 }
4220 if (IS_IPC(conn)) {
4221 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4222 return false;
4223 }
4224 if (IS_PRINT(conn)) {
4225 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4226 return false;
4227 }
4228 doff = SVAL(inbuf,smb_vwv11);
4229
4230 numtowrite = SVAL(inbuf,smb_vwv10);
4231
4232 if (len > doff && len - doff > 0xFFFF) {
4233 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4234 }
4235
4236 if (numtowrite == 0) {
4237 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4238 return false;
4239 }
4240
4241 /* Ensure the sizes match up. */
4242 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4243 /* no pad byte...old smbclient :-( */
4244 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4245 (unsigned int)doff,
4246 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4247 return false;
4248 }
4249
4250 if (len - doff != numtowrite) {
4251 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4252 "len = %u, doff = %u, numtowrite = %u\n",
4253 (unsigned int)len,
4254 (unsigned int)doff,
4255 (unsigned int)numtowrite ));
4256 return false;
4257 }
4258
4259 DEBUG(10,("is_valid_writeX_buffer: true "
4260 "len = %u, doff = %u, numtowrite = %u\n",
4261 (unsigned int)len,
4262 (unsigned int)doff,
4263 (unsigned int)numtowrite ));
4264
4265 return true;
4266 }
4267
4268 /****************************************************************************
4269 Reply to a write and X.
4270 ****************************************************************************/
4271
4272 void reply_write_and_X(struct smb_request *req)
4273 {
4274 connection_struct *conn = req->conn;
4275 files_struct *fsp;
4276 struct lock_struct lock;
4277 SMB_OFF_T startpos;
4278 size_t numtowrite;
4279 bool write_through;
4280 ssize_t nwritten;
4281 unsigned int smb_doff;
4282 unsigned int smblen;
4283 char *data;
4284 NTSTATUS status;
4285
4286 START_PROFILE(SMBwriteX);
4287
4288 if ((req->wct != 12) && (req->wct != 14)) {
4289 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4290 END_PROFILE(SMBwriteX);
4291 return;
4292 }
4293
4294 numtowrite = SVAL(req->vwv+10, 0);
4295 smb_doff = SVAL(req->vwv+11, 0);
4296 smblen = smb_len(req->inbuf);
4297
4298 if (req->unread_bytes > 0xFFFF ||
4299 (smblen > smb_doff &&
4300 smblen - smb_doff > 0xFFFF)) {
4301 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4302 }
4303
4304 if (req->unread_bytes) {
4305 /* Can't do a recvfile write on IPC$ */
4306 if (IS_IPC(conn)) {
4307 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4308 END_PROFILE(SMBwriteX);
4309 return;
4310 }
4311 if (numtowrite != req->unread_bytes) {
4312 reply_doserror(req, ERRDOS, ERRbadmem);
4313 END_PROFILE(SMBwriteX);
4314 return;
4315 }
4316 } else {
4317 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4318 smb_doff + numtowrite > smblen) {
4319 reply_doserror(req, ERRDOS, ERRbadmem);
4320 END_PROFILE(SMBwriteX);
4321 return;
4322 }
4323 }
4324
4325 /* If it's an IPC, pass off the pipe handler. */
4326 if (IS_IPC(conn)) {
4327 if (req->unread_bytes) {
4328 reply_doserror(req, ERRDOS, ERRbadmem);
4329 END_PROFILE(SMBwriteX);
4330 return;
4331 }
4332 reply_pipe_write_and_X(req);
4333 END_PROFILE(SMBwriteX);
4334 return;
4335 }
4336
4337 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4338 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4339 write_through = BITSETW(req->vwv+7,0);
4340
4341 if (!check_fsp(conn, req, fsp)) {
4342 END_PROFILE(SMBwriteX);
4343 return;
4344 }
4345
4346 if (!CHECK_WRITE(fsp)) {
4347 reply_doserror(req, ERRDOS, ERRbadaccess);
4348 END_PROFILE(SMBwriteX);
4349 return;
4350 }
4351
4352 data = smb_base(req->inbuf) + smb_doff;
4353
4354 if(req->wct == 14) {
4355 #ifdef LARGE_SMB_OFF_T
4356 /*
4357 * This is a large offset (64 bit) write.
4358 */
4359 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4360
4361 #else /* !LARGE_SMB_OFF_T */
4362
4363 /*
4364 * Ensure we haven't been sent a >32 bit offset.
4365 */
4366
4367 if(IVAL(req->vwv+12, 0) != 0) {
4368 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4369 "used and we don't support 64 bit offsets.\n",
4370 (unsigned int)IVAL(req->vwv+12, 0) ));
4371 reply_doserror(req, ERRDOS, ERRbadaccess);
4372 END_PROFILE(SMBwriteX);
4373 return;
4374 }
4375
4376 #endif /* LARGE_SMB_OFF_T */
4377 }
4378
4379 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4380 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4381 &lock);
4382
4383 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4384 reply_doserror(req, ERRDOS, ERRlock);
4385 END_PROFILE(SMBwriteX);
4386 return;
4387 }
4388
4389 /* X/Open SMB protocol says that, unlike SMBwrite
4390 if the length is zero then NO truncation is
4391 done, just a write of zero. To truncate a file,
4392 use SMBwrite. */
4393
4394 if(numtowrite == 0) {
4395 nwritten = 0;
4396 } else {
4397
4398 if ((req->unread_bytes == 0) &&
4399 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4400 numtowrite)) {
4401 goto strict_unlock;
4402 }
4403
4404 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4405 }
4406
4407 if(nwritten < 0) {
4408 reply_nterror(req, map_nt_error_from_unix(errno));
4409 goto strict_unlock;
4410 }
4411
4412 if((nwritten == 0) && (numtowrite != 0)) {
4413 reply_doserror(req, ERRHRD, ERRdiskfull);
4414 goto strict_unlock;
4415 }
4416
4417 reply_outbuf(req, 6, 0);
4418 SSVAL(req->outbuf,smb_vwv2,nwritten);
4419 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4420
4421 if (nwritten < (ssize_t)numtowrite) {
4422 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4423 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4424 }
4425
4426 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4427 fsp->fnum, (int)numtowrite, (int)nwritten));
4428
4429 status = sync_file(conn, fsp, write_through);
4430 if (!NT_STATUS_IS_OK(status)) {
4431 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4432 fsp_str_dbg(fsp), nt_errstr(status)));
4433 reply_nterror(req, status);
4434 goto strict_unlock;
4435 }
4436
4437 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4438
4439 END_PROFILE(SMBwriteX);
4440 chain_reply(req);
4441 return;
4442
4443 strict_unlock:
4444 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4445
4446 END_PROFILE(SMBwriteX);
4447 return;
4448 }
4449
4450 /****************************************************************************
4451 Reply to a lseek.
4452 ****************************************************************************/
4453
4454 void reply_lseek(struct smb_request *req)
4455 {
4456 connection_struct *conn = req->conn;
4457 SMB_OFF_T startpos;
4458 SMB_OFF_T res= -1;
4459 int mode,umode;
4460 files_struct *fsp;
4461
4462 START_PROFILE(SMBlseek);
4463
4464 if (req->wct < 4) {
4465 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4466 END_PROFILE(SMBlseek);
4467 return;
4468 }
4469
4470 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4471
4472 if (!check_fsp(conn, req, fsp)) {
4473 return;
4474 }
4475
4476 flush_write_cache(fsp, SEEK_FLUSH);
4477
4478 mode = SVAL(req->vwv+1, 0) & 3;
4479 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4480 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4481
4482 switch (mode) {
4483 case 0:
4484 umode = SEEK_SET;
4485 res = startpos;
4486 break;
4487 case 1:
4488 umode = SEEK_CUR;
4489 res = fsp->fh->pos + startpos;
4490 break;
4491 case 2:
4492 umode = SEEK_END;
4493 break;
4494 default:
4495 umode = SEEK_SET;
4496 res = startpos;
4497 break;
4498 }
4499
4500 if (umode == SEEK_END) {
4501 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4502 if(errno == EINVAL) {
4503 SMB_OFF_T current_pos = startpos;
4504 SMB_STRUCT_STAT sbuf;
4505
4506 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4507 reply_nterror(req,
4508 map_nt_error_from_unix(errno));
4509 END_PROFILE(SMBlseek);
4510 return;
4511 }
4512
4513 current_pos += sbuf.st_ex_size;
4514 if(current_pos < 0)
4515 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4516 }
4517 }
4518
4519 if(res == -1) {
4520 reply_nterror(req, map_nt_error_from_unix(errno));
4521 END_PROFILE(SMBlseek);
4522 return;
4523 }
4524 }
4525
4526 fsp->fh->pos = res;
4527
4528 reply_outbuf(req, 2, 0);
4529 SIVAL(req->outbuf,smb_vwv0,res);
4530
4531 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4532 fsp->fnum, (double)startpos, (double)res, mode));
4533
4534 END_PROFILE(SMBlseek);
4535 return;
4536 }
4537
4538 /****************************************************************************
4539 Reply to a flush.
4540 ****************************************************************************/
4541
4542 void reply_flush(struct smb_request *req)
4543 {
4544 connection_struct *conn = req->conn;
4545 uint16 fnum;
4546 files_struct *fsp;
4547
4548 START_PROFILE(SMBflush);
4549
4550 if (req->wct < 1) {
4551 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4552 return;
4553 }
4554
4555 fnum = SVAL(req->vwv+0, 0);
4556 fsp = file_fsp(req, fnum);
4557
4558 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4559 return;
4560 }
4561
4562 if (!fsp) {
4563 file_sync_all(conn);
4564 } else {
4565 NTSTATUS status = sync_file(conn, fsp, True);
4566 if (!NT_STATUS_IS_OK(status)) {
4567 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4568 fsp_str_dbg(fsp), nt_errstr(status)));
4569 reply_nterror(req, status);
4570 END_PROFILE(SMBflush);
4571 return;
4572 }
4573 }
4574
4575 reply_outbuf(req, 0, 0);
4576
4577 DEBUG(3,("flush\n"));
4578 END_PROFILE(SMBflush);
4579 return;
4580 }
4581
4582 /****************************************************************************
4583 Reply to a exit.
4584 conn POINTER CAN BE NULL HERE !
4585 ****************************************************************************/
4586
4587 void reply_exit(struct smb_request *req)
4588 {
4589 START_PROFILE(SMBexit);
4590
4591 file_close_pid(req->smbpid, req->vuid);
4592
4593 reply_outbuf(req, 0, 0);
4594
4595 DEBUG(3,("exit\n"));
4596
4597 END_PROFILE(SMBexit);
4598 return;
4599 }
4600
4601 /****************************************************************************
4602 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4603 ****************************************************************************/
4604
4605 void reply_close(struct smb_request *req)
4606 {
4607 connection_struct *conn = req->conn;
4608 NTSTATUS status = NT_STATUS_OK;
4609 files_struct *fsp = NULL;
4610 START_PROFILE(SMBclose);
4611
4612 if (req->wct < 3) {
4613 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4614 END_PROFILE(SMBclose);
4615 return;
4616 }
4617
4618 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4619
4620 /*
4621 * We can only use check_fsp if we know it's not a directory.
4622 */
4623
4624 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4625 reply_doserror(req, ERRDOS, ERRbadfid);
4626 END_PROFILE(SMBclose);
4627 return;
4628 }
4629
4630 if(fsp->is_directory) {
4631 /*
4632 * Special case - close NT SMB directory handle.
4633 */
4634 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4635 status = close_file(req, fsp, NORMAL_CLOSE);
4636 } else {
4637 time_t t;
4638 /*
4639 * Close ordinary file.
4640 */
4641
4642 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4643 fsp->fh->fd, fsp->fnum,
4644 conn->num_files_open));
4645
4646 /*
4647 * Take care of any time sent in the close.
4648 */
4649
4650 t = srv_make_unix_date3(req->vwv+1);
4651 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4652
4653 /*
4654 * close_file() returns the unix errno if an error
4655 * was detected on close - normally this is due to
4656 * a disk full error. If not then it was probably an I/O error.
4657 */
4658
4659 status = close_file(req, fsp, NORMAL_CLOSE);
4660 }
4661
4662 if (!NT_STATUS_IS_OK(status)) {
4663 reply_nterror(req, status);
4664 END_PROFILE(SMBclose);
4665 return;
4666 }
4667
4668 reply_outbuf(req, 0, 0);
4669 END_PROFILE(SMBclose);
4670 return;
4671 }
4672
4673 /****************************************************************************
4674 Reply to a writeclose (Core+ protocol).
4675 ****************************************************************************/
4676
4677 void reply_writeclose(struct smb_request *req)
4678 {
4679 connection_struct *conn = req->conn;
4680 size_t numtowrite;
4681 ssize_t nwritten = -1;
4682 NTSTATUS close_status = NT_STATUS_OK;
4683 SMB_OFF_T startpos;
4684 const char *data;
4685 struct timespec mtime;
4686 files_struct *fsp;
4687 struct lock_struct lock;
4688
4689 START_PROFILE(SMBwriteclose);
4690
4691 if (req->wct < 6) {
4692 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4693 END_PROFILE(SMBwriteclose);
4694 return;
4695 }
4696
4697 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4698
4699 if (!check_fsp(conn, req, fsp)) {
4700 END_PROFILE(SMBwriteclose);
4701 return;
4702 }
4703 if (!CHECK_WRITE(fsp)) {
4704 reply_doserror(req, ERRDOS,ERRbadaccess);
4705 END_PROFILE(SMBwriteclose);
4706 return;
4707 }
4708
4709 numtowrite = SVAL(req->vwv+1, 0);
4710 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4711 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4712 data = (const char *)req->buf + 1;
4713
4714 if (numtowrite) {
4715 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4716 (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4717 &lock);
4718
4719 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4720 reply_doserror(req, ERRDOS,ERRlock);
4721 END_PROFILE(SMBwriteclose);
4722 return;
4723 }
4724 }
4725
4726 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4727
4728 set_close_write_time(fsp, mtime);
4729
4730 /*
4731 * More insanity. W2K only closes the file if writelen > 0.
4732 * JRA.
4733 */
4734
4735 if (numtowrite) {
4736 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4737 "file %s\n", fsp_str_dbg(fsp)));
4738 close_status = close_file(req, fsp, NORMAL_CLOSE);
4739 }
4740
4741 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4742 fsp->fnum, (int)numtowrite, (int)nwritten,
4743 conn->num_files_open));
4744
4745 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4746 reply_doserror(req, ERRHRD, ERRdiskfull);
4747 goto strict_unlock;
4748 }
4749
4750 if(!NT_STATUS_IS_OK(close_status)) {
4751 reply_nterror(req, close_status);
4752 goto strict_unlock;
4753 }
4754
4755 reply_outbuf(req, 1, 0);
4756
4757 SSVAL(req->outbuf,smb_vwv0,nwritten);
4758
4759 strict_unlock:
4760 if (numtowrite) {
4761 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4762 }
4763
4764 END_PROFILE(SMBwriteclose);
4765 return;
4766 }
4767
4768 #undef DBGC_CLASS
4769 #define DBGC_CLASS DBGC_LOCKING
4770
4771 /****************************************************************************
4772 Reply to a lock.
4773 ****************************************************************************/
4774
4775 void reply_lock(struct smb_request *req)
4776 {
4777 connection_struct *conn = req->conn;
4778 uint64_t count,offset;
4779 NTSTATUS status;
4780 files_struct *fsp;
4781 struct byte_range_lock *br_lck = NULL;
4782
4783 START_PROFILE(SMBlock);
4784
4785 if (req->wct < 5) {
4786 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4787 END_PROFILE(SMBlock);
4788 return;
4789 }
4790
4791 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4792
4793 if (!check_fsp(conn, req, fsp)) {
4794 END_PROFILE(SMBlock);
4795 return;
4796 }
4797
4798 count = (uint64_t)IVAL(req->vwv+1, 0);
4799 offset = (uint64_t)IVAL(req->vwv+3, 0);
4800
4801 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4802 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4803
4804 br_lck = do_lock(smbd_messaging_context(),
4805 fsp,
4806 req->smbpid,
4807 count,
4808 offset,
4809 WRITE_LOCK,
4810 WINDOWS_LOCK,
4811 False, /* Non-blocking lock. */
4812 &status,
4813 NULL,
4814 NULL);
4815
4816 TALLOC_FREE(br_lck);
4817
4818 if (NT_STATUS_V(status)) {
4819 reply_nterror(req, status);
4820 END_PROFILE(SMBlock);
4821 return;
4822 }
4823
4824 reply_outbuf(req, 0, 0);
4825
4826 END_PROFILE(SMBlock);
4827 return;
4828 }
4829
4830 /****************************************************************************
4831 Reply to a unlock.
4832 ****************************************************************************/
4833
4834 void reply_unlock(struct smb_request *req)
4835 {
4836 connection_struct *conn = req->conn;
4837 uint64_t count,offset;
4838 NTSTATUS status;
4839 files_struct *fsp;
4840
4841 START_PROFILE(SMBunlock);
4842
4843 if (req->wct < 5) {
4844 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4845 END_PROFILE(SMBunlock);
4846 return;
4847 }
4848
4849 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4850
4851 if (!check_fsp(conn, req, fsp)) {
4852 END_PROFILE(SMBunlock);
4853 return;
4854 }
4855
4856 count = (uint64_t)IVAL(req->vwv+1, 0);
4857 offset = (uint64_t)IVAL(req->vwv+3, 0);
4858
4859 status = do_unlock(smbd_messaging_context(),
4860 fsp,
4861 req->smbpid,
4862 count,
4863 offset,
4864 WINDOWS_LOCK);
4865
4866 if (NT_STATUS_V(status)) {
4867 reply_nterror(req, status);
4868 END_PROFILE(SMBunlock);
4869 return;
4870 }
4871
4872 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4873 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4874
4875 reply_outbuf(req, 0, 0);
4876
4877 END_PROFILE(SMBunlock);
4878 return;
4879 }
4880
4881 #undef DBGC_CLASS
4882 #define DBGC_CLASS DBGC_ALL
4883
4884 /****************************************************************************
4885 Reply to a tdis.
4886 conn POINTER CAN BE NULL HERE !
4887 ****************************************************************************/
4888
4889 void reply_tdis(struct smb_request *req)
4890 {
4891 connection_struct *conn = req->conn;
4892 START_PROFILE(SMBtdis);
4893
4894 if (!conn) {
4895 DEBUG(4,("Invalid connection in tdis\n"));
4896 reply_doserror(req, ERRSRV, ERRinvnid);
4897 END_PROFILE(SMBtdis);
4898 return;
4899 }
4900
4901 conn->used = False;
4902
4903 close_cnum(conn,req->vuid);
4904 req->conn = NULL;
4905
4906 reply_outbuf(req, 0, 0);
4907 END_PROFILE(SMBtdis);
4908 return;
4909 }
4910
4911 /****************************************************************************
4912 Reply to a echo.
4913 conn POINTER CAN BE NULL HERE !
4914 ****************************************************************************/
4915
4916 void reply_echo(struct smb_request *req)
4917 {
4918 connection_struct *conn = req->conn;
4919 struct smb_perfcount_data local_pcd;
4920 struct smb_perfcount_data *cur_pcd;
4921 int smb_reverb;
4922 int seq_num;
4923
4924 START_PROFILE(SMBecho);
4925
4926 smb_init_perfcount_data(&local_pcd);
4927
4928 if (req->wct < 1) {
4929 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4930 END_PROFILE(SMBecho);
4931 return;
4932 }
4933
4934 smb_reverb = SVAL(req->vwv+0, 0);
4935
4936 reply_outbuf(req, 1, req->buflen);
4937
4938 /* copy any incoming data back out */
4939 if (req->buflen > 0) {
4940 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4941 }
4942
4943 if (smb_reverb > 100) {
4944 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4945 smb_reverb = 100;
4946 }
4947
4948 for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4949
4950 /* this makes sure we catch the request pcd */
4951 if (seq_num == smb_reverb) {
4952 cur_pcd = &req->pcd;
4953 } else {
4954 SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4955 cur_pcd = &local_pcd;
4956 }
4957
4958 SSVAL(req->outbuf,smb_vwv0,seq_num);
4959
4960 show_msg((char *)req->outbuf);
4961 if (!srv_send_smb(smbd_server_fd(),
4962 (char *)req->outbuf,
4963 true, req->seqnum+1,
4964 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4965 cur_pcd))
4966 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4967 }
4968
4969 DEBUG(3,("echo %d times\n", smb_reverb));
4970
4971 TALLOC_FREE(req->outbuf);
4972
4973 END_PROFILE(SMBecho);
4974 return;
4975 }
4976
4977 /****************************************************************************
4978 Reply to a printopen.
4979 ****************************************************************************/
4980
4981 void reply_printopen(struct smb_request *req)
4982 {
4983 connection_struct *conn = req->conn;
4984 files_struct *fsp;
4985 SMB_STRUCT_STAT sbuf;
4986 NTSTATUS status;
4987
4988 START_PROFILE(SMBsplopen);
4989
4990 if (req->wct < 2) {
4991 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4992 END_PROFILE(SMBsplopen);
4993 return;
4994 }
4995
4996 if (!CAN_PRINT(conn)) {
4997 reply_doserror(req, ERRDOS, ERRnoaccess);
4998 END_PROFILE(SMBsplopen);
4999 return;
5000 }
5001
5002 status = file_new(req, conn, &fsp);
5003 if(!NT_STATUS_IS_OK(status)) {
5004 reply_nterror(req, status);
5005 END_PROFILE(SMBsplopen);
5006 return;
5007 }
5008
5009 /* Open for exclusive use, write only. */
5010 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
5011
5012 if (!NT_STATUS_IS_OK(status)) {
5013 file_free(req, fsp);
5014 reply_nterror(req, status);
5015 END_PROFILE(SMBsplopen);
5016 return;
5017 }
5018
5019 reply_outbuf(req, 1, 0);
5020 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5021
5022 DEBUG(3,("openprint fd=%d fnum=%d\n",
5023 fsp->fh->fd, fsp->fnum));
5024
5025 END_PROFILE(SMBsplopen);
5026 return;
5027 }
5028
5029 /****************************************************************************
5030 Reply to a printclose.
5031 ****************************************************************************/
5032
5033 void reply_printclose(struct smb_request *req)
5034 {
5035 connection_struct *conn = req->conn;
5036 files_struct *fsp;
5037 NTSTATUS status;
5038
5039 START_PROFILE(SMBsplclose);
5040
5041 if (req->wct < 1) {
5042 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5043 END_PROFILE(SMBsplclose);
5044 return;
5045 }
5046
5047 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5048
5049 if (!check_fsp(conn, req, fsp)) {
5050 END_PROFILE(SMBsplclose);
5051 return;
5052 }
5053
5054 if (!CAN_PRINT(conn)) {
5055 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
5056 END_PROFILE(SMBsplclose);
5057 return;
5058 }
5059
5060 DEBUG(3,("printclose fd=%d fnum=%d\n",
5061 fsp->fh->fd,fsp->fnum));
5062
5063 status = close_file(req, fsp, NORMAL_CLOSE);
5064
5065 if(!NT_STATUS_IS_OK(status)) {
5066 reply_nterror(req, status);
5067 END_PROFILE(SMBsplclose);
5068 return;
5069 }
5070
5071 reply_outbuf(req, 0, 0);
5072
5073 END_PROFILE(SMBsplclose);
5074 return;
5075 }
5076
5077 /****************************************************************************
5078 Reply to a printqueue.
5079 ****************************************************************************/
5080
5081 void reply_printqueue(struct smb_request *req)
5082 {
5083 connection_struct *conn = req->conn;
5084 int max_count;
5085 int start_index;
5086
5087 START_PROFILE(SMBsplretq);
5088
5089 if (req->wct < 2) {
5090 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5091 END_PROFILE(SMBsplretq);
5092 return;
5093 }
5094
5095 max_count = SVAL(req->vwv+0, 0);
5096 start_index = SVAL(req->vwv+1, 0);
5097
5098 /* we used to allow the client to get the cnum wrong, but that
5099 is really quite gross and only worked when there was only
5100 one printer - I think we should now only accept it if they
5101 get it right (tridge) */
5102 if (!CAN_PRINT(conn)) {
5103 reply_doserror(req, ERRDOS, ERRnoaccess);
5104 END_PROFILE(SMBsplretq);
5105 return;
5106 }
5107
5108 reply_outbuf(req, 2, 3);
5109 SSVAL(req->outbuf,smb_vwv0,0);
5110 SSVAL(req->outbuf,smb_vwv1,0);
5111 SCVAL(smb_buf(req->outbuf),0,1);
5112 SSVAL(smb_buf(req->outbuf),1,0);
5113
5114 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5115 start_index, max_count));
5116
5117 {
5118 print_queue_struct *queue = NULL;
5119 print_status_struct status;
5120 int count = print_queue_status(SNUM(conn), &queue, &status);
5121 int num_to_get = ABS(max_count);
5122 int first = (max_count>0?start_index:start_index+max_count+1);
5123 int i;
5124
5125 if (first >= count)
5126 num_to_get = 0;
5127 else
5128 num_to_get = MIN(num_to_get,count-first);
5129
5130
5131 for (i=first;i<first+num_to_get;i++) {
5132 char blob[28];
5133 char *p = blob;
5134
5135 srv_put_dos_date2(p,0,queue[i].time);
5136 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5137 SSVAL(p,5, queue[i].job);
5138 SIVAL(p,7,queue[i].size);
5139 SCVAL(p,11,0);
5140 srvstr_push(blob, req->flags2, p+12,
5141 queue[i].fs_user, 16, STR_ASCII);
5142
5143 if (message_push_blob(
5144 &req->outbuf,
5145 data_blob_const(
5146 blob, sizeof(blob))) == -1) {
5147 reply_nterror(req, NT_STATUS_NO_MEMORY);
5148 END_PROFILE(SMBsplretq);
5149 return;
5150 }
5151 }
5152
5153 if (count > 0) {
5154 SSVAL(req->outbuf,smb_vwv0,count);
5155 SSVAL(req->outbuf,smb_vwv1,
5156 (max_count>0?first+count:first-1));
5157 SCVAL(smb_buf(req->outbuf),0,1);
5158 SSVAL(smb_buf(req->outbuf),1,28*count);
5159 }
5160
5161 SAFE_FREE(queue);
5162
5163 DEBUG(3,("%d entries returned in queue\n",count));
5164 }
5165
5166 END_PROFILE(SMBsplretq);
5167 return;
5168 }
5169
5170 /****************************************************************************
5171 Reply to a printwrite.
5172 ****************************************************************************/
5173
5174 void reply_printwrite(struct smb_request *req)
5175 {
5176 connection_struct *conn = req->conn;
5177 int numtowrite;
5178 const char *data;
5179 files_struct *fsp;
5180
5181 START_PROFILE(SMBsplwr);
5182
5183 if (req->wct < 1) {
5184 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5185 END_PROFILE(SMBsplwr);
5186 return;
5187 }
5188
5189 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5190
5191 if (!check_fsp(conn, req, fsp)) {
5192 END_PROFILE(SMBsplwr);
5193 return;
5194 }
5195
5196 if (!CAN_PRINT(conn)) {
5197 reply_doserror(req, ERRDOS, ERRnoaccess);
5198 END_PROFILE(SMBsplwr);
5199 return;
5200 }
5201
5202 if (!CHECK_WRITE(fsp)) {
5203 reply_doserror(req, ERRDOS, ERRbadaccess);
5204 END_PROFILE(SMBsplwr);
5205 return;
5206 }
5207
5208 numtowrite = SVAL(req->buf, 1);
5209
5210 if (req->buflen < numtowrite + 3) {
5211 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5212 END_PROFILE(SMBsplwr);
5213 return;
5214 }
5215
5216 data = (const char *)req->buf + 3;
5217
5218 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5219 reply_nterror(req, map_nt_error_from_unix(errno));
5220 END_PROFILE(SMBsplwr);
5221 return;
5222 }
5223
5224 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5225
5226 END_PROFILE(SMBsplwr);
5227 return;
5228 }
5229
5230 /****************************************************************************
5231 Reply to a mkdir.
5232 ****************************************************************************/
5233
5234 void reply_mkdir(struct smb_request *req)
5235 {
5236 connection_struct *conn = req->conn;
5237 struct smb_filename *smb_dname = NULL;
5238 char *directory = NULL;
5239 NTSTATUS status;
5240 TALLOC_CTX *ctx = talloc_tos();
5241
5242 START_PROFILE(SMBmkdir);
5243
5244 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5245 STR_TERMINATE, &status);
5246 if (!NT_STATUS_IS_OK(status)) {
5247 reply_nterror(req, status);
5248 goto out;
5249 }
5250
5251 status = filename_convert(ctx, conn,
5252 req->flags2 & FLAGS2_DFS_PATHNAMES,
5253 directory,
5254 0,
5255 NULL,
5256 &smb_dname);
5257 if (!NT_STATUS_IS_OK(status)) {
5258 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5259 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5260 ERRSRV, ERRbadpath);
5261 goto out;
5262 }
5263 reply_nterror(req, status);
5264 goto out;
5265 }
5266
5267 status = create_directory(conn, req, smb_dname);
5268
5269 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5270
5271 if (!NT_STATUS_IS_OK(status)) {
5272
5273 if (!use_nt_status()
5274 && NT_STATUS_EQUAL(status,
5275 NT_STATUS_OBJECT_NAME_COLLISION)) {
5276 /*
5277 * Yes, in the DOS error code case we get a
5278 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5279 * samba4 torture test.
5280 */
5281 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5282 }
5283
5284 reply_nterror(req, status);
5285 goto out;
5286 }
5287
5288 reply_outbuf(req, 0, 0);
5289
5290 DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5291 out:
5292 TALLOC_FREE(smb_dname);
5293 END_PROFILE(SMBmkdir);
5294 return;
5295 }
5296
5297 /****************************************************************************
5298 Static function used by reply_rmdir to delete an entire directory
5299 tree recursively. Return True on ok, False on fail.
5300 ****************************************************************************/
5301
5302 static bool recursive_rmdir(TALLOC_CTX *ctx,
5303 connection_struct *conn,
5304 struct smb_filename *smb_dname)
5305 {
5306 char *dname = NULL;
5307 bool ret = True;
5308 long offset = 0;
5309 SMB_STRUCT_STAT st;
5310 struct smb_Dir *dir_hnd;
5311
5312 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5313
5314 dir_hnd = OpenDir(talloc_tos(), conn, smb_dname->base_name, NULL, 0);
5315 if(dir_hnd == NULL)
5316 return False;
5317
5318 while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5319 struct smb_filename *smb_dname_full = NULL;
5320 char *fullname = NULL;
5321 bool do_break = true;
5322 NTSTATUS status;
5323
5324 if (ISDOT(dname) || ISDOTDOT(dname)) {
5325 TALLOC_FREE(dname);
5326 continue;
5327 }
5328
5329 if (!is_visible_file(conn, smb_dname->base_name, dname, &st,
5330 false)) {
5331 TALLOC_FREE(dname);
5332 continue;
5333 }
5334
5335 /* Construct the full name. */
5336 fullname = talloc_asprintf(ctx,
5337 "%s/%s",
5338 smb_dname->base_name,
5339 dname);
5340 if (!fullname) {
5341 errno = ENOMEM;
5342 goto err_break;
5343 }
5344
5345 status = create_synthetic_smb_fname(talloc_tos(), fullname,
5346 NULL, NULL,
5347 &smb_dname_full);
5348 if (!NT_STATUS_IS_OK(status)) {
5349 goto err_break;
5350 }
5351
5352 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5353 goto err_break;
5354 }
5355
5356 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5357 if(!recursive_rmdir(ctx, conn, smb_dname_full)) {
5358 goto err_break;
5359 }
5360 if(SMB_VFS_RMDIR(conn,
5361 smb_dname_full->base_name) != 0) {
5362 goto err_break;
5363 }
5364 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5365 goto err_break;
5366 }
5367
5368 /* Successful iteration. */
5369 do_break = false;
5370
5371 err_break:
5372 TALLOC_FREE(smb_dname_full);
5373 TALLOC_FREE(fullname);
5374 TALLOC_FREE(dname);
5375 if (do_break) {
5376 ret = false;
5377 break;
5378 }
5379 }
5380 TALLOC_FREE(dir_hnd);
5381 return ret;
5382 }
5383
5384 /****************************************************************************
5385 The internals of the rmdir code - called elsewhere.
5386 ****************************************************************************/
5387
5388 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5389 connection_struct *conn,
5390 struct smb_filename *smb_dname)
5391 {
5392 int ret;
5393 SMB_STRUCT_STAT st;
5394
5395 SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5396
5397 /* Might be a symlink. */
5398 if(SMB_VFS_LSTAT(conn, smb_dname) != 0) {
5399 return map_nt_error_from_unix(errno);
5400 }
5401
5402 if (S_ISLNK(smb_dname->st.st_ex_mode)) {
5403 /* Is what it points to a directory ? */
5404 if(SMB_VFS_STAT(conn, smb_dname) != 0) {
5405 return map_nt_error_from_unix(errno);
5406 }
5407 if (!(S_ISDIR(smb_dname->st.st_ex_mode))) {
5408 return NT_STATUS_NOT_A_DIRECTORY;
5409 }
5410 ret = SMB_VFS_UNLINK(conn, smb_dname);
5411 } else {
5412 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5413 }
5414 if (ret == 0) {
5415 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5416 FILE_NOTIFY_CHANGE_DIR_NAME,
5417 smb_dname->base_name);
5418 return NT_STATUS_OK;
5419 }
5420
5421 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5422 /*
5423 * Check to see if the only thing in this directory are
5424 * vetoed files/directories. If so then delete them and
5425 * retry. If we fail to delete any of them (and we *don't*
5426 * do a recursive delete) then fail the rmdir.
5427 */
5428 char *dname = NULL;
5429 long dirpos = 0;
5430 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5431 smb_dname->base_name, NULL,
5432 0);
5433
5434 if(dir_hnd == NULL) {
5435 errno = ENOTEMPTY;
5436 goto err;
5437 }
5438
5439 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5440 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0)) {
5441 TALLOC_FREE(dname);
5442 continue;
5443 }
5444 if (!is_visible_file(conn, smb_dname->base_name, dname,
5445 &st, false)) {
5446 TALLOC_FREE(dname);
5447 continue;
5448 }
5449 if(!IS_VETO_PATH(conn, dname)) {
5450 TALLOC_FREE(dir_hnd);
5451 TALLOC_FREE(dname);
5452 errno = ENOTEMPTY;
5453 goto err;
5454 }
5455 TALLOC_FREE(dname);
5456 }
5457
5458 /* We only have veto files/directories.
5459 * Are we allowed to delete them ? */
5460
5461 if(!lp_recursive_veto_delete(SNUM(conn))) {
5462 TALLOC_FREE(dir_hnd);
5463 errno = ENOTEMPTY;
5464 goto err;
5465 }
5466
5467 /* Do a recursive delete. */
5468 RewindDir(dir_hnd,&dirpos);
5469 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5470 struct smb_filename *smb_dname_full = NULL;
5471 char *fullname = NULL;
5472 bool do_break = true;
5473 NTSTATUS status;
5474
5475 if (ISDOT(dname) || ISDOTDOT(dname)) {
5476 TALLOC_FREE(dname);
5477 continue;
5478 }
5479 if (!is_visible_file(conn, smb_dname->base_name, dname,
5480 &st, false)) {
5481 TALLOC_FREE(dname);
5482 continue;
5483 }
5484
5485 fullname = talloc_asprintf(ctx,
5486 "%s/%s",
5487 smb_dname->base_name,
5488 dname);
5489
5490 if(!fullname) {
5491 errno = ENOMEM;
5492 goto err_break;
5493 }
5494
5495 status = create_synthetic_smb_fname(talloc_tos(),
5496 fullname, NULL,
5497 NULL,
5498 &smb_dname_full);
5499 if (!NT_STATUS_IS_OK(status)) {
5500 errno = map_errno_from_nt_status(status);
5501 goto err_break;
5502 }
5503
5504 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5505 goto err_break;
5506 }
5507 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5508 if(!recursive_rmdir(ctx, conn,
5509 smb_dname_full)) {
5510 goto err_break;
5511 }
5512 if(SMB_VFS_RMDIR(conn,
5513 smb_dname_full->base_name) != 0) {
5514 goto err_break;
5515 }
5516 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5517 goto err_break;
5518 }
5519
5520 /* Successful iteration. */
5521 do_break = false;
5522
5523 err_break:
5524 TALLOC_FREE(fullname);
5525 TALLOC_FREE(smb_dname_full);
5526 TALLOC_FREE(dname);
5527 if (do_break)
5528 break;
5529 }
5530 TALLOC_FREE(dir_hnd);
5531 /* Retry the rmdir */
5532 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5533 }
5534
5535 err:
5536
5537 if (ret != 0) {
5538 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5539 "%s\n", smb_fname_str_dbg(smb_dname),
5540 strerror(errno)));
5541 return map_nt_error_from_unix(errno);
5542 }
5543
5544 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5545 FILE_NOTIFY_CHANGE_DIR_NAME,
5546 smb_dname->base_name);
5547
5548 return NT_STATUS_OK;
5549 }
5550
5551 /****************************************************************************
5552 Reply to a rmdir.
5553 ****************************************************************************/
5554
5555 void reply_rmdir(struct smb_request *req)
5556 {
5557 connection_struct *conn = req->conn;
5558 struct smb_filename *smb_dname = NULL;
5559 char *directory = NULL;
5560 NTSTATUS status;
5561 TALLOC_CTX *ctx = talloc_tos();
5562 struct smbd_server_connection *sconn = smbd_server_conn;
5563
5564 START_PROFILE(SMBrmdir);
5565
5566 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5567 STR_TERMINATE, &status);
5568 if (!NT_STATUS_IS_OK(status)) {
5569 reply_nterror(req, status);
5570 goto out;
5571 }
5572
5573 status = filename_convert(ctx, conn,
5574 req->flags2 & FLAGS2_DFS_PATHNAMES,
5575 directory,
5576 0,
5577 NULL,
5578 &smb_dname);
5579 if (!NT_STATUS_IS_OK(status)) {
5580 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5581 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5582 ERRSRV, ERRbadpath);
5583 goto out;
5584 }
5585 reply_nterror(req, status);
5586 goto out;
5587 }
5588
5589 if (is_ntfs_stream_smb_fname(smb_dname)) {
5590 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5591 goto out;
5592 }
5593
5594 dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5595 status = rmdir_internals(ctx, conn, smb_dname);
5596 if (!NT_STATUS_IS_OK(status)) {
5597 reply_nterror(req, status);
5598 goto out;
5599 }
5600
5601 reply_outbuf(req, 0, 0);
5602
5603 DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5604 out:
5605 TALLOC_FREE(smb_dname);
5606 END_PROFILE(SMBrmdir);
5607 return;
5608 }
5609
5610 /*******************************************************************
5611 Resolve wildcards in a filename rename.
5612 ********************************************************************/
5613
5614 static bool resolve_wildcards(TALLOC_CTX *ctx,
5615 const char *name1,
5616 const char *name2,
5617 char **pp_newname)
5618 {
5619 char *name2_copy = NULL;
5620 char *root1 = NULL;
5621 char *root2 = NULL;
5622 char *ext1 = NULL;
5623 char *ext2 = NULL;
5624 char *p,*p2, *pname1, *pname2;
5625
5626 name2_copy = talloc_strdup(ctx, name2);
5627 if (!name2_copy) {
5628 return False;
5629 }
5630
5631 pname1 = strrchr_m(name1,'/');
5632 pname2 = strrchr_m(name2_copy,'/');
5633
5634 if (!pname1 || !pname2) {
5635 return False;
5636 }
5637
5638 /* Truncate the copy of name2 at the last '/' */
5639 *pname2 = '\0';
5640
5641 /* Now go past the '/' */
5642 pname1++;
5643 pname2++;
5644
5645 root1 = talloc_strdup(ctx, pname1);
5646 root2 = talloc_strdup(ctx, pname2);
5647
5648 if (!root1 || !root2) {
5649 return False;
5650 }
5651
5652 p = strrchr_m(root1,'.');
5653 if (p) {
5654 *p = 0;
5655 ext1 = talloc_strdup(ctx, p+1);
5656 } else {
5657 ext1 = talloc_strdup(ctx, "");
5658 }
5659 p = strrchr_m(root2,'.');
5660 if (p) {
5661 *p = 0;
5662 ext2 = talloc_strdup(ctx, p+1);
5663 } else {
5664 ext2 = talloc_strdup(ctx, "");
5665 }
5666
5667 if (!ext1 || !ext2) {
5668 return False;
5669 }
5670
5671 p = root1;
5672 p2 = root2;
5673 while (*p2) {
5674 if (*p2 == '?') {
5675 /* Hmmm. Should this be mb-aware ? */
5676 *p2 = *p;
5677 p2++;
5678 } else if (*p2 == '*') {
5679 *p2 = '\0';
5680 root2 = talloc_asprintf(ctx, "%s%s",
5681 root2,
5682 p);
5683 if (!root2) {
5684 return False;
5685 }
5686 break;
5687 } else {
5688 p2++;
5689 }
5690 if (*p) {
5691 p++;
5692 }
5693 }
5694
5695 p = ext1;
5696 p2 = ext2;
5697 while (*p2) {
5698 if (*p2 == '?') {
5699 /* Hmmm. Should this be mb-aware ? */
5700 *p2 = *p;
5701 p2++;
5702 } else if (*p2 == '*') {
5703 *p2 = '\0';
5704 ext2 = talloc_asprintf(ctx, "%s%s",
5705 ext2,
5706 p);
5707 if (!ext2) {
5708 return False;
5709 }
5710 break;
5711 } else {
5712 p2++;
5713 }
5714 if (*p) {
5715 p++;
5716 }
5717 }
5718
5719 if (*ext2) {
5720 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5721 name2_copy,
5722 root2,
5723 ext2);
5724 } else {
5725 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5726 name2_copy,
5727 root2);
5728 }
5729
5730 if (!*pp_newname) {
5731 return False;
5732 }
5733
5734 return True;
5735 }
5736
5737 /****************************************************************************
5738 Ensure open files have their names updated. Updated to notify other smbd's
5739 asynchronously.
5740 ****************************************************************************/
5741
5742 static void rename_open_files(connection_struct *conn,
5743 struct share_mode_lock *lck,
5744 const struct smb_filename *smb_fname_dst)
5745 {
5746 files_struct *fsp;
5747 bool did_rename = False;
5748 NTSTATUS status;
5749
5750 for(fsp = file_find_di_first(lck->id); fsp;
5751 fsp = file_find_di_next(fsp)) {
5752 /* fsp_name is a relative path under the fsp. To change this for other
5753 sharepaths we need to manipulate relative paths. */
5754 /* TODO - create the absolute path and manipulate the newname
5755 relative to the sharepath. */
5756 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5757 continue;
5758 }
5759 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5760 "(file_id %s) from %s -> %s\n", fsp->fnum,
5761 file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5762 smb_fname_str_dbg(smb_fname_dst)));
5763
5764 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5765 if (NT_STATUS_IS_OK(status)) {
5766 did_rename = True;
5767 }
5768 }
5769
5770 if (!did_rename) {
5771 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5772 "for %s\n", file_id_string_tos(&lck->id),
5773 smb_fname_str_dbg(smb_fname_dst)));
5774 }
5775
5776 /* Send messages to all smbd's (not ourself) that the name has changed. */
5777 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5778 smb_fname_dst);
5779
5780 }
5781
5782 /****************************************************************************
5783 We need to check if the source path is a parent directory of the destination
5784 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5785 refuse the rename with a sharing violation. Under UNIX the above call can
5786 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5787 probably need to check that the client is a Windows one before disallowing
5788 this as a UNIX client (one with UNIX extensions) can know the source is a
5789 symlink and make this decision intelligently. Found by an excellent bug
5790 report from <AndyLiebman@aol.com>.
5791 ****************************************************************************/
5792
5793 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5794 const struct smb_filename *smb_fname_dst)
5795 {
5796 const char *psrc = smb_fname_src->base_name;
5797 const char *pdst = smb_fname_dst->base_name;
5798 size_t slen;
5799
5800 if (psrc[0] == '.' && psrc[1] == '/') {
5801 psrc += 2;
5802 }
5803 if (pdst[0] == '.' && pdst[1] == '/') {
5804 pdst += 2;
5805 }
5806 if ((slen = strlen(psrc)) > strlen(pdst)) {
5807 return False;
5808 }
5809 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5810 }
5811
5812 /*
5813 * Do the notify calls from a rename
5814 */
5815
5816 static void notify_rename(connection_struct *conn, bool is_dir,
5817 const struct smb_filename *smb_fname_src,
5818 const struct smb_filename *smb_fname_dst)
5819 {
5820 char *parent_dir_src = NULL;
5821 char *parent_dir_dst = NULL;
5822 uint32 mask;
5823
5824 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5825 : FILE_NOTIFY_CHANGE_FILE_NAME;
5826
5827 if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5828 &parent_dir_src, NULL) ||
5829 !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5830 &parent_dir_dst, NULL)) {
5831 goto out;
5832 }
5833
5834 if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5835 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5836 smb_fname_src->base_name);
5837 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5838 smb_fname_dst->base_name);
5839 }
5840 else {
5841 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5842 smb_fname_src->base_name);
5843 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5844 smb_fname_dst->base_name);
5845 }
5846
5847 /* this is a strange one. w2k3 gives an additional event for
5848 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5849 files, but not directories */
5850 if (!is_dir) {
5851 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5852 FILE_NOTIFY_CHANGE_ATTRIBUTES
5853 |FILE_NOTIFY_CHANGE_CREATION,
5854 smb_fname_dst->base_name);
5855 }
5856 out:
5857 TALLOC_FREE(parent_dir_src);
5858 TALLOC_FREE(parent_dir_dst);
5859 }
5860
5861 /****************************************************************************
5862 Rename an open file - given an fsp.
5863 ****************************************************************************/
5864
5865 NTSTATUS rename_internals_fsp(connection_struct *conn,
5866 files_struct *fsp,
5867 const struct smb_filename *smb_fname_dst_in,
5868 uint32 attrs,
5869 bool replace_if_exists)
5870 {
5871 TALLOC_CTX *ctx = talloc_tos();
5872 struct smb_filename *smb_fname_dst = NULL;
5873 NTSTATUS status = NT_STATUS_OK;
5874 struct share_mode_lock *lck = NULL;
5875 bool dst_exists, old_is_stream, new_is_stream;
5876
5877 status = check_name(conn, smb_fname_dst_in->base_name);
5878 if (!NT_STATUS_IS_OK(status)) {
5879 return status;
5880 }
5881
5882 /* Make a copy of the dst smb_fname structs */
5883
5884 status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5885 if (!NT_STATUS_IS_OK(status)) {
5886 goto out;
5887 }
5888
5889 /* Ensure the dst smb_fname contains a '/' */
5890 if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5891 char * tmp;
5892 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5893 smb_fname_dst->base_name);
5894 if (!tmp) {
5895 status = NT_STATUS_NO_MEMORY;
5896 goto out;
5897 }
5898 TALLOC_FREE(smb_fname_dst->base_name);
5899 smb_fname_dst->base_name = tmp;
5900 }
5901
5902 /*
5903 * Check for special case with case preserving and not
5904 * case sensitive. If the old last component differs from the original
5905 * last component only by case, then we should allow
5906 * the rename (user is trying to change the case of the
5907 * filename).
5908 */
5909 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5910 strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5911 strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5912 char *last_slash;
5913 char *fname_dst_lcomp_base_mod = NULL;
5914 struct smb_filename *smb_fname_orig_lcomp = NULL;
5915
5916 /*
5917 * Get the last component of the destination name. Note that
5918 * we guarantee that destination name contains a '/' character
5919 * above.
5920 */
5921 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5922 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5923 if (!fname_dst_lcomp_base_mod) {
5924 status = NT_STATUS_NO_MEMORY;
5925 goto out;
5926 }
5927
5928 /*
5929 * Create an smb_filename struct using the original last
5930 * component of the destination.
5931 */
5932 status = create_synthetic_smb_fname_split(ctx,
5933 smb_fname_dst->original_lcomp, NULL,
5934 &smb_fname_orig_lcomp);
5935 if (!NT_STATUS_IS_OK(status)) {
5936 TALLOC_FREE(fname_dst_lcomp_base_mod);
5937 goto out;
5938 }
5939
5940 /* If the base names only differ by case, use original. */
5941 if(!strcsequal(fname_dst_lcomp_base_mod,
5942 smb_fname_orig_lcomp->base_name)) {
5943 char *tmp;
5944 /*
5945 * Replace the modified last component with the
5946 * original.
5947 */
5948 *last_slash = '\0'; /* Truncate at the '/' */
5949 tmp = talloc_asprintf(smb_fname_dst,
5950 "%s/%s",
5951 smb_fname_dst->base_name,
5952 smb_fname_orig_lcomp->base_name);
5953 if (tmp == NULL) {
5954 status = NT_STATUS_NO_MEMORY;
5955 TALLOC_FREE(fname_dst_lcomp_base_mod);
5956 TALLOC_FREE(smb_fname_orig_lcomp);
5957 goto out;
5958 }
5959 TALLOC_FREE(smb_fname_dst->base_name);
5960 smb_fname_dst->base_name = tmp;
5961 }
5962
5963 /* If the stream_names only differ by case, use original. */
5964 if(!strcsequal(smb_fname_dst->stream_name,
5965 smb_fname_orig_lcomp->stream_name)) {
5966 char *tmp = NULL;
5967 /* Use the original stream. */
5968 tmp = talloc_strdup(smb_fname_dst,
5969 smb_fname_orig_lcomp->stream_name);
5970 if (tmp == NULL) {
5971 status = NT_STATUS_NO_MEMORY;
5972 TALLOC_FREE(fname_dst_lcomp_base_mod);
5973 TALLOC_FREE(smb_fname_orig_lcomp);
5974 goto out;
5975 }
5976 TALLOC_FREE(smb_fname_dst->stream_name);
5977 smb_fname_dst->stream_name = tmp;
5978 }
5979 TALLOC_FREE(fname_dst_lcomp_base_mod);
5980 TALLOC_FREE(smb_fname_orig_lcomp);
5981 }
5982
5983 /*
5984 * If the src and dest names are identical - including case,
5985 * don't do the rename, just return success.
5986 */
5987
5988 if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5989 strcsequal(fsp->fsp_name->stream_name,
5990 smb_fname_dst->stream_name)) {
5991 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5992 "- returning success\n",
5993 smb_fname_str_dbg(smb_fname_dst)));
5994 status = NT_STATUS_OK;
5995 goto out;
5996 }
5997
5998 old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5999 new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6000
6001 /* Return the correct error code if both names aren't streams. */
6002 if (!old_is_stream && new_is_stream) {
6003 status = NT_STATUS_OBJECT_NAME_INVALID;
6004 goto out;
6005 }
6006
6007 if (old_is_stream && !new_is_stream) {
6008 status = NT_STATUS_INVALID_PARAMETER;
6009 goto out;
6010 }
6011
6012 dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6013
6014 if(!replace_if_exists && dst_exists) {
6015 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6016 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6017 smb_fname_str_dbg(smb_fname_dst)));
6018 status = NT_STATUS_OBJECT_NAME_COLLISION;
6019 goto out;
6020 }
6021
6022 if (dst_exists) {
6023 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6024 &smb_fname_dst->st);
6025 files_struct *dst_fsp = file_find_di_first(fileid);
6026 /* The file can be open when renaming a stream */
6027 if (dst_fsp && !new_is_stream) {
6028 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6029 status = NT_STATUS_ACCESS_DENIED;
6030 goto out;
6031 }
6032 }
6033
6034 /* Ensure we have a valid stat struct for the source. */
6035 status = vfs_stat_fsp(fsp);
6036 if (!NT_STATUS_IS_OK(status)) {
6037 goto out;
6038 }
6039
6040 status = can_rename(conn, fsp, attrs, &fsp->fsp_name->st);
6041
6042 if (!NT_STATUS_IS_OK(status)) {
6043 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6044 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6045 smb_fname_str_dbg(smb_fname_dst)));
6046 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6047 status = NT_STATUS_ACCESS_DENIED;
6048 goto out;
6049 }
6050
6051 if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6052 status = NT_STATUS_ACCESS_DENIED;
6053 }
6054
6055 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6056 NULL);
6057
6058 /*
6059 * We have the file open ourselves, so not being able to get the
6060 * corresponding share mode lock is a fatal error.
6061 */
6062
6063 SMB_ASSERT(lck != NULL);
6064
6065 if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6066 uint32 create_options = fsp->fh->private_options;
6067
6068 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6069 "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6070 smb_fname_str_dbg(smb_fname_dst)));
6071
6072 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6073 smb_fname_dst);
6074
6075 rename_open_files(conn, lck, smb_fname_dst);
6076
6077 /*
6078 * A rename acts as a new file create w.r.t. allowing an initial delete
6079 * on close, probably because in Windows there is a new handle to the
6080 * new file. If initial delete on close was requested but not
6081 * originally set, we need to set it here. This is probably not 100% correct,
6082 * but will work for the CIFSFS client which in non-posix mode
6083 * depends on these semantics. JRA.
6084 */
6085
6086 if (create_options & FILE_DELETE_ON_CLOSE) {
6087 status = can_set_delete_on_close(fsp, True, 0);
6088
6089 if (NT_STATUS_IS_OK(status)) {
6090 /* Note that here we set the *inital* delete on close flag,
6091 * not the regular one. The magic gets handled in close. */
6092 fsp->initial_delete_on_close = True;
6093 }
6094 }
6095 TALLOC_FREE(lck);
6096 status = NT_STATUS_OK;
6097 goto out;
6098 }
6099
6100 TALLOC_FREE(lck);
6101
6102 if (errno == ENOTDIR || errno == EISDIR) {
6103 status = NT_STATUS_OBJECT_NAME_COLLISION;
6104 } else {
6105 status = map_nt_error_from_unix(errno);
6106 }
6107
6108 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6109 nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6110 smb_fname_str_dbg(smb_fname_dst)));
6111
6112 out:
6113 TALLOC_FREE(smb_fname_dst);
6114
6115 return status;
6116 }
6117
6118 /****************************************************************************
6119 The guts of the rename command, split out so it may be called by the NT SMB
6120 code.
6121 ****************************************************************************/
6122
6123 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6124 connection_struct *conn,
6125 struct smb_request *req,
6126 struct smb_filename *smb_fname_src,
6127 struct smb_filename *smb_fname_dst,
6128 uint32 attrs,
6129 bool replace_if_exists,
6130 bool src_has_wild,
6131 bool dest_has_wild,
6132 uint32_t access_mask)
6133 {
6134 char *fname_src_dir = NULL;
6135 char *fname_src_mask = NULL;
6136 int count=0;
6137 NTSTATUS status = NT_STATUS_OK;
6138 struct smb_Dir *dir_hnd = NULL;
6139 char *dname = NULL;
6140 long offset = 0;
6141 int create_options = 0;
6142 bool posix_pathnames = lp_posix_pathnames();
6143
6144 /*
6145 * Split the old name into directory and last component
6146 * strings. Note that unix_convert may have stripped off a
6147 * leading ./ from both name and newname if the rename is
6148 * at the root of the share. We need to make sure either both
6149 * name and newname contain a / character or neither of them do
6150 * as this is checked in resolve_wildcards().
6151 */
6152
6153 /* Split up the directory from the filename/mask. */
6154 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6155 &fname_src_dir, &fname_src_mask);
6156 if (!NT_STATUS_IS_OK(status)) {
6157 status = NT_STATUS_NO_MEMORY;
6158 goto out;
6159 }
6160
6161 /*
6162 * We should only check the mangled cache
6163 * here if unix_convert failed. This means
6164 * that the path in 'mask' doesn't exist
6165 * on the file system and so we need to look
6166 * for a possible mangle. This patch from
6167 * Tine Smukavec <valentin.smukavec@hermes.si>.
6168 */
6169
6170 if (!VALID_STAT(smb_fname_src->st) &&
6171 mangle_is_mangled(fname_src_mask, conn->params)) {
6172 char *new_mask = NULL;
6173 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6174 conn->params);
6175 if (new_mask) {
6176 TALLOC_FREE(fname_src_mask);
6177 fname_src_mask = new_mask;
6178 }
6179 }
6180
6181 if (!src_has_wild) {
6182 files_struct *fsp;
6183
6184 /*
6185 * Only one file needs to be renamed. Append the mask back
6186 * onto the directory.
6187 */
6188 TALLOC_FREE(smb_fname_src->base_name);
6189 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6190 "%s/%s",
6191 fname_src_dir,
6192 fname_src_mask);
6193 if (!smb_fname_src->base_name) {
6194 status = NT_STATUS_NO_MEMORY;
6195 goto out;
6196 }
6197
6198 /* Ensure dst fname contains a '/' also */
6199 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6200 char *tmp;
6201 tmp = talloc_asprintf(smb_fname_dst, "./%s",
6202 smb_fname_dst->base_name);
6203 if (!tmp) {
6204 status = NT_STATUS_NO_MEMORY;
6205 goto out;
6206 }
6207 TALLOC_FREE(smb_fname_dst->base_name);
6208 smb_fname_dst->base_name = tmp;
6209 }
6210
6211 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6212 "case_preserve = %d, short case preserve = %d, "
6213 "directory = %s, newname = %s, "
6214 "last_component_dest = %s\n",
6215 conn->case_sensitive, conn->case_preserve,
6216 conn->short_case_preserve,
6217 smb_fname_str_dbg(smb_fname_src),
6218 smb_fname_str_dbg(smb_fname_dst),
6219 smb_fname_dst->original_lcomp));
6220
6221 /* The dest name still may have wildcards. */
6222 if (dest_has_wild) {
6223 char *fname_dst_mod = NULL;
6224 if (!resolve_wildcards(smb_fname_dst,
6225 smb_fname_src->base_name,
6226 smb_fname_dst->base_name,
6227 &fname_dst_mod)) {
6228 DEBUG(6, ("rename_internals: resolve_wildcards "
6229 "%s %s failed\n",
6230 smb_fname_src->base_name,
6231 smb_fname_dst->base_name));
6232 status = NT_STATUS_NO_MEMORY;
6233 goto out;
6234 }
6235 TALLOC_FREE(smb_fname_dst->base_name);
6236 smb_fname_dst->base_name = fname_dst_mod;
6237 }
6238
6239 ZERO_STRUCT(smb_fname_src->st);
6240 if (posix_pathnames) {
6241 SMB_VFS_LSTAT(conn, smb_fname_src);
6242 } else {
6243 SMB_VFS_STAT(conn, smb_fname_src);
6244 }
6245
6246 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6247 create_options |= FILE_DIRECTORY_FILE;
6248 }
6249
6250 status = SMB_VFS_CREATE_FILE(
6251 conn, /* conn */
6252 req, /* req */
6253 0, /* root_dir_fid */
6254 smb_fname_src, /* fname */
6255 access_mask, /* access_mask */
6256 (FILE_SHARE_READ | /* share_access */
6257 FILE_SHARE_WRITE),
6258 FILE_OPEN, /* create_disposition*/
6259 create_options, /* create_options */
6260 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6261 0, /* oplock_request */
6262 0, /* allocation_size */
6263 NULL, /* sd */
6264 NULL, /* ea_list */
6265 &fsp, /* result */
6266 NULL); /* pinfo */
6267
6268 if (!NT_STATUS_IS_OK(status)) {
6269 DEBUG(3, ("Could not open rename source %s: %s\n",
6270 smb_fname_str_dbg(smb_fname_src),
6271 nt_errstr(status)));
6272 goto out;
6273 }
6274
6275 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6276 attrs, replace_if_exists);
6277
6278 close_file(req, fsp, NORMAL_CLOSE);
6279
6280 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6281 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6282 smb_fname_str_dbg(smb_fname_dst)));
6283
6284 goto out;
6285 }
6286
6287 /*
6288 * Wildcards - process each file that matches.
6289 */
6290 if (strequal(fname_src_mask, "????????.???")) {
6291 TALLOC_FREE(fname_src_mask);
6292 fname_src_mask = talloc_strdup(ctx, "*");
6293 if (!fname_src_mask) {
6294 status = NT_STATUS_NO_MEMORY;
6295 goto out;
6296 }
6297 }
6298
6299 status = check_name(conn, fname_src_dir);
6300 if (!NT_STATUS_IS_OK(status)) {
6301 goto out;
6302 }
6303
6304 dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6305 attrs);
6306 if (dir_hnd == NULL) {
6307 status = map_nt_error_from_unix(errno);
6308 goto out;
6309 }
6310
6311 status = NT_STATUS_NO_SUCH_FILE;
6312 /*
6313 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6314 * - gentest fix. JRA
6315 */
6316
6317 while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st))) {
6318 files_struct *fsp = NULL;
6319 char *destname = NULL;
6320 bool sysdir_entry = False;
6321
6322 /* Quick check for "." and ".." */
6323 if (ISDOT(dname) || ISDOTDOT(dname)) {
6324 if (attrs & aDIR) {
6325 sysdir_entry = True;
6326 } else {
6327 TALLOC_FREE(dname);
6328 continue;
6329 }
6330 }
6331
6332 if (!is_visible_file(conn, fname_src_dir, dname,
6333 &smb_fname_src->st, false)) {
6334 TALLOC_FREE(dname);
6335 continue;
6336 }
6337
6338 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6339 TALLOC_FREE(dname);
6340 continue;
6341 }
6342
6343 if (sysdir_entry) {
6344 status = NT_STATUS_OBJECT_NAME_INVALID;
6345 break;
6346 }
6347
6348 TALLOC_FREE(smb_fname_src->base_name);
6349 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6350 "%s/%s",
6351 fname_src_dir,
6352 dname);
6353 if (!smb_fname_src->base_name) {
6354 status = NT_STATUS_NO_MEMORY;
6355 goto out;
6356 }
6357
6358 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6359 smb_fname_dst->base_name,
6360 &destname)) {
6361 DEBUG(6, ("resolve_wildcards %s %s failed\n",
6362 smb_fname_src->base_name, destname));
6363 TALLOC_FREE(dname);
6364 continue;
6365 }
6366 if (!destname) {
6367 status = NT_STATUS_NO_MEMORY;
6368 goto out;
6369 }
6370
6371 TALLOC_FREE(smb_fname_dst->base_name);
6372 smb_fname_dst->base_name = destname;
6373
6374 ZERO_STRUCT(smb_fname_src->st);
6375 if (posix_pathnames) {
6376 SMB_VFS_LSTAT(conn, smb_fname_src);
6377 } else {
6378 SMB_VFS_STAT(conn, smb_fname_src);
6379 }
6380
6381 create_options = 0;
6382
6383 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6384 create_options |= FILE_DIRECTORY_FILE;
6385 }
6386
6387 status = SMB_VFS_CREATE_FILE(
6388 conn, /* conn */
6389 req, /* req */
6390 0, /* root_dir_fid */
6391 smb_fname_src, /* fname */
6392 access_mask, /* access_mask */
6393 (FILE_SHARE_READ | /* share_access */
6394 FILE_SHARE_WRITE),
6395 FILE_OPEN, /* create_disposition*/
6396 create_options, /* create_options */
6397 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6398 0, /* oplock_request */
6399 0, /* allocation_size */
6400 NULL, /* sd */
6401 NULL, /* ea_list */
6402 &fsp, /* result */
6403 NULL); /* pinfo */
6404
6405 if (!NT_STATUS_IS_OK(status)) {
6406 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6407 "returned %s rename %s -> %s\n",
6408 nt_errstr(status),
6409 smb_fname_str_dbg(smb_fname_src),
6410 smb_fname_str_dbg(smb_fname_dst)));
6411 break;
6412 }
6413
6414 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6415 dname);
6416 if (!smb_fname_dst->original_lcomp) {
6417 status = NT_STATUS_NO_MEMORY;
6418 goto out;
6419 }
6420
6421 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6422 attrs, replace_if_exists);
6423
6424 close_file(req, fsp, NORMAL_CLOSE);
6425
6426 if (!NT_STATUS_IS_OK(status)) {
6427 DEBUG(3, ("rename_internals_fsp returned %s for "
6428 "rename %s -> %s\n", nt_errstr(status),
6429 smb_fname_str_dbg(smb_fname_src),
6430 smb_fname_str_dbg(smb_fname_dst)));
6431 break;
6432 }
6433
6434 count++;
6435
6436 DEBUG(3,("rename_internals: doing rename on %s -> "
6437 "%s\n", smb_fname_str_dbg(smb_fname_src),
6438 smb_fname_str_dbg(smb_fname_src)));
6439 TALLOC_FREE(dname);
6440 }
6441 TALLOC_FREE(dir_hnd);
6442
6443 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6444 status = map_nt_error_from_unix(errno);
6445 }
6446
6447 out:
6448 TALLOC_FREE(dname);
6449 TALLOC_FREE(fname_src_dir);
6450 TALLOC_FREE(fname_src_mask);
6451 return status;
6452 }
6453
6454 /****************************************************************************
6455 Reply to a mv.
6456 ****************************************************************************/
6457
6458 void reply_mv(struct smb_request *req)
6459 {
6460 connection_struct *conn = req->conn;
6461 char *name = NULL;
6462 char *newname = NULL;
6463 const char *p;
6464 uint32 attrs;
6465 NTSTATUS status;
6466 bool src_has_wcard = False;
6467 bool dest_has_wcard = False;
6468 TALLOC_CTX *ctx = talloc_tos();
6469 struct smb_filename *smb_fname_src = NULL;
6470 struct smb_filename *smb_fname_dst = NULL;
6471
6472 START_PROFILE(SMBmv);
6473
6474 if (req->wct < 1) {
6475 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6476 goto out;
6477 }
6478
6479 attrs = SVAL(req->vwv+0, 0);
6480
6481 p = (const char *)req->buf + 1;
6482 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6483 &status, &src_has_wcard);
6484 if (!NT_STATUS_IS_OK(status)) {
6485 reply_nterror(req, status);
6486 goto out;
6487 }
6488 p++;
6489 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6490 &status, &dest_has_wcard);
6491 if (!NT_STATUS_IS_OK(status)) {
6492 reply_nterror(req, status);
6493 goto out;
6494 }
6495
6496 status = filename_convert(ctx,
6497 conn,
6498 req->flags2 & FLAGS2_DFS_PATHNAMES,
6499 name,
6500 UCF_COND_ALLOW_WCARD_LCOMP,
6501 &src_has_wcard,
6502 &smb_fname_src);
6503
6504 if (!NT_STATUS_IS_OK(status)) {
6505 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6506 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6507 ERRSRV, ERRbadpath);
6508 goto out;
6509 }
6510 reply_nterror(req, status);
6511 goto out;
6512 }
6513
6514 status = filename_convert(ctx,
6515 conn,
6516 req->flags2 & FLAGS2_DFS_PATHNAMES,
6517 newname,
6518 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6519 &dest_has_wcard,
6520 &smb_fname_dst);
6521
6522 if (!NT_STATUS_IS_OK(status)) {
6523 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6524 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6525 ERRSRV, ERRbadpath);
6526 goto out;
6527 }
6528 reply_nterror(req, status);
6529 goto out;
6530 }
6531
6532 DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6533 smb_fname_str_dbg(smb_fname_dst)));
6534
6535 status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6536 attrs, False, src_has_wcard, dest_has_wcard,
6537 DELETE_ACCESS);
6538 if (!NT_STATUS_IS_OK(status)) {
6539 if (open_was_deferred(req->mid)) {
6540 /* We have re-scheduled this call. */
6541 goto out;
6542 }
6543 reply_nterror(req, status);
6544 goto out;
6545 }
6546
6547 reply_outbuf(req, 0, 0);
6548 out:
6549 TALLOC_FREE(smb_fname_src);
6550 TALLOC_FREE(smb_fname_dst);
6551 END_PROFILE(SMBmv);
6552 return;
6553 }
6554
6555 /*******************************************************************
6556 Copy a file as part of a reply_copy.
6557 ******************************************************************/
6558
6559 /*
6560 * TODO: check error codes on all callers
6561 */
6562
6563 NTSTATUS copy_file(TALLOC_CTX *ctx,
6564 connection_struct *conn,
6565 struct smb_filename *smb_fname_src,
6566 struct smb_filename *smb_fname_dst,
6567 int ofun,
6568 int count,
6569 bool target_is_directory)
6570 {
6571 struct smb_filename *smb_fname_dst_tmp = NULL;
6572 SMB_OFF_T ret=-1;
6573 files_struct *fsp1,*fsp2;
6574 uint32 dosattrs;
6575 uint32 new_create_disposition;
6576 NTSTATUS status;
6577
6578
6579 status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6580 if (!NT_STATUS_IS_OK(status)) {
6581 return status;
6582 }
6583
6584 /*
6585 * If the target is a directory, extract the last component from the
6586 * src filename and append it to the dst filename
6587 */
6588 if (target_is_directory) {
6589 const char *p;
6590
6591 /* dest/target can't be a stream if it's a directory. */
6592 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6593
6594 p = strrchr_m(smb_fname_src->base_name,'/');
6595 if (p) {
6596 p++;
6597 } else {
6598 p = smb_fname_src->base_name;
6599 }
6600 smb_fname_dst_tmp->base_name =
6601 talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6602 p);
6603 if (!smb_fname_dst_tmp->base_name) {
6604 status = NT_STATUS_NO_MEMORY;
6605 goto out;
6606 }
6607 }
6608
6609 status = vfs_file_exist(conn, smb_fname_src);
6610 if (!NT_STATUS_IS_OK(status)) {
6611 goto out;
6612 }
6613
6614 if (!target_is_directory && count) {
6615 new_create_disposition = FILE_OPEN;
6616 } else {
6617 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6618 NULL, NULL,
6619 &new_create_disposition,
6620 NULL)) {
6621 status = NT_STATUS_INVALID_PARAMETER;
6622 goto out;
6623 }
6624 }
6625
6626 /* Open the src file for reading. */
6627 status = SMB_VFS_CREATE_FILE(
6628 conn, /* conn */
6629 NULL, /* req */
6630 0, /* root_dir_fid */
6631 smb_fname_src, /* fname */
6632 FILE_GENERIC_READ, /* access_mask */
6633 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6634 FILE_OPEN, /* create_disposition*/
6635 0, /* create_options */
6636 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6637 INTERNAL_OPEN_ONLY, /* oplock_request */
6638 0, /* allocation_size */
6639 NULL, /* sd */
6640 NULL, /* ea_list */
6641 &fsp1, /* result */
6642 NULL); /* psbuf */
6643
6644 if (!NT_STATUS_IS_OK(status)) {
6645 goto out;
6646 }
6647
6648 dosattrs = dos_mode(conn, smb_fname_src);
6649
6650 if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6651 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6652 }
6653
6654 /* Open the dst file for writing. */
6655 status = SMB_VFS_CREATE_FILE(
6656 conn, /* conn */
6657 NULL, /* req */
6658 0, /* root_dir_fid */
6659 smb_fname_dst, /* fname */
6660 FILE_GENERIC_WRITE, /* access_mask */
6661 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6662 new_create_disposition, /* create_disposition*/
6663 0, /* create_options */
6664 dosattrs, /* file_attributes */
6665 INTERNAL_OPEN_ONLY, /* oplock_request */
6666 0, /* allocation_size */
6667 NULL, /* sd */
6668 NULL, /* ea_list */
6669 &fsp2, /* result */
6670 NULL); /* psbuf */
6671
6672 if (!NT_STATUS_IS_OK(status)) {
6673 close_file(NULL, fsp1, ERROR_CLOSE);
6674 goto out;
6675 }
6676
6677 if ((ofun&3) == 1) {
6678 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6679 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6680 /*
6681 * Stop the copy from occurring.
6682 */
6683 ret = -1;
6684 smb_fname_src->st.st_ex_size = 0;
6685 }
6686 }
6687
6688 /* Do the actual copy. */
6689 if (smb_fname_src->st.st_ex_size) {
6690 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6691 }
6692
6693 close_file(NULL, fsp1, NORMAL_CLOSE);
6694
6695 /* Ensure the modtime is set correctly on the destination file. */
6696 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6697
6698 /*
6699 * As we are opening fsp1 read-only we only expect
6700 * an error on close on fsp2 if we are out of space.
6701 * Thus we don't look at the error return from the
6702 * close of fsp1.
6703 */
6704 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6705
6706 if (!NT_STATUS_IS_OK(status)) {
6707 goto out;
6708 }
6709
6710 if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6711 status = NT_STATUS_DISK_FULL;
6712 goto out;
6713 }
6714
6715 status = NT_STATUS_OK;
6716
6717 out:
6718 TALLOC_FREE(smb_fname_dst_tmp);
6719 return status;
6720 }
6721
6722 /****************************************************************************
6723 Reply to a file copy.
6724 ****************************************************************************/
6725
6726 void reply_copy(struct smb_request *req)
6727 {
6728 connection_struct *conn = req->conn;
6729 struct smb_filename *smb_fname_src = NULL;
6730 struct smb_filename *smb_fname_dst = NULL;
6731 char *fname_src = NULL;
6732 char *fname_dst = NULL;
6733 char *fname_src_mask = NULL;
6734 char *fname_src_dir = NULL;
6735 const char *p;
6736 int count=0;
6737 int error = ERRnoaccess;
6738 int tid2;
6739 int ofun;
6740 int flags;
6741 bool target_is_directory=False;
6742 bool source_has_wild = False;
6743 bool dest_has_wild = False;
6744 NTSTATUS status;
6745 TALLOC_CTX *ctx = talloc_tos();
6746
6747 START_PROFILE(SMBcopy);
6748
6749 if (req->wct < 3) {
6750 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6751 goto out;
6752 }
6753
6754 tid2 = SVAL(req->vwv+0, 0);
6755 ofun = SVAL(req->vwv+1, 0);
6756 flags = SVAL(req->vwv+2, 0);
6757
6758 p = (const char *)req->buf;
6759 p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6760 &status, &source_has_wild);
6761 if (!NT_STATUS_IS_OK(status)) {
6762 reply_nterror(req, status);
6763 goto out;
6764 }
6765 p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6766 &status, &dest_has_wild);
6767 if (!NT_STATUS_IS_OK(status)) {
6768 reply_nterror(req, status);
6769 goto out;
6770 }
6771
6772 DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6773
6774 if (tid2 != conn->cnum) {
6775 /* can't currently handle inter share copies XXXX */
6776 DEBUG(3,("Rejecting inter-share copy\n"));
6777 reply_doserror(req, ERRSRV, ERRinvdevice);
6778 goto out;
6779 }
6780
6781 status = filename_convert(ctx, conn,
6782 req->flags2 & FLAGS2_DFS_PATHNAMES,
6783 fname_src,
6784 UCF_COND_ALLOW_WCARD_LCOMP,
6785 &source_has_wild,
6786 &smb_fname_src);
6787 if (!NT_STATUS_IS_OK(status)) {
6788 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6789 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6790 ERRSRV, ERRbadpath);
6791 goto out;
6792 }
6793 reply_nterror(req, status);
6794 goto out;
6795 }
6796
6797 status = filename_convert(ctx, conn,
6798 req->flags2 & FLAGS2_DFS_PATHNAMES,
6799 fname_dst,
6800 UCF_COND_ALLOW_WCARD_LCOMP,
6801 &dest_has_wild,
6802 &smb_fname_dst);
6803 if (!NT_STATUS_IS_OK(status)) {
6804 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6805 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6806 ERRSRV, ERRbadpath);
6807 goto out;
6808 }
6809 reply_nterror(req, status);
6810 goto out;
6811 }
6812
6813 target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6814
6815 if ((flags&1) && target_is_directory) {
6816 reply_doserror(req, ERRDOS, ERRbadfile);
6817 goto out;
6818 }
6819
6820 if ((flags&2) && !target_is_directory) {
6821 reply_doserror(req, ERRDOS, ERRbadpath);
6822 goto out;
6823 }
6824
6825 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6826 /* wants a tree copy! XXXX */
6827 DEBUG(3,("Rejecting tree copy\n"));
6828 reply_doserror(req, ERRSRV, ERRerror);
6829 goto out;
6830 }
6831
6832 /* Split up the directory from the filename/mask. */
6833 status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6834 &fname_src_dir, &fname_src_mask);
6835 if (!NT_STATUS_IS_OK(status)) {
6836 reply_nterror(req, NT_STATUS_NO_MEMORY);
6837 goto out;
6838 }
6839
6840 /*
6841 * We should only check the mangled cache
6842 * here if unix_convert failed. This means
6843 * that the path in 'mask' doesn't exist
6844 * on the file system and so we need to look
6845 * for a possible mangle. This patch from
6846 * Tine Smukavec <valentin.smukavec@hermes.si>.
6847 */
6848 if (!VALID_STAT(smb_fname_src->st) &&
6849 mangle_is_mangled(fname_src_mask, conn->params)) {
6850 char *new_mask = NULL;
6851 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6852 &new_mask, conn->params);
6853
6854 /* Use demangled name if one was successfully found. */
6855 if (new_mask) {
6856 TALLOC_FREE(fname_src_mask);
6857 fname_src_mask = new_mask;
6858 }
6859 }
6860
6861 if (!source_has_wild) {
6862
6863 /*
6864 * Only one file needs to be copied. Append the mask back onto
6865 * the directory.
6866 */
6867 TALLOC_FREE(smb_fname_src->base_name);
6868 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6869 "%s/%s",
6870 fname_src_dir,
6871 fname_src_mask);
6872 if (!smb_fname_src->base_name) {
6873 reply_nterror(req, NT_STATUS_NO_MEMORY);
6874 goto out;
6875 }
6876
6877 if (dest_has_wild) {
6878 char *fname_dst_mod = NULL;
6879 if (!resolve_wildcards(smb_fname_dst,
6880 smb_fname_src->base_name,
6881 smb_fname_dst->base_name,
6882 &fname_dst_mod)) {
6883 reply_nterror(req, NT_STATUS_NO_MEMORY);
6884 goto out;
6885 }
6886 TALLOC_FREE(smb_fname_dst->base_name);
6887 smb_fname_dst->base_name = fname_dst_mod;
6888 }
6889
6890 status = check_name(conn, smb_fname_src->base_name);
6891 if (!NT_STATUS_IS_OK(status)) {
6892 reply_nterror(req, status);
6893 goto out;
6894 }
6895
6896 status = check_name(conn, smb_fname_dst->base_name);
6897 if (!NT_STATUS_IS_OK(status)) {
6898 reply_nterror(req, status);
6899 goto out;
6900 }
6901
6902 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6903 ofun, count, target_is_directory);
6904
6905 if(!NT_STATUS_IS_OK(status)) {
6906 reply_nterror(req, status);
6907 goto out;
6908 } else {
6909 count++;
6910 }
6911 } else {
6912 struct smb_Dir *dir_hnd = NULL;
6913 char *dname = NULL;
6914 long offset = 0;
6915
6916 /*
6917 * There is a wildcard that requires us to actually read the
6918 * src dir and copy each file matching the mask to the dst.
6919 * Right now streams won't be copied, but this could
6920 * presumably be added with a nested loop for reach dir entry.
6921 */
6922 SMB_ASSERT(!smb_fname_src->stream_name);
6923 SMB_ASSERT(!smb_fname_dst->stream_name);
6924
6925 smb_fname_src->stream_name = NULL;
6926 smb_fname_dst->stream_name = NULL;
6927
6928 if (strequal(fname_src_mask,"????????.???")) {
6929 TALLOC_FREE(fname_src_mask);
6930 fname_src_mask = talloc_strdup(ctx, "*");
6931 if (!fname_src_mask) {
6932 reply_nterror(req, NT_STATUS_NO_MEMORY);
6933 goto out;
6934 }
6935 }
6936
6937 status = check_name(conn, fname_src_dir);
6938 if (!NT_STATUS_IS_OK(status)) {
6939 reply_nterror(req, status);
6940 goto out;
6941 }
6942
6943 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6944 if (dir_hnd == NULL) {
6945 status = map_nt_error_from_unix(errno);
6946 reply_nterror(req, status);
6947 goto out;
6948 }
6949
6950 error = ERRbadfile;
6951
6952 /* Iterate over the src dir copying each entry to the dst. */
6953 while ((dname = ReadDirName(dir_hnd, &offset,
6954 &smb_fname_src->st))) {
6955 char *destname = NULL;
6956
6957 if (ISDOT(dname) || ISDOTDOT(dname)) {
6958 TALLOC_FREE(dname);
6959 continue;
6960 }
6961
6962 if (!is_visible_file(conn, fname_src_dir, dname,
6963 &smb_fname_src->st, false)) {
6964 TALLOC_FREE(dname);
6965 continue;
6966 }
6967
6968 if(!mask_match(dname, fname_src_mask,
6969 conn->case_sensitive)) {
6970 TALLOC_FREE(dname);
6971 continue;
6972 }
6973
6974 error = ERRnoaccess;
6975
6976 /* Get the src smb_fname struct setup. */
6977 TALLOC_FREE(smb_fname_src->base_name);
6978 smb_fname_src->base_name =
6979 talloc_asprintf(smb_fname_src, "%s/%s",
6980 fname_src_dir, dname);
6981
6982 if (!smb_fname_src->base_name) {
6983 TALLOC_FREE(dir_hnd);
6984 TALLOC_FREE(dname);
6985 reply_nterror(req, NT_STATUS_NO_MEMORY);
6986 goto out;
6987 }
6988
6989 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6990 smb_fname_dst->base_name,
6991 &destname)) {
6992 TALLOC_FREE(dname);
6993 continue;
6994 }
6995 if (!destname) {
6996 TALLOC_FREE(dir_hnd);
6997 TALLOC_FREE(dname);
6998 reply_nterror(req, NT_STATUS_NO_MEMORY);
6999 goto out;
7000 }
7001
7002 TALLOC_FREE(smb_fname_dst->base_name);
7003 smb_fname_dst->base_name = destname;
7004
7005 status = check_name(conn, smb_fname_src->base_name);
7006 if (!NT_STATUS_IS_OK(status)) {
7007 TALLOC_FREE(dir_hnd);
7008 TALLOC_FREE(dname);
7009 reply_nterror(req, status);
7010 goto out;
7011 }
7012
7013 status = check_name(conn, smb_fname_dst->base_name);
7014 if (!NT_STATUS_IS_OK(status)) {
7015 TALLOC_FREE(dir_hnd);
7016 TALLOC_FREE(dname);
7017 reply_nterror(req, status);
7018 goto out;
7019 }
7020
7021 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7022 smb_fname_src->base_name,
7023 smb_fname_dst->base_name));
7024
7025 status = copy_file(ctx, conn, smb_fname_src,
7026 smb_fname_dst, ofun, count,
7027 target_is_directory);
7028 if (NT_STATUS_IS_OK(status)) {
7029 count++;
7030 }
7031
7032 TALLOC_FREE(dname);
7033 }
7034 TALLOC_FREE(dir_hnd);
7035 }
7036
7037 if (count == 0) {
7038 reply_doserror(req, ERRDOS, error);
7039 goto out;
7040 }
7041
7042 reply_outbuf(req, 1, 0);
7043 SSVAL(req->outbuf,smb_vwv0,count);
7044 out:
7045 TALLOC_FREE(smb_fname_src);
7046 TALLOC_FREE(smb_fname_dst);
7047 TALLOC_FREE(fname_src);
7048 TALLOC_FREE(fname_dst);
7049 TALLOC_FREE(fname_src_mask);
7050 TALLOC_FREE(fname_src_dir);
7051
7052 END_PROFILE(SMBcopy);
7053 return;
7054 }
7055
7056 #undef DBGC_CLASS
7057 #define DBGC_CLASS DBGC_LOCKING
7058
7059 /****************************************************************************
7060 Get a lock pid, dealing with large count requests.
7061 ****************************************************************************/
7062
7063 uint32 get_lock_pid(const uint8_t *data, int data_offset,
7064 bool large_file_format)
7065 {
7066 if(!large_file_format)
7067 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
7068 else
7069 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7070 }
7071
7072 /****************************************************************************
7073 Get a lock count, dealing with large count requests.
7074 ****************************************************************************/
7075
7076 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7077 bool large_file_format)
7078 {
7079 uint64_t count = 0;
7080
7081 if(!large_file_format) {
7082 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7083 } else {
7084
7085 #if defined(HAVE_LONGLONG)
7086 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7087 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7088 #else /* HAVE_LONGLONG */
7089
7090 /*
7091 * NT4.x seems to be broken in that it sends large file (64 bit)
7092 * lockingX calls even if the CAP_LARGE_FILES was *not*
7093 * negotiated. For boxes without large unsigned ints truncate the
7094 * lock count by dropping the top 32 bits.
7095 */
7096
7097 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7098 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7099 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7100 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7101 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7102 }
7103
7104 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7105 #endif /* HAVE_LONGLONG */
7106 }
7107
7108 return count;
7109 }
7110
7111 #if !defined(HAVE_LONGLONG)
7112 /****************************************************************************
7113 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7114 ****************************************************************************/
7115
7116 static uint32 map_lock_offset(uint32 high, uint32 low)
7117 {
7118 unsigned int i;
7119 uint32 mask = 0;
7120 uint32 highcopy = high;
7121
7122 /*
7123 * Try and find out how many significant bits there are in high.
7124 */
7125
7126 for(i = 0; highcopy; i++)
7127 highcopy >>= 1;
7128
7129 /*
7130 * We use 31 bits not 32 here as POSIX
7131 * lock offsets may not be negative.
7132 */
7133
7134 mask = (~0) << (31 - i);
7135
7136 if(low & mask)
7137 return 0; /* Fail. */
7138
7139 high <<= (31 - i);
7140
7141 return (high|low);
7142 }
7143 #endif /* !defined(HAVE_LONGLONG) */
7144
7145 /****************************************************************************
7146 Get a lock offset, dealing with large offset requests.
7147 ****************************************************************************/
7148
7149 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7150 bool large_file_format, bool *err)
7151 {
7152 uint64_t offset = 0;
7153
7154 *err = False;
7155
7156 if(!large_file_format) {
7157 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7158 } else {
7159
7160 #if defined(HAVE_LONGLONG)
7161 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7162 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7163 #else /* HAVE_LONGLONG */
7164
7165 /*
7166 * NT4.x seems to be broken in that it sends large file (64 bit)
7167 * lockingX calls even if the CAP_LARGE_FILES was *not*
7168 * negotiated. For boxes without large unsigned ints mangle the
7169 * lock offset by mapping the top 32 bits onto the lower 32.
7170 */
7171
7172 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7173 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7174 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7175 uint32 new_low = 0;
7176
7177 if((new_low = map_lock_offset(high, low)) == 0) {
7178 *err = True;
7179 return (uint64_t)-1;
7180 }
7181
7182 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7183 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7184 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7185 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7186 }
7187
7188 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7189 #endif /* HAVE_LONGLONG */
7190 }
7191
7192 return offset;
7193 }
7194
7195 NTSTATUS smbd_do_locking(struct smb_request *req,
7196 files_struct *fsp,
7197 uint8_t type,
7198 int32_t timeout,
7199 uint16_t num_ulocks,
7200 struct smbd_lock_element *ulocks,
7201 uint16_t num_locks,
7202 struct smbd_lock_element *locks,
7203 bool *async)
7204 {
7205 connection_struct *conn = req->conn;
7206 int i;
7207 NTSTATUS status = NT_STATUS_OK;
7208
7209 *async = false;
7210
7211 /* Data now points at the beginning of the list
7212 of smb_unlkrng structs */
7213 for(i = 0; i < (int)num_ulocks; i++) {
7214 struct smbd_lock_element *e = &ulocks[i];
7215
7216 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7217 "pid %u, file %s\n",
7218 (double)e->offset,
7219 (double)e->count,
7220 (unsigned int)e->smbpid,
7221 fsp_str_dbg(fsp)));
7222
7223 if (e->brltype != UNLOCK_LOCK) {
7224 /* this can only happen with SMB2 */
7225 return NT_STATUS_INVALID_PARAMETER;
7226 }
7227
7228 status = do_unlock(smbd_messaging_context(),
7229 fsp,
7230 e->smbpid,
7231 e->count,
7232 e->offset,
7233 WINDOWS_LOCK);
7234
7235 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7236 nt_errstr(status)));
7237
7238 if (!NT_STATUS_IS_OK(status)) {
7239 return status;
7240 }
7241 }
7242
7243 /* Setup the timeout in seconds. */
7244
7245 if (!lp_blocking_locks(SNUM(conn))) {
7246 timeout = 0;
7247 }
7248
7249 /* Data now points at the beginning of the list
7250 of smb_lkrng structs */
7251
7252 for(i = 0; i < (int)num_locks; i++) {
7253 struct smbd_lock_element *e = &locks[i];
7254
7255 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7256 "%u, file %s timeout = %d\n",
7257 (double)e->offset,
7258 (double)e->count,
7259 (unsigned int)e->smbpid,
7260 fsp_str_dbg(fsp),
7261 (int)timeout));
7262
7263 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7264 struct blocking_lock_record *blr = NULL;
7265
7266 if (lp_blocking_locks(SNUM(conn))) {
7267
7268 /* Schedule a message to ourselves to
7269 remove the blocking lock record and
7270 return the right error. */
7271
7272 blr = blocking_lock_cancel(fsp,
7273 e->smbpid,
7274 e->offset,
7275 e->count,
7276 WINDOWS_LOCK,
7277 type,
7278 NT_STATUS_FILE_LOCK_CONFLICT);
7279 if (blr == NULL) {
7280 return NT_STATUS_DOS(
7281 ERRDOS,
7282 ERRcancelviolation);
7283 }
7284 }
7285 /* Remove a matching pending lock. */
7286 status = do_lock_cancel(fsp,
7287 e->smbpid,
7288 e->count,
7289 e->offset,
7290 WINDOWS_LOCK,
7291 blr);
7292 } else {
7293 bool blocking_lock = timeout ? true : false;
7294 bool defer_lock = false;
7295 struct byte_range_lock *br_lck;
7296 uint32_t block_smbpid;
7297
7298 br_lck = do_lock(smbd_messaging_context(),
7299 fsp,
7300 e->smbpid,
7301 e->count,
7302 e->offset,
7303 e->brltype,
7304 WINDOWS_LOCK,
7305 blocking_lock,
7306 &status,
7307 &block_smbpid,
7308 NULL);
7309
7310 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7311 /* Windows internal resolution for blocking locks seems
7312 to be about 200ms... Don't wait for less than that. JRA. */
7313 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7314 timeout = lp_lock_spin_time();
7315 }
7316 defer_lock = true;
7317 }
7318
7319 /* This heuristic seems to match W2K3 very well. If a
7320 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7321 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7322 far as I can tell. Replacement for do_lock_spin(). JRA. */
7323
7324 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7325 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7326 defer_lock = true;
7327 timeout = lp_lock_spin_time();
7328 }
7329
7330 if (br_lck && defer_lock) {
7331 /*
7332 * A blocking lock was requested. Package up
7333 * this smb into a queued request and push it
7334 * onto the blocking lock queue.
7335 */
7336 if(push_blocking_lock_request(br_lck,
7337 req,
7338 fsp,
7339 timeout,
7340 i,
7341 e->smbpid,
7342 e->brltype,
7343 WINDOWS_LOCK,
7344 e->offset,
7345 e->count,
7346 block_smbpid)) {
7347 TALLOC_FREE(br_lck);
7348 *async = true;
7349 return NT_STATUS_OK;
7350 }
7351 }
7352
7353 TALLOC_FREE(br_lck);
7354 }
7355
7356 if (!NT_STATUS_IS_OK(status)) {
7357 break;
7358 }
7359 }
7360
7361 /* If any of the above locks failed, then we must unlock
7362 all of the previous locks (X/Open spec). */
7363
7364 if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7365
7366 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7367 i = -1; /* we want to skip the for loop */
7368 }
7369
7370 /*
7371 * Ensure we don't do a remove on the lock that just failed,
7372 * as under POSIX rules, if we have a lock already there, we
7373 * will delete it (and we shouldn't) .....
7374 */
7375 for(i--; i >= 0; i--) {
7376 struct smbd_lock_element *e = &locks[i];
7377
7378 do_unlock(smbd_messaging_context(),
7379 fsp,
7380 e->smbpid,
7381 e->count,
7382 e->offset,
7383 WINDOWS_LOCK);
7384 }
7385 return status;
7386 }
7387
7388 DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7389 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7390
7391 return NT_STATUS_OK;
7392 }
7393
7394 /****************************************************************************
7395 Reply to a lockingX request.
7396 ****************************************************************************/
7397
7398 void reply_lockingX(struct smb_request *req)
7399 {
7400 connection_struct *conn = req->conn;
7401 files_struct *fsp;
7402 unsigned char locktype;
7403 unsigned char oplocklevel;
7404 uint16 num_ulocks;
7405 uint16 num_locks;
7406 int32 lock_timeout;
7407 int i;
7408 const uint8_t *data;
7409 bool large_file_format;
7410 bool err;
7411 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7412 struct smbd_lock_element *ulocks;
7413 struct smbd_lock_element *locks;
7414 bool async = false;
7415
7416 START_PROFILE(SMBlockingX);
7417
7418 if (req->wct < 8) {
7419 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7420 END_PROFILE(SMBlockingX);
7421 return;
7422 }
7423
7424 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7425 locktype = CVAL(req->vwv+3, 0);
7426 oplocklevel = CVAL(req->vwv+3, 1);
7427 num_ulocks = SVAL(req->vwv+6, 0);
7428 num_locks = SVAL(req->vwv+7, 0);
7429 lock_timeout = IVAL(req->vwv+4, 0);
7430 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7431
7432 if (!check_fsp(conn, req, fsp)) {
7433 END_PROFILE(SMBlockingX);
7434 return;
7435 }
7436
7437 data = req->buf;
7438
7439 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7440 /* we don't support these - and CANCEL_LOCK makes w2k
7441 and XP reboot so I don't really want to be
7442 compatible! (tridge) */
7443 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
7444 END_PROFILE(SMBlockingX);
7445 return;
7446 }
7447
7448 /* Check if this is an oplock break on a file
7449 we have granted an oplock on.
7450 */
7451 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7452 /* Client can insist on breaking to none. */
7453 bool break_to_none = (oplocklevel == 0);
7454 bool result;
7455
7456 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7457 "for fnum = %d\n", (unsigned int)oplocklevel,
7458 fsp->fnum ));
7459
7460 /*
7461 * Make sure we have granted an exclusive or batch oplock on
7462 * this file.
7463 */
7464
7465 if (fsp->oplock_type == 0) {
7466
7467 /* The Samba4 nbench simulator doesn't understand
7468 the difference between break to level2 and break
7469 to none from level2 - it sends oplock break
7470 replies in both cases. Don't keep logging an error
7471 message here - just ignore it. JRA. */
7472
7473 DEBUG(5,("reply_lockingX: Error : oplock break from "
7474 "client for fnum = %d (oplock=%d) and no "
7475 "oplock granted on this file (%s).\n",
7476 fsp->fnum, fsp->oplock_type,
7477 fsp_str_dbg(fsp)));
7478
7479 /* if this is a pure oplock break request then don't
7480 * send a reply */
7481 if (num_locks == 0 && num_ulocks == 0) {
7482 END_PROFILE(SMBlockingX);
7483 return;
7484 } else {
7485 END_PROFILE(SMBlockingX);
7486 reply_doserror(req, ERRDOS, ERRlock);
7487 return;
7488 }
7489 }
7490
7491 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7492 (break_to_none)) {
7493 result = remove_oplock(fsp);
7494 } else {
7495 result = downgrade_oplock(fsp);
7496 }
7497
7498 if (!result) {
7499 DEBUG(0, ("reply_lockingX: error in removing "
7500 "oplock on file %s\n", fsp_str_dbg(fsp)));
7501 /* Hmmm. Is this panic justified? */
7502 smb_panic("internal tdb error");
7503 }
7504
7505 reply_to_oplock_break_requests(fsp);
7506
7507 /* if this is a pure oplock break request then don't send a
7508 * reply */
7509 if (num_locks == 0 && num_ulocks == 0) {
7510 /* Sanity check - ensure a pure oplock break is not a
7511 chained request. */
7512 if(CVAL(req->vwv+0, 0) != 0xff)
7513 DEBUG(0,("reply_lockingX: Error : pure oplock "
7514 "break is a chained %d request !\n",
7515 (unsigned int)CVAL(req->vwv+0, 0)));
7516 END_PROFILE(SMBlockingX);
7517 return;
7518 }
7519 }
7520
7521 if (req->buflen <
7522 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7523 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7524 END_PROFILE(SMBlockingX);
7525 return;
7526 }
7527
7528 ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7529 if (ulocks == NULL) {
7530 reply_nterror(req, NT_STATUS_NO_MEMORY);
7531 END_PROFILE(SMBlockingX);
7532 return;
7533 }
7534
7535 locks = talloc_array(req, struct smbd_lock_element, num_locks);
7536 if (locks == NULL) {
7537 reply_nterror(req, NT_STATUS_NO_MEMORY);
7538 END_PROFILE(SMBlockingX);
7539 return;
7540 }
7541
7542 /* Data now points at the beginning of the list
7543 of smb_unlkrng structs */
7544 for(i = 0; i < (int)num_ulocks; i++) {
7545 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7546 ulocks[i].count = get_lock_count(data, i, large_file_format);
7547 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7548 ulocks[i].brltype = UNLOCK_LOCK;
7549
7550 /*
7551 * There is no error code marked "stupid client bug".... :-).
7552 */
7553 if(err) {
7554 END_PROFILE(SMBlockingX);
7555 reply_doserror(req, ERRDOS, ERRnoaccess);
7556 return;
7557 }
7558 }
7559
7560 /* Now do any requested locks */
7561 data += ((large_file_format ? 20 : 10)*num_ulocks);
7562
7563 /* Data now points at the beginning of the list
7564 of smb_lkrng structs */
7565
7566 for(i = 0; i < (int)num_locks; i++) {
7567 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7568 locks[i].count = get_lock_count(data, i, large_file_format);
7569 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7570
7571 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7572 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7573 locks[i].brltype = PENDING_READ_LOCK;
7574 } else {
7575 locks[i].brltype = READ_LOCK;
7576 }
7577 } else {
7578 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7579 locks[i].brltype = PENDING_WRITE_LOCK;
7580 } else {
7581 locks[i].brltype = WRITE_LOCK;
7582 }
7583 }
7584
7585 /*
7586 * There is no error code marked "stupid client bug".... :-).
7587 */
7588 if(err) {
7589 END_PROFILE(SMBlockingX);
7590 reply_doserror(req, ERRDOS, ERRnoaccess);
7591 return;
7592 }
7593 }
7594
7595 status = smbd_do_locking(req, fsp,
7596 locktype, lock_timeout,
7597 num_ulocks, ulocks,
7598 num_locks, locks,
7599 &async);
7600 if (!NT_STATUS_IS_OK(status)) {
7601 END_PROFILE(SMBlockingX);
7602 reply_nterror(req, status);
7603 return;
7604 }
7605 if (async) {
7606 END_PROFILE(SMBlockingX);
7607 return;
7608 }
7609
7610 reply_outbuf(req, 2, 0);
7611
7612 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7613 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7614
7615 END_PROFILE(SMBlockingX);
7616 chain_reply(req);
7617 }
7618
7619 #undef DBGC_CLASS
7620 #define DBGC_CLASS DBGC_ALL
7621
7622 /****************************************************************************
7623 Reply to a SMBreadbmpx (read block multiplex) request.
7624 Always reply with an error, if someone has a platform really needs this,
7625 please contact vl@samba.org
7626 ****************************************************************************/
7627
7628 void reply_readbmpx(struct smb_request *req)
7629 {
7630 START_PROFILE(SMBreadBmpx);
7631 reply_doserror(req, ERRSRV, ERRuseSTD);
7632 END_PROFILE(SMBreadBmpx);
7633 return;
7634 }
7635
7636 /****************************************************************************
7637 Reply to a SMBreadbs (read block multiplex secondary) request.
7638 Always reply with an error, if someone has a platform really needs this,
7639 please contact vl@samba.org
7640 ****************************************************************************/
7641
7642 void reply_readbs(struct smb_request *req)
7643 {
7644 START_PROFILE(SMBreadBs);
7645 reply_doserror(req, ERRSRV, ERRuseSTD);
7646 END_PROFILE(SMBreadBs);
7647 return;
7648 }
7649
7650 /****************************************************************************
7651 Reply to a SMBsetattrE.
7652 ****************************************************************************/
7653
7654 void reply_setattrE(struct smb_request *req)
7655 {
7656 connection_struct *conn = req->conn;
7657 struct smb_file_time ft;
7658 files_struct *fsp;
7659 NTSTATUS status;
7660
7661 START_PROFILE(SMBsetattrE);
7662 ZERO_STRUCT(ft);
7663
7664 if (req->wct < 7) {
7665 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7666 goto out;
7667 }
7668
7669 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7670
7671 if(!fsp || (fsp->conn != conn)) {
7672 reply_doserror(req, ERRDOS, ERRbadfid);
7673 goto out;
7674 }
7675
7676 /*
7677 * Convert the DOS times into unix times.
7678 */
7679
7680 ft.atime = convert_time_t_to_timespec(
7681 srv_make_unix_date2(req->vwv+3));
7682 ft.mtime = convert_time_t_to_timespec(
7683 srv_make_unix_date2(req->vwv+5));
7684 ft.create_time = convert_time_t_to_timespec(
7685 srv_make_unix_date2(req->vwv+1));
7686
7687 reply_outbuf(req, 0, 0);
7688
7689 /*
7690 * Patch from Ray Frush <frush@engr.colostate.edu>
7691 * Sometimes times are sent as zero - ignore them.
7692 */
7693
7694 /* Ensure we have a valid stat struct for the source. */
7695 status = vfs_stat_fsp(fsp);
7696 if (!NT_STATUS_IS_OK(status)) {
7697 reply_nterror(req, status);
7698 goto out;
7699 }
7700
7701 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7702 if (!NT_STATUS_IS_OK(status)) {
7703 reply_doserror(req, ERRDOS, ERRnoaccess);
7704 goto out;
7705 }
7706
7707 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7708 " createtime=%u\n",
7709 fsp->fnum,
7710 (unsigned int)ft.atime.tv_sec,
7711 (unsigned int)ft.mtime.tv_sec,
7712 (unsigned int)ft.create_time.tv_sec
7713 ));
7714 out:
7715 END_PROFILE(SMBsetattrE);
7716 return;
7717 }
7718
7719
7720 /* Back from the dead for OS/2..... JRA. */
7721
7722 /****************************************************************************
7723 Reply to a SMBwritebmpx (write block multiplex primary) request.
7724 Always reply with an error, if someone has a platform really needs this,
7725 please contact vl@samba.org
7726 ****************************************************************************/
7727
7728 void reply_writebmpx(struct smb_request *req)
7729 {
7730 START_PROFILE(SMBwriteBmpx);
7731 reply_doserror(req, ERRSRV, ERRuseSTD);
7732 END_PROFILE(SMBwriteBmpx);
7733 return;
7734 }
7735
7736 /****************************************************************************
7737 Reply to a SMBwritebs (write block multiplex secondary) request.
7738 Always reply with an error, if someone has a platform really needs this,
7739 please contact vl@samba.org
7740 ****************************************************************************/
7741
7742 void reply_writebs(struct smb_request *req)
7743 {
7744 START_PROFILE(SMBwriteBs);
7745 reply_doserror(req, ERRSRV, ERRuseSTD);
7746 END_PROFILE(SMBwriteBs);
7747 return;
7748 }
7749
7750 /****************************************************************************
7751 Reply to a SMBgetattrE.
7752 ****************************************************************************/
7753
7754 void reply_getattrE(struct smb_request *req)
7755 {
7756 connection_struct *conn = req->conn;
7757 SMB_STRUCT_STAT sbuf;
7758 int mode;
7759 files_struct *fsp;
7760 struct timespec create_ts;
7761
7762 START_PROFILE(SMBgetattrE);
7763
7764 if (req->wct < 1) {
7765 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7766 END_PROFILE(SMBgetattrE);
7767 return;
7768 }
7769
7770 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7771
7772 if(!fsp || (fsp->conn != conn)) {
7773 reply_doserror(req, ERRDOS, ERRbadfid);
7774 END_PROFILE(SMBgetattrE);
7775 return;
7776 }
7777
7778 /* Do an fstat on this file */
7779 if(fsp_stat(fsp, &sbuf)) {
7780 reply_nterror(req, map_nt_error_from_unix(errno));
7781 END_PROFILE(SMBgetattrE);
7782 return;
7783 }
7784
7785 fsp->fsp_name->st = sbuf;
7786
7787 mode = dos_mode(conn, fsp->fsp_name);
7788
7789 /*
7790 * Convert the times into dos times. Set create
7791 * date to be last modify date as UNIX doesn't save
7792 * this.
7793 */
7794
7795 reply_outbuf(req, 11, 0);
7796
7797 create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7798 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7799 srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7800 convert_timespec_to_time_t(sbuf.st_ex_atime));
7801 /* Should we check pending modtime here ? JRA */
7802 srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7803 convert_timespec_to_time_t(sbuf.st_ex_mtime));
7804
7805 if (mode & aDIR) {
7806 SIVAL(req->outbuf, smb_vwv6, 0);
7807 SIVAL(req->outbuf, smb_vwv8, 0);
7808 } else {
7809 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7810 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_ex_size);
7811 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7812 }
7813 SSVAL(req->outbuf,smb_vwv10, mode);
7814
7815 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7816
7817 END_PROFILE(SMBgetattrE);
7818 return;
7819 }
Samba GIT mirror