| blob | 343b7ee2b4913ebed865019b9280d9c7c6dbb0e3 |
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
55 /****************************************************************************
56 Reply to a tcon.
57 conn POINTER CAN BE NULL HERE !
58 ****************************************************************************/
61 {
68 NTSTATUS nt_status;
81 }
95 }
101 }
111 }
123 }
125 /****************************************************************************
126 Reply to a tcon and X.
127 conn POINTER CAN BE NULL HERE !
128 ****************************************************************************/
131 {
137 /* what the client thinks the device is */
139 /* what the server tells the client the share represents */
141 NTSTATUS nt_status;
159 }
164 /* we might have to close an old one */
167 NTSTATUS status;
173 /*
174 * TODO: cancel all outstanding requests on the tcon
175 */
181 /*
182 * If we hit this case, there is something completely
183 * wrong, so we better disconnect the transport connection.
184 */
188 }
191 /*
192 * This tree id is gone. Make sure we can't re-use it
193 * by accident.
194 */
196 }
202 }
208 }
216 }
218 /*
219 * the service name can be either: \\server\share
220 * or share directly like on the DELL PowerVault 705
221 */
228 }
232 }
242 }
252 }
257 }
262 }
268 }
270 /*
271 * If there is no application key defined yet
272 * we create one.
273 *
274 * This means we setup the application key on the
275 * first tcon that happens via the given session.
276 *
277 * Once the application key is defined, it does not
278 * change any more.
279 */
282 {
292 /*
293 * The application key is truncated/padded to 16 bytes
294 */
296 session_key,
303 }
307 NTSTATUS status;
317 }
319 }
321 /*
322 * Place the application key into the session_info
323 */
332 }
335 }
348 }
352 }
358 else
368 }
370 /* NT sets the fstype of IPC$ to the null string */
374 /* Return permissions. */
385 }
391 }
400 }
402 /* what does setting this bit do? It is set by NT4 and
403 may affect the ability to autorun mounted cdroms */
405 optional_support |=
412 }
415 }
421 service));
423 /* set the incoming and outgoing tid to the just created one */
430 }
432 /****************************************************************************
433 Reply to an unknown type.
434 ****************************************************************************/
437 {
442 }
444 /****************************************************************************
445 Reply to an ioctl.
446 conn POINTER CAN BE NULL HERE !
447 ****************************************************************************/
450 {
466 }
482 }
494 {
495 NTSTATUS status;
503 }
504 /* Job number */
514 }
519 lp_sub,
526 }
529 }
531 }
532 }
536 }
538 /****************************************************************************
539 Strange checkpath NTSTATUS mapping.
540 ****************************************************************************/
543 {
544 /* Strange DOS error code semantics only for checkpath... */
547 /* We need to map to ERRbadpath */
549 }
550 }
552 }
554 /****************************************************************************
555 Reply to a checkpath.
556 ****************************************************************************/
559 {
563 NTSTATUS status;
579 }
585 }
587 conn,
588 name,
589 ucf_flags,
590 twrp,
599 }
601 }
609 }
615 }
619 path_err:
620 /* We special case this - as when a Windows machine
621 is parsing a path is steps through the components
622 one at a time - if a component fails it expects
623 ERRbadpath, not ERRbadfile.
624 */
627 /*
628 * Windows returns different error codes if
629 * the parent directory is valid but not the
630 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
631 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
632 * if the path is invalid.
633 */
637 }
641 out:
645 }
647 /****************************************************************************
648 Reply to a getatr.
649 ****************************************************************************/
652 {
660 NTSTATUS status;
671 }
673 /*
674 * dos sometimes asks for a stat of "" - it returns a "hidden
675 * directory" under WfWg - weird!
676 */
681 }
690 }
692 conn,
693 fname,
694 ucf_flags,
695 twrp,
703 }
706 }
714 }
728 }
729 }
734 }
735 }
744 }
750 }
755 out:
760 }
762 /****************************************************************************
763 Reply to a setatr.
764 ****************************************************************************/
767 {
776 NTSTATUS status;
787 }
794 }
798 }
800 conn,
801 fname,
802 ucf_flags,
803 twrp,
811 }
814 }
817 /*
818 * Not sure here is the right place to catch this
819 * condition. Might be moved to somewhere else later -- vl
820 */
823 }
826 /* Can't set access rights on a symlink. */
829 }
837 else
843 FILE_WRITE_ATTRIBUTES);
847 }
853 }
854 }
862 }
867 mode));
868 out:
872 }
874 /****************************************************************************
875 Reply to a dskattr.
876 ****************************************************************************/
879 {
894 }
901 }
903 /*
904 * Force max to fit in 16 bit fields.
905 */
917 }
918 }
924 /* we need to scale this to a number that DOS6 can handle. We
925 use floating point so we can handle large drives on systems
926 that don't have 64 bit integers
928 we end up displaying a maximum of 2G to DOS systems
929 */
948 }
954 }
956 /****************************************************************************
957 Make a dir struct.
958 ****************************************************************************/
964 off_t size,
968 {
974 }
978 }
988 }
995 /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
996 Strange, but verified on W2K3. Needed for OS/2. JRA. */
1000 }
1002 /****************************************************************************
1003 Reply to a search.
1004 Can be called from SMBsearch, SMBffirst or SMBfunique.
1005 ****************************************************************************/
1008 {
1015 off_t size;
1028 NTSTATUS nt_status;
1044 }
1049 }
1051 /* If we were called as SMBffirst then we must expect close. */
1054 }
1065 }
1070 }
1072 p++;
1076 /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1085 conn,
1086 path,
1087 ucf_flags,
1097 }
1100 }
1105 /*
1106 * Open an fsp on this directory for the dptr.
1107 */
1114 FILE_SHARE_READ|
1135 }
1140 True,
1141 expect_close,
1143 mask,
1144 dirtype,
1150 /*
1151 * Use NULL here for the first parameter (req)
1152 * as this is not a client visible handle so
1153 * can'tbe part of an SMB1 chain.
1154 */
1158 }
1166 }
1175 }
1181 }
1186 }
1192 }
1197 }
1199 }
1212 }
1218 }
1224 }
1236 }
1241 mask,
1242 dirtype,
1247 check_descend,
1248 ask_sharemode);
1253 buf,
1254 mask,
1255 fname,
1256 size,
1257 mode,
1262 }
1265 }
1271 }
1272 numentries++;
1273 }
1274 }
1275 }
1277 SearchEmpty:
1279 /* If we were called as SMBffirst with smb_search_id == NULL
1280 and no entries were found then return error and close fsp->dptr
1281 (X/Open spec) */
1287 }
1289 /* Close the dptr - we know it's gone */
1293 }
1294 }
1296 /* If we were called as SMBfunique, then we can close the fsp->dptr now ! */
1299 /* fsp may have been closed above. */
1302 }
1303 }
1308 }
1315 /* The replies here are never long name. */
1322 }
1324 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1330 mask,
1331 directory,
1332 dirtype,
1333 numentries,
1334 maxentries ));
1335 out:
1341 }
1343 /****************************************************************************
1344 Reply to a fclose (stop directory search).
1345 ****************************************************************************/
1348 {
1354 NTSTATUS err;
1365 }
1374 }
1380 }
1382 p++;
1390 }
1396 }
1402 /* Close the file - we know it's gone */
1405 }
1414 }
1416 /****************************************************************************
1417 Reply to an open.
1418 ****************************************************************************/
1421 {
1439 NTSTATUS status;
1449 }
1460 }
1468 }
1474 }
1476 conn,
1477 fname,
1478 ucf_flags,
1479 twrp,
1485 NT_STATUS_PATH_NOT_COVERED,
1488 }
1491 }
1506 private_flags,
1515 /* We have re-scheduled this call. */
1517 }
1522 }
1525 req,
1526 smb_fname,
1527 access_mask,
1528 create_options,
1529 private_flags);
1534 }
1537 }
1538 }
1540 /* Ensure we're pointing at the correct stat struct. */
1556 }
1565 }
1572 }
1577 }
1578 out:
1581 }
1583 /****************************************************************************
1584 Reply to an open and X.
1585 ****************************************************************************/
1588 {
1595 /* Breakout the oplock request bits so we can set the
1596 reply bits separately. */
1600 #if 0
1603 #endif
1610 NTSTATUS status;
1627 }
1638 /* If it's an IPC, pass off the pipe handler. */
1644 }
1646 }
1648 /* XXXX we need to handle passed times, sattr and flags */
1654 }
1657 smb_ofun,
1664 }
1670 }
1673 conn,
1674 fname,
1675 ucf_flags,
1676 twrp,
1682 NT_STATUS_PATH_NOT_COVERED,
1685 }
1688 }
1703 private_flags,
1712 /* We have re-scheduled this call. */
1714 }
1719 }
1722 req,
1723 smb_fname,
1724 access_mask,
1725 create_options,
1726 private_flags);
1731 }
1734 }
1738 }
1740 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1741 if the file is truncated or created. */
1742 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1748 }
1754 }
1760 }
1761 }
1768 }
1771 /* If the caller set the extended oplock request bit
1772 and we granted one (by whatever means) - set the
1773 correct bit for extended oplock reply.
1774 */
1778 }
1782 }
1784 /* If the caller set the core oplock request bit
1785 and we granted one (by whatever means) - set the
1786 correct bit for core oplock reply.
1787 */
1793 }
1801 }
1806 }
1814 }
1821 }
1823 out:
1827 }
1829 /****************************************************************************
1830 Reply to a SMBulogoffX.
1831 ****************************************************************************/
1838 {
1842 NTSTATUS status;
1844 /*
1845 * Don't setup the profile charge here, take
1846 * it in reply_ulogoffX_done(). Not strictly correct
1847 * but better than the other SMB1 async
1848 * code that double-charges at the moment.
1849 */
1856 /* Not going async, profile here. */
1865 }
1869 /* Not going async, profile here. */
1874 }
1876 /* We're async. This will complete later. */
1879 }
1884 };
1888 /****************************************************************************
1889 Async SMB1 ulogoffX.
1890 Note, on failure here we deallocate and return NULL to allow the caller to
1891 SMB1 return an error of ERRnomem immediately.
1892 ****************************************************************************/
1896 {
1908 }
1914 }
1917 /*
1918 * Make sure that no new request will be able to use this session.
1919 * This ensures that once all outstanding fsp->aio_requests
1920 * on this session are done, we are safe to close it.
1921 */
1927 }
1928 /*
1929 * Flag the file as close in progress.
1930 * This will prevent any more IO being
1931 * done on it.
1932 */
1936 /*
1937 * Now wait until all aio requests on this fsp are
1938 * finished.
1939 *
1940 * We don't set a callback, as we just want to block the
1941 * wait queue and the talloc_free() of fsp->aio_request
1942 * will remove the item from the wait queue.
1943 */
1950 }
1951 }
1952 }
1954 /*
1955 * Now we add our own waiter to the end of the queue,
1956 * this way we get notified when all pending requests are finished
1957 * and reply to the outstanding SMB1 request.
1958 */
1965 }
1967 /*
1968 * We're really going async - move the SMB1 request from
1969 * a talloc stackframe above us to the sconn talloc-context.
1970 * We need this to stick around until the wait_done
1971 * callback is invoked.
1972 */
1978 }
1981 {
1988 }
1991 {
1993 }
1996 {
2002 NTSTATUS status;
2004 /*
2005 * Take the profile charge here. Not strictly
2006 * correct but better than the other SMB1 async
2007 * code that double-charges at the moment.
2008 */
2018 }
2026 }
2038 /*
2039 * The following call is needed to push the
2040 * reply data back out the socket after async
2041 * return. Plus it frees smb1req.
2042 */
2045 }
2047 /****************************************************************************
2048 Reply to a mknew or a create.
2049 ****************************************************************************/
2052 {
2061 NTSTATUS status;
2076 }
2082 /* We should fail if file exists. */
2085 /* Create if file doesn't exist, truncate if it does. */
2087 }
2089 /* mtime. */
2097 }
2102 }
2105 conn,
2106 fname,
2107 ucf_flags,
2108 twrp,
2114 NT_STATUS_PATH_NOT_COVERED,
2117 }
2120 }
2126 }
2150 /* We have re-scheduled this call. */
2152 }
2157 }
2158 }
2161 }
2168 }
2176 }
2181 }
2188 out:
2192 }
2194 /****************************************************************************
2195 Reply to a create temporary file.
2196 ****************************************************************************/
2199 {
2209 NTSTATUS status;
2220 }
2230 }
2236 wire_name,
2242 }
2247 }
2252 }
2254 conn,
2255 fname,
2256 ucf_flags,
2257 twrp,
2265 }
2268 }
2270 /* Create the file. */
2296 }
2300 /* We have re-scheduled this call. */
2302 }
2308 }
2309 }
2312 }
2315 }
2318 /* Collision after 10 times... */
2321 }
2326 /* the returned filename is relative to the directory */
2331 s++;
2332 }
2334 #if 0
2335 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2336 thing in the byte section. JRA */
2338 #endif
2343 }
2348 }
2353 }
2358 out:
2363 }
2365 /****************************************************************************
2366 Reply to a unlink
2367 ****************************************************************************/
2370 {
2376 NTSTATUS status;
2386 }
2395 }
2399 }
2401 conn,
2402 name,
2403 ucf_flags,
2404 twrp,
2412 }
2415 }
2422 /* We have re-scheduled this call. */
2424 }
2429 }
2430 }
2433 }
2436 out:
2440 }
2442 /****************************************************************************
2443 Fail for readbraw.
2444 ****************************************************************************/
2447 {
2453 }
2455 }
2457 /****************************************************************************
2458 Return a readbraw error (4 bytes of zero).
2459 ****************************************************************************/
2462 {
2470 /*
2471 * Try and give an error message saying what
2472 * client failed.
2473 */
2481 }
2483 }
2485 /*******************************************************************
2486 Ensure we don't use sendfile if server smb signing is active.
2487 ********************************************************************/
2490 {
2493 /* Using sendfile blows the brains out of any DOS or Win9x TCP stack... JRA. */
2496 }
2499 }
2503 }
2504 /****************************************************************************
2505 Use sendfile in readbraw.
2506 ****************************************************************************/
2511 off_t startpos,
2513 ssize_t mincount)
2514 {
2519 /*
2520 * We can only use sendfile on a non-chained packet
2521 * but we can use on a non-oplocked file. tridge proved this
2522 * on a train in Germany :-). JRA.
2523 * reply_readbraw has already checked the length.
2524 */
2532 DATA_BLOB header_blob;
2539 nread);
2541 /* Returning ENOSYS means no data at all was sent.
2542 * Do this as a normal read. */
2545 }
2547 /*
2548 * Special hack for broken Linux with no working sendfile. If we
2549 * return EINTR we sent the header but not the rest of the data.
2550 * Fake this up by doing read/write calls.
2551 */
2553 /* Ensure we don't do this again. */
2559 "fake_sendfile failed for "
2564 }
2566 }
2573 /*
2574 * Some sendfile implementations return 0 to indicate
2575 * that there was a short read, but nothing was
2576 * actually written to the socket. In this case,
2577 * fallback to the normal read path so the header gets
2578 * the correct byte count.
2579 */
2581 "bytes falling back to the normal read: "
2584 }
2586 /* Deal with possible short send. */
2592 }
2593 }
2595 }
2597 normal_readbraw:
2605 }
2612 #else
2615 #endif
2616 }
2621 /*
2622 * Try and give an error message saying what
2623 * client failed.
2624 */
2631 }
2634 }
2636 /****************************************************************************
2637 Reply to a readbraw (core+ protocol).
2638 ****************************************************************************/
2641 {
2646 off_t startpos;
2650 NTSTATUS status;
2657 }
2663 }
2671 }
2673 /*
2674 * Special check if an oplock break has been issued
2675 * and the readraw request croses on the wire, we must
2676 * return a zero length response here.
2677 */
2681 /*
2682 * We have to do a check_fsp by hand here, as
2683 * we must always return 4 zero bytes on error,
2684 * not a NTSTATUS.
2685 */
2693 {
2694 /*
2695 * fsp could be NULL here so use the value from the packet. JRA.
2696 */
2703 }
2705 /* Do a "by hand" version of CHECK_READ. */
2714 }
2718 /*
2719 * This is a large offset (64 bit) read.
2720 */
2731 }
2732 }
2737 /* ensure we don't overrun the packet size */
2744 READ_LOCK,
2752 }
2757 }
2763 }
2768 #endif
2783 }
2785 #undef DBGC_CLASS
2786 #define DBGC_CLASS DBGC_LOCKING
2788 /****************************************************************************
2789 Reply to a lockread (core+ protocol).
2790 ****************************************************************************/
2795 {
2807 }
2814 }
2820 }
2827 }
2829 /*
2830 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2831 * protocol request that predates the read/write lock concept.
2832 * Thus instead of asking for a read lock here we need to ask
2833 * for a write lock. JRA.
2834 * Note that the requested lock size is unaffected by max_send.
2835 */
2844 };
2847 fsp,
2850 fsp,
2854 lck);
2859 }
2862 }
2865 {
2869 NTSTATUS status;
2871 off_t startpos;
2887 }
2893 }
2898 /*
2899 * However the requested READ size IS affected by max_send. Insanity.... JRA.
2900 */
2905 "maximum allowed (%zu/%d). "
2906 "Returning short read of maximum allowed for "
2908 numtoread,
2909 maxtoread,
2912 }
2923 }
2936 send:
2942 NULL);
2945 }
2949 }
2951 #undef DBGC_CLASS
2952 #define DBGC_CLASS DBGC_ALL
2954 /****************************************************************************
2955 Reply to a read.
2956 ****************************************************************************/
2959 {
2965 off_t startpos;
2976 }
2983 }
2989 }
2994 /*
2995 * The requested read size cannot be greater than max_send. JRA.
2996 */
3005 }
3015 READ_LOCK,
3023 }
3031 }
3043 out:
3046 }
3048 /****************************************************************************
3049 Setup readX header.
3050 ****************************************************************************/
3053 {
3057 False);
3072 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3076 }
3078 /****************************************************************************
3079 Reply to a read and X - possibly using sendfile.
3080 ****************************************************************************/
3085 {
3090 NTSTATUS status;
3096 READ_LOCK,
3103 }
3105 /*
3106 * We can only use sendfile on a non-chained packet
3107 * but we can use on a non-oplocked file. tridge proved this
3108 * on a train in Germany :-). JRA.
3109 */
3116 DATA_BLOB header;
3122 }
3127 /*
3128 * We already know that we would do a short read, so don't
3129 * try the sendfile() path.
3130 */
3132 }
3134 /*
3135 * Set up the packet header before send. We
3136 * assume here the sendfile will work (get the
3137 * correct amount of data).
3138 */
3150 /* Returning ENOSYS means no data at all was sent.
3151 Do this as a normal read. */
3154 }
3156 /*
3157 * Special hack for broken Linux with no working sendfile. If we
3158 * return EINTR we sent the header but not the rest of the data.
3159 * Fake this up by doing read/write calls.
3160 */
3163 /* Ensure we don't do this again. */
3167 smb_maxcnt);
3171 "fake_sendfile failed for "
3172 "file %s (%s) for client %s. "
3179 }
3182 /* No outbuf here means successful sendfile. */
3184 }
3191 /*
3192 * Some sendfile implementations return 0 to indicate
3193 * that there was a short read, but nothing was
3194 * actually written to the socket. In this case,
3195 * fallback to the normal read path so the header gets
3196 * the correct byte count.
3197 */
3202 }
3207 /* Deal with possible short send. */
3209 ssize_t ret;
3219 }
3220 }
3221 /* No outbuf here means successful sendfile. */
3225 }
3227 normal_read:
3231 ssize_t ret;
3236 /*
3237 * We already know that we would do a short
3238 * read, so don't try the sendfile() path.
3239 */
3241 }
3246 /* Send out the header. */
3251 /*
3252 * Try and give an error message saying what
3253 * client failed.
3254 */
3262 }
3273 }
3275 }
3277 nosendfile_read:
3290 }
3298 out:
3301 }
3303 /****************************************************************************
3304 Work out how much space we have for a read return.
3305 ****************************************************************************/
3308 {
3313 }
3317 }
3321 }
3324 /*
3325 * Don't take encrypted traffic up to the
3326 * limit. There are padding considerations
3327 * that make that tricky.
3328 */
3330 }
3334 }
3338 }
3340 /*
3341 * We can do ultra-large POSIX reads.
3342 */
3344 }
3346 /****************************************************************************
3347 Calculate how big a read can be. Copes with all clients. It's always
3348 safe to return a short read - Windows does this.
3349 ****************************************************************************/
3354 {
3361 /*
3362 * Windows explicitly ignores upper size of 0xFFFF.
3363 * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3364 * We must do the same as these will never fit even in
3365 * an extended size NetBIOS packet.
3366 */
3369 }
3373 }
3377 /*
3378 * LARGE_READX test shows it's always safe to return
3379 * a short read. Windows does so.
3380 */
3382 }
3384 /****************************************************************************
3385 Reply to a read and X.
3386 ****************************************************************************/
3389 {
3392 off_t startpos;
3396 #if 0
3398 #endif
3405 }
3411 /* If it's an IPC, pass off the pipe handler. */
3416 }
3421 }
3427 }
3432 /*
3433 * This is a heuristic to avoid keeping large
3434 * outgoing buffers around over long-lived aio
3435 * requests.
3436 */
3438 }
3441 /*
3442 * This is a large offset (64 bit) read.
3443 */
3446 }
3450 req,
3451 fsp,
3452 startpos,
3453 smb_maxcnt);
3455 /* Read scheduled - we're done. */
3457 }
3459 /* Real error - report to client. */
3463 }
3464 /* NT_STATUS_RETRY - fall back to sync read. */
3465 }
3471 out:
3474 }
3476 /****************************************************************************
3477 Error replies to writebraw must have smb_wct == 1. Fix this up.
3478 ****************************************************************************/
3481 {
3488 }
3490 /****************************************************************************
3491 Read 4 bytes of a smb packet and return the smb length of the packet.
3492 Store the result in the buffer. This version of the function will
3493 never return a session keepalive (length of zero).
3494 Timeout is in milliseconds.
3495 ****************************************************************************/
3499 {
3503 NTSTATUS status;
3506 len);
3509 /* Try and give an error message
3510 * saying what client failed. */
3516 }
3519 }
3525 }
3527 /****************************************************************************
3528 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3529 ****************************************************************************/
3532 {
3540 off_t startpos;
3545 NTSTATUS status;
3549 /*
3550 * If we ever reply with an error, it must have the SMB command
3551 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3552 * we're finished.
3553 */
3560 }
3567 }
3576 }
3583 }
3590 }
3596 /* We have to deal with slightly different formats depending
3597 on whether we are using the core+ or lanman1.0 protocol */
3605 }
3607 /* Ensure we don't write bytes past the end of this packet. */
3608 /*
3609 * This already protects us against CVE-2017-12163.
3610 */
3616 }
3623 WRITE_LOCK,
3632 }
3633 }
3637 }
3648 }
3652 /* Allocate a buffer of 64k + length. */
3658 }
3660 /* Return a SMBwritebraw message to the redirector to tell
3661 * it to send more bytes */
3669 buf,
3675 }
3677 /* Now read the raw data into the buffer and write it */
3682 }
3684 /* Set up outbuf to return the correct size */
3694 }
3700 }
3703 numtowrite);
3706 /* Try and give an error message
3707 * saying what client failed. */
3709 "raw read failed (%s) for client %s. "
3713 }
3715 /*
3716 * We are not vulnerable to CVE-2017-12163
3717 * here as we are guaranteed to have numtowrite
3718 * bytes available - we just read from the client.
3719 */
3726 }
3731 }
3735 }
3736 }
3748 }
3755 /* We won't return a status if write through is not selected - this
3756 * follows what WfWg does */
3761 #if RABBIT_PELLET_FIX
3762 /*
3763 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3764 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
3765 * JRA.
3766 */
3770 }
3771 #endif
3773 }
3776 out:
3779 }
3781 #undef DBGC_CLASS
3782 #define DBGC_CLASS DBGC_LOCKING
3784 /****************************************************************************
3785 Reply to a writeunlock (core+).
3786 ****************************************************************************/
3789 {
3794 off_t startpos;
3807 }
3814 }
3820 }
3826 /*
3827 * Ensure client isn't asking us to write more than
3828 * they sent. CVE-2017-12163.
3829 */
3835 }
3842 WRITE_LOCK,
3850 }
3851 }
3853 /* The special X/Open SMB protocol handling of
3854 zero length writes is *NOT* done for
3855 this call */
3861 }
3869 }
3874 }
3879 }
3889 };
3894 }
3895 }
3904 out:
3907 }
3909 #undef DBGC_CLASS
3910 #define DBGC_CLASS DBGC_ALL
3912 /****************************************************************************
3913 Reply to a write.
3914 ****************************************************************************/
3917 {
3922 off_t startpos;
3926 NTSTATUS status;
3935 }
3937 /* If it's an IPC, pass off the pipe handler. */
3942 }
3949 }
3955 }
3961 /*
3962 * Ensure client isn't asking us to write more than
3963 * they sent. CVE-2017-12163.
3964 */
3970 }
3977 WRITE_LOCK,
3985 }
3986 }
3988 /*
3989 * X/Open SMB protocol says that if smb_vwv1 is
3990 * zero then the file size should be extended or
3991 * truncated to the size given in smb_vwv[2-3].
3992 */
3995 /*
3996 * This is actually an allocate call, and set EOF. JRA.
3997 */
4002 }
4007 }
4011 }
4019 }
4024 }
4029 }
4038 }
4042 out:
4045 }
4047 /****************************************************************************
4048 Ensure a buffer is a valid writeX for recvfile purposes.
4049 ****************************************************************************/
4057 {
4064 NTSTATUS status;
4067 /* Can't do this on encrypted
4068 * connections. */
4070 }
4074 }
4081 }
4085 fnum,
4091 }
4096 }
4100 }
4105 }
4109 }
4113 }
4120 }
4125 }
4127 /* Ensure the sizes match up. */
4129 /* no pad byte...old smbclient :-( */
4134 }
4143 }
4152 }
4154 /****************************************************************************
4155 Reply to a write and X.
4156 ****************************************************************************/
4159 {
4164 off_t startpos;
4167 ssize_t nwritten;
4171 NTSTATUS status;
4179 }
4189 }
4192 /* Can't do a recvfile write on IPC$ */
4196 }
4200 }
4202 /*
4203 * This already protects us against CVE-2017-12163.
4204 */
4209 }
4210 }
4212 /* If it's an IPC, pass off the pipe handler. */
4217 }
4220 }
4228 }
4233 }
4238 /*
4239 * This is a large offset (64 bit) write.
4240 */
4243 }
4245 /* X/Open SMB protocol says that, unlike SMBwrite
4246 if the length is zero then NO truncation is
4247 done, just a write of zero. To truncate a file,
4248 use SMBwrite. */
4255 req,
4256 fsp,
4257 data,
4258 startpos,
4259 numtowrite);
4262 /* write scheduled - we're done. */
4264 }
4266 /* Real error - report to client. */
4269 }
4270 /* NT_STATUS_RETRY - fall through to sync write. */
4271 }
4277 WRITE_LOCK,
4284 }
4288 }
4293 }
4298 }
4315 }
4320 out:
4322 /* writeX failed. drain socket. */
4326 }
4328 }
4332 }
4334 /****************************************************************************
4335 Reply to a lseek.
4336 ****************************************************************************/
4339 {
4341 off_t startpos;
4345 NTSTATUS status;
4353 }
4359 }
4362 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4381 }
4393 }
4398 }
4399 }
4405 }
4406 }
4418 }
4422 {
4428 }
4431 }
4436 }
4439 }
4441 /****************************************************************************
4442 Reply to a flush.
4443 ****************************************************************************/
4446 {
4456 }
4463 }
4475 }
4478 }
4479 }
4486 }
4488 /****************************************************************************
4489 Reply to a exit.
4490 conn POINTER CAN BE NULL HERE !
4491 ****************************************************************************/
4497 {
4500 /*
4501 * Don't setup the profile charge here, take
4502 * it in reply_exit_done(). Not strictly correct
4503 * but better than the other SMB1 async
4504 * code that double-charges at the moment.
4505 */
4508 /* Not going async, profile here. */
4513 }
4515 /* We're async. This will complete later. */
4518 }
4522 };
4526 /****************************************************************************
4527 Async SMB1 exit.
4528 Note, on failure here we deallocate and return NULL to allow the caller to
4529 SMB1 return an error of ERRnomem immediately.
4530 ****************************************************************************/
4533 {
4544 }
4550 }
4555 }
4558 }
4559 /*
4560 * Flag the file as close in progress.
4561 * This will prevent any more IO being
4562 * done on it.
4563 */
4567 /*
4568 * Now wait until all aio requests on this fsp are
4569 * finished.
4570 *
4571 * We don't set a callback, as we just want to block the
4572 * wait queue and the talloc_free() of fsp->aio_request
4573 * will remove the item from the wait queue.
4574 */
4581 }
4582 }
4583 }
4585 /*
4586 * Now we add our own waiter to the end of the queue,
4587 * this way we get notified when all pending requests are finished
4588 * and reply to the outstanding SMB1 request.
4589 */
4596 }
4598 /*
4599 * We're really going async - move the SMB1 request from
4600 * a talloc stackframe above us to the conn talloc-context.
4601 * We need this to stick around until the wait_done
4602 * callback is invoked.
4603 */
4609 }
4612 {
4619 }
4622 {
4624 }
4627 {
4635 NTSTATUS status;
4637 /*
4638 * Take the profile charge here. Not strictly
4639 * correct but better than the other SMB1 async
4640 * code that double-charges at the moment.
4641 */
4651 }
4653 /*
4654 * Ensure the session is still valid.
4655 */
4658 now,
4664 }
4666 /*
4667 * Ensure the vuid is still valid - no one
4668 * called reply_ulogoffX() in the meantime.
4669 * reply_exit() doesn't have AS_USER set, so
4670 * use set_current_user_info() directly.
4671 * This is the same logic as in switch_message().
4672 */
4678 }
4680 /* No more aio - do the actual closes. */
4687 }
4690 }
4693 }
4695 /*
4696 * reply_exit() has the DO_CHDIR flag set.
4697 */
4703 }
4705 }
4708 /*
4709 * The following call is needed to push the
4710 * reply data back out the socket after async
4711 * return. Plus it frees smb1req.
4712 */
4717 }
4724 {
4734 }
4738 /*
4739 * We can only use check_fsp if we know it's not a directory.
4740 */
4746 }
4757 /*
4758 * Take care of any time sent in the close.
4759 */
4763 }
4772 }
4773 /* We're async. This will complete later. */
4777 }
4779 /*
4780 * close_file_free() returns the unix errno if an error was detected on
4781 * close - normally this is due to a disk full error. If not then it
4782 * was probably an I/O error.
4783 */
4786 done:
4791 }
4796 }
4801 };
4805 /****************************************************************************
4806 Async SMB1 close.
4807 Note, on failure here we deallocate and return NULL to allow the caller to
4808 SMB1 return an error of ERRnomem immediately.
4809 ****************************************************************************/
4813 {
4823 }
4829 }
4831 /*
4832 * Flag the file as close in progress.
4833 * This will prevent any more IO being
4834 * done on it.
4835 */
4838 /*
4839 * Now wait until all aio requests on this fsp are
4840 * finished.
4841 *
4842 * We don't set a callback, as we just want to block the
4843 * wait queue and the talloc_free() of fsp->aio_request
4844 * will remove the item from the wait queue.
4845 */
4852 }
4854 /*
4855 * Now we add our own waiter to the end of the queue,
4856 * this way we get notified when all pending requests are finished
4857 * and reply to the outstanding SMB1 request.
4858 */
4865 }
4867 /*
4868 * We're really going async - move the SMB1 request from
4869 * a talloc stackframe above us to the conn talloc-context.
4870 * We need this to stick around until the wait_done
4871 * callback is invoked.
4872 */
4878 }
4881 {
4888 }
4891 {
4893 }
4896 {
4901 NTSTATUS status;
4909 }
4916 }
4917 /*
4918 * The following call is needed to push the
4919 * reply data back out the socket after async
4920 * return. Plus it frees smb1req.
4921 */
4923 }
4925 /****************************************************************************
4926 Reply to a writeclose (Core+ protocol).
4927 ****************************************************************************/
4930 {
4936 off_t startpos;
4948 }
4955 }
4960 }
4967 /*
4968 * Ensure client isn't asking us to write more than
4969 * they sent. CVE-2017-12163.
4970 */
4976 }
4983 WRITE_LOCK,
4991 }
4992 }
4998 /*
4999 * More insanity. W2K only closes the file if writelen > 0.
5000 * JRA.
5001 */
5011 }
5016 }
5021 }
5027 out:
5031 }
5033 #undef DBGC_CLASS
5034 #define DBGC_CLASS DBGC_LOCKING
5036 /****************************************************************************
5037 Reply to a lock.
5038 ****************************************************************************/
5043 {
5055 }
5062 }
5069 }
5078 };
5087 fsp,
5090 fsp,
5094 lck);
5099 }
5102 }
5105 {
5107 NTSTATUS status;
5122 }
5129 NULL);
5132 }
5135 }
5137 /****************************************************************************
5138 Reply to a unlock.
5139 ****************************************************************************/
5142 {
5144 NTSTATUS status;
5154 }
5161 }
5170 };
5178 }
5190 }
5192 #undef DBGC_CLASS
5193 #define DBGC_CLASS DBGC_ALL
5195 /****************************************************************************
5196 Reply to a tdis.
5197 conn POINTER CAN BE NULL HERE !
5198 ****************************************************************************/
5204 {
5208 /*
5209 * Don't setup the profile charge here, take
5210 * it in reply_tdis_done(). Not strictly correct
5211 * but better than the other SMB1 async
5212 * code that double-charges at the moment.
5213 */
5216 /* Not going async, profile here. */
5222 }
5226 /* Not going async, profile here. */
5231 }
5232 /* We're async. This will complete later. */
5235 }
5239 };
5243 /****************************************************************************
5244 Async SMB1 tdis.
5245 Note, on failure here we deallocate and return NULL to allow the caller to
5246 SMB1 return an error of ERRnomem immediately.
5247 ****************************************************************************/
5250 {
5261 }
5266 }
5268 /*
5269 * Make sure that no new request will be able to use this tcon.
5270 * This ensures that once all outstanding fsp->aio_requests
5271 * on this tcon are done, we are safe to close it.
5272 */
5278 }
5279 /*
5280 * Flag the file as close in progress.
5281 * This will prevent any more IO being
5282 * done on it. Not strictly needed, but
5283 * doesn't hurt to flag it as closing.
5284 */
5288 /*
5289 * Now wait until all aio requests on this fsp are
5290 * finished.
5291 *
5292 * We don't set a callback, as we just want to block the
5293 * wait queue and the talloc_free() of fsp->aio_request
5294 * will remove the item from the wait queue.
5295 */
5302 }
5303 }
5304 }
5306 /*
5307 * Now we add our own waiter to the end of the queue,
5308 * this way we get notified when all pending requests are finished
5309 * and reply to the outstanding SMB1 request.
5310 */
5317 }
5319 /*
5320 * We're really going async - move the SMB1 request from
5321 * a talloc stackframe above us to the sconn talloc-context.
5322 * We need this to stick around until the wait_done
5323 * callback is invoked.
5324 */
5330 }
5333 {
5340 }
5343 {
5345 }
5348 {
5351 NTSTATUS status;
5355 /*
5356 * Take the profile charge here. Not strictly
5357 * correct but better than the other SMB1 async
5358 * code that double-charges at the moment.
5359 */
5369 }
5371 /*
5372 * As we've been awoken, we may have changed
5373 * directory in the meantime.
5374 * reply_tdis() has the DO_CHDIR flag set.
5375 */
5381 }
5390 }
5392 /* smbXsrv_tcon_disconnect frees smb1req->conn. */
5398 /*
5399 * The following call is needed to push the
5400 * reply data back out the socket after async
5401 * return. Plus it frees smb1req.
5402 */
5405 }
5407 /****************************************************************************
5408 Reply to a echo.
5409 conn POINTER CAN BE NULL HERE !
5410 ****************************************************************************/
5413 {
5428 }
5434 /* copy any incoming data back out */
5437 }
5442 }
5446 /* this makes sure we catch the request pcd */
5452 }
5461 cur_pcd))
5463 }
5471 }
5473 /****************************************************************************
5474 Reply to a printopen.
5475 ****************************************************************************/
5478 {
5481 NTSTATUS status;
5489 }
5495 }
5502 }
5504 /* Open for exclusive use, write only. */
5512 }
5522 }
5524 /****************************************************************************
5525 Reply to a printclose.
5526 ****************************************************************************/
5529 {
5532 NTSTATUS status;
5540 }
5547 }
5553 }
5564 }
5570 }
5572 /****************************************************************************
5573 Reply to a printqueue.
5574 ****************************************************************************/
5577 {
5590 }
5595 /* we used to allow the client to get the cnum wrong, but that
5596 is really quite gross and only worked when there was only
5597 one printer - I think we should now only accept it if they
5598 get it right (tridge) */
5603 }
5614 {
5616 NTSTATUS status;
5617 WERROR werr;
5644 }
5650 sharename,
5652 SEC_FLAG_MAXIMUM_ALLOWED,
5658 }
5662 }
5675 }
5681 }
5687 }
5702 }
5714 }
5721 }
5722 }
5730 }
5736 out:
5739 }
5741 }
5745 }
5747 /****************************************************************************
5748 Reply to a printwrite.
5749 ****************************************************************************/
5752 {
5764 }
5771 }
5777 }
5783 }
5787 /*
5788 * This already protects us against CVE-2017-12163.
5789 */
5794 }
5802 }
5810 }
5812 /****************************************************************************
5813 Reply to a mkdir.
5814 ****************************************************************************/
5817 {
5822 NTSTATUS status;
5834 }
5839 }
5841 conn,
5842 directory,
5843 ucf_flags,
5844 twrp,
5852 }
5855 }
5865 NT_STATUS_OBJECT_NAME_COLLISION)) {
5866 /*
5867 * Yes, in the DOS error code case we get a
5868 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5869 * samba4 torture test.
5870 */
5872 }
5876 }
5881 out:
5885 }
5887 /****************************************************************************
5888 Reply to a rmdir.
5889 ****************************************************************************/
5892 {
5896 NTSTATUS status;
5911 }
5915 }
5917 conn,
5918 directory,
5919 ucf_flags,
5920 twrp,
5928 }
5931 }
5940 FILE_SHARE_DELETE),
5956 /* We have re-scheduled this call. */
5958 }
5963 }
5964 }
5967 }
5974 }
5982 }
5989 }
5992 out:
5996 }
5998 /****************************************************************************
5999 Reply to a mv.
6000 ****************************************************************************/
6003 {
6009 NTSTATUS status;
6027 }
6037 }
6038 p++;
6044 }
6047 /* The newname must begin with a ':' if the
6048 name contains a ':'. */
6053 }
6055 }
6056 }
6060 }
6062 conn,
6063 name,
6064 src_ucf_flags,
6065 src_twrp,
6074 }
6077 }
6081 }
6083 conn,
6084 newname,
6085 dst_ucf_flags,
6086 dst_twrp,
6095 }
6098 }
6100 /* Get the last component of the destination for rename_internals(). */
6102 conn,
6103 newname,
6104 dst_ucf_flags);
6108 }
6111 /* smb_fname_dst->base_name must be the same as
6112 smb_fname_src->base_name. */
6119 }
6120 }
6126 conn,
6127 req,
6129 smb_fname_src,
6131 smb_fname_dst,
6132 dst_original_lcomp,
6133 attrs,
6135 DELETE_ACCESS);
6138 /* We have re-scheduled this call. */
6140 }
6145 }
6146 }
6149 }
6152 out:
6157 }
6159 /****************************************************************************
6160 Reply to a file copy.
6162 From MS-CIFS.
6164 This command was introduced in the LAN Manager 1.0 dialect
6165 It was rendered obsolete in the NT LAN Manager dialect.
6166 This command was used to perform server-side file copies, but
6167 is no longer used. Clients SHOULD
6168 NOT send requests using this command code.
6169 Servers receiving requests with this command code
6170 SHOULD return STATUS_NOT_IMPLEMENTED (ERRDOS/ERRbadfunc).
6171 ****************************************************************************/
6174 {
6179 }
6181 #undef DBGC_CLASS
6182 #define DBGC_CLASS DBGC_LOCKING
6184 /****************************************************************************
6185 Get a lock pid, dealing with large count requests.
6186 ****************************************************************************/
6190 {
6193 else
6195 }
6197 /****************************************************************************
6198 Get a lock count, dealing with large count requests.
6199 ****************************************************************************/
6203 {
6209 /*
6210 * No BVAL, this is reversed!
6211 */
6214 }
6217 }
6219 /****************************************************************************
6220 Reply to a lockingX request.
6221 ****************************************************************************/
6226 {
6248 }
6261 }
6266 /* we don't support these - and CANCEL_LOCK makes w2k
6267 and XP reboot so I don't really want to be
6268 compatible! (tridge) */
6272 }
6274 /* Check if this is an oplock break on a file
6275 we have granted an oplock on.
6276 */
6278 /* Client can insist on breaking to none. */
6286 /*
6287 * Make sure we have granted an exclusive or batch oplock on
6288 * this file.
6289 */
6293 /* The Samba4 nbench simulator doesn't understand
6294 the difference between break to level2 and break
6295 to none from level2 - it sends oplock break
6296 replies in both cases. Don't keep logging an error
6297 message here - just ignore it. JRA. */
6300 "client for %s (oplock=%d) and no "
6305 /* if this is a pure oplock break request then don't
6306 * send a reply */
6310 }
6315 }
6322 }
6327 /* Hmmm. Is this panic justified? */
6329 }
6331 /* if this is a pure oplock break request then don't send a
6332 * reply */
6334 /* Sanity check - ensure a pure oplock break is not a
6335 chained request. */
6340 }
6343 }
6344 }
6351 }
6363 }
6365 /*
6366 * Data now points at the beginning of the list of
6367 * smb_unlkrng structs
6368 */
6380 }
6382 /*
6383 * Unlock cancels pending locks
6384 */
6387 fsp,
6388 large_file_format,
6390 NT_STATUS_OK);
6397 }
6406 }
6407 }
6409 /* Now do any requested locks */
6412 /* Data now points at the beginning of the list
6413 of smb_lkrng structs */
6419 }
6426 }
6435 }
6442 /* See smbtorture3 lock11 test */
6444 /* andx chain ends */
6449 }
6452 fsp,
6453 large_file_format,
6455 NT_STATUS_FILE_LOCK_CONFLICT);
6461 }
6468 }
6471 fsp,
6474 fsp,
6475 lock_timeout,
6476 large_file_format,
6477 num_locks,
6478 locks);
6483 }
6486 }
6489 {
6491 NTSTATUS status;
6510 }
6517 NULL);
6520 }
6523 }
6525 #undef DBGC_CLASS
6526 #define DBGC_CLASS DBGC_ALL
6528 /****************************************************************************
6529 Reply to a SMBreadbmpx (read block multiplex) request.
6530 Always reply with an error, if someone has a platform really needs this,
6531 please contact vl@samba.org
6532 ****************************************************************************/
6535 {
6540 }
6542 /****************************************************************************
6543 Reply to a SMBreadbs (read block multiplex secondary) request.
6544 Always reply with an error, if someone has a platform really needs this,
6545 please contact vl@samba.org
6546 ****************************************************************************/
6549 {
6554 }
6556 /****************************************************************************
6557 Reply to a SMBsetattrE.
6558 ****************************************************************************/
6561 {
6565 NTSTATUS status;
6573 }
6580 }
6582 /*
6583 * Convert the DOS times into unix times.
6584 */
6595 /*
6596 * Patch from Ray Frush <frush@engr.colostate.edu>
6597 * Sometimes times are sent as zero - ignore them.
6598 */
6600 /* Ensure we have a valid stat struct for the source. */
6605 }
6610 }
6616 }
6620 }
6628 ));
6629 out:
6632 }
6635 /* Back from the dead for OS/2..... JRA. */
6637 /****************************************************************************
6638 Reply to a SMBwritebmpx (write block multiplex primary) request.
6639 Always reply with an error, if someone has a platform really needs this,
6640 please contact vl@samba.org
6641 ****************************************************************************/
6644 {
6649 }
6651 /****************************************************************************
6652 Reply to a SMBwritebs (write block multiplex secondary) request.
6653 Always reply with an error, if someone has a platform really needs this,
6654 please contact vl@samba.org
6655 ****************************************************************************/
6658 {
6663 }
6665 /****************************************************************************
6666 Reply to a SMBgetattrE.
6667 ****************************************************************************/
6670 {
6675 NTSTATUS status;
6683 }
6691 }
6693 /* Do an fstat on this file */
6699 }
6703 /*
6704 * Convert the times into dos times. Set create
6705 * date to be last modify date as UNIX doesn't save
6706 * this.
6707 */
6715 /* Should we check pending modtime here ? JRA */
6726 }
6733 }
6735 /****************************************************************************
6736 Reply to a SMBfindclose (stop trans2 directory search).
6737 ****************************************************************************/
6740 {
6751 }
6757 /*
6758 * OS/2 seems to use -1 to indicate "close all directories"
6759 * This has to mean on this specific connection struct.
6760 */
6768 }
6769 }
6777 }
6779 /****************************************************************************
6780 Reply to a SMBfindnclose (stop FINDNOTIFYFIRST directory search).
6781 ****************************************************************************/
6784 {
6793 }
6799 /* We never give out valid handles for a
6800 findnotifyfirst - so any dptr_num is ok here.
6801 Just ignore it. */
6809 }