?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r21121: Fix error message, based on RAW-NOTIFY
[Samba/bb.git] / source3 / smbd / nttrans.c
blob7483073a5876866c8cf23ec2c205bc527ef810cc
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 extern int max_send;
25 extern enum protocol_types Protocol;
26 extern int smb_read_error;
27 extern struct current_user current_user;
28
29 static const char *known_nt_pipes[] = {
30 "\\LANMAN",
31 "\\srvsvc",
32 "\\samr",
33 "\\wkssvc",
34 "\\NETLOGON",
35 "\\ntlsa",
36 "\\ntsvcs",
37 "\\lsass",
38 "\\lsarpc",
39 "\\winreg",
40 "\\initshutdown",
41 "\\spoolss",
42 "\\netdfs",
43 "\\rpcecho",
44 "\\svcctl",
45 "\\eventlog",
46 "\\unixinfo",
47 NULL
48 };
49
50 static char *nttrans_realloc(char **ptr, size_t size)
51 {
52 if (ptr==NULL) {
53 smb_panic("nttrans_realloc() called with NULL ptr\n");
54 }
55
56 *ptr = (char *)SMB_REALLOC(*ptr, size);
57 if(*ptr == NULL) {
58 return NULL;
59 }
60 memset(*ptr,'\0',size);
61 return *ptr;
62 }
63
64 /****************************************************************************
65 Send the required number of replies back.
66 We assume all fields other than the data fields are
67 set correctly for the type of call.
68 HACK ! Always assumes smb_setup field is zero.
69 ****************************************************************************/
70
71 int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
72 char *params, int paramsize, char *pdata, int datasize)
73 {
74 int data_to_send = datasize;
75 int params_to_send = paramsize;
76 int useable_space;
77 char *pp = params;
78 char *pd = pdata;
79 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80 int alignment_offset = 3;
81 int data_alignment_offset = 0;
82
83 /*
84 * Initially set the wcnt area to be 18 - this is true for all
85 * transNT replies.
86 */
87
88 set_message(outbuf,18,0,True);
89
90 if (NT_STATUS_V(nt_error)) {
91 ERROR_NT(nt_error);
92 }
93
94 /*
95 * If there genuinely are no parameters or data to send just send
96 * the empty packet.
97 */
98
99 if(params_to_send == 0 && data_to_send == 0) {
100 show_msg(outbuf);
101 if (!send_smb(smbd_server_fd(),outbuf)) {
102 exit_server_cleanly("send_nt_replies: send_smb failed.");
103 }
104 return 0;
105 }
106
107 /*
108 * When sending params and data ensure that both are nicely aligned.
109 * Only do this alignment when there is also data to send - else
110 * can cause NT redirector problems.
111 */
112
113 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
114 data_alignment_offset = 4 - (params_to_send % 4);
115 }
116
117 /*
118 * Space is bufsize minus Netbios over TCP header minus SMB header.
119 * The alignment_offset is to align the param bytes on a four byte
120 * boundary (2 bytes for data len, one byte pad).
121 * NT needs this to work correctly.
122 */
123
124 useable_space = bufsize - ((smb_buf(outbuf)+
125 alignment_offset+data_alignment_offset) -
126 outbuf);
127
128 /*
129 * useable_space can never be more than max_send minus the
130 * alignment offset.
131 */
132
133 useable_space = MIN(useable_space,
134 max_send - (alignment_offset+data_alignment_offset));
135
136
137 while (params_to_send || data_to_send) {
138
139 /*
140 * Calculate whether we will totally or partially fill this packet.
141 */
142
143 total_sent_thistime = params_to_send + data_to_send +
144 alignment_offset + data_alignment_offset;
145
146 /*
147 * We can never send more than useable_space.
148 */
149
150 total_sent_thistime = MIN(total_sent_thistime, useable_space);
151
152 set_message(outbuf, 18, total_sent_thistime, True);
153
154 /*
155 * Set total params and data to be sent.
156 */
157
158 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
159 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
160
161 /*
162 * Calculate how many parameters and data we can fit into
163 * this packet. Parameters get precedence.
164 */
165
166 params_sent_thistime = MIN(params_to_send,useable_space);
167 data_sent_thistime = useable_space - params_sent_thistime;
168 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
169
170 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
171
172 if(params_sent_thistime == 0) {
173 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
174 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
175 } else {
176 /*
177 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
178 * parameter bytes, however the first 4 bytes of outbuf are
179 * the Netbios over TCP header. Thus use smb_base() to subtract
180 * them from the calculation.
181 */
182
183 SIVAL(outbuf,smb_ntr_ParameterOffset,
184 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
185 /*
186 * Absolute displacement of param bytes sent in this packet.
187 */
188
189 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
190 }
191
192 /*
193 * Deal with the data portion.
194 */
195
196 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
197
198 if(data_sent_thistime == 0) {
199 SIVAL(outbuf,smb_ntr_DataOffset,0);
200 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
201 } else {
202 /*
203 * The offset of the data bytes is the offset of the
204 * parameter bytes plus the number of parameters being sent this time.
205 */
206
207 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
208 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
209 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
210 }
211
212 /*
213 * Copy the param bytes into the packet.
214 */
215
216 if(params_sent_thistime) {
217 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
218 }
219
220 /*
221 * Copy in the data bytes
222 */
223
224 if(data_sent_thistime) {
225 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
226 data_alignment_offset,pd,data_sent_thistime);
227 }
228
229 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
230 params_sent_thistime, data_sent_thistime, useable_space));
231 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
232 params_to_send, data_to_send, paramsize, datasize));
233
234 /* Send the packet */
235 show_msg(outbuf);
236 if (!send_smb(smbd_server_fd(),outbuf)) {
237 exit_server_cleanly("send_nt_replies: send_smb failed.");
238 }
239
240 pp += params_sent_thistime;
241 pd += data_sent_thistime;
242
243 params_to_send -= params_sent_thistime;
244 data_to_send -= data_sent_thistime;
245
246 /*
247 * Sanity check
248 */
249
250 if(params_to_send < 0 || data_to_send < 0) {
251 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
252 params_to_send, data_to_send));
253 return -1;
254 }
255 }
256
257 return 0;
258 }
259
260 /****************************************************************************
261 Is it an NTFS stream name ?
262 ****************************************************************************/
263
264 BOOL is_ntfs_stream_name(const char *fname)
265 {
266 if (lp_posix_pathnames()) {
267 return False;
268 }
269 return (strchr_m(fname, ':') != NULL) ? True : False;
270 }
271
272 /****************************************************************************
273 Save case statics.
274 ****************************************************************************/
275
276 static BOOL saved_case_sensitive;
277 static BOOL saved_case_preserve;
278 static BOOL saved_short_case_preserve;
279
280 /****************************************************************************
281 Save case semantics.
282 ****************************************************************************/
283
284 static void set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
285 {
286 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
287 return;
288 }
289
290 saved_case_sensitive = conn->case_sensitive;
291 saved_case_preserve = conn->case_preserve;
292 saved_short_case_preserve = conn->short_case_preserve;
293
294 /* Set to POSIX. */
295 conn->case_sensitive = True;
296 conn->case_preserve = True;
297 conn->short_case_preserve = True;
298 }
299
300 /****************************************************************************
301 Restore case semantics.
302 ****************************************************************************/
303
304 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
305 {
306 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
307 return;
308 }
309
310 conn->case_sensitive = saved_case_sensitive;
311 conn->case_preserve = saved_case_preserve;
312 conn->short_case_preserve = saved_short_case_preserve;
313 }
314
315 /****************************************************************************
316 Reply to an NT create and X call on a pipe.
317 ****************************************************************************/
318
319 static int nt_open_pipe(char *fname, connection_struct *conn,
320 char *inbuf, char *outbuf, int *ppnum)
321 {
322 smb_np_struct *p = NULL;
323 uint16 vuid = SVAL(inbuf, smb_uid);
324 int i;
325
326 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
327
328 /* See if it is one we want to handle. */
329
330 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
331 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
332 }
333
334 for( i = 0; known_nt_pipes[i]; i++ ) {
335 if( strequal(fname,known_nt_pipes[i])) {
336 break;
337 }
338 }
339
340 if ( known_nt_pipes[i] == NULL ) {
341 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
342 }
343
344 /* Strip \\ off the name. */
345 fname++;
346
347 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
348
349 p = open_rpc_pipe_p(fname, conn, vuid);
350 if (!p) {
351 return(ERROR_DOS(ERRSRV,ERRnofids));
352 }
353
354 /* TODO: Add pipe to db */
355
356 if ( !store_pipe_opendb( p ) ) {
357 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
358 }
359
360 *ppnum = p->pnum;
361 return 0;
362 }
363
364 /****************************************************************************
365 Reply to an NT create and X call for pipes.
366 ****************************************************************************/
367
368 static int do_ntcreate_pipe_open(connection_struct *conn,
369 char *inbuf,char *outbuf,int length,int bufsize)
370 {
371 pstring fname;
372 int ret;
373 int pnum = -1;
374 char *p = NULL;
375
376 srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
377
378 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
379 return ret;
380 }
381
382 /*
383 * Deal with pipe return.
384 */
385
386 set_message(outbuf,34,0,True);
387
388 p = outbuf + smb_vwv2;
389 p++;
390 SSVAL(p,0,pnum);
391 p += 2;
392 SIVAL(p,0,FILE_WAS_OPENED);
393 p += 4;
394 p += 32;
395 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
396 p += 20;
397 /* File type. */
398 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
399 /* Device state. */
400 SSVAL(p,2, 0x5FF); /* ? */
401
402 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
403
404 return chain_reply(inbuf,outbuf,length,bufsize);
405 }
406
407 /****************************************************************************
408 Reply to an NT create and X call for a quota file.
409 ****************************************************************************/
410
411 int reply_ntcreate_and_X_quota(connection_struct *conn,
412 char *inbuf,
413 char *outbuf,
414 int length,
415 int bufsize,
416 enum FAKE_FILE_TYPE fake_file_type,
417 const char *fname)
418 {
419 int result;
420 char *p;
421 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
422 files_struct *fsp;
423 NTSTATUS status;
424
425 status = open_fake_file(conn, fake_file_type, fname, desired_access,
426 &fsp);
427
428 if (!NT_STATUS_IS_OK(status)) {
429 return ERROR_NT(status);
430 }
431
432 set_message(outbuf,34,0,True);
433
434 p = outbuf + smb_vwv2;
435
436 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
437 p++;
438 SSVAL(p,0,fsp->fnum);
439
440 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
441
442 result = chain_reply(inbuf,outbuf,length,bufsize);
443 return result;
444 }
445
446 /****************************************************************************
447 Reply to an NT create and X call.
448 ****************************************************************************/
449
450 int reply_ntcreate_and_X(connection_struct *conn,
451 char *inbuf,char *outbuf,int length,int bufsize)
452 {
453 int result;
454 pstring fname;
455 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
456 uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
457 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
458 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
459 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
460 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
461 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
462 /* Breakout the oplock request bits so we can set the
463 reply bits separately. */
464 int oplock_request = 0;
465 uint32 fattr=0;
466 SMB_OFF_T file_len = 0;
467 SMB_STRUCT_STAT sbuf;
468 int info = 0;
469 files_struct *fsp=NULL;
470 char *p = NULL;
471 struct timespec c_timespec;
472 struct timespec a_timespec;
473 struct timespec m_timespec;
474 BOOL extended_oplock_granted = False;
475 NTSTATUS status;
476
477 START_PROFILE(SMBntcreateX);
478
479 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
480 "file_attributes = 0x%x, share_access = 0x%x, "
481 "create_disposition = 0x%x create_options = 0x%x "
482 "root_dir_fid = 0x%x\n",
483 (unsigned int)flags,
484 (unsigned int)access_mask,
485 (unsigned int)file_attributes,
486 (unsigned int)share_access,
487 (unsigned int)create_disposition,
488 (unsigned int)create_options,
489 (unsigned int)root_dir_fid ));
490
491 /* If it's an IPC, use the pipe handler. */
492
493 if (IS_IPC(conn)) {
494 if (lp_nt_pipe_support()) {
495 END_PROFILE(SMBntcreateX);
496 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
497 } else {
498 END_PROFILE(SMBntcreateX);
499 return(ERROR_DOS(ERRDOS,ERRnoaccess));
500 }
501 }
502
503 if (create_options & FILE_OPEN_BY_FILE_ID) {
504 END_PROFILE(SMBntcreateX);
505 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
506 }
507
508 /*
509 * Get the file name.
510 */
511
512 if(root_dir_fid != 0) {
513 /*
514 * This filename is relative to a directory fid.
515 */
516 pstring rel_fname;
517 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
518 size_t dir_name_len;
519
520 if(!dir_fsp) {
521 END_PROFILE(SMBntcreateX);
522 return(ERROR_DOS(ERRDOS,ERRbadfid));
523 }
524
525 if(!dir_fsp->is_directory) {
526
527 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
528 if (!NT_STATUS_IS_OK(status)) {
529 END_PROFILE(SMBntcreateX);
530 return ERROR_NT(status);
531 }
532
533 /*
534 * Check to see if this is a mac fork of some kind.
535 */
536
537 if( is_ntfs_stream_name(fname)) {
538 END_PROFILE(SMBntcreateX);
539 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
540 }
541
542 /*
543 we need to handle the case when we get a
544 relative open relative to a file and the
545 pathname is blank - this is a reopen!
546 (hint from demyn plantenberg)
547 */
548
549 END_PROFILE(SMBntcreateX);
550 return(ERROR_DOS(ERRDOS,ERRbadfid));
551 }
552
553 /*
554 * Copy in the base directory name.
555 */
556
557 pstrcpy( fname, dir_fsp->fsp_name );
558 dir_name_len = strlen(fname);
559
560 /*
561 * Ensure it ends in a '\'.
562 */
563
564 if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
565 pstrcat(fname, "/");
566 dir_name_len++;
567 }
568
569 srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
570 if (!NT_STATUS_IS_OK(status)) {
571 END_PROFILE(SMBntcreateX);
572 return ERROR_NT(status);
573 }
574 pstrcat(fname, rel_fname);
575 } else {
576 srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
577 if (!NT_STATUS_IS_OK(status)) {
578 END_PROFILE(SMBntcreateX);
579 return ERROR_NT(status);
580 }
581
582 /*
583 * Check to see if this is a mac fork of some kind.
584 */
585
586 if( is_ntfs_stream_name(fname)) {
587 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
588 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
589 /*
590 * Here we go! support for changing the disk quotas --metze
591 *
592 * We need to fake up to open this MAGIC QUOTA file
593 * and return a valid FID.
594 *
595 * w2k close this file directly after openening
596 * xp also tries a QUERY_FILE_INFO on the file and then close it
597 */
598 result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
599 fake_file_type, fname);
600 END_PROFILE(SMBntcreateX);
601 return result;
602 } else {
603 END_PROFILE(SMBntcreateX);
604 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
605 }
606 }
607 }
608
609 /*
610 * Now contruct the smb_open_mode value from the filename,
611 * desired access and the share access.
612 */
613 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
614
615 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
616 if (oplock_request) {
617 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
618 }
619
620 /*
621 * Ordinary file or directory.
622 */
623
624 /*
625 * Check if POSIX semantics are wanted.
626 */
627
628 set_posix_case_semantics(conn, file_attributes);
629
630 status = unix_convert(conn, fname, False, NULL, &sbuf);
631 if (!NT_STATUS_IS_OK(status)) {
632 restore_case_semantics(conn, file_attributes);
633 END_PROFILE(SMBntcreateX);
634 return ERROR_NT(status);
635 }
636 /* All file access must go through check_name() */
637 status = check_name(conn, fname);
638 if (!NT_STATUS_IS_OK(status)) {
639 restore_case_semantics(conn, file_attributes);
640 END_PROFILE(SMBntcreateX);
641 return ERROR_NT(status);
642 }
643
644 /* This is the correct thing to do (check every time) but can_delete is
645 expensive (it may have to read the parent directory permissions). So
646 for now we're not doing it unless we have a strong hint the client
647 is really going to delete this file. If the client is forcing FILE_CREATE
648 let the filesystem take care of the permissions. */
649
650 /* Setting FILE_SHARE_DELETE is the hint. */
651
652 if (lp_acl_check_permissions(SNUM(conn))
653 && (create_disposition != FILE_CREATE)
654 && (share_access & FILE_SHARE_DELETE)
655 && (access_mask & DELETE_ACCESS)) {
656 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
657 !can_delete_file_in_directory(conn, fname)) {
658 restore_case_semantics(conn, file_attributes);
659 END_PROFILE(SMBntcreateX);
660 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
661 }
662 }
663
664 /*
665 * If it's a request for a directory open, deal with it separately.
666 */
667
668 if(create_options & FILE_DIRECTORY_FILE) {
669 oplock_request = 0;
670
671 /* Can't open a temp directory. IFS kit test. */
672 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
673 END_PROFILE(SMBntcreateX);
674 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
675 }
676
677 status = open_directory(conn, fname, &sbuf,
678 access_mask,
679 share_access,
680 create_disposition,
681 create_options,
682 &info, &fsp);
683
684 restore_case_semantics(conn, file_attributes);
685
686 if(!NT_STATUS_IS_OK(status)) {
687 if (!use_nt_status() && NT_STATUS_EQUAL(
688 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
689 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
690 }
691 END_PROFILE(SMBntcreateX);
692 return ERROR_NT(status);
693 }
694 } else {
695 /*
696 * Ordinary file case.
697 */
698
699 /* NB. We have a potential bug here. If we
700 * cause an oplock break to ourselves, then we
701 * could end up processing filename related
702 * SMB requests whilst we await the oplock
703 * break response. As we may have changed the
704 * filename case semantics to be POSIX-like,
705 * this could mean a filename request could
706 * fail when it should succeed. This is a rare
707 * condition, but eventually we must arrange
708 * to restore the correct case semantics
709 * before issuing an oplock break request to
710 * our client. JRA. */
711
712 status = open_file_ntcreate(conn,fname,&sbuf,
713 access_mask,
714 share_access,
715 create_disposition,
716 create_options,
717 file_attributes,
718 oplock_request,
719 &info, &fsp);
720 if (!NT_STATUS_IS_OK(status)) {
721 /* We cheat here. There are two cases we
722 * care about. One is a directory rename,
723 * where the NT client will attempt to
724 * open the source directory for
725 * DELETE access. Note that when the
726 * NT client does this it does *not*
727 * set the directory bit in the
728 * request packet. This is translated
729 * into a read/write open
730 * request. POSIX states that any open
731 * for write request on a directory
732 * will generate an EISDIR error, so
733 * we can catch this here and open a
734 * pseudo handle that is flagged as a
735 * directory. The second is an open
736 * for a permissions read only, which
737 * we handle in the open_file_stat case. JRA.
738 */
739
740 if (NT_STATUS_EQUAL(status,
741 NT_STATUS_FILE_IS_A_DIRECTORY)) {
742
743 /*
744 * Fail the open if it was explicitly a non-directory file.
745 */
746
747 if (create_options & FILE_NON_DIRECTORY_FILE) {
748 restore_case_semantics(conn, file_attributes);
749 END_PROFILE(SMBntcreateX);
750 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
751 }
752
753 oplock_request = 0;
754 status = open_directory(conn, fname, &sbuf,
755 access_mask,
756 share_access,
757 create_disposition,
758 create_options,
759 &info, &fsp);
760
761 if(!NT_STATUS_IS_OK(status)) {
762 restore_case_semantics(conn, file_attributes);
763 if (!use_nt_status() && NT_STATUS_EQUAL(
764 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
765 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
766 }
767 END_PROFILE(SMBntcreateX);
768 return ERROR_NT(status);
769 }
770 } else {
771
772 restore_case_semantics(conn, file_attributes);
773 END_PROFILE(SMBntcreateX);
774 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
775 /* We have re-scheduled this call. */
776 return -1;
777 }
778 return ERROR_NT(status);
779 }
780 }
781 }
782
783 restore_case_semantics(conn, file_attributes);
784
785 file_len = sbuf.st_size;
786 fattr = dos_mode(conn,fname,&sbuf);
787 if(fattr == 0) {
788 fattr = FILE_ATTRIBUTE_NORMAL;
789 }
790 if (!fsp->is_directory && (fattr & aDIR)) {
791 close_file(fsp,ERROR_CLOSE);
792 END_PROFILE(SMBntcreateX);
793 return ERROR_DOS(ERRDOS,ERRnoaccess);
794 }
795
796 /* Save the requested allocation size. */
797 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
798 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
799 #ifdef LARGE_SMB_OFF_T
800 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
801 #endif
802 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
803 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
804 if (fsp->is_directory) {
805 close_file(fsp,ERROR_CLOSE);
806 END_PROFILE(SMBntcreateX);
807 /* Can't set allocation size on a directory. */
808 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
809 }
810 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
811 close_file(fsp,ERROR_CLOSE);
812 END_PROFILE(SMBntcreateX);
813 return ERROR_NT(NT_STATUS_DISK_FULL);
814 }
815 } else {
816 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
817 }
818 }
819
820 /*
821 * If the caller set the extended oplock request bit
822 * and we granted one (by whatever means) - set the
823 * correct bit for extended oplock reply.
824 */
825
826 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
827 extended_oplock_granted = True;
828 }
829
830 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
831 extended_oplock_granted = True;
832 }
833
834 #if 0
835 /* W2K sends back 42 words here ! If we do the same it breaks offline sync. Go figure... ? JRA. */
836 set_message(outbuf,42,0,True);
837 #else
838 set_message(outbuf,34,0,True);
839 #endif
840
841 p = outbuf + smb_vwv2;
842
843 /*
844 * Currently as we don't support level II oplocks we just report
845 * exclusive & batch here.
846 */
847
848 if (extended_oplock_granted) {
849 if (flags & REQUEST_BATCH_OPLOCK) {
850 SCVAL(p,0, BATCH_OPLOCK_RETURN);
851 } else {
852 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
853 }
854 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
855 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
856 } else {
857 SCVAL(p,0,NO_OPLOCK_RETURN);
858 }
859
860 p++;
861 SSVAL(p,0,fsp->fnum);
862 p += 2;
863 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
864 SIVAL(p,0,FILE_WAS_SUPERSEDED);
865 } else {
866 SIVAL(p,0,info);
867 }
868 p += 4;
869
870 /* Create time. */
871 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
872 a_timespec = get_atimespec(&sbuf);
873 m_timespec = get_mtimespec(&sbuf);
874
875 if (lp_dos_filetime_resolution(SNUM(conn))) {
876 dos_filetime_timespec(&c_timespec);
877 dos_filetime_timespec(&a_timespec);
878 dos_filetime_timespec(&m_timespec);
879 }
880
881 put_long_date_timespec(p, c_timespec);
882 p += 8;
883 put_long_date_timespec(p, a_timespec); /* access time */
884 p += 8;
885 put_long_date_timespec(p, m_timespec); /* write time */
886 p += 8;
887 put_long_date_timespec(p, m_timespec); /* change time */
888 p += 8;
889 SIVAL(p,0,fattr); /* File Attributes. */
890 p += 4;
891 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
892 p += 8;
893 SOFF_T(p,0,file_len);
894 p += 8;
895 if (flags & EXTENDED_RESPONSE_REQUIRED) {
896 SSVAL(p,2,0x7);
897 }
898 p += 4;
899 SCVAL(p,0,fsp->is_directory ? 1 : 0);
900
901 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
902
903 result = chain_reply(inbuf,outbuf,length,bufsize);
904 END_PROFILE(SMBntcreateX);
905 return result;
906 }
907
908 /****************************************************************************
909 Reply to a NT_TRANSACT_CREATE call to open a pipe.
910 ****************************************************************************/
911
912 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
913 uint16 **ppsetup, uint32 setup_count,
914 char **ppparams, uint32 parameter_count,
915 char **ppdata, uint32 data_count)
916 {
917 pstring fname;
918 char *params = *ppparams;
919 int ret;
920 int pnum = -1;
921 char *p = NULL;
922 NTSTATUS status;
923
924 /*
925 * Ensure minimum number of parameters sent.
926 */
927
928 if(parameter_count < 54) {
929 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
930 return ERROR_DOS(ERRDOS,ERRnoaccess);
931 }
932
933 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
934 if (!NT_STATUS_IS_OK(status)) {
935 return ERROR_NT(status);
936 }
937
938 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
939 return ret;
940 }
941
942 /* Realloc the size of parameters and data we will return */
943 params = nttrans_realloc(ppparams, 69);
944 if(params == NULL) {
945 return ERROR_DOS(ERRDOS,ERRnomem);
946 }
947
948 p = params;
949 SCVAL(p,0,NO_OPLOCK_RETURN);
950
951 p += 2;
952 SSVAL(p,0,pnum);
953 p += 2;
954 SIVAL(p,0,FILE_WAS_OPENED);
955 p += 8;
956
957 p += 32;
958 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
959 p += 20;
960 /* File type. */
961 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
962 /* Device state. */
963 SSVAL(p,2, 0x5FF); /* ? */
964
965 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
966
967 /* Send the required number of replies */
968 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
969
970 return -1;
971 }
972
973 /****************************************************************************
974 Internal fn to set security descriptors.
975 ****************************************************************************/
976
977 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
978 {
979 prs_struct pd;
980 SEC_DESC *psd = NULL;
981 TALLOC_CTX *mem_ctx;
982 BOOL ret;
983
984 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
985 return NT_STATUS_OK;
986 }
987
988 /*
989 * Init the parse struct we will unmarshall from.
990 */
991
992 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
993 DEBUG(0,("set_sd: talloc_init failed.\n"));
994 return NT_STATUS_NO_MEMORY;
995 }
996
997 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
998
999 /*
1000 * Setup the prs_struct to point at the memory we just
1001 * allocated.
1002 */
1003
1004 prs_give_memory( &pd, data, sd_len, False);
1005
1006 /*
1007 * Finally, unmarshall from the data buffer.
1008 */
1009
1010 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1011 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1012 /*
1013 * Return access denied for want of a better error message..
1014 */
1015 talloc_destroy(mem_ctx);
1016 return NT_STATUS_NO_MEMORY;
1017 }
1018
1019 if (psd->owner_sid==0) {
1020 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1021 }
1022 if (psd->group_sid==0) {
1023 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1024 }
1025 if (psd->sacl==0) {
1026 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1027 }
1028 if (psd->dacl==0) {
1029 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1030 }
1031
1032 ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1033
1034 if (!ret) {
1035 talloc_destroy(mem_ctx);
1036 return NT_STATUS_ACCESS_DENIED;
1037 }
1038
1039 talloc_destroy(mem_ctx);
1040
1041 return NT_STATUS_OK;
1042 }
1043
1044 /****************************************************************************
1045 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1046 ****************************************************************************/
1047
1048 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1049 {
1050 struct ea_list *ea_list_head = NULL;
1051 size_t offset = 0;
1052
1053 if (data_size < 4) {
1054 return NULL;
1055 }
1056
1057 while (offset + 4 <= data_size) {
1058 size_t next_offset = IVAL(pdata,offset);
1059 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1060
1061 if (!eal) {
1062 return NULL;
1063 }
1064
1065 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1066 if (next_offset == 0) {
1067 break;
1068 }
1069 offset += next_offset;
1070 }
1071
1072 return ea_list_head;
1073 }
1074
1075 /****************************************************************************
1076 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1077 ****************************************************************************/
1078
1079 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1080 uint16 **ppsetup, uint32 setup_count,
1081 char **ppparams, uint32 parameter_count,
1082 char **ppdata, uint32 data_count, uint32 max_data_count)
1083 {
1084 pstring fname;
1085 char *params = *ppparams;
1086 char *data = *ppdata;
1087 /* Breakout the oplock request bits so we can set the reply bits separately. */
1088 int oplock_request = 0;
1089 uint32 fattr=0;
1090 SMB_OFF_T file_len = 0;
1091 SMB_STRUCT_STAT sbuf;
1092 int info = 0;
1093 files_struct *fsp = NULL;
1094 char *p = NULL;
1095 BOOL extended_oplock_granted = False;
1096 uint32 flags;
1097 uint32 access_mask;
1098 uint32 file_attributes;
1099 uint32 share_access;
1100 uint32 create_disposition;
1101 uint32 create_options;
1102 uint32 sd_len;
1103 uint32 ea_len;
1104 uint16 root_dir_fid;
1105 struct timespec c_timespec;
1106 struct timespec a_timespec;
1107 struct timespec m_timespec;
1108 struct ea_list *ea_list = NULL;
1109 TALLOC_CTX *ctx = NULL;
1110 char *pdata = NULL;
1111 NTSTATUS status;
1112
1113 DEBUG(5,("call_nt_transact_create\n"));
1114
1115 /*
1116 * If it's an IPC, use the pipe handler.
1117 */
1118
1119 if (IS_IPC(conn)) {
1120 if (lp_nt_pipe_support()) {
1121 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1122 bufsize,
1123 ppsetup, setup_count,
1124 ppparams, parameter_count,
1125 ppdata, data_count);
1126 } else {
1127 return ERROR_DOS(ERRDOS,ERRnoaccess);
1128 }
1129 }
1130
1131 /*
1132 * Ensure minimum number of parameters sent.
1133 */
1134
1135 if(parameter_count < 54) {
1136 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1137 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1138 }
1139
1140 flags = IVAL(params,0);
1141 access_mask = IVAL(params,8);
1142 file_attributes = IVAL(params,20);
1143 share_access = IVAL(params,24);
1144 create_disposition = IVAL(params,28);
1145 create_options = IVAL(params,32);
1146 sd_len = IVAL(params,36);
1147 ea_len = IVAL(params,40);
1148 root_dir_fid = (uint16)IVAL(params,4);
1149
1150 /* Ensure the data_len is correct for the sd and ea values given. */
1151 if ((ea_len + sd_len > data_count) ||
1152 (ea_len > data_count) || (sd_len > data_count) ||
1153 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1154 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1155 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1156 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1157 }
1158
1159 if (ea_len) {
1160 if (!lp_ea_support(SNUM(conn))) {
1161 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1162 (unsigned int)ea_len ));
1163 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1164 }
1165
1166 if (ea_len < 10) {
1167 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1168 (unsigned int)ea_len ));
1169 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1170 }
1171 }
1172
1173 if (create_options & FILE_OPEN_BY_FILE_ID) {
1174 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1175 }
1176
1177 /*
1178 * Get the file name.
1179 */
1180
1181 if(root_dir_fid != 0) {
1182 /*
1183 * This filename is relative to a directory fid.
1184 */
1185 files_struct *dir_fsp = file_fsp(params,4);
1186 size_t dir_name_len;
1187
1188 if(!dir_fsp) {
1189 return ERROR_DOS(ERRDOS,ERRbadfid);
1190 }
1191
1192 if(!dir_fsp->is_directory) {
1193 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1194 if (!NT_STATUS_IS_OK(status)) {
1195 return ERROR_NT(status);
1196 }
1197
1198 /*
1199 * Check to see if this is a mac fork of some kind.
1200 */
1201
1202 if( is_ntfs_stream_name(fname)) {
1203 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1204 }
1205
1206 return ERROR_DOS(ERRDOS,ERRbadfid);
1207 }
1208
1209 /*
1210 * Copy in the base directory name.
1211 */
1212
1213 pstrcpy( fname, dir_fsp->fsp_name );
1214 dir_name_len = strlen(fname);
1215
1216 /*
1217 * Ensure it ends in a '\'.
1218 */
1219
1220 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1221 pstrcat(fname, "/");
1222 dir_name_len++;
1223 }
1224
1225 {
1226 pstring tmpname;
1227 srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
1228 if (!NT_STATUS_IS_OK(status)) {
1229 return ERROR_NT(status);
1230 }
1231 pstrcat(fname, tmpname);
1232 }
1233 } else {
1234 srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
1235 if (!NT_STATUS_IS_OK(status)) {
1236 return ERROR_NT(status);
1237 }
1238
1239 /*
1240 * Check to see if this is a mac fork of some kind.
1241 */
1242
1243 if( is_ntfs_stream_name(fname)) {
1244 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1245 }
1246 }
1247
1248 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1249 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1250
1251 /*
1252 * Check if POSIX semantics are wanted.
1253 */
1254
1255 set_posix_case_semantics(conn, file_attributes);
1256
1257 RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1258
1259 status = unix_convert(conn, fname, False, NULL, &sbuf);
1260 if (!NT_STATUS_IS_OK(status)) {
1261 restore_case_semantics(conn, file_attributes);
1262 return ERROR_NT(status);
1263 }
1264 /* All file access must go through check_name() */
1265 status = check_name(conn, fname);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 restore_case_semantics(conn, file_attributes);
1268 return ERROR_NT(status);
1269 }
1270
1271 /* This is the correct thing to do (check every time) but can_delete is
1272 expensive (it may have to read the parent directory permissions). So
1273 for now we're not doing it unless we have a strong hint the client
1274 is really going to delete this file. If the client is forcing FILE_CREATE
1275 let the filesystem take care of the permissions. */
1276
1277 /* Setting FILE_SHARE_DELETE is the hint. */
1278
1279 if (lp_acl_check_permissions(SNUM(conn))
1280 && (create_disposition != FILE_CREATE)
1281 && (share_access & FILE_SHARE_DELETE)
1282 && (access_mask & DELETE_ACCESS)) {
1283 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
1284 !can_delete_file_in_directory(conn, fname)) {
1285 restore_case_semantics(conn, file_attributes);
1286 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1287 }
1288 }
1289
1290 if (ea_len) {
1291 pdata = data + sd_len;
1292
1293 /* We have already checked that ea_len <= data_count here. */
1294 ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1295 ea_len);
1296 if (!ea_list ) {
1297 restore_case_semantics(conn, file_attributes);
1298 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1299 }
1300 }
1301
1302 /*
1303 * If it's a request for a directory open, deal with it separately.
1304 */
1305
1306 if(create_options & FILE_DIRECTORY_FILE) {
1307
1308 /* Can't open a temp directory. IFS kit test. */
1309 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1310 restore_case_semantics(conn, file_attributes);
1311 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1312 }
1313
1314 oplock_request = 0;
1315
1316 /*
1317 * We will get a create directory here if the Win32
1318 * app specified a security descriptor in the
1319 * CreateDirectory() call.
1320 */
1321
1322 status = open_directory(conn, fname, &sbuf,
1323 access_mask,
1324 share_access,
1325 create_disposition,
1326 create_options,
1327 &info, &fsp);
1328 if(!NT_STATUS_IS_OK(status)) {
1329 restore_case_semantics(conn, file_attributes);
1330 return ERROR_NT(status);
1331 }
1332
1333 } else {
1334
1335 /*
1336 * Ordinary file case.
1337 */
1338
1339 status = open_file_ntcreate(conn,fname,&sbuf,
1340 access_mask,
1341 share_access,
1342 create_disposition,
1343 create_options,
1344 file_attributes,
1345 oplock_request,
1346 &info, &fsp);
1347
1348 if (!NT_STATUS_IS_OK(status)) {
1349 if (NT_STATUS_EQUAL(status,
1350 NT_STATUS_FILE_IS_A_DIRECTORY)) {
1351
1352 /*
1353 * Fail the open if it was explicitly a non-directory file.
1354 */
1355
1356 if (create_options & FILE_NON_DIRECTORY_FILE) {
1357 restore_case_semantics(conn, file_attributes);
1358 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1359 }
1360
1361 oplock_request = 0;
1362 status = open_directory(conn, fname, &sbuf,
1363 access_mask,
1364 share_access,
1365 create_disposition,
1366 create_options,
1367 &info, &fsp);
1368 if(!NT_STATUS_IS_OK(status)) {
1369 restore_case_semantics(conn, file_attributes);
1370 return ERROR_NT(status);
1371 }
1372 } else {
1373 restore_case_semantics(conn, file_attributes);
1374 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1375 /* We have re-scheduled this call. */
1376 return -1;
1377 }
1378 return ERROR_NT(status);
1379 }
1380 }
1381 }
1382
1383 /*
1384 * According to the MS documentation, the only time the security
1385 * descriptor is applied to the opened file is iff we *created* the
1386 * file; an existing file stays the same.
1387 *
1388 * Also, it seems (from observation) that you can open the file with
1389 * any access mask but you can still write the sd. We need to override
1390 * the granted access before we call set_sd
1391 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1392 */
1393
1394 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1395 uint32 saved_access_mask = fsp->access_mask;
1396
1397 /* We have already checked that sd_len <= data_count here. */
1398
1399 fsp->access_mask = FILE_GENERIC_ALL;
1400
1401 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1402 if (!NT_STATUS_IS_OK(status)) {
1403 talloc_destroy(ctx);
1404 close_file(fsp,ERROR_CLOSE);
1405 restore_case_semantics(conn, file_attributes);
1406 return ERROR_NT(status);
1407 }
1408 fsp->access_mask = saved_access_mask;
1409 }
1410
1411 if (ea_len && (info == FILE_WAS_CREATED)) {
1412 status = set_ea(conn, fsp, fname, ea_list);
1413 if (!NT_STATUS_IS_OK(status)) {
1414 close_file(fsp,ERROR_CLOSE);
1415 restore_case_semantics(conn, file_attributes);
1416 return ERROR_NT(status);
1417 }
1418 }
1419
1420 restore_case_semantics(conn, file_attributes);
1421
1422 file_len = sbuf.st_size;
1423 fattr = dos_mode(conn,fname,&sbuf);
1424 if(fattr == 0) {
1425 fattr = FILE_ATTRIBUTE_NORMAL;
1426 }
1427 if (!fsp->is_directory && (fattr & aDIR)) {
1428 close_file(fsp,ERROR_CLOSE);
1429 return ERROR_DOS(ERRDOS,ERRnoaccess);
1430 }
1431
1432 /* Save the requested allocation size. */
1433 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1434 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1435 #ifdef LARGE_SMB_OFF_T
1436 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1437 #endif
1438 if (allocation_size && (allocation_size > file_len)) {
1439 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1440 if (fsp->is_directory) {
1441 close_file(fsp,ERROR_CLOSE);
1442 /* Can't set allocation size on a directory. */
1443 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1444 }
1445 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1446 close_file(fsp,ERROR_CLOSE);
1447 return ERROR_NT(NT_STATUS_DISK_FULL);
1448 }
1449 } else {
1450 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1451 }
1452 }
1453
1454 /*
1455 * If the caller set the extended oplock request bit
1456 * and we granted one (by whatever means) - set the
1457 * correct bit for extended oplock reply.
1458 */
1459
1460 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1461 extended_oplock_granted = True;
1462 }
1463
1464 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1465 extended_oplock_granted = True;
1466 }
1467
1468 /* Realloc the size of parameters and data we will return */
1469 params = nttrans_realloc(ppparams, 69);
1470 if(params == NULL) {
1471 return ERROR_DOS(ERRDOS,ERRnomem);
1472 }
1473
1474 p = params;
1475 if (extended_oplock_granted) {
1476 if (flags & REQUEST_BATCH_OPLOCK) {
1477 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1478 } else {
1479 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1480 }
1481 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1482 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1483 } else {
1484 SCVAL(p,0,NO_OPLOCK_RETURN);
1485 }
1486
1487 p += 2;
1488 SSVAL(p,0,fsp->fnum);
1489 p += 2;
1490 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1491 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1492 } else {
1493 SIVAL(p,0,info);
1494 }
1495 p += 8;
1496
1497 /* Create time. */
1498 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1499 a_timespec = get_atimespec(&sbuf);
1500 m_timespec = get_mtimespec(&sbuf);
1501
1502 if (lp_dos_filetime_resolution(SNUM(conn))) {
1503 dos_filetime_timespec(&c_timespec);
1504 dos_filetime_timespec(&a_timespec);
1505 dos_filetime_timespec(&m_timespec);
1506 }
1507
1508 put_long_date_timespec(p, c_timespec); /* create time. */
1509 p += 8;
1510 put_long_date_timespec(p, a_timespec); /* access time */
1511 p += 8;
1512 put_long_date_timespec(p, m_timespec); /* write time */
1513 p += 8;
1514 put_long_date_timespec(p, m_timespec); /* change time */
1515 p += 8;
1516 SIVAL(p,0,fattr); /* File Attributes. */
1517 p += 4;
1518 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1519 p += 8;
1520 SOFF_T(p,0,file_len);
1521 p += 8;
1522 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1523 SSVAL(p,2,0x7);
1524 }
1525 p += 4;
1526 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1527
1528 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1529
1530 /* Send the required number of replies */
1531 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 69, *ppdata, 0);
1532
1533 return -1;
1534 }
1535
1536 /****************************************************************************
1537 Reply to a NT CANCEL request.
1538 conn POINTER CAN BE NULL HERE !
1539 ****************************************************************************/
1540
1541 int reply_ntcancel(connection_struct *conn,
1542 char *inbuf,char *outbuf,int length,int bufsize)
1543 {
1544 /*
1545 * Go through and cancel any pending change notifies.
1546 */
1547
1548 int mid = SVAL(inbuf,smb_mid);
1549 START_PROFILE(SMBntcancel);
1550 remove_pending_change_notify_requests_by_mid(mid);
1551 remove_pending_lock_requests_by_mid(mid);
1552 srv_cancel_sign_response(mid);
1553
1554 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1555
1556 END_PROFILE(SMBntcancel);
1557 return(-1);
1558 }
1559
1560 /****************************************************************************
1561 Copy a file.
1562 ****************************************************************************/
1563
1564 static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint32 attrs)
1565 {
1566 SMB_STRUCT_STAT sbuf1, sbuf2;
1567 pstring last_component_oldname;
1568 pstring last_component_newname;
1569 files_struct *fsp1,*fsp2;
1570 uint32 fattr;
1571 int info;
1572 SMB_OFF_T ret=-1;
1573 int close_ret;
1574 NTSTATUS status = NT_STATUS_OK;
1575
1576 ZERO_STRUCT(sbuf1);
1577 ZERO_STRUCT(sbuf2);
1578
1579 if (!CAN_WRITE(conn)) {
1580 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1581 }
1582
1583 status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1584 if (!NT_STATUS_IS_OK(status)) {
1585 return status;
1586 }
1587
1588 /* Source must already exist. */
1589 if (!VALID_STAT(sbuf1)) {
1590 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1591 }
1592 status = check_name(conn, oldname);
1593 if (!NT_STATUS_IS_OK(status)) {
1594 return status;
1595 }
1596
1597 /* Ensure attributes match. */
1598 fattr = dos_mode(conn,oldname,&sbuf1);
1599 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1600 return NT_STATUS_NO_SUCH_FILE;
1601 }
1602
1603 status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1604 if (!NT_STATUS_IS_OK(status)) {
1605 return status;
1606 }
1607
1608 /* Disallow if newname already exists. */
1609 if (VALID_STAT(sbuf2)) {
1610 return NT_STATUS_OBJECT_NAME_COLLISION;
1611 }
1612
1613 status = check_name(conn, newname);
1614 if (!NT_STATUS_IS_OK(status)) {
1615 return status;
1616 }
1617
1618 /* No links from a directory. */
1619 if (S_ISDIR(sbuf1.st_mode)) {
1620 return NT_STATUS_FILE_IS_A_DIRECTORY;
1621 }
1622
1623 /* Ensure this is within the share. */
1624 status = reduce_name(conn, oldname);
1625 if (!NT_STATUS_IS_OK(status)) {
1626 return status;
1627 }
1628
1629 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1630
1631 status = open_file_ntcreate(conn,oldname,&sbuf1,
1632 FILE_READ_DATA, /* Read-only. */
1633 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1634 FILE_OPEN,
1635 0, /* No create options. */
1636 FILE_ATTRIBUTE_NORMAL,
1637 NO_OPLOCK,
1638 &info, &fsp1);
1639
1640 if (!NT_STATUS_IS_OK(status)) {
1641 return status;
1642 }
1643
1644 status = open_file_ntcreate(conn,newname,&sbuf2,
1645 FILE_WRITE_DATA, /* Read-only. */
1646 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1647 FILE_CREATE,
1648 0, /* No create options. */
1649 fattr,
1650 NO_OPLOCK,
1651 &info, &fsp2);
1652
1653 if (!NT_STATUS_IS_OK(status)) {
1654 close_file(fsp1,ERROR_CLOSE);
1655 return status;
1656 }
1657
1658 if (sbuf1.st_size) {
1659 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1660 }
1661
1662 /*
1663 * As we are opening fsp1 read-only we only expect
1664 * an error on close on fsp2 if we are out of space.
1665 * Thus we don't look at the error return from the
1666 * close of fsp1.
1667 */
1668 close_file(fsp1,NORMAL_CLOSE);
1669
1670 /* Ensure the modtime is set correctly on the destination file. */
1671 fsp_set_pending_modtime(fsp2, sbuf1.st_mtime);
1672
1673 close_ret = close_file(fsp2,NORMAL_CLOSE);
1674
1675 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1676 creates the file. This isn't the correct thing to do in the copy
1677 case. JRA */
1678 file_set_dosmode(conn, newname, fattr, &sbuf2,
1679 parent_dirname(newname));
1680
1681 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1682 return NT_STATUS_DISK_FULL;
1683 }
1684
1685 if (close_ret != 0) {
1686 status = map_nt_error_from_unix(close_ret);
1687 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1688 nt_errstr(status), oldname, newname));
1689 }
1690 return status;
1691 }
1692
1693 /****************************************************************************
1694 Reply to a NT rename request.
1695 ****************************************************************************/
1696
1697 int reply_ntrename(connection_struct *conn,
1698 char *inbuf,char *outbuf,int length,int bufsize)
1699 {
1700 int outsize = 0;
1701 pstring oldname;
1702 pstring newname;
1703 char *p;
1704 NTSTATUS status;
1705 BOOL path1_contains_wcard = False;
1706 BOOL path2_contains_wcard = False;
1707 uint32 attrs = SVAL(inbuf,smb_vwv0);
1708 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1709
1710 START_PROFILE(SMBntrename);
1711
1712 p = smb_buf(inbuf) + 1;
1713 p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &path1_contains_wcard);
1714 if (!NT_STATUS_IS_OK(status)) {
1715 END_PROFILE(SMBntrename);
1716 return ERROR_NT(status);
1717 }
1718
1719 if( is_ntfs_stream_name(oldname)) {
1720 /* Can't rename a stream. */
1721 END_PROFILE(SMBntrename);
1722 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1723 }
1724
1725 if (ms_has_wild(oldname)) {
1726 END_PROFILE(SMBntrename);
1727 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1728 }
1729
1730 p++;
1731 p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path2_contains_wcard);
1732 if (!NT_STATUS_IS_OK(status)) {
1733 END_PROFILE(SMBntrename);
1734 return ERROR_NT(status);
1735 }
1736
1737 RESOLVE_DFSPATH(oldname, conn, inbuf, outbuf);
1738 RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
1739
1740 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1741
1742 switch(rename_type) {
1743 case RENAME_FLAG_RENAME:
1744 status = rename_internals(conn, oldname, newname, attrs, False, path1_contains_wcard);
1745 break;
1746 case RENAME_FLAG_HARD_LINK:
1747 if (path1_contains_wcard || path2_contains_wcard) {
1748 /* No wildcards. */
1749 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1750 } else {
1751 status = hardlink_internals(conn, oldname, newname);
1752 }
1753 break;
1754 case RENAME_FLAG_COPY:
1755 if (path1_contains_wcard || path2_contains_wcard) {
1756 /* No wildcards. */
1757 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1758 } else {
1759 status = copy_internals(conn, oldname, newname, attrs);
1760 }
1761 break;
1762 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1763 status = NT_STATUS_INVALID_PARAMETER;
1764 break;
1765 default:
1766 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1767 break;
1768 }
1769
1770 if (!NT_STATUS_IS_OK(status)) {
1771 END_PROFILE(SMBntrename);
1772 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1773 /* We have re-scheduled this call. */
1774 return -1;
1775 }
1776 return ERROR_NT(status);
1777 }
1778
1779 outsize = set_message(outbuf,0,0,False);
1780
1781 END_PROFILE(SMBntrename);
1782 return(outsize);
1783 }
1784
1785 /****************************************************************************
1786 Reply to a notify change - queue the request and
1787 don't allow a directory to be opened.
1788 ****************************************************************************/
1789
1790 static void notify_callback(void *private_data, const struct notify_event *e)
1791 {
1792 files_struct *fsp = (files_struct *)private_data;
1793 DEBUG(10, ("notify_callback called for %s\n", fsp->fsp_name));
1794 notify_fsp(fsp, e->action, e->path);
1795 }
1796
1797 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
1798 char *outbuf, int length,
1799 int bufsize,
1800 uint16 **ppsetup, uint32 setup_count,
1801 char **ppparams,
1802 uint32 parameter_count,
1803 char **ppdata, uint32 data_count,
1804 uint32 max_data_count,
1805 uint32 max_param_count)
1806 {
1807 uint16 *setup = *ppsetup;
1808 files_struct *fsp;
1809 uint32 filter;
1810 NTSTATUS status;
1811 BOOL recursive;
1812
1813 if(setup_count < 6) {
1814 return ERROR_DOS(ERRDOS,ERRbadfunc);
1815 }
1816
1817 fsp = file_fsp((char *)setup,4);
1818 filter = IVAL(setup, 0);
1819 recursive = (SVAL(setup, 6) != 0) ? True : False;
1820
1821 DEBUG(3,("call_nt_transact_notify_change\n"));
1822
1823 if(!fsp) {
1824 return ERROR_DOS(ERRDOS,ERRbadfid);
1825 }
1826
1827 {
1828 char *filter_string;
1829
1830 if (!(filter_string = notify_filter_string(NULL, filter))) {
1831 return ERROR_NT(NT_STATUS_NO_MEMORY);
1832 }
1833
1834 DEBUG(3,("call_nt_transact_notify_change: notify change "
1835 "called on %s, filter = %s, recursive = %d\n",
1836 fsp->fsp_name, filter_string, recursive));
1837
1838 TALLOC_FREE(filter_string);
1839 }
1840
1841 if((!fsp->is_directory) || (conn != fsp->conn)) {
1842 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1843 }
1844
1845 if (fsp->notify == NULL) {
1846 char *fullpath;
1847 struct notify_entry e;
1848
1849 if (!(fsp->notify = TALLOC_ZERO_P(
1850 NULL, struct notify_change_buf))) {
1851 return ERROR_NT(NT_STATUS_NO_MEMORY);
1852 }
1853
1854 if (asprintf(&fullpath, "%s/%s", fsp->conn->connectpath,
1855 fsp->fsp_name) == -1) {
1856 DEBUG(0, ("asprintf failed\n"));
1857 return ERROR_NT(NT_STATUS_NO_MEMORY);
1858 }
1859
1860 e.path = fullpath;
1861 e.filter = filter;
1862 e.subdir_filter = 0;
1863 if (recursive) {
1864 e.subdir_filter = filter;
1865 }
1866
1867 status = notify_add(fsp->conn->notify_ctx, &e, notify_callback,
1868 fsp);
1869 SAFE_FREE(fullpath);
1870
1871 if (!NT_STATUS_IS_OK(status)) {
1872 DEBUG(10, ("notify_add returned %s\n",
1873 nt_errstr(status)));
1874 return ERROR_NT(status);
1875 }
1876 }
1877
1878 if (fsp->notify->num_changes != 0) {
1879
1880 /*
1881 * We've got changes pending, respond immediately
1882 */
1883
1884 /*
1885 * TODO: write a torture test to check the filtering behaviour
1886 * here.
1887 */
1888
1889 change_notify_reply(inbuf, max_param_count,
1890 fsp->notify->num_changes,
1891 fsp->notify->changes);
1892
1893 TALLOC_FREE(fsp->notify->changes);
1894 fsp->notify->num_changes = 0;
1895
1896 /*
1897 * change_notify_reply() above has independently sent its
1898 * results
1899 */
1900 return -1;
1901 }
1902
1903 /*
1904 * No changes pending, queue the request
1905 */
1906
1907 status = change_notify_add_request(inbuf, max_param_count, filter,
1908 recursive, fsp);
1909 if (!NT_STATUS_IS_OK(status)) {
1910 return ERROR_NT(status);
1911 }
1912
1913 return -1;
1914 }
1915
1916 /****************************************************************************
1917 Reply to an NT transact rename command.
1918 ****************************************************************************/
1919
1920 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1921 uint16 **ppsetup, uint32 setup_count,
1922 char **ppparams, uint32 parameter_count,
1923 char **ppdata, uint32 data_count, uint32 max_data_count)
1924 {
1925 char *params = *ppparams;
1926 pstring new_name;
1927 files_struct *fsp = NULL;
1928 BOOL replace_if_exists = False;
1929 BOOL path_contains_wcard = False;
1930 NTSTATUS status;
1931
1932 if(parameter_count < 5) {
1933 return ERROR_DOS(ERRDOS,ERRbadfunc);
1934 }
1935
1936 fsp = file_fsp(params, 0);
1937 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
1938 CHECK_FSP(fsp, conn);
1939 srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4, STR_TERMINATE, &status, &path_contains_wcard);
1940 if (!NT_STATUS_IS_OK(status)) {
1941 return ERROR_NT(status);
1942 }
1943
1944 status = rename_internals(conn, fsp->fsp_name,
1945 new_name, 0, replace_if_exists, path_contains_wcard);
1946
1947 if (!NT_STATUS_IS_OK(status)) {
1948 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1949 /* We have re-scheduled this call. */
1950 return -1;
1951 }
1952 return ERROR_NT(status);
1953 }
1954
1955 /*
1956 * Rename was successful.
1957 */
1958 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
1959
1960 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
1961 fsp->fsp_name, new_name));
1962
1963 return -1;
1964 }
1965
1966 /******************************************************************************
1967 Fake up a completely empty SD.
1968 *******************************************************************************/
1969
1970 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1971 {
1972 size_t sd_size;
1973
1974 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1975 if(!*ppsd) {
1976 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1977 sd_size = 0;
1978 }
1979
1980 return sd_size;
1981 }
1982
1983 /****************************************************************************
1984 Reply to query a security descriptor.
1985 ****************************************************************************/
1986
1987 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1988 uint16 **ppsetup, uint32 setup_count,
1989 char **ppparams, uint32 parameter_count,
1990 char **ppdata, uint32 data_count, uint32 max_data_count)
1991 {
1992 char *params = *ppparams;
1993 char *data = *ppdata;
1994 prs_struct pd;
1995 SEC_DESC *psd = NULL;
1996 size_t sd_size;
1997 uint32 security_info_wanted;
1998 TALLOC_CTX *mem_ctx;
1999 files_struct *fsp = NULL;
2000
2001 if(parameter_count < 8) {
2002 return ERROR_DOS(ERRDOS,ERRbadfunc);
2003 }
2004
2005 fsp = file_fsp(params,0);
2006 if(!fsp) {
2007 return ERROR_DOS(ERRDOS,ERRbadfid);
2008 }
2009
2010 security_info_wanted = IVAL(params,4);
2011
2012 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2013 (unsigned int)security_info_wanted ));
2014
2015 params = nttrans_realloc(ppparams, 4);
2016 if(params == NULL) {
2017 return ERROR_DOS(ERRDOS,ERRnomem);
2018 }
2019
2020 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2021 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2022 return ERROR_DOS(ERRDOS,ERRnomem);
2023 }
2024
2025 /*
2026 * Get the permissions to return.
2027 */
2028
2029 if (!lp_nt_acl_support(SNUM(conn))) {
2030 sd_size = get_null_nt_acl(mem_ctx, &psd);
2031 } else {
2032 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2033 }
2034
2035 if (sd_size == 0) {
2036 talloc_destroy(mem_ctx);
2037 return(UNIXERROR(ERRDOS,ERRnoaccess));
2038 }
2039
2040 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2041
2042 SIVAL(params,0,(uint32)sd_size);
2043
2044 if(max_data_count < sd_size) {
2045
2046 send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2047 params, 4, *ppdata, 0);
2048 talloc_destroy(mem_ctx);
2049 return -1;
2050 }
2051
2052 /*
2053 * Allocate the data we will point this at.
2054 */
2055
2056 data = nttrans_realloc(ppdata, sd_size);
2057 if(data == NULL) {
2058 talloc_destroy(mem_ctx);
2059 return ERROR_DOS(ERRDOS,ERRnomem);
2060 }
2061
2062 /*
2063 * Init the parse struct we will marshall into.
2064 */
2065
2066 prs_init(&pd, 0, mem_ctx, MARSHALL);
2067
2068 /*
2069 * Setup the prs_struct to point at the memory we just
2070 * allocated.
2071 */
2072
2073 prs_give_memory( &pd, data, (uint32)sd_size, False);
2074
2075 /*
2076 * Finally, linearize into the outgoing buffer.
2077 */
2078
2079 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2080 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2081 security descriptor.\n"));
2082 /*
2083 * Return access denied for want of a better error message..
2084 */
2085 talloc_destroy(mem_ctx);
2086 return(UNIXERROR(ERRDOS,ERRnoaccess));
2087 }
2088
2089 /*
2090 * Now we can delete the security descriptor.
2091 */
2092
2093 talloc_destroy(mem_ctx);
2094
2095 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2096 (int)sd_size);
2097 return -1;
2098 }
2099
2100 /****************************************************************************
2101 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2102 ****************************************************************************/
2103
2104 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2105 uint16 **ppsetup, uint32 setup_count,
2106 char **ppparams, uint32 parameter_count,
2107 char **ppdata, uint32 data_count, uint32 max_data_count)
2108 {
2109 char *params= *ppparams;
2110 char *data = *ppdata;
2111 files_struct *fsp = NULL;
2112 uint32 security_info_sent = 0;
2113 NTSTATUS nt_status;
2114
2115 if(parameter_count < 8) {
2116 return ERROR_DOS(ERRDOS,ERRbadfunc);
2117 }
2118
2119 if((fsp = file_fsp(params,0)) == NULL) {
2120 return ERROR_DOS(ERRDOS,ERRbadfid);
2121 }
2122
2123 if(!lp_nt_acl_support(SNUM(conn))) {
2124 goto done;
2125 }
2126
2127 security_info_sent = IVAL(params,4);
2128
2129 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2130 (unsigned int)security_info_sent ));
2131
2132 if (data_count == 0) {
2133 return ERROR_DOS(ERRDOS, ERRnoaccess);
2134 }
2135
2136 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2137 return ERROR_NT(nt_status);
2138 }
2139
2140 done:
2141
2142 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2143 return -1;
2144 }
2145
2146 /****************************************************************************
2147 Reply to NT IOCTL
2148 ****************************************************************************/
2149
2150 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2151 uint16 **ppsetup, uint32 setup_count,
2152 char **ppparams, uint32 parameter_count,
2153 char **ppdata, uint32 data_count, uint32 max_data_count)
2154 {
2155 uint32 function;
2156 uint16 fidnum;
2157 files_struct *fsp;
2158 uint8 isFSctl;
2159 uint8 compfilter;
2160 static BOOL logged_message;
2161 char *pdata = *ppdata;
2162
2163 if (setup_count != 8) {
2164 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2165 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2166 }
2167
2168 function = IVAL(*ppsetup, 0);
2169 fidnum = SVAL(*ppsetup, 4);
2170 isFSctl = CVAL(*ppsetup, 6);
2171 compfilter = CVAL(*ppsetup, 7);
2172
2173 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2174 function, fidnum, isFSctl, compfilter));
2175
2176 fsp=file_fsp((char *)*ppsetup, 4);
2177 /* this check is done in each implemented function case for now
2178 because I don't want to break anything... --metze
2179 FSP_BELONGS_CONN(fsp,conn);*/
2180
2181 switch (function) {
2182 case FSCTL_SET_SPARSE:
2183 /* pretend this succeeded - tho strictly we should
2184 mark the file sparse (if the local fs supports it)
2185 so we can know if we need to pre-allocate or not */
2186
2187 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2188 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2189 0);
2190 return -1;
2191
2192 case FSCTL_0x000900C0:
2193 /* pretend this succeeded - don't know what this really is
2194 but works ok like this --metze
2195 */
2196
2197 DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
2198 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2199 0);
2200 return -1;
2201
2202 case FSCTL_GET_REPARSE_POINT:
2203 /* pretend this fail - my winXP does it like this
2204 * --metze
2205 */
2206
2207 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2208 send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2209 NULL, 0, NULL, 0);
2210 return -1;
2211
2212 case FSCTL_SET_REPARSE_POINT:
2213 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2214 * --metze
2215 */
2216
2217 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2218 send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
2219 NULL, 0, NULL, 0);
2220 return -1;
2221
2222 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2223 {
2224 /*
2225 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2226 * and return their volume names. If max_data_count is 16, then it is just
2227 * asking for the number of volumes and length of the combined names.
2228 *
2229 * pdata is the data allocated by our caller, but that uses
2230 * total_data_count (which is 0 in our case) rather than max_data_count.
2231 * Allocate the correct amount and return the pointer to let
2232 * it be deallocated when we return.
2233 */
2234 SHADOW_COPY_DATA *shadow_data = NULL;
2235 TALLOC_CTX *shadow_mem_ctx = NULL;
2236 BOOL labels = False;
2237 uint32 labels_data_count = 0;
2238 uint32 i;
2239 char *cur_pdata;
2240
2241 FSP_BELONGS_CONN(fsp,conn);
2242
2243 if (max_data_count < 16) {
2244 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2245 max_data_count));
2246 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2247 }
2248
2249 if (max_data_count > 16) {
2250 labels = True;
2251 }
2252
2253 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2254 if (shadow_mem_ctx == NULL) {
2255 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2256 return ERROR_NT(NT_STATUS_NO_MEMORY);
2257 }
2258
2259 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2260 if (shadow_data == NULL) {
2261 DEBUG(0,("talloc_zero() failed!\n"));
2262 talloc_destroy(shadow_mem_ctx);
2263 return ERROR_NT(NT_STATUS_NO_MEMORY);
2264 }
2265
2266 shadow_data->mem_ctx = shadow_mem_ctx;
2267
2268 /*
2269 * Call the VFS routine to actually do the work.
2270 */
2271 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2272 talloc_destroy(shadow_data->mem_ctx);
2273 if (errno == ENOSYS) {
2274 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2275 conn->connectpath));
2276 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2277 } else {
2278 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2279 conn->connectpath));
2280 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2281 }
2282 }
2283
2284 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2285
2286 if (!labels) {
2287 data_count = 16;
2288 } else {
2289 data_count = 12+labels_data_count+4;
2290 }
2291
2292 if (max_data_count<data_count) {
2293 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2294 max_data_count,data_count));
2295 talloc_destroy(shadow_data->mem_ctx);
2296 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2297 }
2298
2299 pdata = nttrans_realloc(ppdata, data_count);
2300 if (pdata == NULL) {
2301 talloc_destroy(shadow_data->mem_ctx);
2302 return ERROR_NT(NT_STATUS_NO_MEMORY);
2303 }
2304
2305 cur_pdata = pdata;
2306
2307 /* num_volumes 4 bytes */
2308 SIVAL(pdata,0,shadow_data->num_volumes);
2309
2310 if (labels) {
2311 /* num_labels 4 bytes */
2312 SIVAL(pdata,4,shadow_data->num_volumes);
2313 }
2314
2315 /* needed_data_count 4 bytes */
2316 SIVAL(pdata,8,labels_data_count);
2317
2318 cur_pdata+=12;
2319
2320 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2321 shadow_data->num_volumes,fsp->fsp_name));
2322 if (labels && shadow_data->labels) {
2323 for (i=0;i<shadow_data->num_volumes;i++) {
2324 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2325 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2326 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2327 }
2328 }
2329
2330 talloc_destroy(shadow_data->mem_ctx);
2331
2332 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2333 pdata, data_count);
2334
2335 return -1;
2336 }
2337
2338 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2339 {
2340 /* pretend this succeeded -
2341 *
2342 * we have to send back a list with all files owned by this SID
2343 *
2344 * but I have to check that --metze
2345 */
2346 DOM_SID sid;
2347 uid_t uid;
2348 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2349
2350 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2351
2352 FSP_BELONGS_CONN(fsp,conn);
2353
2354 /* unknown 4 bytes: this is not the length of the sid :-( */
2355 /*unknown = IVAL(pdata,0);*/
2356
2357 sid_parse(pdata+4,sid_len,&sid);
2358 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2359
2360 if (!sid_to_uid(&sid, &uid)) {
2361 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2362 sid_string_static(&sid),(unsigned long)sid_len));
2363 uid = (-1);
2364 }
2365
2366 /* we can take a look at the find source :-)
2367 *
2368 * find ./ -uid $uid -name '*' is what we need here
2369 *
2370 *
2371 * and send 4bytes len and then NULL terminated unicode strings
2372 * for each file
2373 *
2374 * but I don't know how to deal with the paged results
2375 * (maybe we can hang the result anywhere in the fsp struct)
2376 *
2377 * we don't send all files at once
2378 * and at the next we should *not* start from the beginning,
2379 * so we have to cache the result
2380 *
2381 * --metze
2382 */
2383
2384 /* this works for now... */
2385 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2386 NULL, 0);
2387 return -1;
2388 }
2389 default:
2390 if (!logged_message) {
2391 logged_message = True; /* Only print this once... */
2392 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2393 function));
2394 }
2395 }
2396
2397 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2398 }
2399
2400
2401 #ifdef HAVE_SYS_QUOTAS
2402 /****************************************************************************
2403 Reply to get user quota
2404 ****************************************************************************/
2405
2406 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2407 uint16 **ppsetup, uint32 setup_count,
2408 char **ppparams, uint32 parameter_count,
2409 char **ppdata, uint32 data_count, uint32 max_data_count)
2410 {
2411 NTSTATUS nt_status = NT_STATUS_OK;
2412 char *params = *ppparams;
2413 char *pdata = *ppdata;
2414 char *entry;
2415 int data_len=0,param_len=0;
2416 int qt_len=0;
2417 int entry_len = 0;
2418 files_struct *fsp = NULL;
2419 uint16 level = 0;
2420 size_t sid_len;
2421 DOM_SID sid;
2422 BOOL start_enum = True;
2423 SMB_NTQUOTA_STRUCT qt;
2424 SMB_NTQUOTA_LIST *tmp_list;
2425 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2426
2427 ZERO_STRUCT(qt);
2428
2429 /* access check */
2430 if (current_user.ut.uid != 0) {
2431 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2432 lp_servicename(SNUM(conn)),conn->user));
2433 return ERROR_DOS(ERRDOS,ERRnoaccess);
2434 }
2435
2436 /*
2437 * Ensure minimum number of parameters sent.
2438 */
2439
2440 if (parameter_count < 4) {
2441 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2442 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2443 }
2444
2445 /* maybe we can check the quota_fnum */
2446 fsp = file_fsp(params,0);
2447 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2448 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2449 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2450 }
2451
2452 /* the NULL pointer checking for fsp->fake_file_handle->pd
2453 * is done by CHECK_NTQUOTA_HANDLE_OK()
2454 */
2455 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2456
2457 level = SVAL(params,2);
2458
2459 /* unknown 12 bytes leading in params */
2460
2461 switch (level) {
2462 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2463 /* seems that we should continue with the enum here --metze */
2464
2465 if (qt_handle->quota_list!=NULL &&
2466 qt_handle->tmp_list==NULL) {
2467
2468 /* free the list */
2469 free_ntquota_list(&(qt_handle->quota_list));
2470
2471 /* Realloc the size of parameters and data we will return */
2472 param_len = 4;
2473 params = nttrans_realloc(ppparams, param_len);
2474 if(params == NULL) {
2475 return ERROR_DOS(ERRDOS,ERRnomem);
2476 }
2477
2478 data_len = 0;
2479 SIVAL(params,0,data_len);
2480
2481 break;
2482 }
2483
2484 start_enum = False;
2485
2486 case TRANSACT_GET_USER_QUOTA_LIST_START:
2487
2488 if (qt_handle->quota_list==NULL &&
2489 qt_handle->tmp_list==NULL) {
2490 start_enum = True;
2491 }
2492
2493 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2494 return ERROR_DOS(ERRSRV,ERRerror);
2495
2496 /* Realloc the size of parameters and data we will return */
2497 param_len = 4;
2498 params = nttrans_realloc(ppparams, param_len);
2499 if(params == NULL) {
2500 return ERROR_DOS(ERRDOS,ERRnomem);
2501 }
2502
2503 /* we should not trust the value in max_data_count*/
2504 max_data_count = MIN(max_data_count,2048);
2505
2506 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2507 if(pdata == NULL) {
2508 return ERROR_DOS(ERRDOS,ERRnomem);
2509 }
2510
2511 entry = pdata;
2512
2513 /* set params Size of returned Quota Data 4 bytes*/
2514 /* but set it later when we know it */
2515
2516 /* for each entry push the data */
2517
2518 if (start_enum) {
2519 qt_handle->tmp_list = qt_handle->quota_list;
2520 }
2521
2522 tmp_list = qt_handle->tmp_list;
2523
2524 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2525 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2526
2527 sid_len = sid_size(&tmp_list->quotas->sid);
2528 entry_len = 40 + sid_len;
2529
2530 /* nextoffset entry 4 bytes */
2531 SIVAL(entry,0,entry_len);
2532
2533 /* then the len of the SID 4 bytes */
2534 SIVAL(entry,4,sid_len);
2535
2536 /* unknown data 8 bytes SMB_BIG_UINT */
2537 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2538
2539 /* the used disk space 8 bytes SMB_BIG_UINT */
2540 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2541
2542 /* the soft quotas 8 bytes SMB_BIG_UINT */
2543 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2544
2545 /* the hard quotas 8 bytes SMB_BIG_UINT */
2546 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2547
2548 /* and now the SID */
2549 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2550 }
2551
2552 qt_handle->tmp_list = tmp_list;
2553
2554 /* overwrite the offset of the last entry */
2555 SIVAL(entry-entry_len,0,0);
2556
2557 data_len = 4+qt_len;
2558 /* overwrite the params quota_data_len */
2559 SIVAL(params,0,data_len);
2560
2561 break;
2562
2563 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2564
2565 /* unknown 4 bytes IVAL(pdata,0) */
2566
2567 if (data_count < 8) {
2568 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2569 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2570 }
2571
2572 sid_len = IVAL(pdata,4);
2573 /* Ensure this is less than 1mb. */
2574 if (sid_len > (1024*1024)) {
2575 return ERROR_DOS(ERRDOS,ERRnomem);
2576 }
2577
2578 if (data_count < 8+sid_len) {
2579 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2580 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2581 }
2582
2583 data_len = 4+40+sid_len;
2584
2585 if (max_data_count < data_len) {
2586 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2587 max_data_count, data_len));
2588 param_len = 4;
2589 SIVAL(params,0,data_len);
2590 data_len = 0;
2591 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2592 break;
2593 }
2594
2595 sid_parse(pdata+8,sid_len,&sid);
2596
2597 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2598 ZERO_STRUCT(qt);
2599 /*
2600 * we have to return zero's in all fields
2601 * instead of returning an error here
2602 * --metze
2603 */
2604 }
2605
2606 /* Realloc the size of parameters and data we will return */
2607 param_len = 4;
2608 params = nttrans_realloc(ppparams, param_len);
2609 if(params == NULL) {
2610 return ERROR_DOS(ERRDOS,ERRnomem);
2611 }
2612
2613 pdata = nttrans_realloc(ppdata, data_len);
2614 if(pdata == NULL) {
2615 return ERROR_DOS(ERRDOS,ERRnomem);
2616 }
2617
2618 entry = pdata;
2619
2620 /* set params Size of returned Quota Data 4 bytes*/
2621 SIVAL(params,0,data_len);
2622
2623 /* nextoffset entry 4 bytes */
2624 SIVAL(entry,0,0);
2625
2626 /* then the len of the SID 4 bytes */
2627 SIVAL(entry,4,sid_len);
2628
2629 /* unknown data 8 bytes SMB_BIG_UINT */
2630 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2631
2632 /* the used disk space 8 bytes SMB_BIG_UINT */
2633 SBIG_UINT(entry,16,qt.usedspace);
2634
2635 /* the soft quotas 8 bytes SMB_BIG_UINT */
2636 SBIG_UINT(entry,24,qt.softlim);
2637
2638 /* the hard quotas 8 bytes SMB_BIG_UINT */
2639 SBIG_UINT(entry,32,qt.hardlim);
2640
2641 /* and now the SID */
2642 sid_linearize(entry+40, sid_len, &sid);
2643
2644 break;
2645
2646 default:
2647 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2648 return ERROR_DOS(ERRSRV,ERRerror);
2649 break;
2650 }
2651
2652 send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
2653 pdata, data_len);
2654
2655 return -1;
2656 }
2657
2658 /****************************************************************************
2659 Reply to set user quota
2660 ****************************************************************************/
2661
2662 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2663 uint16 **ppsetup, uint32 setup_count,
2664 char **ppparams, uint32 parameter_count,
2665 char **ppdata, uint32 data_count, uint32 max_data_count)
2666 {
2667 char *params = *ppparams;
2668 char *pdata = *ppdata;
2669 int data_len=0,param_len=0;
2670 SMB_NTQUOTA_STRUCT qt;
2671 size_t sid_len;
2672 DOM_SID sid;
2673 files_struct *fsp = NULL;
2674
2675 ZERO_STRUCT(qt);
2676
2677 /* access check */
2678 if (current_user.ut.uid != 0) {
2679 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2680 lp_servicename(SNUM(conn)),conn->user));
2681 return ERROR_DOS(ERRDOS,ERRnoaccess);
2682 }
2683
2684 /*
2685 * Ensure minimum number of parameters sent.
2686 */
2687
2688 if (parameter_count < 2) {
2689 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2690 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2691 }
2692
2693 /* maybe we can check the quota_fnum */
2694 fsp = file_fsp(params,0);
2695 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2696 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2697 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2698 }
2699
2700 if (data_count < 40) {
2701 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2702 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2703 }
2704
2705 /* offset to next quota record.
2706 * 4 bytes IVAL(pdata,0)
2707 * unused here...
2708 */
2709
2710 /* sid len */
2711 sid_len = IVAL(pdata,4);
2712
2713 if (data_count < 40+sid_len) {
2714 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2715 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2716 }
2717
2718 /* unknown 8 bytes in pdata
2719 * maybe its the change time in NTTIME
2720 */
2721
2722 /* the used space 8 bytes (SMB_BIG_UINT)*/
2723 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2724 #ifdef LARGE_SMB_OFF_T
2725 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2726 #else /* LARGE_SMB_OFF_T */
2727 if ((IVAL(pdata,20) != 0)&&
2728 ((qt.usedspace != 0xFFFFFFFF)||
2729 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2730 /* more than 32 bits? */
2731 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2732 }
2733 #endif /* LARGE_SMB_OFF_T */
2734
2735 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2736 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2737 #ifdef LARGE_SMB_OFF_T
2738 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2739 #else /* LARGE_SMB_OFF_T */
2740 if ((IVAL(pdata,28) != 0)&&
2741 ((qt.softlim != 0xFFFFFFFF)||
2742 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2743 /* more than 32 bits? */
2744 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2745 }
2746 #endif /* LARGE_SMB_OFF_T */
2747
2748 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2749 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2750 #ifdef LARGE_SMB_OFF_T
2751 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2752 #else /* LARGE_SMB_OFF_T */
2753 if ((IVAL(pdata,36) != 0)&&
2754 ((qt.hardlim != 0xFFFFFFFF)||
2755 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2756 /* more than 32 bits? */
2757 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2758 }
2759 #endif /* LARGE_SMB_OFF_T */
2760
2761 sid_parse(pdata+40,sid_len,&sid);
2762 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2763
2764 /* 44 unknown bytes left... */
2765
2766 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2767 return ERROR_DOS(ERRSRV,ERRerror);
2768 }
2769
2770 send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
2771 pdata, data_len);
2772
2773 return -1;
2774 }
2775 #endif /* HAVE_SYS_QUOTAS */
2776
2777 static int handle_nttrans(connection_struct *conn,
2778 struct trans_state *state,
2779 char *inbuf, char *outbuf, int size, int bufsize)
2780 {
2781 int outsize;
2782
2783 if (Protocol >= PROTOCOL_NT1) {
2784 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
2785 }
2786
2787 /* Now we must call the relevant NT_TRANS function */
2788 switch(state->call) {
2789 case NT_TRANSACT_CREATE:
2790 {
2791 START_PROFILE(NT_transact_create);
2792 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2793 size, bufsize,
2794 &state->setup, state->setup_count,
2795 &state->param, state->total_param,
2796 &state->data, state->total_data,
2797 state->max_data_return);
2798 END_PROFILE(NT_transact_create);
2799 break;
2800 }
2801
2802 case NT_TRANSACT_IOCTL:
2803 {
2804 START_PROFILE(NT_transact_ioctl);
2805 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2806 size, bufsize,
2807 &state->setup, state->setup_count,
2808 &state->param, state->total_param,
2809 &state->data, state->total_data, state->max_data_return);
2810 END_PROFILE(NT_transact_ioctl);
2811 break;
2812 }
2813
2814 case NT_TRANSACT_SET_SECURITY_DESC:
2815 {
2816 START_PROFILE(NT_transact_set_security_desc);
2817 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2818 size, bufsize,
2819 &state->setup, state->setup_count,
2820 &state->param, state->total_param,
2821 &state->data, state->total_data, state->max_data_return);
2822 END_PROFILE(NT_transact_set_security_desc);
2823 break;
2824 }
2825
2826 case NT_TRANSACT_NOTIFY_CHANGE:
2827 {
2828 START_PROFILE(NT_transact_notify_change);
2829 outsize = call_nt_transact_notify_change(
2830 conn, inbuf, outbuf, size, bufsize,
2831 &state->setup, state->setup_count,
2832 &state->param, state->total_param,
2833 &state->data, state->total_data,
2834 state->max_data_return,
2835 state->max_param_return);
2836 END_PROFILE(NT_transact_notify_change);
2837 break;
2838 }
2839
2840 case NT_TRANSACT_RENAME:
2841 {
2842 START_PROFILE(NT_transact_rename);
2843 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
2844 size, bufsize,
2845 &state->setup, state->setup_count,
2846 &state->param, state->total_param,
2847 &state->data, state->total_data, state->max_data_return);
2848 END_PROFILE(NT_transact_rename);
2849 break;
2850 }
2851
2852 case NT_TRANSACT_QUERY_SECURITY_DESC:
2853 {
2854 START_PROFILE(NT_transact_query_security_desc);
2855 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
2856 size, bufsize,
2857 &state->setup, state->setup_count,
2858 &state->param, state->total_param,
2859 &state->data, state->total_data, state->max_data_return);
2860 END_PROFILE(NT_transact_query_security_desc);
2861 break;
2862 }
2863
2864 #ifdef HAVE_SYS_QUOTAS
2865 case NT_TRANSACT_GET_USER_QUOTA:
2866 {
2867 START_PROFILE(NT_transact_get_user_quota);
2868 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
2869 size, bufsize,
2870 &state->setup, state->setup_count,
2871 &state->param, state->total_param,
2872 &state->data, state->total_data, state->max_data_return);
2873 END_PROFILE(NT_transact_get_user_quota);
2874 break;
2875 }
2876
2877 case NT_TRANSACT_SET_USER_QUOTA:
2878 {
2879 START_PROFILE(NT_transact_set_user_quota);
2880 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
2881 size, bufsize,
2882 &state->setup, state->setup_count,
2883 &state->param, state->total_param,
2884 &state->data, state->total_data, state->max_data_return);
2885 END_PROFILE(NT_transact_set_user_quota);
2886 break;
2887 }
2888 #endif /* HAVE_SYS_QUOTAS */
2889
2890 default:
2891 /* Error in request */
2892 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
2893 state->call));
2894 return ERROR_DOS(ERRSRV,ERRerror);
2895 }
2896 return outsize;
2897 }
2898
2899 /****************************************************************************
2900 Reply to a SMBNTtrans.
2901 ****************************************************************************/
2902
2903 int reply_nttrans(connection_struct *conn,
2904 char *inbuf,char *outbuf,int size,int bufsize)
2905 {
2906 int outsize = 0;
2907 uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
2908 uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
2909 uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
2910 uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
2911
2912 uint16 function_code = SVAL( inbuf, smb_nt_Function);
2913 NTSTATUS result;
2914 struct trans_state *state;
2915
2916 START_PROFILE(SMBnttrans);
2917
2918 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2919 END_PROFILE(SMBnttrans);
2920 return ERROR_DOS(ERRSRV,ERRaccess);
2921 }
2922
2923 result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
2924 if (!NT_STATUS_IS_OK(result)) {
2925 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2926 END_PROFILE(SMBnttrans);
2927 return ERROR_NT(result);
2928 }
2929
2930 if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2931 END_PROFILE(SMBnttrans);
2932 return ERROR_DOS(ERRSRV,ERRaccess);
2933 }
2934
2935 state->cmd = SMBnttrans;
2936
2937 state->mid = SVAL(inbuf,smb_mid);
2938 state->vuid = SVAL(inbuf,smb_uid);
2939 state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
2940 state->data = NULL;
2941 state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
2942 state->param = NULL;
2943 state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
2944 state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
2945
2946 /* setup count is in *words* */
2947 state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
2948 state->setup = NULL;
2949 state->call = function_code;
2950
2951 /*
2952 * All nttrans messages we handle have smb_wct == 19 +
2953 * state->setup_count. Ensure this is so as a sanity check.
2954 */
2955
2956 if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
2957 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2958 CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
2959 goto bad_param;
2960 }
2961
2962 /* Don't allow more than 128mb for each value. */
2963 if ((state->total_data > (1024*1024*128)) ||
2964 (state->total_param > (1024*1024*128))) {
2965 END_PROFILE(SMBnttrans);
2966 return ERROR_DOS(ERRDOS,ERRnomem);
2967 }
2968
2969 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2970 goto bad_param;
2971
2972 if (state->total_data) {
2973 /* Can't use talloc here, the core routines do realloc on the
2974 * params and data. */
2975 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2976 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2977 "bytes !\n", (unsigned int)state->total_data));
2978 TALLOC_FREE(state);
2979 END_PROFILE(SMBnttrans);
2980 return(ERROR_DOS(ERRDOS,ERRnomem));
2981 }
2982 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
2983 goto bad_param;
2984 if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
2985 (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
2986 goto bad_param;
2987
2988 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
2989 }
2990
2991 if (state->total_param) {
2992 /* Can't use talloc here, the core routines do realloc on the
2993 * params and data. */
2994 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2995 DEBUG(0,("reply_nttrans: param malloc fail for %u "
2996 "bytes !\n", (unsigned int)state->total_param));
2997 SAFE_FREE(state->data);
2998 TALLOC_FREE(state);
2999 END_PROFILE(SMBnttrans);
3000 return(ERROR_DOS(ERRDOS,ERRnomem));
3001 }
3002 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
3003 goto bad_param;
3004 if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
3005 (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
3006 goto bad_param;
3007
3008 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
3009 }
3010
3011 state->received_data = dscnt;
3012 state->received_param = pscnt;
3013
3014 if(state->setup_count > 0) {
3015 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3016 state->setup_count));
3017 state->setup = (uint16 *)TALLOC(state, state->setup_count);
3018 if (state->setup == NULL) {
3019 DEBUG(0,("reply_nttrans : Out of memory\n"));
3020 SAFE_FREE(state->data);
3021 SAFE_FREE(state->param);
3022 TALLOC_FREE(state);
3023 END_PROFILE(SMBnttrans);
3024 return ERROR_DOS(ERRDOS,ERRnomem);
3025 }
3026
3027 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
3028 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3029 goto bad_param;
3030 }
3031 if (smb_nt_SetupStart + state->setup_count > size) {
3032 goto bad_param;
3033 }
3034
3035 memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3036 dump_data(10, (char *)state->setup, state->setup_count);
3037 }
3038
3039 if ((state->received_data == state->total_data) &&
3040 (state->received_param == state->total_param)) {
3041 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3042 size, bufsize);
3043 SAFE_FREE(state->param);
3044 SAFE_FREE(state->data);
3045 TALLOC_FREE(state);
3046 END_PROFILE(SMBnttrans);
3047 return outsize;
3048 }
3049
3050 DLIST_ADD(conn->pending_trans, state);
3051
3052 /* We need to send an interim response then receive the rest
3053 of the parameter/data bytes */
3054 outsize = set_message(outbuf,0,0,False);
3055 show_msg(outbuf);
3056 END_PROFILE(SMBnttrans);
3057 return outsize;
3058
3059 bad_param:
3060
3061 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3062 SAFE_FREE(state->data);
3063 SAFE_FREE(state->param);
3064 TALLOC_FREE(state);
3065 END_PROFILE(SMBnttrans);
3066 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3067 }
3068
3069 /****************************************************************************
3070 Reply to a SMBnttranss
3071 ****************************************************************************/
3072
3073 int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf,
3074 int size,int bufsize)
3075 {
3076 int outsize = 0;
3077 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3078 struct trans_state *state;
3079
3080 START_PROFILE(SMBnttranss);
3081
3082 show_msg(inbuf);
3083
3084 for (state = conn->pending_trans; state != NULL;
3085 state = state->next) {
3086 if (state->mid == SVAL(inbuf,smb_mid)) {
3087 break;
3088 }
3089 }
3090
3091 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3092 END_PROFILE(SMBnttranss);
3093 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3094 }
3095
3096 /* Revise state->total_param and state->total_data in case they have
3097 changed downwards */
3098 if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3099 state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3100 }
3101 if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3102 state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3103 }
3104
3105 pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3106 poff = IVAL(inbuf, smb_nts_ParameterOffset);
3107 pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3108
3109 dcnt = IVAL(inbuf, smb_nts_DataCount);
3110 ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3111 doff = IVAL(inbuf, smb_nts_DataOffset);
3112
3113 state->received_param += pcnt;
3114 state->received_data += dcnt;
3115
3116 if ((state->received_data > state->total_data) ||
3117 (state->received_param > state->total_param))
3118 goto bad_param;
3119
3120 if (pcnt) {
3121 if (pdisp+pcnt > state->total_param)
3122 goto bad_param;
3123 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3124 goto bad_param;
3125 if (pdisp > state->total_param)
3126 goto bad_param;
3127 if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
3128 (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3129 goto bad_param;
3130 if (state->param + pdisp < state->param)
3131 goto bad_param;
3132
3133 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3134 pcnt);
3135 }
3136
3137 if (dcnt) {
3138 if (ddisp+dcnt > state->total_data)
3139 goto bad_param;
3140 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3141 goto bad_param;
3142 if (ddisp > state->total_data)
3143 goto bad_param;
3144 if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
3145 (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3146 goto bad_param;
3147 if (state->data + ddisp < state->data)
3148 goto bad_param;
3149
3150 memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3151 dcnt);
3152 }
3153
3154 if ((state->received_param < state->total_param) ||
3155 (state->received_data < state->total_data)) {
3156 END_PROFILE(SMBnttranss);
3157 return -1;
3158 }
3159
3160 /* construct_reply_common has done us the favor to pre-fill the
3161 * command field with SMBnttranss which is wrong :-)
3162 */
3163 SCVAL(outbuf,smb_com,SMBnttrans);
3164
3165 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3166 size, bufsize);
3167
3168 DLIST_REMOVE(conn->pending_trans, state);
3169 SAFE_FREE(state->data);
3170 SAFE_FREE(state->param);
3171 TALLOC_FREE(state);
3172
3173 if (outsize == 0) {
3174 END_PROFILE(SMBnttranss);
3175 return(ERROR_DOS(ERRSRV,ERRnosupport));
3176 }
3177
3178 END_PROFILE(SMBnttranss);
3179 return(outsize);
3180
3181 bad_param:
3182
3183 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3184 DLIST_REMOVE(conn->pending_trans, state);
3185 SAFE_FREE(state->data);
3186 SAFE_FREE(state->param);
3187 TALLOC_FREE(state);
3188 END_PROFILE(SMBnttranss);
3189 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3190 }