?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-security: use shared SECINFO_OWNER define.
[Samba/ekacnet.git] / source3 / smbd / nttrans.c
blob9b838a616dc4525876dcb594182de35f478dc74c
1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23 #include "../librpc/gen_ndr/ndr_security.h"
24
25 extern const struct generic_mapping file_generic_mapping;
26
27 static char *nttrans_realloc(char **ptr, size_t size)
28 {
29 if (ptr==NULL) {
30 smb_panic("nttrans_realloc() called with NULL ptr");
31 }
32
33 *ptr = (char *)SMB_REALLOC(*ptr, size);
34 if(*ptr == NULL) {
35 return NULL;
36 }
37 memset(*ptr,'\0',size);
38 return *ptr;
39 }
40
41 /****************************************************************************
42 Send the required number of replies back.
43 We assume all fields other than the data fields are
44 set correctly for the type of call.
45 HACK ! Always assumes smb_setup field is zero.
46 ****************************************************************************/
47
48 void send_nt_replies(connection_struct *conn,
49 struct smb_request *req, NTSTATUS nt_error,
50 char *params, int paramsize,
51 char *pdata, int datasize)
52 {
53 int data_to_send = datasize;
54 int params_to_send = paramsize;
55 int useable_space;
56 char *pp = params;
57 char *pd = pdata;
58 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
59 int alignment_offset = 3;
60 int data_alignment_offset = 0;
61 struct smbd_server_connection *sconn = smbd_server_conn;
62 int max_send = sconn->smb1.sessions.max_send;
63
64 /*
65 * If there genuinely are no parameters or data to send just send
66 * the empty packet.
67 */
68
69 if(params_to_send == 0 && data_to_send == 0) {
70 reply_outbuf(req, 18, 0);
71 if (NT_STATUS_V(nt_error)) {
72 error_packet_set((char *)req->outbuf,
73 0, 0, nt_error,
74 __LINE__,__FILE__);
75 }
76 show_msg((char *)req->outbuf);
77 if (!srv_send_smb(smbd_server_fd(),
78 (char *)req->outbuf,
79 true, req->seqnum+1,
80 IS_CONN_ENCRYPTED(conn),
81 &req->pcd)) {
82 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
83 }
84 TALLOC_FREE(req->outbuf);
85 return;
86 }
87
88 /*
89 * When sending params and data ensure that both are nicely aligned.
90 * Only do this alignment when there is also data to send - else
91 * can cause NT redirector problems.
92 */
93
94 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
95 data_alignment_offset = 4 - (params_to_send % 4);
96 }
97
98 /*
99 * Space is bufsize minus Netbios over TCP header minus SMB header.
100 * The alignment_offset is to align the param bytes on a four byte
101 * boundary (2 bytes for data len, one byte pad).
102 * NT needs this to work correctly.
103 */
104
105 useable_space = max_send - (smb_size
106 + 2 * 18 /* wct */
107 + alignment_offset
108 + data_alignment_offset);
109
110 if (useable_space < 0) {
111 char *msg = talloc_asprintf(
112 talloc_tos(),
113 "send_nt_replies failed sanity useable_space = %d!!!",
114 useable_space);
115 DEBUG(0, ("%s\n", msg));
116 exit_server_cleanly(msg);
117 }
118
119 while (params_to_send || data_to_send) {
120
121 /*
122 * Calculate whether we will totally or partially fill this packet.
123 */
124
125 total_sent_thistime = params_to_send + data_to_send;
126
127 /*
128 * We can never send more than useable_space.
129 */
130
131 total_sent_thistime = MIN(total_sent_thistime, useable_space);
132
133 reply_outbuf(req, 18,
134 total_sent_thistime + alignment_offset
135 + data_alignment_offset);
136
137 /*
138 * We might have had SMBnttranss in req->inbuf, fix that.
139 */
140 SCVAL(req->outbuf, smb_com, SMBnttrans);
141
142 /*
143 * Set total params and data to be sent.
144 */
145
146 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
147 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
148
149 /*
150 * Calculate how many parameters and data we can fit into
151 * this packet. Parameters get precedence.
152 */
153
154 params_sent_thistime = MIN(params_to_send,useable_space);
155 data_sent_thistime = useable_space - params_sent_thistime;
156 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
157
158 SIVAL(req->outbuf, smb_ntr_ParameterCount,
159 params_sent_thistime);
160
161 if(params_sent_thistime == 0) {
162 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
163 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
164 } else {
165 /*
166 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
167 * parameter bytes, however the first 4 bytes of outbuf are
168 * the Netbios over TCP header. Thus use smb_base() to subtract
169 * them from the calculation.
170 */
171
172 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
173 ((smb_buf(req->outbuf)+alignment_offset)
174 - smb_base(req->outbuf)));
175 /*
176 * Absolute displacement of param bytes sent in this packet.
177 */
178
179 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
180 pp - params);
181 }
182
183 /*
184 * Deal with the data portion.
185 */
186
187 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
188
189 if(data_sent_thistime == 0) {
190 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
191 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
192 } else {
193 /*
194 * The offset of the data bytes is the offset of the
195 * parameter bytes plus the number of parameters being sent this time.
196 */
197
198 SIVAL(req->outbuf, smb_ntr_DataOffset,
199 ((smb_buf(req->outbuf)+alignment_offset) -
200 smb_base(req->outbuf))
201 + params_sent_thistime + data_alignment_offset);
202 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
203 }
204
205 /*
206 * Copy the param bytes into the packet.
207 */
208
209 if(params_sent_thistime) {
210 if (alignment_offset != 0) {
211 memset(smb_buf(req->outbuf), 0,
212 alignment_offset);
213 }
214 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
215 params_sent_thistime);
216 }
217
218 /*
219 * Copy in the data bytes
220 */
221
222 if(data_sent_thistime) {
223 if (data_alignment_offset != 0) {
224 memset((smb_buf(req->outbuf)+alignment_offset+
225 params_sent_thistime), 0,
226 data_alignment_offset);
227 }
228 memcpy(smb_buf(req->outbuf)+alignment_offset
229 +params_sent_thistime+data_alignment_offset,
230 pd,data_sent_thistime);
231 }
232
233 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
234 params_sent_thistime, data_sent_thistime, useable_space));
235 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
236 params_to_send, data_to_send, paramsize, datasize));
237
238 if (NT_STATUS_V(nt_error)) {
239 error_packet_set((char *)req->outbuf,
240 0, 0, nt_error,
241 __LINE__,__FILE__);
242 }
243
244 /* Send the packet */
245 show_msg((char *)req->outbuf);
246 if (!srv_send_smb(smbd_server_fd(),
247 (char *)req->outbuf,
248 true, req->seqnum+1,
249 IS_CONN_ENCRYPTED(conn),
250 &req->pcd)) {
251 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
252 }
253
254 TALLOC_FREE(req->outbuf);
255
256 pp += params_sent_thistime;
257 pd += data_sent_thistime;
258
259 params_to_send -= params_sent_thistime;
260 data_to_send -= data_sent_thistime;
261
262 /*
263 * Sanity check
264 */
265
266 if(params_to_send < 0 || data_to_send < 0) {
267 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
268 params_to_send, data_to_send));
269 exit_server_cleanly("send_nt_replies: internal error");
270 }
271 }
272 }
273
274 /****************************************************************************
275 Reply to an NT create and X call on a pipe
276 ****************************************************************************/
277
278 static void nt_open_pipe(char *fname, connection_struct *conn,
279 struct smb_request *req, int *ppnum)
280 {
281 files_struct *fsp;
282 NTSTATUS status;
283
284 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
285
286 /* Strip \\ off the name. */
287 fname++;
288
289 status = open_np_file(req, fname, &fsp);
290 if (!NT_STATUS_IS_OK(status)) {
291 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
292 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
293 ERRDOS, ERRbadpipe);
294 return;
295 }
296 reply_nterror(req, status);
297 return;
298 }
299
300 *ppnum = fsp->fnum;
301 return;
302 }
303
304 /****************************************************************************
305 Reply to an NT create and X call for pipes.
306 ****************************************************************************/
307
308 static void do_ntcreate_pipe_open(connection_struct *conn,
309 struct smb_request *req)
310 {
311 char *fname = NULL;
312 int pnum = -1;
313 char *p = NULL;
314 uint32 flags = IVAL(req->vwv+3, 1);
315 TALLOC_CTX *ctx = talloc_tos();
316
317 srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
318
319 if (!fname) {
320 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
321 ERRDOS, ERRbadpipe);
322 return;
323 }
324 nt_open_pipe(fname, conn, req, &pnum);
325
326 if (req->outbuf) {
327 /* error reply */
328 return;
329 }
330
331 /*
332 * Deal with pipe return.
333 */
334
335 if (flags & EXTENDED_RESPONSE_REQUIRED) {
336 /* This is very strange. We
337 * return 50 words, but only set
338 * the wcnt to 42 ? It's definately
339 * what happens on the wire....
340 */
341 reply_outbuf(req, 50, 0);
342 SCVAL(req->outbuf,smb_wct,42);
343 } else {
344 reply_outbuf(req, 34, 0);
345 }
346
347 p = (char *)req->outbuf + smb_vwv2;
348 p++;
349 SSVAL(p,0,pnum);
350 p += 2;
351 SIVAL(p,0,FILE_WAS_OPENED);
352 p += 4;
353 p += 32;
354 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
355 p += 20;
356 /* File type. */
357 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
358 /* Device state. */
359 SSVAL(p,2, 0x5FF); /* ? */
360 p += 4;
361
362 if (flags & EXTENDED_RESPONSE_REQUIRED) {
363 p += 25;
364 SIVAL(p,0,FILE_GENERIC_ALL);
365 /*
366 * For pipes W2K3 seems to return
367 * 0x12019B next.
368 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
369 */
370 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
371 }
372
373 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
374
375 chain_reply(req);
376 }
377
378 struct case_semantics_state {
379 connection_struct *conn;
380 bool case_sensitive;
381 bool case_preserve;
382 bool short_case_preserve;
383 };
384
385 /****************************************************************************
386 Restore case semantics.
387 ****************************************************************************/
388
389 static int restore_case_semantics(struct case_semantics_state *state)
390 {
391 state->conn->case_sensitive = state->case_sensitive;
392 state->conn->case_preserve = state->case_preserve;
393 state->conn->short_case_preserve = state->short_case_preserve;
394 return 0;
395 }
396
397 /****************************************************************************
398 Save case semantics.
399 ****************************************************************************/
400
401 static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
402 connection_struct *conn)
403 {
404 struct case_semantics_state *result;
405
406 if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
407 return NULL;
408 }
409
410 result->conn = conn;
411 result->case_sensitive = conn->case_sensitive;
412 result->case_preserve = conn->case_preserve;
413 result->short_case_preserve = conn->short_case_preserve;
414
415 /* Set to POSIX. */
416 conn->case_sensitive = True;
417 conn->case_preserve = True;
418 conn->short_case_preserve = True;
419
420 talloc_set_destructor(result, restore_case_semantics);
421
422 return result;
423 }
424
425 /****************************************************************************
426 Reply to an NT create and X call.
427 ****************************************************************************/
428
429 void reply_ntcreate_and_X(struct smb_request *req)
430 {
431 connection_struct *conn = req->conn;
432 struct smb_filename *smb_fname = NULL;
433 char *fname = NULL;
434 uint32 flags;
435 uint32 access_mask;
436 uint32 file_attributes;
437 uint32 share_access;
438 uint32 create_disposition;
439 uint32 create_options;
440 uint16 root_dir_fid;
441 uint64_t allocation_size;
442 /* Breakout the oplock request bits so we can set the
443 reply bits separately. */
444 uint32 fattr=0;
445 SMB_OFF_T file_len = 0;
446 int info = 0;
447 files_struct *fsp = NULL;
448 char *p = NULL;
449 struct timespec create_timespec;
450 struct timespec c_timespec;
451 struct timespec a_timespec;
452 struct timespec m_timespec;
453 struct timespec write_time_ts;
454 NTSTATUS status;
455 int oplock_request;
456 uint8_t oplock_granted = NO_OPLOCK_RETURN;
457 struct case_semantics_state *case_state = NULL;
458 TALLOC_CTX *ctx = talloc_tos();
459
460 START_PROFILE(SMBntcreateX);
461
462 if (req->wct < 24) {
463 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
464 goto out;
465 }
466
467 flags = IVAL(req->vwv+3, 1);
468 access_mask = IVAL(req->vwv+7, 1);
469 file_attributes = IVAL(req->vwv+13, 1);
470 share_access = IVAL(req->vwv+15, 1);
471 create_disposition = IVAL(req->vwv+17, 1);
472 create_options = IVAL(req->vwv+19, 1);
473 root_dir_fid = (uint16)IVAL(req->vwv+5, 1);
474
475 allocation_size = (uint64_t)IVAL(req->vwv+9, 1);
476 #ifdef LARGE_SMB_OFF_T
477 allocation_size |= (((uint64_t)IVAL(req->vwv+11, 1)) << 32);
478 #endif
479
480 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
481 STR_TERMINATE, &status);
482
483 if (!NT_STATUS_IS_OK(status)) {
484 reply_nterror(req, status);
485 goto out;
486 }
487
488 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
489 "file_attributes = 0x%x, share_access = 0x%x, "
490 "create_disposition = 0x%x create_options = 0x%x "
491 "root_dir_fid = 0x%x, fname = %s\n",
492 (unsigned int)flags,
493 (unsigned int)access_mask,
494 (unsigned int)file_attributes,
495 (unsigned int)share_access,
496 (unsigned int)create_disposition,
497 (unsigned int)create_options,
498 (unsigned int)root_dir_fid,
499 fname));
500
501 /*
502 * we need to remove ignored bits when they come directly from the client
503 * because we reuse some of them for internal stuff
504 */
505 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
506
507 /*
508 * If it's an IPC, use the pipe handler.
509 */
510
511 if (IS_IPC(conn)) {
512 if (lp_nt_pipe_support()) {
513 do_ntcreate_pipe_open(conn, req);
514 goto out;
515 }
516 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
517 goto out;
518 }
519
520 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
521 if (oplock_request) {
522 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
523 ? BATCH_OPLOCK : 0;
524 }
525
526 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
527 case_state = set_posix_case_semantics(ctx, conn);
528 if (!case_state) {
529 reply_nterror(req, NT_STATUS_NO_MEMORY);
530 goto out;
531 }
532 }
533
534 status = filename_convert(ctx,
535 conn,
536 req->flags2 & FLAGS2_DFS_PATHNAMES,
537 fname,
538 0,
539 NULL,
540 &smb_fname);
541
542 TALLOC_FREE(case_state);
543
544 if (!NT_STATUS_IS_OK(status)) {
545 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
546 reply_botherror(req,
547 NT_STATUS_PATH_NOT_COVERED,
548 ERRSRV, ERRbadpath);
549 goto out;
550 }
551 reply_nterror(req, status);
552 goto out;
553 }
554
555 /*
556 * Bug #6898 - clients using Windows opens should
557 * never be able to set this attribute into the
558 * VFS.
559 */
560 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
561
562 status = SMB_VFS_CREATE_FILE(
563 conn, /* conn */
564 req, /* req */
565 root_dir_fid, /* root_dir_fid */
566 smb_fname, /* fname */
567 access_mask, /* access_mask */
568 share_access, /* share_access */
569 create_disposition, /* create_disposition*/
570 create_options, /* create_options */
571 file_attributes, /* file_attributes */
572 oplock_request, /* oplock_request */
573 allocation_size, /* allocation_size */
574 0, /* private_flags */
575 NULL, /* sd */
576 NULL, /* ea_list */
577 &fsp, /* result */
578 &info); /* pinfo */
579
580 if (!NT_STATUS_IS_OK(status)) {
581 if (open_was_deferred(req->mid)) {
582 /* We have re-scheduled this call, no error. */
583 goto out;
584 }
585 reply_openerror(req, status);
586 goto out;
587 }
588
589 /* Ensure we're pointing at the correct stat struct. */
590 TALLOC_FREE(smb_fname);
591 smb_fname = fsp->fsp_name;
592
593 /*
594 * If the caller set the extended oplock request bit
595 * and we granted one (by whatever means) - set the
596 * correct bit for extended oplock reply.
597 */
598
599 if (oplock_request &&
600 (lp_fake_oplocks(SNUM(conn))
601 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
602
603 /*
604 * Exclusive oplock granted
605 */
606
607 if (flags & REQUEST_BATCH_OPLOCK) {
608 oplock_granted = BATCH_OPLOCK_RETURN;
609 } else {
610 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
611 }
612 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
613 oplock_granted = LEVEL_II_OPLOCK_RETURN;
614 } else {
615 oplock_granted = NO_OPLOCK_RETURN;
616 }
617
618 file_len = smb_fname->st.st_ex_size;
619
620 if (flags & EXTENDED_RESPONSE_REQUIRED) {
621 /* This is very strange. We
622 * return 50 words, but only set
623 * the wcnt to 42 ? It's definately
624 * what happens on the wire....
625 */
626 reply_outbuf(req, 50, 0);
627 SCVAL(req->outbuf,smb_wct,42);
628 } else {
629 reply_outbuf(req, 34, 0);
630 }
631
632 p = (char *)req->outbuf + smb_vwv2;
633
634 SCVAL(p, 0, oplock_granted);
635
636 p++;
637 SSVAL(p,0,fsp->fnum);
638 p += 2;
639 if ((create_disposition == FILE_SUPERSEDE)
640 && (info == FILE_WAS_OVERWRITTEN)) {
641 SIVAL(p,0,FILE_WAS_SUPERSEDED);
642 } else {
643 SIVAL(p,0,info);
644 }
645 p += 4;
646
647 fattr = dos_mode(conn, smb_fname);
648 if (fattr == 0) {
649 fattr = FILE_ATTRIBUTE_NORMAL;
650 }
651
652 /* Deal with other possible opens having a modified
653 write time. JRA. */
654 ZERO_STRUCT(write_time_ts);
655 get_file_infos(fsp->file_id, NULL, &write_time_ts);
656 if (!null_timespec(write_time_ts)) {
657 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
658 }
659
660 /* Create time. */
661 create_timespec = get_create_timespec(conn, fsp, smb_fname);
662 a_timespec = smb_fname->st.st_ex_atime;
663 m_timespec = smb_fname->st.st_ex_mtime;
664 c_timespec = get_change_timespec(conn, fsp, smb_fname);
665
666 if (lp_dos_filetime_resolution(SNUM(conn))) {
667 dos_filetime_timespec(&create_timespec);
668 dos_filetime_timespec(&a_timespec);
669 dos_filetime_timespec(&m_timespec);
670 dos_filetime_timespec(&c_timespec);
671 }
672
673 put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
674 p += 8;
675 put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
676 p += 8;
677 put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
678 p += 8;
679 put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
680 p += 8;
681 SIVAL(p,0,fattr); /* File Attributes. */
682 p += 4;
683 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
684 p += 8;
685 SOFF_T(p,0,file_len);
686 p += 8;
687 if (flags & EXTENDED_RESPONSE_REQUIRED) {
688 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
689 size_t num_names = 0;
690 unsigned int num_streams;
691 struct stream_struct *streams = NULL;
692
693 /* Do we have any EA's ? */
694 status = get_ea_names_from_file(ctx, conn, fsp,
695 smb_fname->base_name, NULL, &num_names);
696 if (NT_STATUS_IS_OK(status) && num_names) {
697 file_status &= ~NO_EAS;
698 }
699 status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
700 &num_streams, &streams);
701 /* There is always one stream, ::$DATA. */
702 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
703 file_status &= ~NO_SUBSTREAMS;
704 }
705 TALLOC_FREE(streams);
706 SSVAL(p,2,file_status);
707 }
708 p += 4;
709 SCVAL(p,0,fsp->is_directory ? 1 : 0);
710
711 if (flags & EXTENDED_RESPONSE_REQUIRED) {
712 uint32 perms = 0;
713 p += 25;
714 if (fsp->is_directory ||
715 can_write_to_file(conn, smb_fname)) {
716 perms = FILE_GENERIC_ALL;
717 } else {
718 perms = FILE_GENERIC_READ|FILE_EXECUTE;
719 }
720 SIVAL(p,0,perms);
721 }
722
723 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
724 fsp->fnum, smb_fname_str_dbg(smb_fname)));
725
726 chain_reply(req);
727 out:
728 END_PROFILE(SMBntcreateX);
729 return;
730 }
731
732 /****************************************************************************
733 Reply to a NT_TRANSACT_CREATE call to open a pipe.
734 ****************************************************************************/
735
736 static void do_nt_transact_create_pipe(connection_struct *conn,
737 struct smb_request *req,
738 uint16 **ppsetup, uint32 setup_count,
739 char **ppparams, uint32 parameter_count,
740 char **ppdata, uint32 data_count)
741 {
742 char *fname = NULL;
743 char *params = *ppparams;
744 int pnum = -1;
745 char *p = NULL;
746 NTSTATUS status;
747 size_t param_len;
748 uint32 flags;
749 TALLOC_CTX *ctx = talloc_tos();
750
751 /*
752 * Ensure minimum number of parameters sent.
753 */
754
755 if(parameter_count < 54) {
756 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
757 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
758 return;
759 }
760
761 flags = IVAL(params,0);
762
763 srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
764 parameter_count-53, STR_TERMINATE,
765 &status);
766 if (!NT_STATUS_IS_OK(status)) {
767 reply_nterror(req, status);
768 return;
769 }
770
771 nt_open_pipe(fname, conn, req, &pnum);
772
773 if (req->outbuf) {
774 /* Error return */
775 return;
776 }
777
778 /* Realloc the size of parameters and data we will return */
779 if (flags & EXTENDED_RESPONSE_REQUIRED) {
780 /* Extended response is 32 more byyes. */
781 param_len = 101;
782 } else {
783 param_len = 69;
784 }
785 params = nttrans_realloc(ppparams, param_len);
786 if(params == NULL) {
787 reply_nterror(req, NT_STATUS_NO_MEMORY);
788 return;
789 }
790
791 p = params;
792 SCVAL(p,0,NO_OPLOCK_RETURN);
793
794 p += 2;
795 SSVAL(p,0,pnum);
796 p += 2;
797 SIVAL(p,0,FILE_WAS_OPENED);
798 p += 8;
799
800 p += 32;
801 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
802 p += 20;
803 /* File type. */
804 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
805 /* Device state. */
806 SSVAL(p,2, 0x5FF); /* ? */
807 p += 4;
808
809 if (flags & EXTENDED_RESPONSE_REQUIRED) {
810 p += 25;
811 SIVAL(p,0,FILE_GENERIC_ALL);
812 /*
813 * For pipes W2K3 seems to return
814 * 0x12019B next.
815 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
816 */
817 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
818 }
819
820 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
821
822 /* Send the required number of replies */
823 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
824
825 return;
826 }
827
828 /****************************************************************************
829 Internal fn to set security descriptors.
830 ****************************************************************************/
831
832 NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
833 uint32_t security_info_sent)
834 {
835 struct security_descriptor *psd = NULL;
836 NTSTATUS status;
837
838 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
839 return NT_STATUS_OK;
840 }
841
842 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
843
844 if (!NT_STATUS_IS_OK(status)) {
845 return status;
846 }
847
848 if (psd->owner_sid == NULL) {
849 security_info_sent &= ~SECINFO_OWNER;
850 }
851 if (psd->group_sid == NULL) {
852 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
853 }
854
855 /* Convert all the generic bits. */
856 security_acl_map_generic(psd->dacl, &file_generic_mapping);
857 security_acl_map_generic(psd->sacl, &file_generic_mapping);
858
859 if (DEBUGLEVEL >= 10) {
860 DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
861 NDR_PRINT_DEBUG(security_descriptor, psd);
862 }
863
864 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
865
866 TALLOC_FREE(psd);
867
868 return status;
869 }
870
871 /****************************************************************************
872 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
873 ****************************************************************************/
874
875 struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
876 {
877 struct ea_list *ea_list_head = NULL;
878 size_t offset = 0;
879
880 if (data_size < 4) {
881 return NULL;
882 }
883
884 while (offset + 4 <= data_size) {
885 size_t next_offset = IVAL(pdata,offset);
886 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
887
888 if (!eal) {
889 return NULL;
890 }
891
892 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
893 if (next_offset == 0) {
894 break;
895 }
896 offset += next_offset;
897 }
898
899 return ea_list_head;
900 }
901
902 /****************************************************************************
903 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
904 ****************************************************************************/
905
906 static void call_nt_transact_create(connection_struct *conn,
907 struct smb_request *req,
908 uint16 **ppsetup, uint32 setup_count,
909 char **ppparams, uint32 parameter_count,
910 char **ppdata, uint32 data_count,
911 uint32 max_data_count)
912 {
913 struct smb_filename *smb_fname = NULL;
914 char *fname = NULL;
915 char *params = *ppparams;
916 char *data = *ppdata;
917 /* Breakout the oplock request bits so we can set the reply bits separately. */
918 uint32 fattr=0;
919 SMB_OFF_T file_len = 0;
920 int info = 0;
921 files_struct *fsp = NULL;
922 char *p = NULL;
923 uint32 flags;
924 uint32 access_mask;
925 uint32 file_attributes;
926 uint32 share_access;
927 uint32 create_disposition;
928 uint32 create_options;
929 uint32 sd_len;
930 struct security_descriptor *sd = NULL;
931 uint32 ea_len;
932 uint16 root_dir_fid;
933 struct timespec create_timespec;
934 struct timespec c_timespec;
935 struct timespec a_timespec;
936 struct timespec m_timespec;
937 struct timespec write_time_ts;
938 struct ea_list *ea_list = NULL;
939 NTSTATUS status;
940 size_t param_len;
941 uint64_t allocation_size;
942 int oplock_request;
943 uint8_t oplock_granted;
944 struct case_semantics_state *case_state = NULL;
945 TALLOC_CTX *ctx = talloc_tos();
946
947 DEBUG(5,("call_nt_transact_create\n"));
948
949 /*
950 * If it's an IPC, use the pipe handler.
951 */
952
953 if (IS_IPC(conn)) {
954 if (lp_nt_pipe_support()) {
955 do_nt_transact_create_pipe(
956 conn, req,
957 ppsetup, setup_count,
958 ppparams, parameter_count,
959 ppdata, data_count);
960 goto out;
961 }
962 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
963 goto out;
964 }
965
966 /*
967 * Ensure minimum number of parameters sent.
968 */
969
970 if(parameter_count < 54) {
971 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
973 goto out;
974 }
975
976 flags = IVAL(params,0);
977 access_mask = IVAL(params,8);
978 file_attributes = IVAL(params,20);
979 share_access = IVAL(params,24);
980 create_disposition = IVAL(params,28);
981 create_options = IVAL(params,32);
982 sd_len = IVAL(params,36);
983 ea_len = IVAL(params,40);
984 root_dir_fid = (uint16)IVAL(params,4);
985 allocation_size = (uint64_t)IVAL(params,12);
986 #ifdef LARGE_SMB_OFF_T
987 allocation_size |= (((uint64_t)IVAL(params,16)) << 32);
988 #endif
989
990 /*
991 * we need to remove ignored bits when they come directly from the client
992 * because we reuse some of them for internal stuff
993 */
994 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
995
996 /* Ensure the data_len is correct for the sd and ea values given. */
997 if ((ea_len + sd_len > data_count)
998 || (ea_len > data_count) || (sd_len > data_count)
999 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1000 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1001 "%u, data_count = %u\n", (unsigned int)ea_len,
1002 (unsigned int)sd_len, (unsigned int)data_count));
1003 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1004 goto out;
1005 }
1006
1007 if (sd_len) {
1008 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
1009 sd_len));
1010
1011 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1012 &sd);
1013 if (!NT_STATUS_IS_OK(status)) {
1014 DEBUG(10, ("call_nt_transact_create: "
1015 "unmarshall_sec_desc failed: %s\n",
1016 nt_errstr(status)));
1017 reply_nterror(req, status);
1018 goto out;
1019 }
1020 }
1021
1022 if (ea_len) {
1023 if (!lp_ea_support(SNUM(conn))) {
1024 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1025 "EA's not supported.\n",
1026 (unsigned int)ea_len));
1027 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1028 goto out;
1029 }
1030
1031 if (ea_len < 10) {
1032 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1033 "too small (should be more than 10)\n",
1034 (unsigned int)ea_len ));
1035 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1036 goto out;
1037 }
1038
1039 /* We have already checked that ea_len <= data_count here. */
1040 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1041 ea_len);
1042 if (ea_list == NULL) {
1043 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1044 goto out;
1045 }
1046 }
1047
1048 srvstr_get_path(ctx, params, req->flags2, &fname,
1049 params+53, parameter_count-53,
1050 STR_TERMINATE, &status);
1051 if (!NT_STATUS_IS_OK(status)) {
1052 reply_nterror(req, status);
1053 goto out;
1054 }
1055
1056 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1057 case_state = set_posix_case_semantics(ctx, conn);
1058 if (!case_state) {
1059 reply_nterror(req, NT_STATUS_NO_MEMORY);
1060 goto out;
1061 }
1062 }
1063
1064 status = filename_convert(ctx,
1065 conn,
1066 req->flags2 & FLAGS2_DFS_PATHNAMES,
1067 fname,
1068 0,
1069 NULL,
1070 &smb_fname);
1071
1072 TALLOC_FREE(case_state);
1073
1074 if (!NT_STATUS_IS_OK(status)) {
1075 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1076 reply_botherror(req,
1077 NT_STATUS_PATH_NOT_COVERED,
1078 ERRSRV, ERRbadpath);
1079 goto out;
1080 }
1081 reply_nterror(req, status);
1082 goto out;
1083 }
1084
1085 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1086 if (oplock_request) {
1087 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
1088 ? BATCH_OPLOCK : 0;
1089 }
1090
1091 /*
1092 * Bug #6898 - clients using Windows opens should
1093 * never be able to set this attribute into the
1094 * VFS.
1095 */
1096 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1097
1098 status = SMB_VFS_CREATE_FILE(
1099 conn, /* conn */
1100 req, /* req */
1101 root_dir_fid, /* root_dir_fid */
1102 smb_fname, /* fname */
1103 access_mask, /* access_mask */
1104 share_access, /* share_access */
1105 create_disposition, /* create_disposition*/
1106 create_options, /* create_options */
1107 file_attributes, /* file_attributes */
1108 oplock_request, /* oplock_request */
1109 allocation_size, /* allocation_size */
1110 0, /* private_flags */
1111 sd, /* sd */
1112 ea_list, /* ea_list */
1113 &fsp, /* result */
1114 &info); /* pinfo */
1115
1116 if(!NT_STATUS_IS_OK(status)) {
1117 if (open_was_deferred(req->mid)) {
1118 /* We have re-scheduled this call, no error. */
1119 return;
1120 }
1121 reply_openerror(req, status);
1122 goto out;
1123 }
1124
1125 /* Ensure we're pointing at the correct stat struct. */
1126 TALLOC_FREE(smb_fname);
1127 smb_fname = fsp->fsp_name;
1128
1129 /*
1130 * If the caller set the extended oplock request bit
1131 * and we granted one (by whatever means) - set the
1132 * correct bit for extended oplock reply.
1133 */
1134
1135 if (oplock_request &&
1136 (lp_fake_oplocks(SNUM(conn))
1137 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1138
1139 /*
1140 * Exclusive oplock granted
1141 */
1142
1143 if (flags & REQUEST_BATCH_OPLOCK) {
1144 oplock_granted = BATCH_OPLOCK_RETURN;
1145 } else {
1146 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1147 }
1148 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1149 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1150 } else {
1151 oplock_granted = NO_OPLOCK_RETURN;
1152 }
1153
1154 file_len = smb_fname->st.st_ex_size;
1155
1156 /* Realloc the size of parameters and data we will return */
1157 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1158 /* Extended response is 32 more byyes. */
1159 param_len = 101;
1160 } else {
1161 param_len = 69;
1162 }
1163 params = nttrans_realloc(ppparams, param_len);
1164 if(params == NULL) {
1165 reply_nterror(req, NT_STATUS_NO_MEMORY);
1166 goto out;
1167 }
1168
1169 p = params;
1170 SCVAL(p, 0, oplock_granted);
1171
1172 p += 2;
1173 SSVAL(p,0,fsp->fnum);
1174 p += 2;
1175 if ((create_disposition == FILE_SUPERSEDE)
1176 && (info == FILE_WAS_OVERWRITTEN)) {
1177 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1178 } else {
1179 SIVAL(p,0,info);
1180 }
1181 p += 8;
1182
1183 fattr = dos_mode(conn, smb_fname);
1184 if (fattr == 0) {
1185 fattr = FILE_ATTRIBUTE_NORMAL;
1186 }
1187
1188 /* Deal with other possible opens having a modified
1189 write time. JRA. */
1190 ZERO_STRUCT(write_time_ts);
1191 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1192 if (!null_timespec(write_time_ts)) {
1193 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1194 }
1195
1196 /* Create time. */
1197 create_timespec = get_create_timespec(conn, fsp, smb_fname);
1198 a_timespec = smb_fname->st.st_ex_atime;
1199 m_timespec = smb_fname->st.st_ex_mtime;
1200 c_timespec = get_change_timespec(conn, fsp, smb_fname);
1201
1202 if (lp_dos_filetime_resolution(SNUM(conn))) {
1203 dos_filetime_timespec(&create_timespec);
1204 dos_filetime_timespec(&a_timespec);
1205 dos_filetime_timespec(&m_timespec);
1206 dos_filetime_timespec(&c_timespec);
1207 }
1208
1209 put_long_date_timespec(conn->ts_res, p, create_timespec); /* create time. */
1210 p += 8;
1211 put_long_date_timespec(conn->ts_res, p, a_timespec); /* access time */
1212 p += 8;
1213 put_long_date_timespec(conn->ts_res, p, m_timespec); /* write time */
1214 p += 8;
1215 put_long_date_timespec(conn->ts_res, p, c_timespec); /* change time */
1216 p += 8;
1217 SIVAL(p,0,fattr); /* File Attributes. */
1218 p += 4;
1219 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1220 p += 8;
1221 SOFF_T(p,0,file_len);
1222 p += 8;
1223 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1224 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
1225 size_t num_names = 0;
1226 unsigned int num_streams;
1227 struct stream_struct *streams = NULL;
1228
1229 /* Do we have any EA's ? */
1230 status = get_ea_names_from_file(ctx, conn, fsp,
1231 smb_fname->base_name, NULL, &num_names);
1232 if (NT_STATUS_IS_OK(status) && num_names) {
1233 file_status &= ~NO_EAS;
1234 }
1235 status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
1236 &num_streams, &streams);
1237 /* There is always one stream, ::$DATA. */
1238 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
1239 file_status &= ~NO_SUBSTREAMS;
1240 }
1241 TALLOC_FREE(streams);
1242 SSVAL(p,2,file_status);
1243 }
1244 p += 4;
1245 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1246
1247 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1248 uint32 perms = 0;
1249 p += 25;
1250 if (fsp->is_directory ||
1251 can_write_to_file(conn, smb_fname)) {
1252 perms = FILE_GENERIC_ALL;
1253 } else {
1254 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1255 }
1256 SIVAL(p,0,perms);
1257 }
1258
1259 DEBUG(5,("call_nt_transact_create: open name = %s\n",
1260 smb_fname_str_dbg(smb_fname)));
1261
1262 /* Send the required number of replies */
1263 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1264 out:
1265 return;
1266 }
1267
1268 /****************************************************************************
1269 Reply to a NT CANCEL request.
1270 conn POINTER CAN BE NULL HERE !
1271 ****************************************************************************/
1272
1273 void reply_ntcancel(struct smb_request *req)
1274 {
1275 /*
1276 * Go through and cancel any pending change notifies.
1277 */
1278
1279 START_PROFILE(SMBntcancel);
1280 srv_cancel_sign_response(smbd_server_conn);
1281 remove_pending_change_notify_requests_by_mid(req->mid);
1282 remove_pending_lock_requests_by_mid_smb1(req->mid);
1283
1284 DEBUG(3,("reply_ntcancel: cancel called on mid = %llu.\n",
1285 (unsigned long long)req->mid));
1286
1287 END_PROFILE(SMBntcancel);
1288 return;
1289 }
1290
1291 /****************************************************************************
1292 Copy a file.
1293 ****************************************************************************/
1294
1295 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1296 connection_struct *conn,
1297 struct smb_request *req,
1298 struct smb_filename *smb_fname_src,
1299 struct smb_filename *smb_fname_dst,
1300 uint32 attrs)
1301 {
1302 files_struct *fsp1,*fsp2;
1303 uint32 fattr;
1304 int info;
1305 SMB_OFF_T ret=-1;
1306 NTSTATUS status = NT_STATUS_OK;
1307 char *parent;
1308
1309 if (!CAN_WRITE(conn)) {
1310 status = NT_STATUS_MEDIA_WRITE_PROTECTED;
1311 goto out;
1312 }
1313
1314 /* Source must already exist. */
1315 if (!VALID_STAT(smb_fname_src->st)) {
1316 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1317 goto out;
1318 }
1319
1320 /* Ensure attributes match. */
1321 fattr = dos_mode(conn, smb_fname_src);
1322 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1323 status = NT_STATUS_NO_SUCH_FILE;
1324 goto out;
1325 }
1326
1327 /* Disallow if dst file already exists. */
1328 if (VALID_STAT(smb_fname_dst->st)) {
1329 status = NT_STATUS_OBJECT_NAME_COLLISION;
1330 goto out;
1331 }
1332
1333 /* No links from a directory. */
1334 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
1335 status = NT_STATUS_FILE_IS_A_DIRECTORY;
1336 goto out;
1337 }
1338
1339 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1340 smb_fname_str_dbg(smb_fname_src),
1341 smb_fname_str_dbg(smb_fname_dst)));
1342
1343 status = SMB_VFS_CREATE_FILE(
1344 conn, /* conn */
1345 req, /* req */
1346 0, /* root_dir_fid */
1347 smb_fname_src, /* fname */
1348 FILE_READ_DATA, /* access_mask */
1349 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1350 FILE_SHARE_DELETE),
1351 FILE_OPEN, /* create_disposition*/
1352 0, /* create_options */
1353 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1354 NO_OPLOCK, /* oplock_request */
1355 0, /* allocation_size */
1356 0, /* private_flags */
1357 NULL, /* sd */
1358 NULL, /* ea_list */
1359 &fsp1, /* result */
1360 &info); /* pinfo */
1361
1362 if (!NT_STATUS_IS_OK(status)) {
1363 goto out;
1364 }
1365
1366 status = SMB_VFS_CREATE_FILE(
1367 conn, /* conn */
1368 req, /* req */
1369 0, /* root_dir_fid */
1370 smb_fname_dst, /* fname */
1371 FILE_WRITE_DATA, /* access_mask */
1372 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1373 FILE_SHARE_DELETE),
1374 FILE_CREATE, /* create_disposition*/
1375 0, /* create_options */
1376 fattr, /* file_attributes */
1377 NO_OPLOCK, /* oplock_request */
1378 0, /* allocation_size */
1379 0, /* private_flags */
1380 NULL, /* sd */
1381 NULL, /* ea_list */
1382 &fsp2, /* result */
1383 &info); /* pinfo */
1384
1385 if (!NT_STATUS_IS_OK(status)) {
1386 close_file(NULL, fsp1, ERROR_CLOSE);
1387 goto out;
1388 }
1389
1390 if (smb_fname_src->st.st_ex_size) {
1391 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
1392 }
1393
1394 /*
1395 * As we are opening fsp1 read-only we only expect
1396 * an error on close on fsp2 if we are out of space.
1397 * Thus we don't look at the error return from the
1398 * close of fsp1.
1399 */
1400 close_file(NULL, fsp1, NORMAL_CLOSE);
1401
1402 /* Ensure the modtime is set correctly on the destination file. */
1403 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
1404
1405 status = close_file(NULL, fsp2, NORMAL_CLOSE);
1406
1407 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1408 creates the file. This isn't the correct thing to do in the copy
1409 case. JRA */
1410 if (!parent_dirname(talloc_tos(), smb_fname_dst->base_name, &parent,
1411 NULL)) {
1412 status = NT_STATUS_NO_MEMORY;
1413 goto out;
1414 }
1415 file_set_dosmode(conn, smb_fname_dst, fattr, parent, false);
1416 TALLOC_FREE(parent);
1417
1418 if (ret < (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
1419 status = NT_STATUS_DISK_FULL;
1420 goto out;
1421 }
1422 out:
1423 if (!NT_STATUS_IS_OK(status)) {
1424 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1425 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
1426 smb_fname_str_dbg(smb_fname_dst)));
1427 }
1428
1429 return status;
1430 }
1431
1432 /****************************************************************************
1433 Reply to a NT rename request.
1434 ****************************************************************************/
1435
1436 void reply_ntrename(struct smb_request *req)
1437 {
1438 connection_struct *conn = req->conn;
1439 struct smb_filename *smb_fname_old = NULL;
1440 struct smb_filename *smb_fname_new = NULL;
1441 char *oldname = NULL;
1442 char *newname = NULL;
1443 const char *p;
1444 NTSTATUS status;
1445 bool src_has_wcard = False;
1446 bool dest_has_wcard = False;
1447 uint32 attrs;
1448 uint32_t ucf_flags_src = 0;
1449 uint32_t ucf_flags_dst = 0;
1450 uint16 rename_type;
1451 TALLOC_CTX *ctx = talloc_tos();
1452
1453 START_PROFILE(SMBntrename);
1454
1455 if (req->wct < 4) {
1456 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1457 goto out;
1458 }
1459
1460 attrs = SVAL(req->vwv+0, 0);
1461 rename_type = SVAL(req->vwv+1, 0);
1462
1463 p = (const char *)req->buf + 1;
1464 p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1465 &status, &src_has_wcard);
1466 if (!NT_STATUS_IS_OK(status)) {
1467 reply_nterror(req, status);
1468 goto out;
1469 }
1470
1471 if (ms_has_wild(oldname)) {
1472 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1473 goto out;
1474 }
1475
1476 p++;
1477 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1478 &status, &dest_has_wcard);
1479 if (!NT_STATUS_IS_OK(status)) {
1480 reply_nterror(req, status);
1481 goto out;
1482 }
1483
1484 /* The newname must begin with a ':' if the oldname contains a ':'. */
1485 if (strchr_m(oldname, ':') && (newname[0] != ':')) {
1486 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1487 goto out;
1488 }
1489
1490 /*
1491 * If this is a rename operation, allow wildcards and save the
1492 * destination's last component.
1493 */
1494 if (rename_type == RENAME_FLAG_RENAME) {
1495 ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP;
1496 ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP;
1497 }
1498
1499 /* rename_internals() calls unix_convert(), so don't call it here. */
1500 status = filename_convert(ctx, conn,
1501 req->flags2 & FLAGS2_DFS_PATHNAMES,
1502 oldname,
1503 ucf_flags_src,
1504 NULL,
1505 &smb_fname_old);
1506 if (!NT_STATUS_IS_OK(status)) {
1507 if (NT_STATUS_EQUAL(status,
1508 NT_STATUS_PATH_NOT_COVERED)) {
1509 reply_botherror(req,
1510 NT_STATUS_PATH_NOT_COVERED,
1511 ERRSRV, ERRbadpath);
1512 goto out;
1513 }
1514 reply_nterror(req, status);
1515 goto out;
1516 }
1517
1518 status = filename_convert(ctx, conn,
1519 req->flags2 & FLAGS2_DFS_PATHNAMES,
1520 newname,
1521 ucf_flags_dst,
1522 &dest_has_wcard,
1523 &smb_fname_new);
1524 if (!NT_STATUS_IS_OK(status)) {
1525 if (NT_STATUS_EQUAL(status,
1526 NT_STATUS_PATH_NOT_COVERED)) {
1527 reply_botherror(req,
1528 NT_STATUS_PATH_NOT_COVERED,
1529 ERRSRV, ERRbadpath);
1530 goto out;
1531 }
1532 reply_nterror(req, status);
1533 goto out;
1534 }
1535
1536 DEBUG(3,("reply_ntrename: %s -> %s\n",
1537 smb_fname_str_dbg(smb_fname_old),
1538 smb_fname_str_dbg(smb_fname_new)));
1539
1540 switch(rename_type) {
1541 case RENAME_FLAG_RENAME:
1542 status = rename_internals(ctx, conn, req,
1543 smb_fname_old, smb_fname_new,
1544 attrs, False, src_has_wcard,
1545 dest_has_wcard,
1546 DELETE_ACCESS);
1547 break;
1548 case RENAME_FLAG_HARD_LINK:
1549 if (src_has_wcard || dest_has_wcard) {
1550 /* No wildcards. */
1551 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1552 } else {
1553 status = hardlink_internals(ctx, conn,
1554 req,
1555 false,
1556 smb_fname_old,
1557 smb_fname_new);
1558 }
1559 break;
1560 case RENAME_FLAG_COPY:
1561 if (src_has_wcard || dest_has_wcard) {
1562 /* No wildcards. */
1563 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1564 } else {
1565 status = copy_internals(ctx, conn, req,
1566 smb_fname_old,
1567 smb_fname_new,
1568 attrs);
1569 }
1570 break;
1571 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1572 status = NT_STATUS_INVALID_PARAMETER;
1573 break;
1574 default:
1575 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1576 break;
1577 }
1578
1579 if (!NT_STATUS_IS_OK(status)) {
1580 if (open_was_deferred(req->mid)) {
1581 /* We have re-scheduled this call. */
1582 goto out;
1583 }
1584
1585 reply_nterror(req, status);
1586 goto out;
1587 }
1588
1589 reply_outbuf(req, 0, 0);
1590 out:
1591 END_PROFILE(SMBntrename);
1592 return;
1593 }
1594
1595 /****************************************************************************
1596 Reply to a notify change - queue the request and
1597 don't allow a directory to be opened.
1598 ****************************************************************************/
1599
1600 static void smbd_smb1_notify_reply(struct smb_request *req,
1601 NTSTATUS error_code,
1602 uint8_t *buf, size_t len)
1603 {
1604 send_nt_replies(req->conn, req, error_code, (char *)buf, len, NULL, 0);
1605 }
1606
1607 static void call_nt_transact_notify_change(connection_struct *conn,
1608 struct smb_request *req,
1609 uint16 **ppsetup,
1610 uint32 setup_count,
1611 char **ppparams,
1612 uint32 parameter_count,
1613 char **ppdata, uint32 data_count,
1614 uint32 max_data_count,
1615 uint32 max_param_count)
1616 {
1617 uint16 *setup = *ppsetup;
1618 files_struct *fsp;
1619 uint32 filter;
1620 NTSTATUS status;
1621 bool recursive;
1622
1623 if(setup_count < 6) {
1624 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1625 return;
1626 }
1627
1628 fsp = file_fsp(req, SVAL(setup,4));
1629 filter = IVAL(setup, 0);
1630 recursive = (SVAL(setup, 6) != 0) ? True : False;
1631
1632 DEBUG(3,("call_nt_transact_notify_change\n"));
1633
1634 if(!fsp) {
1635 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1636 return;
1637 }
1638
1639 {
1640 char *filter_string;
1641
1642 if (!(filter_string = notify_filter_string(NULL, filter))) {
1643 reply_nterror(req,NT_STATUS_NO_MEMORY);
1644 return;
1645 }
1646
1647 DEBUG(3,("call_nt_transact_notify_change: notify change "
1648 "called on %s, filter = %s, recursive = %d\n",
1649 fsp_str_dbg(fsp), filter_string, recursive));
1650
1651 TALLOC_FREE(filter_string);
1652 }
1653
1654 if((!fsp->is_directory) || (conn != fsp->conn)) {
1655 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1656 return;
1657 }
1658
1659 if (fsp->notify == NULL) {
1660
1661 status = change_notify_create(fsp, filter, recursive);
1662
1663 if (!NT_STATUS_IS_OK(status)) {
1664 DEBUG(10, ("change_notify_create returned %s\n",
1665 nt_errstr(status)));
1666 reply_nterror(req, status);
1667 return;
1668 }
1669 }
1670
1671 if (fsp->notify->num_changes != 0) {
1672
1673 /*
1674 * We've got changes pending, respond immediately
1675 */
1676
1677 /*
1678 * TODO: write a torture test to check the filtering behaviour
1679 * here.
1680 */
1681
1682 change_notify_reply(fsp->conn, req,
1683 NT_STATUS_OK,
1684 max_param_count,
1685 fsp->notify,
1686 smbd_smb1_notify_reply);
1687
1688 /*
1689 * change_notify_reply() above has independently sent its
1690 * results
1691 */
1692 return;
1693 }
1694
1695 /*
1696 * No changes pending, queue the request
1697 */
1698
1699 status = change_notify_add_request(req,
1700 max_param_count,
1701 filter,
1702 recursive, fsp,
1703 smbd_smb1_notify_reply);
1704 if (!NT_STATUS_IS_OK(status)) {
1705 reply_nterror(req, status);
1706 }
1707 return;
1708 }
1709
1710 /****************************************************************************
1711 Reply to an NT transact rename command.
1712 ****************************************************************************/
1713
1714 static void call_nt_transact_rename(connection_struct *conn,
1715 struct smb_request *req,
1716 uint16 **ppsetup, uint32 setup_count,
1717 char **ppparams, uint32 parameter_count,
1718 char **ppdata, uint32 data_count,
1719 uint32 max_data_count)
1720 {
1721 char *params = *ppparams;
1722 char *new_name = NULL;
1723 files_struct *fsp = NULL;
1724 bool dest_has_wcard = False;
1725 NTSTATUS status;
1726 TALLOC_CTX *ctx = talloc_tos();
1727
1728 if(parameter_count < 5) {
1729 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1730 return;
1731 }
1732
1733 fsp = file_fsp(req, SVAL(params, 0));
1734 if (!check_fsp(conn, req, fsp)) {
1735 return;
1736 }
1737 srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1738 parameter_count - 4,
1739 STR_TERMINATE, &status, &dest_has_wcard);
1740 if (!NT_STATUS_IS_OK(status)) {
1741 reply_nterror(req, status);
1742 return;
1743 }
1744
1745 /*
1746 * W2K3 ignores this request as the RAW-RENAME test
1747 * demonstrates, so we do.
1748 */
1749 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1750
1751 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1752 fsp_str_dbg(fsp), new_name));
1753
1754 return;
1755 }
1756
1757 /******************************************************************************
1758 Fake up a completely empty SD.
1759 *******************************************************************************/
1760
1761 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, struct security_descriptor **ppsd)
1762 {
1763 size_t sd_size;
1764
1765 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1766 if(!*ppsd) {
1767 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1768 return NT_STATUS_NO_MEMORY;
1769 }
1770
1771 return NT_STATUS_OK;
1772 }
1773
1774 /****************************************************************************
1775 Reply to query a security descriptor.
1776 Callable from SMB2 and SMB2.
1777 If it returns NT_STATUS_BUFFER_TOO_SMALL, pdata_size is initialized with
1778 the required size.
1779 ****************************************************************************/
1780
1781 NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
1782 TALLOC_CTX *mem_ctx,
1783 files_struct *fsp,
1784 uint32_t security_info_wanted,
1785 uint32_t max_data_count,
1786 uint8_t **ppmarshalled_sd,
1787 size_t *psd_size)
1788 {
1789 NTSTATUS status;
1790 struct security_descriptor *psd = NULL;
1791
1792 /*
1793 * Get the permissions to return.
1794 */
1795
1796 if (!lp_nt_acl_support(SNUM(conn))) {
1797 status = get_null_nt_acl(mem_ctx, &psd);
1798 } else {
1799 status = SMB_VFS_FGET_NT_ACL(
1800 fsp, security_info_wanted, &psd);
1801 }
1802 if (!NT_STATUS_IS_OK(status)) {
1803 return status;
1804 }
1805
1806 /* If the SACL/DACL is NULL, but was requested, we mark that it is
1807 * present in the reply to match Windows behavior */
1808 if (psd->sacl == NULL &&
1809 security_info_wanted & SACL_SECURITY_INFORMATION)
1810 psd->type |= SEC_DESC_SACL_PRESENT;
1811 if (psd->dacl == NULL &&
1812 security_info_wanted & DACL_SECURITY_INFORMATION)
1813 psd->type |= SEC_DESC_DACL_PRESENT;
1814
1815 *psd_size = ndr_size_security_descriptor(psd, 0);
1816
1817 DEBUG(3,("smbd_do_query_security_desc: sd_size = %lu.\n",
1818 (unsigned long)*psd_size));
1819
1820 if (DEBUGLEVEL >= 10) {
1821 DEBUG(10,("smbd_do_query_security_desc for file %s\n",
1822 fsp_str_dbg(fsp)));
1823 NDR_PRINT_DEBUG(security_descriptor, psd);
1824 }
1825
1826 if (max_data_count < *psd_size) {
1827 TALLOC_FREE(psd);
1828 return NT_STATUS_BUFFER_TOO_SMALL;
1829 }
1830
1831 status = marshall_sec_desc(mem_ctx, psd,
1832 ppmarshalled_sd, psd_size);
1833
1834 if (!NT_STATUS_IS_OK(status)) {
1835 TALLOC_FREE(psd);
1836 return status;
1837 }
1838
1839 TALLOC_FREE(psd);
1840 return NT_STATUS_OK;
1841 }
1842
1843 /****************************************************************************
1844 SMB1 reply to query a security descriptor.
1845 ****************************************************************************/
1846
1847 static void call_nt_transact_query_security_desc(connection_struct *conn,
1848 struct smb_request *req,
1849 uint16 **ppsetup,
1850 uint32 setup_count,
1851 char **ppparams,
1852 uint32 parameter_count,
1853 char **ppdata,
1854 uint32 data_count,
1855 uint32 max_data_count)
1856 {
1857 char *params = *ppparams;
1858 char *data = *ppdata;
1859 size_t sd_size = 0;
1860 uint32 security_info_wanted;
1861 files_struct *fsp = NULL;
1862 NTSTATUS status;
1863 uint8_t *marshalled_sd = NULL;
1864
1865 if(parameter_count < 8) {
1866 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1867 return;
1868 }
1869
1870 fsp = file_fsp(req, SVAL(params,0));
1871 if(!fsp) {
1872 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1873 return;
1874 }
1875
1876 security_info_wanted = IVAL(params,4);
1877
1878 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, "
1879 "info_wanted = 0x%x\n", fsp_str_dbg(fsp),
1880 (unsigned int)security_info_wanted));
1881
1882 params = nttrans_realloc(ppparams, 4);
1883 if(params == NULL) {
1884 reply_nterror(req, NT_STATUS_NO_MEMORY);
1885 return;
1886 }
1887
1888 /*
1889 * Get the permissions to return.
1890 */
1891
1892 status = smbd_do_query_security_desc(conn,
1893 talloc_tos(),
1894 fsp,
1895 security_info_wanted,
1896 max_data_count,
1897 &marshalled_sd,
1898 &sd_size);
1899
1900 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
1901 SIVAL(params,0,(uint32_t)sd_size);
1902 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1903 params, 4, NULL, 0);
1904 return;
1905 }
1906
1907 if (!NT_STATUS_IS_OK(status)) {
1908 reply_nterror(req, status);
1909 return;
1910 }
1911
1912 SMB_ASSERT(sd_size > 0);
1913
1914 SIVAL(params,0,(uint32_t)sd_size);
1915
1916 if (max_data_count < sd_size) {
1917 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1918 params, 4, NULL, 0);
1919 return;
1920 }
1921
1922 /*
1923 * Allocate the data we will return.
1924 */
1925
1926 data = nttrans_realloc(ppdata, sd_size);
1927 if(data == NULL) {
1928 reply_nterror(req, NT_STATUS_NO_MEMORY);
1929 return;
1930 }
1931
1932 memcpy(data, marshalled_sd, sd_size);
1933
1934 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1935
1936 return;
1937 }
1938
1939 /****************************************************************************
1940 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1941 ****************************************************************************/
1942
1943 static void call_nt_transact_set_security_desc(connection_struct *conn,
1944 struct smb_request *req,
1945 uint16 **ppsetup,
1946 uint32 setup_count,
1947 char **ppparams,
1948 uint32 parameter_count,
1949 char **ppdata,
1950 uint32 data_count,
1951 uint32 max_data_count)
1952 {
1953 char *params= *ppparams;
1954 char *data = *ppdata;
1955 files_struct *fsp = NULL;
1956 uint32 security_info_sent = 0;
1957 NTSTATUS status;
1958
1959 if(parameter_count < 8) {
1960 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1961 return;
1962 }
1963
1964 if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
1965 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1966 return;
1967 }
1968
1969 if(!lp_nt_acl_support(SNUM(conn))) {
1970 goto done;
1971 }
1972
1973 security_info_sent = IVAL(params,4);
1974
1975 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n",
1976 fsp_str_dbg(fsp), (unsigned int)security_info_sent));
1977
1978 if (data_count == 0) {
1979 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1980 return;
1981 }
1982
1983 status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1984
1985 if (!NT_STATUS_IS_OK(status)) {
1986 reply_nterror(req, status);
1987 return;
1988 }
1989
1990 done:
1991 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1992 return;
1993 }
1994
1995 /****************************************************************************
1996 Reply to NT IOCTL
1997 ****************************************************************************/
1998
1999 static void call_nt_transact_ioctl(connection_struct *conn,
2000 struct smb_request *req,
2001 uint16 **ppsetup, uint32 setup_count,
2002 char **ppparams, uint32 parameter_count,
2003 char **ppdata, uint32 data_count,
2004 uint32 max_data_count)
2005 {
2006 uint32 function;
2007 uint16 fidnum;
2008 files_struct *fsp;
2009 uint8 isFSctl;
2010 uint8 compfilter;
2011 char *pdata = *ppdata;
2012
2013 if (setup_count != 8) {
2014 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2015 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2016 return;
2017 }
2018
2019 function = IVAL(*ppsetup, 0);
2020 fidnum = SVAL(*ppsetup, 4);
2021 isFSctl = CVAL(*ppsetup, 6);
2022 compfilter = CVAL(*ppsetup, 7);
2023
2024 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2025 function, fidnum, isFSctl, compfilter));
2026
2027 fsp=file_fsp(req, fidnum);
2028 /* this check is done in each implemented function case for now
2029 because I don't want to break anything... --metze
2030 FSP_BELONGS_CONN(fsp,conn);*/
2031
2032 SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
2033
2034 switch (function) {
2035 case FSCTL_SET_SPARSE:
2036 /* pretend this succeeded - tho strictly we should
2037 mark the file sparse (if the local fs supports it)
2038 so we can know if we need to pre-allocate or not */
2039
2040 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2041 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2042 return;
2043
2044 case FSCTL_CREATE_OR_GET_OBJECT_ID:
2045 {
2046 unsigned char objid[16];
2047
2048 /* This should return the object-id on this file.
2049 * I think I'll make this be the inode+dev. JRA.
2050 */
2051
2052 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2053
2054 if (!fsp_belongs_conn(conn, req, fsp)) {
2055 return;
2056 }
2057
2058 data_count = 64;
2059 pdata = nttrans_realloc(ppdata, data_count);
2060 if (pdata == NULL) {
2061 reply_nterror(req, NT_STATUS_NO_MEMORY);
2062 return;
2063 }
2064
2065 /* For backwards compatibility only store the dev/inode. */
2066 push_file_id_16(pdata, &fsp->file_id);
2067 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2068 push_file_id_16(pdata+32, &fsp->file_id);
2069 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2070 pdata, data_count);
2071 return;
2072 }
2073
2074 case FSCTL_GET_REPARSE_POINT:
2075 /* pretend this fail - my winXP does it like this
2076 * --metze
2077 */
2078
2079 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2080 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2081 return;
2082
2083 case FSCTL_SET_REPARSE_POINT:
2084 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2085 * --metze
2086 */
2087
2088 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2089 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
2090 return;
2091
2092 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2093 {
2094 /*
2095 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2096 * and return their volume names. If max_data_count is 16, then it is just
2097 * asking for the number of volumes and length of the combined names.
2098 *
2099 * pdata is the data allocated by our caller, but that uses
2100 * total_data_count (which is 0 in our case) rather than max_data_count.
2101 * Allocate the correct amount and return the pointer to let
2102 * it be deallocated when we return.
2103 */
2104 SHADOW_COPY_DATA *shadow_data = NULL;
2105 TALLOC_CTX *shadow_mem_ctx = NULL;
2106 bool labels = False;
2107 uint32 labels_data_count = 0;
2108 uint32 i;
2109 char *cur_pdata;
2110
2111 if (!fsp_belongs_conn(conn, req, fsp)) {
2112 return;
2113 }
2114
2115 if (max_data_count < 16) {
2116 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2117 max_data_count));
2118 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2119 return;
2120 }
2121
2122 if (max_data_count > 16) {
2123 labels = True;
2124 }
2125
2126 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2127 if (shadow_mem_ctx == NULL) {
2128 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2129 reply_nterror(req, NT_STATUS_NO_MEMORY);
2130 return;
2131 }
2132
2133 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2134 if (shadow_data == NULL) {
2135 DEBUG(0,("TALLOC_ZERO() failed!\n"));
2136 talloc_destroy(shadow_mem_ctx);
2137 reply_nterror(req, NT_STATUS_NO_MEMORY);
2138 return;
2139 }
2140
2141 shadow_data->mem_ctx = shadow_mem_ctx;
2142
2143 /*
2144 * Call the VFS routine to actually do the work.
2145 */
2146 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2147 talloc_destroy(shadow_data->mem_ctx);
2148 if (errno == ENOSYS) {
2149 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2150 conn->connectpath));
2151 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2152 return;
2153 } else {
2154 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2155 conn->connectpath));
2156 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
2157 return;
2158 }
2159 }
2160
2161 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2162
2163 if (!labels) {
2164 data_count = 16;
2165 } else {
2166 data_count = 12+labels_data_count+4;
2167 }
2168
2169 if (max_data_count<data_count) {
2170 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2171 max_data_count,data_count));
2172 talloc_destroy(shadow_data->mem_ctx);
2173 reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
2174 return;
2175 }
2176
2177 pdata = nttrans_realloc(ppdata, data_count);
2178 if (pdata == NULL) {
2179 talloc_destroy(shadow_data->mem_ctx);
2180 reply_nterror(req, NT_STATUS_NO_MEMORY);
2181 return;
2182 }
2183
2184 cur_pdata = pdata;
2185
2186 /* num_volumes 4 bytes */
2187 SIVAL(pdata,0,shadow_data->num_volumes);
2188
2189 if (labels) {
2190 /* num_labels 4 bytes */
2191 SIVAL(pdata,4,shadow_data->num_volumes);
2192 }
2193
2194 /* needed_data_count 4 bytes */
2195 SIVAL(pdata, 8, labels_data_count+4);
2196
2197 cur_pdata+=12;
2198
2199 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2200 shadow_data->num_volumes, fsp_str_dbg(fsp)));
2201 if (labels && shadow_data->labels) {
2202 for (i=0;i<shadow_data->num_volumes;i++) {
2203 srvstr_push(pdata, req->flags2,
2204 cur_pdata, shadow_data->labels[i],
2205 2*sizeof(SHADOW_COPY_LABEL),
2206 STR_UNICODE|STR_TERMINATE);
2207 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2208 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2209 }
2210 }
2211
2212 talloc_destroy(shadow_data->mem_ctx);
2213
2214 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2215 pdata, data_count);
2216
2217 return;
2218 }
2219
2220 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2221 {
2222 /* pretend this succeeded -
2223 *
2224 * we have to send back a list with all files owned by this SID
2225 *
2226 * but I have to check that --metze
2227 */
2228 struct dom_sid sid;
2229 uid_t uid;
2230 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2231
2232 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2233
2234 if (!fsp_belongs_conn(conn, req, fsp)) {
2235 return;
2236 }
2237
2238 /* unknown 4 bytes: this is not the length of the sid :-( */
2239 /*unknown = IVAL(pdata,0);*/
2240
2241 sid_parse(pdata+4,sid_len,&sid);
2242 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
2243
2244 if (!sid_to_uid(&sid, &uid)) {
2245 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2246 sid_string_dbg(&sid),
2247 (unsigned long)sid_len));
2248 uid = (-1);
2249 }
2250
2251 /* we can take a look at the find source :-)
2252 *
2253 * find ./ -uid $uid -name '*' is what we need here
2254 *
2255 *
2256 * and send 4bytes len and then NULL terminated unicode strings
2257 * for each file
2258 *
2259 * but I don't know how to deal with the paged results
2260 * (maybe we can hang the result anywhere in the fsp struct)
2261 *
2262 * we don't send all files at once
2263 * and at the next we should *not* start from the beginning,
2264 * so we have to cache the result
2265 *
2266 * --metze
2267 */
2268
2269 /* this works for now... */
2270 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2271 return;
2272 }
2273 case FSCTL_QUERY_ALLOCATED_RANGES:
2274 {
2275 /* FIXME: This is just a dummy reply, telling that all of the
2276 * file is allocated. MKS cp needs that.
2277 * Adding the real allocated ranges via FIEMAP on Linux
2278 * and SEEK_DATA/SEEK_HOLE on Solaris is needed to make
2279 * this FSCTL correct for sparse files.
2280 */
2281 NTSTATUS status;
2282 uint64_t offset, length;
2283
2284 if (!fsp_belongs_conn(conn, req, fsp)) {
2285 return;
2286 }
2287
2288 if (data_count != 16) {
2289 DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: data_count(%u) != 16 is invalid!\n",
2290 data_count));
2291 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2292 return;
2293 }
2294
2295 if (max_data_count < 16) {
2296 DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_data_count(%u) < 16 is invalid!\n",
2297 max_data_count));
2298 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2299 return;
2300 }
2301
2302 offset = BVAL(pdata,0);
2303 length = BVAL(pdata,8);
2304
2305 if (offset + length < offset) {
2306 /* No 64-bit integer wrap. */
2307 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2308 return;
2309 }
2310
2311 status = vfs_stat_fsp(fsp);
2312 if (!NT_STATUS_IS_OK(status)) {
2313 reply_nterror(req, status);
2314 return;
2315 }
2316
2317 if (offset > fsp->fsp_name->st.st_ex_size ||
2318 fsp->fsp_name->st.st_ex_size == 0 ||
2319 length == 0) {
2320 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2321 } else {
2322 uint64_t end = offset + length;
2323 end = MIN(end, fsp->fsp_name->st.st_ex_size);
2324 SBVAL(pdata,0,0);
2325 SBVAL(pdata,8,end);
2326 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
2327 pdata, 16);
2328 }
2329 return;
2330 }
2331 default:
2332 if (!logged_ioctl_message) {
2333 logged_ioctl_message = true; /* Only print this once... */
2334 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2335 function));
2336 }
2337 }
2338
2339 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2340 }
2341
2342
2343 #ifdef HAVE_SYS_QUOTAS
2344 /****************************************************************************
2345 Reply to get user quota
2346 ****************************************************************************/
2347
2348 static void call_nt_transact_get_user_quota(connection_struct *conn,
2349 struct smb_request *req,
2350 uint16 **ppsetup,
2351 uint32 setup_count,
2352 char **ppparams,
2353 uint32 parameter_count,
2354 char **ppdata,
2355 uint32 data_count,
2356 uint32 max_data_count)
2357 {
2358 NTSTATUS nt_status = NT_STATUS_OK;
2359 char *params = *ppparams;
2360 char *pdata = *ppdata;
2361 char *entry;
2362 int data_len=0,param_len=0;
2363 int qt_len=0;
2364 int entry_len = 0;
2365 files_struct *fsp = NULL;
2366 uint16 level = 0;
2367 size_t sid_len;
2368 struct dom_sid sid;
2369 bool start_enum = True;
2370 SMB_NTQUOTA_STRUCT qt;
2371 SMB_NTQUOTA_LIST *tmp_list;
2372 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2373
2374 ZERO_STRUCT(qt);
2375
2376 /* access check */
2377 if (conn->server_info->utok.uid != 0) {
2378 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2379 "[%s]\n", lp_servicename(SNUM(conn)),
2380 conn->server_info->unix_name));
2381 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2382 return;
2383 }
2384
2385 /*
2386 * Ensure minimum number of parameters sent.
2387 */
2388
2389 if (parameter_count < 4) {
2390 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2391 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2392 return;
2393 }
2394
2395 /* maybe we can check the quota_fnum */
2396 fsp = file_fsp(req, SVAL(params,0));
2397 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2398 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2399 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2400 return;
2401 }
2402
2403 /* the NULL pointer checking for fsp->fake_file_handle->pd
2404 * is done by CHECK_NTQUOTA_HANDLE_OK()
2405 */
2406 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2407
2408 level = SVAL(params,2);
2409
2410 /* unknown 12 bytes leading in params */
2411
2412 switch (level) {
2413 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2414 /* seems that we should continue with the enum here --metze */
2415
2416 if (qt_handle->quota_list!=NULL &&
2417 qt_handle->tmp_list==NULL) {
2418
2419 /* free the list */
2420 free_ntquota_list(&(qt_handle->quota_list));
2421
2422 /* Realloc the size of parameters and data we will return */
2423 param_len = 4;
2424 params = nttrans_realloc(ppparams, param_len);
2425 if(params == NULL) {
2426 reply_nterror(req, NT_STATUS_NO_MEMORY);
2427 return;
2428 }
2429
2430 data_len = 0;
2431 SIVAL(params,0,data_len);
2432
2433 break;
2434 }
2435
2436 start_enum = False;
2437
2438 case TRANSACT_GET_USER_QUOTA_LIST_START:
2439
2440 if (qt_handle->quota_list==NULL &&
2441 qt_handle->tmp_list==NULL) {
2442 start_enum = True;
2443 }
2444
2445 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2446 reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2447 return;
2448 }
2449
2450 /* Realloc the size of parameters and data we will return */
2451 param_len = 4;
2452 params = nttrans_realloc(ppparams, param_len);
2453 if(params == NULL) {
2454 reply_nterror(req, NT_STATUS_NO_MEMORY);
2455 return;
2456 }
2457
2458 /* we should not trust the value in max_data_count*/
2459 max_data_count = MIN(max_data_count,2048);
2460
2461 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2462 if(pdata == NULL) {
2463 reply_nterror(req, NT_STATUS_NO_MEMORY);
2464 return;
2465 }
2466
2467 entry = pdata;
2468
2469 /* set params Size of returned Quota Data 4 bytes*/
2470 /* but set it later when we know it */
2471
2472 /* for each entry push the data */
2473
2474 if (start_enum) {
2475 qt_handle->tmp_list = qt_handle->quota_list;
2476 }
2477
2478 tmp_list = qt_handle->tmp_list;
2479
2480 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2481 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2482
2483 sid_len = ndr_size_dom_sid(
2484 &tmp_list->quotas->sid, 0);
2485 entry_len = 40 + sid_len;
2486
2487 /* nextoffset entry 4 bytes */
2488 SIVAL(entry,0,entry_len);
2489
2490 /* then the len of the SID 4 bytes */
2491 SIVAL(entry,4,sid_len);
2492
2493 /* unknown data 8 bytes uint64_t */
2494 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-metze*/
2495
2496 /* the used disk space 8 bytes uint64_t */
2497 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2498
2499 /* the soft quotas 8 bytes uint64_t */
2500 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2501
2502 /* the hard quotas 8 bytes uint64_t */
2503 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2504
2505 /* and now the SID */
2506 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2507 }
2508
2509 qt_handle->tmp_list = tmp_list;
2510
2511 /* overwrite the offset of the last entry */
2512 SIVAL(entry-entry_len,0,0);
2513
2514 data_len = 4+qt_len;
2515 /* overwrite the params quota_data_len */
2516 SIVAL(params,0,data_len);
2517
2518 break;
2519
2520 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2521
2522 /* unknown 4 bytes IVAL(pdata,0) */
2523
2524 if (data_count < 8) {
2525 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2526 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2527 return;
2528 }
2529
2530 sid_len = IVAL(pdata,4);
2531 /* Ensure this is less than 1mb. */
2532 if (sid_len > (1024*1024)) {
2533 reply_nterror(req, NT_STATUS_NO_MEMORY);
2534 return;
2535 }
2536
2537 if (data_count < 8+sid_len) {
2538 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2539 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2540 return;
2541 }
2542
2543 data_len = 4+40+sid_len;
2544
2545 if (max_data_count < data_len) {
2546 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2547 max_data_count, data_len));
2548 param_len = 4;
2549 SIVAL(params,0,data_len);
2550 data_len = 0;
2551 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2552 break;
2553 }
2554
2555 sid_parse(pdata+8,sid_len,&sid);
2556
2557 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2558 ZERO_STRUCT(qt);
2559 /*
2560 * we have to return zero's in all fields
2561 * instead of returning an error here
2562 * --metze
2563 */
2564 }
2565
2566 /* Realloc the size of parameters and data we will return */
2567 param_len = 4;
2568 params = nttrans_realloc(ppparams, param_len);
2569 if(params == NULL) {
2570 reply_nterror(req, NT_STATUS_NO_MEMORY);
2571 return;
2572 }
2573
2574 pdata = nttrans_realloc(ppdata, data_len);
2575 if(pdata == NULL) {
2576 reply_nterror(req, NT_STATUS_NO_MEMORY);
2577 return;
2578 }
2579
2580 entry = pdata;
2581
2582 /* set params Size of returned Quota Data 4 bytes*/
2583 SIVAL(params,0,data_len);
2584
2585 /* nextoffset entry 4 bytes */
2586 SIVAL(entry,0,0);
2587
2588 /* then the len of the SID 4 bytes */
2589 SIVAL(entry,4,sid_len);
2590
2591 /* unknown data 8 bytes uint64_t */
2592 SBIG_UINT(entry,8,(uint64_t)0); /* this is not 0 in windows...-mezte*/
2593
2594 /* the used disk space 8 bytes uint64_t */
2595 SBIG_UINT(entry,16,qt.usedspace);
2596
2597 /* the soft quotas 8 bytes uint64_t */
2598 SBIG_UINT(entry,24,qt.softlim);
2599
2600 /* the hard quotas 8 bytes uint64_t */
2601 SBIG_UINT(entry,32,qt.hardlim);
2602
2603 /* and now the SID */
2604 sid_linearize(entry+40, sid_len, &sid);
2605
2606 break;
2607
2608 default:
2609 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2610 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2611 return;
2612 break;
2613 }
2614
2615 send_nt_replies(conn, req, nt_status, params, param_len,
2616 pdata, data_len);
2617 }
2618
2619 /****************************************************************************
2620 Reply to set user quota
2621 ****************************************************************************/
2622
2623 static void call_nt_transact_set_user_quota(connection_struct *conn,
2624 struct smb_request *req,
2625 uint16 **ppsetup,
2626 uint32 setup_count,
2627 char **ppparams,
2628 uint32 parameter_count,
2629 char **ppdata,
2630 uint32 data_count,
2631 uint32 max_data_count)
2632 {
2633 char *params = *ppparams;
2634 char *pdata = *ppdata;
2635 int data_len=0,param_len=0;
2636 SMB_NTQUOTA_STRUCT qt;
2637 size_t sid_len;
2638 struct dom_sid sid;
2639 files_struct *fsp = NULL;
2640
2641 ZERO_STRUCT(qt);
2642
2643 /* access check */
2644 if (conn->server_info->utok.uid != 0) {
2645 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2646 "[%s]\n", lp_servicename(SNUM(conn)),
2647 conn->server_info->unix_name));
2648 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2649 return;
2650 }
2651
2652 /*
2653 * Ensure minimum number of parameters sent.
2654 */
2655
2656 if (parameter_count < 2) {
2657 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2658 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2659 return;
2660 }
2661
2662 /* maybe we can check the quota_fnum */
2663 fsp = file_fsp(req, SVAL(params,0));
2664 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2665 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2666 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2667 return;
2668 }
2669
2670 if (data_count < 40) {
2671 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2672 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2673 return;
2674 }
2675
2676 /* offset to next quota record.
2677 * 4 bytes IVAL(pdata,0)
2678 * unused here...
2679 */
2680
2681 /* sid len */
2682 sid_len = IVAL(pdata,4);
2683
2684 if (data_count < 40+sid_len) {
2685 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2686 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2687 return;
2688 }
2689
2690 /* unknown 8 bytes in pdata
2691 * maybe its the change time in NTTIME
2692 */
2693
2694 /* the used space 8 bytes (uint64_t)*/
2695 qt.usedspace = (uint64_t)IVAL(pdata,16);
2696 #ifdef LARGE_SMB_OFF_T
2697 qt.usedspace |= (((uint64_t)IVAL(pdata,20)) << 32);
2698 #else /* LARGE_SMB_OFF_T */
2699 if ((IVAL(pdata,20) != 0)&&
2700 ((qt.usedspace != 0xFFFFFFFF)||
2701 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2702 /* more than 32 bits? */
2703 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2704 return;
2705 }
2706 #endif /* LARGE_SMB_OFF_T */
2707
2708 /* the soft quotas 8 bytes (uint64_t)*/
2709 qt.softlim = (uint64_t)IVAL(pdata,24);
2710 #ifdef LARGE_SMB_OFF_T
2711 qt.softlim |= (((uint64_t)IVAL(pdata,28)) << 32);
2712 #else /* LARGE_SMB_OFF_T */
2713 if ((IVAL(pdata,28) != 0)&&
2714 ((qt.softlim != 0xFFFFFFFF)||
2715 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2716 /* more than 32 bits? */
2717 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2718 return;
2719 }
2720 #endif /* LARGE_SMB_OFF_T */
2721
2722 /* the hard quotas 8 bytes (uint64_t)*/
2723 qt.hardlim = (uint64_t)IVAL(pdata,32);
2724 #ifdef LARGE_SMB_OFF_T
2725 qt.hardlim |= (((uint64_t)IVAL(pdata,36)) << 32);
2726 #else /* LARGE_SMB_OFF_T */
2727 if ((IVAL(pdata,36) != 0)&&
2728 ((qt.hardlim != 0xFFFFFFFF)||
2729 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2730 /* more than 32 bits? */
2731 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2732 return;
2733 }
2734 #endif /* LARGE_SMB_OFF_T */
2735
2736 sid_parse(pdata+40,sid_len,&sid);
2737 DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2738
2739 /* 44 unknown bytes left... */
2740
2741 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2742 reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
2743 return;
2744 }
2745
2746 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2747 pdata, data_len);
2748 }
2749 #endif /* HAVE_SYS_QUOTAS */
2750
2751 static void handle_nttrans(connection_struct *conn,
2752 struct trans_state *state,
2753 struct smb_request *req)
2754 {
2755 if (get_Protocol() >= PROTOCOL_NT1) {
2756 req->flags2 |= 0x40; /* IS_LONG_NAME */
2757 SSVAL(req->inbuf,smb_flg2,req->flags2);
2758 }
2759
2760
2761 SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2762
2763 /* Now we must call the relevant NT_TRANS function */
2764 switch(state->call) {
2765 case NT_TRANSACT_CREATE:
2766 {
2767 START_PROFILE(NT_transact_create);
2768 call_nt_transact_create(
2769 conn, req,
2770 &state->setup, state->setup_count,
2771 &state->param, state->total_param,
2772 &state->data, state->total_data,
2773 state->max_data_return);
2774 END_PROFILE(NT_transact_create);
2775 break;
2776 }
2777
2778 case NT_TRANSACT_IOCTL:
2779 {
2780 START_PROFILE(NT_transact_ioctl);
2781 call_nt_transact_ioctl(
2782 conn, req,
2783 &state->setup, state->setup_count,
2784 &state->param, state->total_param,
2785 &state->data, state->total_data,
2786 state->max_data_return);
2787 END_PROFILE(NT_transact_ioctl);
2788 break;
2789 }
2790
2791 case NT_TRANSACT_SET_SECURITY_DESC:
2792 {
2793 START_PROFILE(NT_transact_set_security_desc);
2794 call_nt_transact_set_security_desc(
2795 conn, req,
2796 &state->setup, state->setup_count,
2797 &state->param, state->total_param,
2798 &state->data, state->total_data,
2799 state->max_data_return);
2800 END_PROFILE(NT_transact_set_security_desc);
2801 break;
2802 }
2803
2804 case NT_TRANSACT_NOTIFY_CHANGE:
2805 {
2806 START_PROFILE(NT_transact_notify_change);
2807 call_nt_transact_notify_change(
2808 conn, req,
2809 &state->setup, state->setup_count,
2810 &state->param, state->total_param,
2811 &state->data, state->total_data,
2812 state->max_data_return,
2813 state->max_param_return);
2814 END_PROFILE(NT_transact_notify_change);
2815 break;
2816 }
2817
2818 case NT_TRANSACT_RENAME:
2819 {
2820 START_PROFILE(NT_transact_rename);
2821 call_nt_transact_rename(
2822 conn, req,
2823 &state->setup, state->setup_count,
2824 &state->param, state->total_param,
2825 &state->data, state->total_data,
2826 state->max_data_return);
2827 END_PROFILE(NT_transact_rename);
2828 break;
2829 }
2830
2831 case NT_TRANSACT_QUERY_SECURITY_DESC:
2832 {
2833 START_PROFILE(NT_transact_query_security_desc);
2834 call_nt_transact_query_security_desc(
2835 conn, req,
2836 &state->setup, state->setup_count,
2837 &state->param, state->total_param,
2838 &state->data, state->total_data,
2839 state->max_data_return);
2840 END_PROFILE(NT_transact_query_security_desc);
2841 break;
2842 }
2843
2844 #ifdef HAVE_SYS_QUOTAS
2845 case NT_TRANSACT_GET_USER_QUOTA:
2846 {
2847 START_PROFILE(NT_transact_get_user_quota);
2848 call_nt_transact_get_user_quota(
2849 conn, req,
2850 &state->setup, state->setup_count,
2851 &state->param, state->total_param,
2852 &state->data, state->total_data,
2853 state->max_data_return);
2854 END_PROFILE(NT_transact_get_user_quota);
2855 break;
2856 }
2857
2858 case NT_TRANSACT_SET_USER_QUOTA:
2859 {
2860 START_PROFILE(NT_transact_set_user_quota);
2861 call_nt_transact_set_user_quota(
2862 conn, req,
2863 &state->setup, state->setup_count,
2864 &state->param, state->total_param,
2865 &state->data, state->total_data,
2866 state->max_data_return);
2867 END_PROFILE(NT_transact_set_user_quota);
2868 break;
2869 }
2870 #endif /* HAVE_SYS_QUOTAS */
2871
2872 default:
2873 /* Error in request */
2874 DEBUG(0,("handle_nttrans: Unknown request %d in "
2875 "nttrans call\n", state->call));
2876 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2877 return;
2878 }
2879 return;
2880 }
2881
2882 /****************************************************************************
2883 Reply to a SMBNTtrans.
2884 ****************************************************************************/
2885
2886 void reply_nttrans(struct smb_request *req)
2887 {
2888 connection_struct *conn = req->conn;
2889 uint32_t pscnt;
2890 uint32_t psoff;
2891 uint32_t dscnt;
2892 uint32_t dsoff;
2893 uint16 function_code;
2894 NTSTATUS result;
2895 struct trans_state *state;
2896
2897 START_PROFILE(SMBnttrans);
2898
2899 if (req->wct < 19) {
2900 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2901 END_PROFILE(SMBnttrans);
2902 return;
2903 }
2904
2905 pscnt = IVAL(req->vwv+9, 1);
2906 psoff = IVAL(req->vwv+11, 1);
2907 dscnt = IVAL(req->vwv+13, 1);
2908 dsoff = IVAL(req->vwv+15, 1);
2909 function_code = SVAL(req->vwv+18, 0);
2910
2911 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2912 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2913 END_PROFILE(SMBnttrans);
2914 return;
2915 }
2916
2917 result = allow_new_trans(conn->pending_trans, req->mid);
2918 if (!NT_STATUS_IS_OK(result)) {
2919 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2920 reply_nterror(req, result);
2921 END_PROFILE(SMBnttrans);
2922 return;
2923 }
2924
2925 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
2926 reply_nterror(req, NT_STATUS_NO_MEMORY);
2927 END_PROFILE(SMBnttrans);
2928 return;
2929 }
2930
2931 state->cmd = SMBnttrans;
2932
2933 state->mid = req->mid;
2934 state->vuid = req->vuid;
2935 state->total_data = IVAL(req->vwv+3, 1);
2936 state->data = NULL;
2937 state->total_param = IVAL(req->vwv+1, 1);
2938 state->param = NULL;
2939 state->max_data_return = IVAL(req->vwv+7, 1);
2940 state->max_param_return = IVAL(req->vwv+5, 1);
2941
2942 /* setup count is in *words* */
2943 state->setup_count = 2*CVAL(req->vwv+17, 1);
2944 state->setup = NULL;
2945 state->call = function_code;
2946
2947 DEBUG(10, ("num_setup=%u, "
2948 "param_total=%u, this_param=%u, max_param=%u, "
2949 "data_total=%u, this_data=%u, max_data=%u, "
2950 "param_offset=%u, data_offset=%u\n",
2951 (unsigned)state->setup_count,
2952 (unsigned)state->total_param, (unsigned)pscnt,
2953 (unsigned)state->max_param_return,
2954 (unsigned)state->total_data, (unsigned)dscnt,
2955 (unsigned)state->max_data_return,
2956 (unsigned)psoff, (unsigned)dsoff));
2957
2958 /*
2959 * All nttrans messages we handle have smb_wct == 19 +
2960 * state->setup_count. Ensure this is so as a sanity check.
2961 */
2962
2963 if(req->wct != 19 + (state->setup_count/2)) {
2964 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2965 req->wct, 19 + (state->setup_count/2)));
2966 goto bad_param;
2967 }
2968
2969 /* Don't allow more than 128mb for each value. */
2970 if ((state->total_data > (1024*1024*128)) ||
2971 (state->total_param > (1024*1024*128))) {
2972 reply_nterror(req, NT_STATUS_NO_MEMORY);
2973 END_PROFILE(SMBnttrans);
2974 return;
2975 }
2976
2977 if ((dscnt > state->total_data) || (pscnt > state->total_param))
2978 goto bad_param;
2979
2980 if (state->total_data) {
2981
2982 if (trans_oob(state->total_data, 0, dscnt)
2983 || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
2984 goto bad_param;
2985 }
2986
2987 /* Can't use talloc here, the core routines do realloc on the
2988 * params and data. */
2989 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2990 DEBUG(0,("reply_nttrans: data malloc fail for %u "
2991 "bytes !\n", (unsigned int)state->total_data));
2992 TALLOC_FREE(state);
2993 reply_nterror(req, NT_STATUS_NO_MEMORY);
2994 END_PROFILE(SMBnttrans);
2995 return;
2996 }
2997
2998 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2999 }
3000
3001 if (state->total_param) {
3002
3003 if (trans_oob(state->total_param, 0, pscnt)
3004 || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
3005 goto bad_param;
3006 }
3007
3008 /* Can't use talloc here, the core routines do realloc on the
3009 * params and data. */
3010 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3011 DEBUG(0,("reply_nttrans: param malloc fail for %u "
3012 "bytes !\n", (unsigned int)state->total_param));
3013 SAFE_FREE(state->data);
3014 TALLOC_FREE(state);
3015 reply_nterror(req, NT_STATUS_NO_MEMORY);
3016 END_PROFILE(SMBnttrans);
3017 return;
3018 }
3019
3020 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
3021 }
3022
3023 state->received_data = dscnt;
3024 state->received_param = pscnt;
3025
3026 if(state->setup_count > 0) {
3027 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3028 state->setup_count));
3029
3030 /*
3031 * No overflow possible here, state->setup_count is an
3032 * unsigned int, being filled by a single byte from
3033 * CVAL(req->vwv+13, 0) above. The cast in the comparison
3034 * below is not necessary, it's here to clarify things. The
3035 * validity of req->vwv and req->wct has been checked in
3036 * init_smb_request already.
3037 */
3038 if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
3039 goto bad_param;
3040 }
3041
3042 state->setup = (uint16 *)TALLOC(state, state->setup_count);
3043 if (state->setup == NULL) {
3044 DEBUG(0,("reply_nttrans : Out of memory\n"));
3045 SAFE_FREE(state->data);
3046 SAFE_FREE(state->param);
3047 TALLOC_FREE(state);
3048 reply_nterror(req, NT_STATUS_NO_MEMORY);
3049 END_PROFILE(SMBnttrans);
3050 return;
3051 }
3052
3053 memcpy(state->setup, req->vwv+19, state->setup_count);
3054 dump_data(10, (uint8 *)state->setup, state->setup_count);
3055 }
3056
3057 if ((state->received_data == state->total_data) &&
3058 (state->received_param == state->total_param)) {
3059 handle_nttrans(conn, state, req);
3060 SAFE_FREE(state->param);
3061 SAFE_FREE(state->data);
3062 TALLOC_FREE(state);
3063 END_PROFILE(SMBnttrans);
3064 return;
3065 }
3066
3067 DLIST_ADD(conn->pending_trans, state);
3068
3069 /* We need to send an interim response then receive the rest
3070 of the parameter/data bytes */
3071 reply_outbuf(req, 0, 0);
3072 show_msg((char *)req->outbuf);
3073 END_PROFILE(SMBnttrans);
3074 return;
3075
3076 bad_param:
3077
3078 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3079 SAFE_FREE(state->data);
3080 SAFE_FREE(state->param);
3081 TALLOC_FREE(state);
3082 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3083 END_PROFILE(SMBnttrans);
3084 return;
3085 }
3086
3087 /****************************************************************************
3088 Reply to a SMBnttranss
3089 ****************************************************************************/
3090
3091 void reply_nttranss(struct smb_request *req)
3092 {
3093 connection_struct *conn = req->conn;
3094 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
3095 struct trans_state *state;
3096
3097 START_PROFILE(SMBnttranss);
3098
3099 show_msg((char *)req->inbuf);
3100
3101 if (req->wct < 18) {
3102 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3103 END_PROFILE(SMBnttranss);
3104 return;
3105 }
3106
3107 for (state = conn->pending_trans; state != NULL;
3108 state = state->next) {
3109 if (state->mid == req->mid) {
3110 break;
3111 }
3112 }
3113
3114 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3115 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3116 END_PROFILE(SMBnttranss);
3117 return;
3118 }
3119
3120 /* Revise state->total_param and state->total_data in case they have
3121 changed downwards */
3122 if (IVAL(req->vwv+1, 1) < state->total_param) {
3123 state->total_param = IVAL(req->vwv+1, 1);
3124 }
3125 if (IVAL(req->vwv+3, 1) < state->total_data) {
3126 state->total_data = IVAL(req->vwv+3, 1);
3127 }
3128
3129 pcnt = IVAL(req->vwv+5, 1);
3130 poff = IVAL(req->vwv+7, 1);
3131 pdisp = IVAL(req->vwv+9, 1);
3132
3133 dcnt = IVAL(req->vwv+11, 1);
3134 doff = IVAL(req->vwv+13, 1);
3135 ddisp = IVAL(req->vwv+15, 1);
3136
3137 state->received_param += pcnt;
3138 state->received_data += dcnt;
3139
3140 if ((state->received_data > state->total_data) ||
3141 (state->received_param > state->total_param))
3142 goto bad_param;
3143
3144 if (pcnt) {
3145 if (trans_oob(state->total_param, pdisp, pcnt)
3146 || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
3147 goto bad_param;
3148 }
3149 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
3150 }
3151
3152 if (dcnt) {
3153 if (trans_oob(state->total_data, ddisp, dcnt)
3154 || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
3155 goto bad_param;
3156 }
3157 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
3158 }
3159
3160 if ((state->received_param < state->total_param) ||
3161 (state->received_data < state->total_data)) {
3162 END_PROFILE(SMBnttranss);
3163 return;
3164 }
3165
3166 handle_nttrans(conn, state, req);
3167
3168 DLIST_REMOVE(conn->pending_trans, state);
3169 SAFE_FREE(state->data);
3170 SAFE_FREE(state->param);
3171 TALLOC_FREE(state);
3172 END_PROFILE(SMBnttranss);
3173 return;
3174
3175 bad_param:
3176
3177 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3178 DLIST_REMOVE(conn->pending_trans, state);
3179 SAFE_FREE(state->data);
3180 SAFE_FREE(state->param);
3181 TALLOC_FREE(state);
3182 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3183 END_PROFILE(SMBnttranss);
3184 return;
3185 }