?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #Bug 6090 renaming or deleting a "not matching/resolving" symlink is failing.
[Samba/ekacnet.git] / source3 / smbd / reply.c
blobbb5fadd4658c4e768048a93c0be18c4474d199f2
1 /*
2 Unix SMB/CIFS implementation.
3 Main SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 1992-2007.
7 Copyright (C) Volker Lendecke 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles most of the reply_ calls that the server
24 makes to handle specific protocols
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 extern enum protocol_types Protocol;
31
32 /****************************************************************************
33 Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
34 path or anything including wildcards.
35 We're assuming here that '/' is not the second byte in any multibyte char
36 set (a safe assumption). '\\' *may* be the second byte in a multibyte char
37 set.
38 ****************************************************************************/
39
40 /* Custom version for processing POSIX paths. */
41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
42
43 static NTSTATUS check_path_syntax_internal(char *path,
44 bool posix_path,
45 bool *p_last_component_contains_wcard)
46 {
47 char *d = path;
48 const char *s = path;
49 NTSTATUS ret = NT_STATUS_OK;
50 bool start_of_name_component = True;
51 bool stream_started = false;
52
53 *p_last_component_contains_wcard = False;
54
55 while (*s) {
56 if (stream_started) {
57 switch (*s) {
58 case '/':
59 case '\\':
60 return NT_STATUS_OBJECT_NAME_INVALID;
61 case ':':
62 if (s[1] == '\0') {
63 return NT_STATUS_OBJECT_NAME_INVALID;
64 }
65 if (strchr_m(&s[1], ':')) {
66 return NT_STATUS_OBJECT_NAME_INVALID;
67 }
68 if (StrCaseCmp(s, ":$DATA") != 0) {
69 return NT_STATUS_INVALID_PARAMETER;
70 }
71 break;
72 }
73 }
74
75 if (!stream_started && *s == ':') {
76 if (*p_last_component_contains_wcard) {
77 return NT_STATUS_OBJECT_NAME_INVALID;
78 }
79 /* stream names allow more characters than file names */
80 stream_started = true;
81 start_of_name_component = false;
82 posix_path = true;
83
84 if (s[1] == '\0') {
85 return NT_STATUS_OBJECT_NAME_INVALID;
86 }
87 }
88
89 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
90 /*
91 * Safe to assume is not the second part of a mb char
92 * as this is handled below.
93 */
94 /* Eat multiple '/' or '\\' */
95 while (IS_PATH_SEP(*s,posix_path)) {
96 s++;
97 }
98 if ((d != path) && (*s != '\0')) {
99 /* We only care about non-leading or trailing '/' or '\\' */
100 *d++ = '/';
101 }
102
103 start_of_name_component = True;
104 /* New component. */
105 *p_last_component_contains_wcard = False;
106 continue;
107 }
108
109 if (start_of_name_component) {
110 if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
111 /* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
112
113 /*
114 * No mb char starts with '.' so we're safe checking the directory separator here.
115 */
116
117 /* If we just added a '/' - delete it */
118 if ((d > path) && (*(d-1) == '/')) {
119 *(d-1) = '\0';
120 d--;
121 }
122
123 /* Are we at the start ? Can't go back further if so. */
124 if (d <= path) {
125 ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
126 break;
127 }
128 /* Go back one level... */
129 /* We know this is safe as '/' cannot be part of a mb sequence. */
130 /* NOTE - if this assumption is invalid we are not in good shape... */
131 /* Decrement d first as d points to the *next* char to write into. */
132 for (d--; d > path; d--) {
133 if (*d == '/')
134 break;
135 }
136 s += 2; /* Else go past the .. */
137 /* We're still at the start of a name component, just the previous one. */
138 continue;
139
140 } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
141 if (posix_path) {
142 /* Eat the '.' */
143 s++;
144 continue;
145 }
146 }
147
148 }
149
150 if (!(*s & 0x80)) {
151 if (!posix_path) {
152 if (*s <= 0x1f || *s == '|') {
153 return NT_STATUS_OBJECT_NAME_INVALID;
154 }
155 switch (*s) {
156 case '*':
157 case '?':
158 case '<':
159 case '>':
160 case '"':
161 *p_last_component_contains_wcard = True;
162 break;
163 default:
164 break;
165 }
166 }
167 *d++ = *s++;
168 } else {
169 size_t siz;
170 /* Get the size of the next MB character. */
171 next_codepoint(s,&siz);
172 switch(siz) {
173 case 5:
174 *d++ = *s++;
175 /*fall through*/
176 case 4:
177 *d++ = *s++;
178 /*fall through*/
179 case 3:
180 *d++ = *s++;
181 /*fall through*/
182 case 2:
183 *d++ = *s++;
184 /*fall through*/
185 case 1:
186 *d++ = *s++;
187 break;
188 default:
189 DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
190 *d = '\0';
191 return NT_STATUS_INVALID_PARAMETER;
192 }
193 }
194 start_of_name_component = False;
195 }
196
197 *d = '\0';
198
199 return ret;
200 }
201
202 /****************************************************************************
203 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
204 No wildcards allowed.
205 ****************************************************************************/
206
207 NTSTATUS check_path_syntax(char *path)
208 {
209 bool ignore;
210 return check_path_syntax_internal(path, False, &ignore);
211 }
212
213 /****************************************************************************
214 Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
215 Wildcards allowed - p_contains_wcard returns true if the last component contained
216 a wildcard.
217 ****************************************************************************/
218
219 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
220 {
221 return check_path_syntax_internal(path, False, p_contains_wcard);
222 }
223
224 /****************************************************************************
225 Check the path for a POSIX client.
226 We're assuming here that '/' is not the second byte in any multibyte char
227 set (a safe assumption).
228 ****************************************************************************/
229
230 NTSTATUS check_path_syntax_posix(char *path)
231 {
232 bool ignore;
233 return check_path_syntax_internal(path, True, &ignore);
234 }
235
236 /****************************************************************************
237 Pull a string and check the path allowing a wilcard - provide for error return.
238 ****************************************************************************/
239
240 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
241 const char *base_ptr,
242 uint16 smb_flags2,
243 char **pp_dest,
244 const char *src,
245 size_t src_len,
246 int flags,
247 NTSTATUS *err,
248 bool *contains_wcard)
249 {
250 size_t ret;
251
252 *pp_dest = NULL;
253
254 ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
255 src_len, flags);
256
257 if (!*pp_dest) {
258 *err = NT_STATUS_INVALID_PARAMETER;
259 return ret;
260 }
261
262 *contains_wcard = False;
263
264 if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
265 /*
266 * For a DFS path the function parse_dfs_path()
267 * will do the path processing, just make a copy.
268 */
269 *err = NT_STATUS_OK;
270 return ret;
271 }
272
273 if (lp_posix_pathnames()) {
274 *err = check_path_syntax_posix(*pp_dest);
275 } else {
276 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
277 }
278
279 return ret;
280 }
281
282 /****************************************************************************
283 Pull a string and check the path - provide for error return.
284 ****************************************************************************/
285
286 size_t srvstr_get_path(TALLOC_CTX *ctx,
287 const char *base_ptr,
288 uint16 smb_flags2,
289 char **pp_dest,
290 const char *src,
291 size_t src_len,
292 int flags,
293 NTSTATUS *err)
294 {
295 bool ignore;
296 return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
297 src_len, flags, err, &ignore);
298 }
299
300 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
301 char **pp_dest, const char *src, int flags,
302 NTSTATUS *err, bool *contains_wcard)
303 {
304 return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
305 pp_dest, src, smbreq_bufrem(req, src),
306 flags, err, contains_wcard);
307 }
308
309 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
310 char **pp_dest, const char *src, int flags,
311 NTSTATUS *err)
312 {
313 bool ignore;
314 return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
315 flags, err, &ignore);
316 }
317
318 /****************************************************************************
319 Check if we have a correct fsp pointing to a file. Basic check for open fsp.
320 ****************************************************************************/
321
322 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
323 files_struct *fsp)
324 {
325 if (!(fsp) || !(conn)) {
326 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
327 return False;
328 }
329 if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
330 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
331 return False;
332 }
333 return True;
334 }
335
336 /****************************************************************************
337 Check if we have a correct fsp pointing to a file.
338 ****************************************************************************/
339
340 bool check_fsp(connection_struct *conn, struct smb_request *req,
341 files_struct *fsp)
342 {
343 if (!check_fsp_open(conn, req, fsp)) {
344 return False;
345 }
346 if ((fsp)->is_directory) {
347 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
348 return False;
349 }
350 if ((fsp)->fh->fd == -1) {
351 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
352 return False;
353 }
354 (fsp)->num_smb_operations++;
355 return True;
356 }
357
358 /****************************************************************************
359 Check if we have a correct fsp pointing to a quota fake file. Replacement for
360 the CHECK_NTQUOTA_HANDLE_OK macro.
361 ****************************************************************************/
362
363 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
364 files_struct *fsp)
365 {
366 if (!check_fsp_open(conn, req, fsp)) {
367 return false;
368 }
369
370 if (fsp->is_directory) {
371 return false;
372 }
373
374 if (fsp->fake_file_handle == NULL) {
375 return false;
376 }
377
378 if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
379 return false;
380 }
381
382 if (fsp->fake_file_handle->private_data == NULL) {
383 return false;
384 }
385
386 return true;
387 }
388
389 /****************************************************************************
390 Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
391 ****************************************************************************/
392
393 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
394 files_struct *fsp)
395 {
396 if ((fsp) && (conn) && ((conn)==(fsp)->conn)
397 && (req->vuid == (fsp)->vuid)) {
398 return True;
399 }
400
401 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
402 return False;
403 }
404
405 /****************************************************************************
406 Reply to a (netbios-level) special message.
407 ****************************************************************************/
408
409 void reply_special(char *inbuf)
410 {
411 int msg_type = CVAL(inbuf,0);
412 int msg_flags = CVAL(inbuf,1);
413 fstring name1,name2;
414 char name_type = 0;
415
416 /*
417 * We only really use 4 bytes of the outbuf, but for the smb_setlen
418 * calculation & friends (srv_send_smb uses that) we need the full smb
419 * header.
420 */
421 char outbuf[smb_size];
422
423 *name1 = *name2 = 0;
424
425 memset(outbuf, '\0', sizeof(outbuf));
426
427 smb_setlen(outbuf,0);
428
429 switch (msg_type) {
430 case 0x81: /* session request */
431
432 if (already_got_session) {
433 exit_server_cleanly("multiple session request not permitted");
434 }
435
436 SCVAL(outbuf,0,0x82);
437 SCVAL(outbuf,3,0);
438 if (name_len(inbuf+4) > 50 ||
439 name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
440 DEBUG(0,("Invalid name length in session request\n"));
441 return;
442 }
443 name_extract(inbuf,4,name1);
444 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
445 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
446 name1,name2));
447
448 set_local_machine_name(name1, True);
449 set_remote_machine_name(name2, True);
450
451 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
452 get_local_machine_name(), get_remote_machine_name(),
453 name_type));
454
455 if (name_type == 'R') {
456 /* We are being asked for a pathworks session ---
457 no thanks! */
458 SCVAL(outbuf, 0,0x83);
459 break;
460 }
461
462 /* only add the client's machine name to the list
463 of possibly valid usernames if we are operating
464 in share mode security */
465 if (lp_security() == SEC_SHARE) {
466 add_session_user(get_remote_machine_name());
467 }
468
469 reload_services(True);
470 reopen_logs();
471
472 already_got_session = True;
473 break;
474
475 case 0x89: /* session keepalive request
476 (some old clients produce this?) */
477 SCVAL(outbuf,0,SMBkeepalive);
478 SCVAL(outbuf,3,0);
479 break;
480
481 case 0x82: /* positive session response */
482 case 0x83: /* negative session response */
483 case 0x84: /* retarget session response */
484 DEBUG(0,("Unexpected session response\n"));
485 break;
486
487 case SMBkeepalive: /* session keepalive */
488 default:
489 return;
490 }
491
492 DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
493 msg_type, msg_flags));
494
495 srv_send_smb(smbd_server_fd(), outbuf, false);
496 return;
497 }
498
499 /****************************************************************************
500 Reply to a tcon.
501 conn POINTER CAN BE NULL HERE !
502 ****************************************************************************/
503
504 void reply_tcon(struct smb_request *req)
505 {
506 connection_struct *conn = req->conn;
507 const char *service;
508 char *service_buf = NULL;
509 char *password = NULL;
510 char *dev = NULL;
511 int pwlen=0;
512 NTSTATUS nt_status;
513 const char *p;
514 DATA_BLOB password_blob;
515 TALLOC_CTX *ctx = talloc_tos();
516
517 START_PROFILE(SMBtcon);
518
519 if (req->buflen < 4) {
520 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
521 END_PROFILE(SMBtcon);
522 return;
523 }
524
525 p = (const char *)req->buf + 1;
526 p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
527 p += 1;
528 pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
529 p += pwlen+1;
530 p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
531 p += 1;
532
533 if (service_buf == NULL || password == NULL || dev == NULL) {
534 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
535 END_PROFILE(SMBtcon);
536 return;
537 }
538 p = strrchr_m(service_buf,'\\');
539 if (p) {
540 service = p+1;
541 } else {
542 service = service_buf;
543 }
544
545 password_blob = data_blob(password, pwlen+1);
546
547 conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
548 req->conn = conn;
549
550 data_blob_clear_free(&password_blob);
551
552 if (!conn) {
553 reply_nterror(req, nt_status);
554 END_PROFILE(SMBtcon);
555 return;
556 }
557
558 reply_outbuf(req, 2, 0);
559 SSVAL(req->outbuf,smb_vwv0,max_recv);
560 SSVAL(req->outbuf,smb_vwv1,conn->cnum);
561 SSVAL(req->outbuf,smb_tid,conn->cnum);
562
563 DEBUG(3,("tcon service=%s cnum=%d\n",
564 service, conn->cnum));
565
566 END_PROFILE(SMBtcon);
567 return;
568 }
569
570 /****************************************************************************
571 Reply to a tcon and X.
572 conn POINTER CAN BE NULL HERE !
573 ****************************************************************************/
574
575 void reply_tcon_and_X(struct smb_request *req)
576 {
577 connection_struct *conn = req->conn;
578 const char *service = NULL;
579 DATA_BLOB password;
580 TALLOC_CTX *ctx = talloc_tos();
581 /* what the cleint thinks the device is */
582 char *client_devicetype = NULL;
583 /* what the server tells the client the share represents */
584 const char *server_devicetype;
585 NTSTATUS nt_status;
586 int passlen;
587 char *path = NULL;
588 const char *p, *q;
589 uint16 tcon_flags;
590
591 START_PROFILE(SMBtconX);
592
593 if (req->wct < 4) {
594 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
595 END_PROFILE(SMBtconX);
596 return;
597 }
598
599 passlen = SVAL(req->vwv+3, 0);
600 tcon_flags = SVAL(req->vwv+2, 0);
601
602 /* we might have to close an old one */
603 if ((tcon_flags & 0x1) && conn) {
604 close_cnum(conn,req->vuid);
605 req->conn = NULL;
606 conn = NULL;
607 }
608
609 if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
610 reply_doserror(req, ERRDOS, ERRbuftoosmall);
611 END_PROFILE(SMBtconX);
612 return;
613 }
614
615 if (global_encrypted_passwords_negotiated) {
616 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
617 if (lp_security() == SEC_SHARE) {
618 /*
619 * Security = share always has a pad byte
620 * after the password.
621 */
622 p = (const char *)req->buf + passlen + 1;
623 } else {
624 p = (const char *)req->buf + passlen;
625 }
626 } else {
627 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
628 /* Ensure correct termination */
629 password.data[passlen]=0;
630 p = (const char *)req->buf + passlen + 1;
631 }
632
633 p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
634
635 if (path == NULL) {
636 data_blob_clear_free(&password);
637 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
638 END_PROFILE(SMBtconX);
639 return;
640 }
641
642 /*
643 * the service name can be either: \\server\share
644 * or share directly like on the DELL PowerVault 705
645 */
646 if (*path=='\\') {
647 q = strchr_m(path+2,'\\');
648 if (!q) {
649 data_blob_clear_free(&password);
650 reply_doserror(req, ERRDOS, ERRnosuchshare);
651 END_PROFILE(SMBtconX);
652 return;
653 }
654 service = q+1;
655 } else {
656 service = path;
657 }
658
659 p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
660 &client_devicetype, p,
661 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
662
663 if (client_devicetype == NULL) {
664 data_blob_clear_free(&password);
665 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
666 END_PROFILE(SMBtconX);
667 return;
668 }
669
670 DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
671
672 conn = make_connection(service, password, client_devicetype,
673 req->vuid, &nt_status);
674 req->conn =conn;
675
676 data_blob_clear_free(&password);
677
678 if (!conn) {
679 reply_nterror(req, nt_status);
680 END_PROFILE(SMBtconX);
681 return;
682 }
683
684 if ( IS_IPC(conn) )
685 server_devicetype = "IPC";
686 else if ( IS_PRINT(conn) )
687 server_devicetype = "LPT1:";
688 else
689 server_devicetype = "A:";
690
691 if (Protocol < PROTOCOL_NT1) {
692 reply_outbuf(req, 2, 0);
693 if (message_push_string(&req->outbuf, server_devicetype,
694 STR_TERMINATE|STR_ASCII) == -1) {
695 reply_nterror(req, NT_STATUS_NO_MEMORY);
696 END_PROFILE(SMBtconX);
697 return;
698 }
699 } else {
700 /* NT sets the fstype of IPC$ to the null string */
701 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
702
703 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
704 /* Return permissions. */
705 uint32 perm1 = 0;
706 uint32 perm2 = 0;
707
708 reply_outbuf(req, 7, 0);
709
710 if (IS_IPC(conn)) {
711 perm1 = FILE_ALL_ACCESS;
712 perm2 = FILE_ALL_ACCESS;
713 } else {
714 perm1 = CAN_WRITE(conn) ?
715 SHARE_ALL_ACCESS :
716 SHARE_READ_ONLY;
717 }
718
719 SIVAL(req->outbuf, smb_vwv3, perm1);
720 SIVAL(req->outbuf, smb_vwv5, perm2);
721 } else {
722 reply_outbuf(req, 3, 0);
723 }
724
725 if ((message_push_string(&req->outbuf, server_devicetype,
726 STR_TERMINATE|STR_ASCII) == -1)
727 || (message_push_string(&req->outbuf, fstype,
728 STR_TERMINATE) == -1)) {
729 reply_nterror(req, NT_STATUS_NO_MEMORY);
730 END_PROFILE(SMBtconX);
731 return;
732 }
733
734 /* what does setting this bit do? It is set by NT4 and
735 may affect the ability to autorun mounted cdroms */
736 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
737 (lp_csc_policy(SNUM(conn)) << 2));
738
739 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
740 DEBUG(2,("Serving %s as a Dfs root\n",
741 lp_servicename(SNUM(conn)) ));
742 SSVAL(req->outbuf, smb_vwv2,
743 SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
744 }
745 }
746
747
748 DEBUG(3,("tconX service=%s \n",
749 service));
750
751 /* set the incoming and outgoing tid to the just created one */
752 SSVAL(req->inbuf,smb_tid,conn->cnum);
753 SSVAL(req->outbuf,smb_tid,conn->cnum);
754
755 END_PROFILE(SMBtconX);
756
757 chain_reply(req);
758 return;
759 }
760
761 /****************************************************************************
762 Reply to an unknown type.
763 ****************************************************************************/
764
765 void reply_unknown_new(struct smb_request *req, uint8 type)
766 {
767 DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
768 smb_fn_name(type), type, type));
769 reply_doserror(req, ERRSRV, ERRunknownsmb);
770 return;
771 }
772
773 /****************************************************************************
774 Reply to an ioctl.
775 conn POINTER CAN BE NULL HERE !
776 ****************************************************************************/
777
778 void reply_ioctl(struct smb_request *req)
779 {
780 connection_struct *conn = req->conn;
781 uint16 device;
782 uint16 function;
783 uint32 ioctl_code;
784 int replysize;
785 char *p;
786
787 START_PROFILE(SMBioctl);
788
789 if (req->wct < 3) {
790 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
791 END_PROFILE(SMBioctl);
792 return;
793 }
794
795 device = SVAL(req->vwv+1, 0);
796 function = SVAL(req->vwv+2, 0);
797 ioctl_code = (device << 16) + function;
798
799 DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
800
801 switch (ioctl_code) {
802 case IOCTL_QUERY_JOB_INFO:
803 replysize = 32;
804 break;
805 default:
806 reply_doserror(req, ERRSRV, ERRnosupport);
807 END_PROFILE(SMBioctl);
808 return;
809 }
810
811 reply_outbuf(req, 8, replysize+1);
812 SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
813 SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
814 SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
815 p = smb_buf(req->outbuf);
816 memset(p, '\0', replysize+1); /* valgrind-safe. */
817 p += 1; /* Allow for alignment */
818
819 switch (ioctl_code) {
820 case IOCTL_QUERY_JOB_INFO:
821 {
822 files_struct *fsp = file_fsp(
823 req, SVAL(req->vwv+0, 0));
824 if (!fsp) {
825 reply_doserror(req, ERRDOS, ERRbadfid);
826 END_PROFILE(SMBioctl);
827 return;
828 }
829 SSVAL(p,0,fsp->rap_print_jobid); /* Job number */
830 srvstr_push((char *)req->outbuf, req->flags2, p+2,
831 global_myname(), 15,
832 STR_TERMINATE|STR_ASCII);
833 if (conn) {
834 srvstr_push((char *)req->outbuf, req->flags2,
835 p+18, lp_servicename(SNUM(conn)),
836 13, STR_TERMINATE|STR_ASCII);
837 } else {
838 memset(p+18, 0, 13);
839 }
840 break;
841 }
842 }
843
844 END_PROFILE(SMBioctl);
845 return;
846 }
847
848 /****************************************************************************
849 Strange checkpath NTSTATUS mapping.
850 ****************************************************************************/
851
852 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
853 {
854 /* Strange DOS error code semantics only for checkpath... */
855 if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
856 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
857 /* We need to map to ERRbadpath */
858 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
859 }
860 }
861 return status;
862 }
863
864 /****************************************************************************
865 Reply to a checkpath.
866 ****************************************************************************/
867
868 void reply_checkpath(struct smb_request *req)
869 {
870 connection_struct *conn = req->conn;
871 char *name = NULL;
872 SMB_STRUCT_STAT sbuf;
873 NTSTATUS status;
874 TALLOC_CTX *ctx = talloc_tos();
875
876 START_PROFILE(SMBcheckpath);
877
878 srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
879 STR_TERMINATE, &status);
880
881 if (!NT_STATUS_IS_OK(status)) {
882 status = map_checkpath_error(req->flags2, status);
883 reply_nterror(req, status);
884 END_PROFILE(SMBcheckpath);
885 return;
886 }
887
888 status = resolve_dfspath(ctx, conn,
889 req->flags2 & FLAGS2_DFS_PATHNAMES,
890 name,
891 &name);
892 if (!NT_STATUS_IS_OK(status)) {
893 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
894 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
895 ERRSRV, ERRbadpath);
896 END_PROFILE(SMBcheckpath);
897 return;
898 }
899 goto path_err;
900 }
901
902 DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
903
904 status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
905 if (!NT_STATUS_IS_OK(status)) {
906 goto path_err;
907 }
908
909 status = check_name(conn, name);
910 if (!NT_STATUS_IS_OK(status)) {
911 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
912 goto path_err;
913 }
914
915 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
916 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
917 status = map_nt_error_from_unix(errno);
918 goto path_err;
919 }
920
921 if (!S_ISDIR(sbuf.st_mode)) {
922 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
923 ERRDOS, ERRbadpath);
924 END_PROFILE(SMBcheckpath);
925 return;
926 }
927
928 reply_outbuf(req, 0, 0);
929
930 END_PROFILE(SMBcheckpath);
931 return;
932
933 path_err:
934
935 END_PROFILE(SMBcheckpath);
936
937 /* We special case this - as when a Windows machine
938 is parsing a path is steps through the components
939 one at a time - if a component fails it expects
940 ERRbadpath, not ERRbadfile.
941 */
942 status = map_checkpath_error(req->flags2, status);
943 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
944 /*
945 * Windows returns different error codes if
946 * the parent directory is valid but not the
947 * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
948 * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
949 * if the path is invalid.
950 */
951 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
952 ERRDOS, ERRbadpath);
953 return;
954 }
955
956 reply_nterror(req, status);
957 }
958
959 /****************************************************************************
960 Reply to a getatr.
961 ****************************************************************************/
962
963 void reply_getatr(struct smb_request *req)
964 {
965 connection_struct *conn = req->conn;
966 char *fname = NULL;
967 SMB_STRUCT_STAT sbuf;
968 int mode=0;
969 SMB_OFF_T size=0;
970 time_t mtime=0;
971 const char *p;
972 NTSTATUS status;
973 TALLOC_CTX *ctx = talloc_tos();
974
975 START_PROFILE(SMBgetatr);
976
977 p = (const char *)req->buf + 1;
978 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
979 if (!NT_STATUS_IS_OK(status)) {
980 reply_nterror(req, status);
981 END_PROFILE(SMBgetatr);
982 return;
983 }
984
985 status = resolve_dfspath(ctx, conn,
986 req->flags2 & FLAGS2_DFS_PATHNAMES,
987 fname,
988 &fname);
989 if (!NT_STATUS_IS_OK(status)) {
990 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
991 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
992 ERRSRV, ERRbadpath);
993 END_PROFILE(SMBgetatr);
994 return;
995 }
996 reply_nterror(req, status);
997 END_PROFILE(SMBgetatr);
998 return;
999 }
1000
1001 /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1002 under WfWg - weird! */
1003 if (*fname == '\0') {
1004 mode = aHIDDEN | aDIR;
1005 if (!CAN_WRITE(conn)) {
1006 mode |= aRONLY;
1007 }
1008 size = 0;
1009 mtime = 0;
1010 } else {
1011 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1012 if (!NT_STATUS_IS_OK(status)) {
1013 reply_nterror(req, status);
1014 END_PROFILE(SMBgetatr);
1015 return;
1016 }
1017 status = check_name(conn, fname);
1018 if (!NT_STATUS_IS_OK(status)) {
1019 DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1020 reply_nterror(req, status);
1021 END_PROFILE(SMBgetatr);
1022 return;
1023 }
1024 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1025 DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1026 reply_unixerror(req, ERRDOS,ERRbadfile);
1027 END_PROFILE(SMBgetatr);
1028 return;
1029 }
1030
1031 mode = dos_mode(conn,fname,&sbuf);
1032 size = sbuf.st_size;
1033 mtime = sbuf.st_mtime;
1034 if (mode & aDIR) {
1035 size = 0;
1036 }
1037 }
1038
1039 reply_outbuf(req, 10, 0);
1040
1041 SSVAL(req->outbuf,smb_vwv0,mode);
1042 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1043 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1044 } else {
1045 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1046 }
1047 SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1048
1049 if (Protocol >= PROTOCOL_NT1) {
1050 SSVAL(req->outbuf, smb_flg2,
1051 SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1052 }
1053
1054 DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1055
1056 END_PROFILE(SMBgetatr);
1057 return;
1058 }
1059
1060 /****************************************************************************
1061 Reply to a setatr.
1062 ****************************************************************************/
1063
1064 void reply_setatr(struct smb_request *req)
1065 {
1066 struct smb_file_time ft;
1067 connection_struct *conn = req->conn;
1068 char *fname = NULL;
1069 int mode;
1070 time_t mtime;
1071 SMB_STRUCT_STAT sbuf;
1072 const char *p;
1073 NTSTATUS status;
1074 TALLOC_CTX *ctx = talloc_tos();
1075
1076 START_PROFILE(SMBsetatr);
1077
1078 ZERO_STRUCT(ft);
1079
1080 if (req->wct < 2) {
1081 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1082 return;
1083 }
1084
1085 p = (const char *)req->buf + 1;
1086 p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1087 if (!NT_STATUS_IS_OK(status)) {
1088 reply_nterror(req, status);
1089 END_PROFILE(SMBsetatr);
1090 return;
1091 }
1092
1093 status = resolve_dfspath(ctx, conn,
1094 req->flags2 & FLAGS2_DFS_PATHNAMES,
1095 fname,
1096 &fname);
1097 if (!NT_STATUS_IS_OK(status)) {
1098 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1099 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1100 ERRSRV, ERRbadpath);
1101 END_PROFILE(SMBsetatr);
1102 return;
1103 }
1104 reply_nterror(req, status);
1105 END_PROFILE(SMBsetatr);
1106 return;
1107 }
1108
1109 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1110 if (!NT_STATUS_IS_OK(status)) {
1111 reply_nterror(req, status);
1112 END_PROFILE(SMBsetatr);
1113 return;
1114 }
1115
1116 status = check_name(conn, fname);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 reply_nterror(req, status);
1119 END_PROFILE(SMBsetatr);
1120 return;
1121 }
1122
1123 if (fname[0] == '.' && fname[1] == '\0') {
1124 /*
1125 * Not sure here is the right place to catch this
1126 * condition. Might be moved to somewhere else later -- vl
1127 */
1128 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1129 END_PROFILE(SMBsetatr);
1130 return;
1131 }
1132
1133 mode = SVAL(req->vwv+0, 0);
1134 mtime = srv_make_unix_date3(req->vwv+1);
1135
1136 ft.mtime = convert_time_t_to_timespec(mtime);
1137 status = smb_set_file_time(conn, NULL, fname,
1138 &sbuf, &ft, true);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 reply_unixerror(req, ERRDOS, ERRnoaccess);
1141 END_PROFILE(SMBsetatr);
1142 return;
1143 }
1144
1145 if (mode != FILE_ATTRIBUTE_NORMAL) {
1146 if (VALID_STAT_OF_DIR(sbuf))
1147 mode |= aDIR;
1148 else
1149 mode &= ~aDIR;
1150
1151 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1152 reply_unixerror(req, ERRDOS, ERRnoaccess);
1153 END_PROFILE(SMBsetatr);
1154 return;
1155 }
1156 }
1157
1158 reply_outbuf(req, 0, 0);
1159
1160 DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1161
1162 END_PROFILE(SMBsetatr);
1163 return;
1164 }
1165
1166 /****************************************************************************
1167 Reply to a dskattr.
1168 ****************************************************************************/
1169
1170 void reply_dskattr(struct smb_request *req)
1171 {
1172 connection_struct *conn = req->conn;
1173 uint64_t dfree,dsize,bsize;
1174 START_PROFILE(SMBdskattr);
1175
1176 if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1177 reply_unixerror(req, ERRHRD, ERRgeneral);
1178 END_PROFILE(SMBdskattr);
1179 return;
1180 }
1181
1182 reply_outbuf(req, 5, 0);
1183
1184 if (Protocol <= PROTOCOL_LANMAN2) {
1185 double total_space, free_space;
1186 /* we need to scale this to a number that DOS6 can handle. We
1187 use floating point so we can handle large drives on systems
1188 that don't have 64 bit integers
1189
1190 we end up displaying a maximum of 2G to DOS systems
1191 */
1192 total_space = dsize * (double)bsize;
1193 free_space = dfree * (double)bsize;
1194
1195 dsize = (uint64_t)((total_space+63*512) / (64*512));
1196 dfree = (uint64_t)((free_space+63*512) / (64*512));
1197
1198 if (dsize > 0xFFFF) dsize = 0xFFFF;
1199 if (dfree > 0xFFFF) dfree = 0xFFFF;
1200
1201 SSVAL(req->outbuf,smb_vwv0,dsize);
1202 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1203 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1204 SSVAL(req->outbuf,smb_vwv3,dfree);
1205 } else {
1206 SSVAL(req->outbuf,smb_vwv0,dsize);
1207 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1208 SSVAL(req->outbuf,smb_vwv2,512);
1209 SSVAL(req->outbuf,smb_vwv3,dfree);
1210 }
1211
1212 DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1213
1214 END_PROFILE(SMBdskattr);
1215 return;
1216 }
1217
1218 /****************************************************************************
1219 Reply to a search.
1220 Can be called from SMBsearch, SMBffirst or SMBfunique.
1221 ****************************************************************************/
1222
1223 void reply_search(struct smb_request *req)
1224 {
1225 connection_struct *conn = req->conn;
1226 const char *mask = NULL;
1227 char *directory = NULL;
1228 char *fname = NULL;
1229 SMB_OFF_T size;
1230 uint32 mode;
1231 time_t date;
1232 uint32 dirtype;
1233 unsigned int numentries = 0;
1234 unsigned int maxentries = 0;
1235 bool finished = False;
1236 const char *p;
1237 int status_len;
1238 char *path = NULL;
1239 char status[21];
1240 int dptr_num= -1;
1241 bool check_descend = False;
1242 bool expect_close = False;
1243 NTSTATUS nt_status;
1244 bool mask_contains_wcard = False;
1245 bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1246 TALLOC_CTX *ctx = talloc_tos();
1247 bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1248
1249 START_PROFILE(SMBsearch);
1250
1251 if (req->wct < 2) {
1252 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1253 END_PROFILE(SMBsearch);
1254 return;
1255 }
1256
1257 if (lp_posix_pathnames()) {
1258 reply_unknown_new(req, req->cmd);
1259 END_PROFILE(SMBsearch);
1260 return;
1261 }
1262
1263 /* If we were called as SMBffirst then we must expect close. */
1264 if(req->cmd == SMBffirst) {
1265 expect_close = True;
1266 }
1267
1268 reply_outbuf(req, 1, 3);
1269 maxentries = SVAL(req->vwv+0, 0);
1270 dirtype = SVAL(req->vwv+1, 0);
1271 p = (const char *)req->buf + 1;
1272 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1273 &nt_status, &mask_contains_wcard);
1274 if (!NT_STATUS_IS_OK(nt_status)) {
1275 reply_nterror(req, nt_status);
1276 END_PROFILE(SMBsearch);
1277 return;
1278 }
1279
1280 nt_status = resolve_dfspath_wcard(ctx, conn,
1281 req->flags2 & FLAGS2_DFS_PATHNAMES,
1282 path,
1283 &path,
1284 &mask_contains_wcard);
1285 if (!NT_STATUS_IS_OK(nt_status)) {
1286 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1287 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1288 ERRSRV, ERRbadpath);
1289 END_PROFILE(SMBsearch);
1290 return;
1291 }
1292 reply_nterror(req, nt_status);
1293 END_PROFILE(SMBsearch);
1294 return;
1295 }
1296
1297 p++;
1298 status_len = SVAL(p, 0);
1299 p += 2;
1300
1301 /* dirtype &= ~aDIR; */
1302
1303 if (status_len == 0) {
1304 SMB_STRUCT_STAT sbuf;
1305
1306 nt_status = unix_convert(ctx, conn, path, True,
1307 &directory, NULL, &sbuf);
1308 if (!NT_STATUS_IS_OK(nt_status)) {
1309 reply_nterror(req, nt_status);
1310 END_PROFILE(SMBsearch);
1311 return;
1312 }
1313
1314 nt_status = check_name(conn, directory);
1315 if (!NT_STATUS_IS_OK(nt_status)) {
1316 reply_nterror(req, nt_status);
1317 END_PROFILE(SMBsearch);
1318 return;
1319 }
1320
1321 p = strrchr_m(directory,'/');
1322 if ((p != NULL) && (*directory != '/')) {
1323 mask = p + 1;
1324 directory = talloc_strndup(ctx, directory,
1325 PTR_DIFF(p, directory));
1326 } else {
1327 mask = directory;
1328 directory = talloc_strdup(ctx,".");
1329 }
1330
1331 if (!directory) {
1332 reply_nterror(req, NT_STATUS_NO_MEMORY);
1333 END_PROFILE(SMBsearch);
1334 return;
1335 }
1336
1337 memset((char *)status,'\0',21);
1338 SCVAL(status,0,(dirtype & 0x1F));
1339
1340 nt_status = dptr_create(conn,
1341 directory,
1342 True,
1343 expect_close,
1344 req->smbpid,
1345 mask,
1346 mask_contains_wcard,
1347 dirtype,
1348 &conn->dirptr);
1349 if (!NT_STATUS_IS_OK(nt_status)) {
1350 reply_nterror(req, nt_status);
1351 END_PROFILE(SMBsearch);
1352 return;
1353 }
1354 dptr_num = dptr_dnum(conn->dirptr);
1355 } else {
1356 int status_dirtype;
1357
1358 memcpy(status,p,21);
1359 status_dirtype = CVAL(status,0) & 0x1F;
1360 if (status_dirtype != (dirtype & 0x1F)) {
1361 dirtype = status_dirtype;
1362 }
1363
1364 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1365 if (!conn->dirptr) {
1366 goto SearchEmpty;
1367 }
1368 string_set(&conn->dirpath,dptr_path(dptr_num));
1369 mask = dptr_wcard(dptr_num);
1370 if (!mask) {
1371 goto SearchEmpty;
1372 }
1373 /*
1374 * For a 'continue' search we have no string. So
1375 * check from the initial saved string.
1376 */
1377 mask_contains_wcard = ms_has_wild(mask);
1378 dirtype = dptr_attr(dptr_num);
1379 }
1380
1381 DEBUG(4,("dptr_num is %d\n",dptr_num));
1382
1383 if ((dirtype&0x1F) == aVOLID) {
1384 char buf[DIR_STRUCT_SIZE];
1385 memcpy(buf,status,21);
1386 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1387 0,aVOLID,0,!allow_long_path_components)) {
1388 reply_nterror(req, NT_STATUS_NO_MEMORY);
1389 END_PROFILE(SMBsearch);
1390 return;
1391 }
1392 dptr_fill(buf+12,dptr_num);
1393 if (dptr_zero(buf+12) && (status_len==0)) {
1394 numentries = 1;
1395 } else {
1396 numentries = 0;
1397 }
1398 if (message_push_blob(&req->outbuf,
1399 data_blob_const(buf, sizeof(buf)))
1400 == -1) {
1401 reply_nterror(req, NT_STATUS_NO_MEMORY);
1402 END_PROFILE(SMBsearch);
1403 return;
1404 }
1405 } else {
1406 unsigned int i;
1407 maxentries = MIN(
1408 maxentries,
1409 ((BUFFER_SIZE -
1410 ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1411 /DIR_STRUCT_SIZE));
1412
1413 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1414 conn->dirpath,lp_dontdescend(SNUM(conn))));
1415 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1416 check_descend = True;
1417 }
1418
1419 for (i=numentries;(i<maxentries) && !finished;i++) {
1420 finished = !get_dir_entry(ctx,
1421 conn,
1422 mask,
1423 dirtype,
1424 &fname,
1425 &size,
1426 &mode,
1427 &date,
1428 check_descend,
1429 ask_sharemode);
1430 if (!finished) {
1431 char buf[DIR_STRUCT_SIZE];
1432 memcpy(buf,status,21);
1433 if (!make_dir_struct(ctx,
1434 buf,
1435 mask,
1436 fname,
1437 size,
1438 mode,
1439 date,
1440 !allow_long_path_components)) {
1441 reply_nterror(req, NT_STATUS_NO_MEMORY);
1442 END_PROFILE(SMBsearch);
1443 return;
1444 }
1445 if (!dptr_fill(buf+12,dptr_num)) {
1446 break;
1447 }
1448 if (message_push_blob(&req->outbuf,
1449 data_blob_const(buf, sizeof(buf)))
1450 == -1) {
1451 reply_nterror(req, NT_STATUS_NO_MEMORY);
1452 END_PROFILE(SMBsearch);
1453 return;
1454 }
1455 numentries++;
1456 }
1457 }
1458 }
1459
1460 SearchEmpty:
1461
1462 /* If we were called as SMBffirst with smb_search_id == NULL
1463 and no entries were found then return error and close dirptr
1464 (X/Open spec) */
1465
1466 if (numentries == 0) {
1467 dptr_close(&dptr_num);
1468 } else if(expect_close && status_len == 0) {
1469 /* Close the dptr - we know it's gone */
1470 dptr_close(&dptr_num);
1471 }
1472
1473 /* If we were called as SMBfunique, then we can close the dirptr now ! */
1474 if(dptr_num >= 0 && req->cmd == SMBfunique) {
1475 dptr_close(&dptr_num);
1476 }
1477
1478 if ((numentries == 0) && !mask_contains_wcard) {
1479 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1480 END_PROFILE(SMBsearch);
1481 return;
1482 }
1483
1484 SSVAL(req->outbuf,smb_vwv0,numentries);
1485 SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1486 SCVAL(smb_buf(req->outbuf),0,5);
1487 SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1488
1489 /* The replies here are never long name. */
1490 SSVAL(req->outbuf, smb_flg2,
1491 SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1492 if (!allow_long_path_components) {
1493 SSVAL(req->outbuf, smb_flg2,
1494 SVAL(req->outbuf, smb_flg2)
1495 & (~FLAGS2_LONG_PATH_COMPONENTS));
1496 }
1497
1498 /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1499 SSVAL(req->outbuf, smb_flg2,
1500 (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1501
1502 if (!directory) {
1503 directory = dptr_path(dptr_num);
1504 }
1505
1506 DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1507 smb_fn_name(req->cmd),
1508 mask,
1509 directory ? directory : "./",
1510 dirtype,
1511 numentries,
1512 maxentries ));
1513
1514 END_PROFILE(SMBsearch);
1515 return;
1516 }
1517
1518 /****************************************************************************
1519 Reply to a fclose (stop directory search).
1520 ****************************************************************************/
1521
1522 void reply_fclose(struct smb_request *req)
1523 {
1524 int status_len;
1525 char status[21];
1526 int dptr_num= -2;
1527 const char *p;
1528 char *path = NULL;
1529 NTSTATUS err;
1530 bool path_contains_wcard = False;
1531 TALLOC_CTX *ctx = talloc_tos();
1532
1533 START_PROFILE(SMBfclose);
1534
1535 if (lp_posix_pathnames()) {
1536 reply_unknown_new(req, req->cmd);
1537 END_PROFILE(SMBfclose);
1538 return;
1539 }
1540
1541 p = (const char *)req->buf + 1;
1542 p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1543 &err, &path_contains_wcard);
1544 if (!NT_STATUS_IS_OK(err)) {
1545 reply_nterror(req, err);
1546 END_PROFILE(SMBfclose);
1547 return;
1548 }
1549 p++;
1550 status_len = SVAL(p,0);
1551 p += 2;
1552
1553 if (status_len == 0) {
1554 reply_doserror(req, ERRSRV, ERRsrverror);
1555 END_PROFILE(SMBfclose);
1556 return;
1557 }
1558
1559 memcpy(status,p,21);
1560
1561 if(dptr_fetch(status+12,&dptr_num)) {
1562 /* Close the dptr - we know it's gone */
1563 dptr_close(&dptr_num);
1564 }
1565
1566 reply_outbuf(req, 1, 0);
1567 SSVAL(req->outbuf,smb_vwv0,0);
1568
1569 DEBUG(3,("search close\n"));
1570
1571 END_PROFILE(SMBfclose);
1572 return;
1573 }
1574
1575 /****************************************************************************
1576 Reply to an open.
1577 ****************************************************************************/
1578
1579 void reply_open(struct smb_request *req)
1580 {
1581 connection_struct *conn = req->conn;
1582 char *fname = NULL;
1583 uint32 fattr=0;
1584 SMB_OFF_T size = 0;
1585 time_t mtime=0;
1586 int info;
1587 SMB_STRUCT_STAT sbuf;
1588 files_struct *fsp;
1589 int oplock_request;
1590 int deny_mode;
1591 uint32 dos_attr;
1592 uint32 access_mask;
1593 uint32 share_mode;
1594 uint32 create_disposition;
1595 uint32 create_options = 0;
1596 NTSTATUS status;
1597 TALLOC_CTX *ctx = talloc_tos();
1598
1599 START_PROFILE(SMBopen);
1600
1601 if (req->wct < 2) {
1602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1603 END_PROFILE(SMBopen);
1604 return;
1605 }
1606
1607 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1608 deny_mode = SVAL(req->vwv+0, 0);
1609 dos_attr = SVAL(req->vwv+1, 0);
1610
1611 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1612 STR_TERMINATE, &status);
1613 if (!NT_STATUS_IS_OK(status)) {
1614 reply_nterror(req, status);
1615 END_PROFILE(SMBopen);
1616 return;
1617 }
1618
1619 if (!map_open_params_to_ntcreate(
1620 fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1621 &share_mode, &create_disposition, &create_options)) {
1622 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1623 END_PROFILE(SMBopen);
1624 return;
1625 }
1626
1627 status = SMB_VFS_CREATE_FILE(
1628 conn, /* conn */
1629 req, /* req */
1630 0, /* root_dir_fid */
1631 fname, /* fname */
1632 CFF_DOS_PATH, /* create_file_flags */
1633 access_mask, /* access_mask */
1634 share_mode, /* share_access */
1635 create_disposition, /* create_disposition*/
1636 create_options, /* create_options */
1637 dos_attr, /* file_attributes */
1638 oplock_request, /* oplock_request */
1639 0, /* allocation_size */
1640 NULL, /* sd */
1641 NULL, /* ea_list */
1642 &fsp, /* result */
1643 &info, /* pinfo */
1644 &sbuf); /* psbuf */
1645
1646 if (!NT_STATUS_IS_OK(status)) {
1647 if (open_was_deferred(req->mid)) {
1648 /* We have re-scheduled this call. */
1649 END_PROFILE(SMBopen);
1650 return;
1651 }
1652 reply_openerror(req, status);
1653 END_PROFILE(SMBopen);
1654 return;
1655 }
1656
1657 size = sbuf.st_size;
1658 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1659 mtime = sbuf.st_mtime;
1660
1661 if (fattr & aDIR) {
1662 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1663 close_file(req, fsp, ERROR_CLOSE);
1664 reply_doserror(req, ERRDOS,ERRnoaccess);
1665 END_PROFILE(SMBopen);
1666 return;
1667 }
1668
1669 reply_outbuf(req, 7, 0);
1670 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1671 SSVAL(req->outbuf,smb_vwv1,fattr);
1672 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1673 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1674 } else {
1675 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1676 }
1677 SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1678 SSVAL(req->outbuf,smb_vwv6,deny_mode);
1679
1680 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1681 SCVAL(req->outbuf,smb_flg,
1682 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1683 }
1684
1685 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1686 SCVAL(req->outbuf,smb_flg,
1687 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1688 }
1689 END_PROFILE(SMBopen);
1690 return;
1691 }
1692
1693 /****************************************************************************
1694 Reply to an open and X.
1695 ****************************************************************************/
1696
1697 void reply_open_and_X(struct smb_request *req)
1698 {
1699 connection_struct *conn = req->conn;
1700 char *fname = NULL;
1701 uint16 open_flags;
1702 int deny_mode;
1703 uint32 smb_attr;
1704 /* Breakout the oplock request bits so we can set the
1705 reply bits separately. */
1706 int ex_oplock_request;
1707 int core_oplock_request;
1708 int oplock_request;
1709 #if 0
1710 int smb_sattr = SVAL(req->vwv+4, 0);
1711 uint32 smb_time = make_unix_date3(req->vwv+6);
1712 #endif
1713 int smb_ofun;
1714 uint32 fattr=0;
1715 int mtime=0;
1716 SMB_STRUCT_STAT sbuf;
1717 int smb_action = 0;
1718 files_struct *fsp;
1719 NTSTATUS status;
1720 uint64_t allocation_size;
1721 ssize_t retval = -1;
1722 uint32 access_mask;
1723 uint32 share_mode;
1724 uint32 create_disposition;
1725 uint32 create_options = 0;
1726 TALLOC_CTX *ctx = talloc_tos();
1727
1728 START_PROFILE(SMBopenX);
1729
1730 if (req->wct < 15) {
1731 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1732 END_PROFILE(SMBopenX);
1733 return;
1734 }
1735
1736 open_flags = SVAL(req->vwv+2, 0);
1737 deny_mode = SVAL(req->vwv+3, 0);
1738 smb_attr = SVAL(req->vwv+5, 0);
1739 ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1740 core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1741 oplock_request = ex_oplock_request | core_oplock_request;
1742 smb_ofun = SVAL(req->vwv+8, 0);
1743 allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1744
1745 /* If it's an IPC, pass off the pipe handler. */
1746 if (IS_IPC(conn)) {
1747 if (lp_nt_pipe_support()) {
1748 reply_open_pipe_and_X(conn, req);
1749 } else {
1750 reply_doserror(req, ERRSRV, ERRaccess);
1751 }
1752 END_PROFILE(SMBopenX);
1753 return;
1754 }
1755
1756 /* XXXX we need to handle passed times, sattr and flags */
1757 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1758 STR_TERMINATE, &status);
1759 if (!NT_STATUS_IS_OK(status)) {
1760 reply_nterror(req, status);
1761 END_PROFILE(SMBopenX);
1762 return;
1763 }
1764
1765 if (!map_open_params_to_ntcreate(
1766 fname, deny_mode, smb_ofun, &access_mask,
1767 &share_mode, &create_disposition, &create_options)) {
1768 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1769 END_PROFILE(SMBopenX);
1770 return;
1771 }
1772
1773 status = SMB_VFS_CREATE_FILE(
1774 conn, /* conn */
1775 req, /* req */
1776 0, /* root_dir_fid */
1777 fname, /* fname */
1778 CFF_DOS_PATH, /* create_file_flags */
1779 access_mask, /* access_mask */
1780 share_mode, /* share_access */
1781 create_disposition, /* create_disposition*/
1782 create_options, /* create_options */
1783 smb_attr, /* file_attributes */
1784 oplock_request, /* oplock_request */
1785 0, /* allocation_size */
1786 NULL, /* sd */
1787 NULL, /* ea_list */
1788 &fsp, /* result */
1789 &smb_action, /* pinfo */
1790 &sbuf); /* psbuf */
1791
1792 if (!NT_STATUS_IS_OK(status)) {
1793 END_PROFILE(SMBopenX);
1794 if (open_was_deferred(req->mid)) {
1795 /* We have re-scheduled this call. */
1796 return;
1797 }
1798 reply_openerror(req, status);
1799 return;
1800 }
1801
1802 /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1803 if the file is truncated or created. */
1804 if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1805 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1806 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1807 close_file(req, fsp, ERROR_CLOSE);
1808 reply_nterror(req, NT_STATUS_DISK_FULL);
1809 END_PROFILE(SMBopenX);
1810 return;
1811 }
1812 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1813 if (retval < 0) {
1814 close_file(req, fsp, ERROR_CLOSE);
1815 reply_nterror(req, NT_STATUS_DISK_FULL);
1816 END_PROFILE(SMBopenX);
1817 return;
1818 }
1819 sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
1820 }
1821
1822 fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1823 mtime = sbuf.st_mtime;
1824 if (fattr & aDIR) {
1825 close_file(req, fsp, ERROR_CLOSE);
1826 reply_doserror(req, ERRDOS, ERRnoaccess);
1827 END_PROFILE(SMBopenX);
1828 return;
1829 }
1830
1831 /* If the caller set the extended oplock request bit
1832 and we granted one (by whatever means) - set the
1833 correct bit for extended oplock reply.
1834 */
1835
1836 if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1837 smb_action |= EXTENDED_OPLOCK_GRANTED;
1838 }
1839
1840 if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1841 smb_action |= EXTENDED_OPLOCK_GRANTED;
1842 }
1843
1844 /* If the caller set the core oplock request bit
1845 and we granted one (by whatever means) - set the
1846 correct bit for core oplock reply.
1847 */
1848
1849 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1850 reply_outbuf(req, 19, 0);
1851 } else {
1852 reply_outbuf(req, 15, 0);
1853 }
1854
1855 if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1856 SCVAL(req->outbuf, smb_flg,
1857 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1858 }
1859
1860 if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1861 SCVAL(req->outbuf, smb_flg,
1862 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1863 }
1864
1865 SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1866 SSVAL(req->outbuf,smb_vwv3,fattr);
1867 if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1868 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1869 } else {
1870 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1871 }
1872 SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1873 SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1874 SSVAL(req->outbuf,smb_vwv11,smb_action);
1875
1876 if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1877 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1878 }
1879
1880 END_PROFILE(SMBopenX);
1881 chain_reply(req);
1882 return;
1883 }
1884
1885 /****************************************************************************
1886 Reply to a SMBulogoffX.
1887 ****************************************************************************/
1888
1889 void reply_ulogoffX(struct smb_request *req)
1890 {
1891 user_struct *vuser;
1892
1893 START_PROFILE(SMBulogoffX);
1894
1895 vuser = get_valid_user_struct(req->vuid);
1896
1897 if(vuser == NULL) {
1898 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1899 req->vuid));
1900 }
1901
1902 /* in user level security we are supposed to close any files
1903 open by this user */
1904 if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1905 file_close_user(req->vuid);
1906 }
1907
1908 invalidate_vuid(req->vuid);
1909
1910 reply_outbuf(req, 2, 0);
1911
1912 DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1913
1914 END_PROFILE(SMBulogoffX);
1915 chain_reply(req);
1916 }
1917
1918 /****************************************************************************
1919 Reply to a mknew or a create.
1920 ****************************************************************************/
1921
1922 void reply_mknew(struct smb_request *req)
1923 {
1924 connection_struct *conn = req->conn;
1925 char *fname = NULL;
1926 uint32 fattr = 0;
1927 struct smb_file_time ft;
1928 files_struct *fsp;
1929 int oplock_request = 0;
1930 SMB_STRUCT_STAT sbuf;
1931 NTSTATUS status;
1932 uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1933 uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1934 uint32 create_disposition;
1935 uint32 create_options = 0;
1936 TALLOC_CTX *ctx = talloc_tos();
1937
1938 START_PROFILE(SMBcreate);
1939 ZERO_STRUCT(ft);
1940
1941 if (req->wct < 3) {
1942 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1943 END_PROFILE(SMBcreate);
1944 return;
1945 }
1946
1947 fattr = SVAL(req->vwv+0, 0);
1948 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1949
1950 /* mtime. */
1951 ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
1952
1953 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
1954 STR_TERMINATE, &status);
1955 if (!NT_STATUS_IS_OK(status)) {
1956 reply_nterror(req, status);
1957 END_PROFILE(SMBcreate);
1958 return;
1959 }
1960
1961 if (fattr & aVOLID) {
1962 DEBUG(0,("Attempt to create file (%s) with volid set - "
1963 "please report this\n", fname));
1964 }
1965
1966 if(req->cmd == SMBmknew) {
1967 /* We should fail if file exists. */
1968 create_disposition = FILE_CREATE;
1969 } else {
1970 /* Create if file doesn't exist, truncate if it does. */
1971 create_disposition = FILE_OVERWRITE_IF;
1972 }
1973
1974 status = SMB_VFS_CREATE_FILE(
1975 conn, /* conn */
1976 req, /* req */
1977 0, /* root_dir_fid */
1978 fname, /* fname */
1979 CFF_DOS_PATH, /* create_file_flags */
1980 access_mask, /* access_mask */
1981 share_mode, /* share_access */
1982 create_disposition, /* create_disposition*/
1983 create_options, /* create_options */
1984 fattr, /* file_attributes */
1985 oplock_request, /* oplock_request */
1986 0, /* allocation_size */
1987 NULL, /* sd */
1988 NULL, /* ea_list */
1989 &fsp, /* result */
1990 NULL, /* pinfo */
1991 &sbuf); /* psbuf */
1992
1993 if (!NT_STATUS_IS_OK(status)) {
1994 END_PROFILE(SMBcreate);
1995 if (open_was_deferred(req->mid)) {
1996 /* We have re-scheduled this call. */
1997 return;
1998 }
1999 reply_openerror(req, status);
2000 return;
2001 }
2002
2003 ft.atime = get_atimespec(&sbuf); /* atime. */
2004 status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
2005 if (!NT_STATUS_IS_OK(status)) {
2006 END_PROFILE(SMBcreate);
2007 reply_openerror(req, status);
2008 return;
2009 }
2010
2011 reply_outbuf(req, 1, 0);
2012 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2013
2014 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2015 SCVAL(req->outbuf,smb_flg,
2016 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2017 }
2018
2019 if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2020 SCVAL(req->outbuf,smb_flg,
2021 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2022 }
2023
2024 DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2025 DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2026 fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2027
2028 END_PROFILE(SMBcreate);
2029 return;
2030 }
2031
2032 /****************************************************************************
2033 Reply to a create temporary file.
2034 ****************************************************************************/
2035
2036 void reply_ctemp(struct smb_request *req)
2037 {
2038 connection_struct *conn = req->conn;
2039 char *fname = NULL;
2040 uint32 fattr;
2041 files_struct *fsp;
2042 int oplock_request;
2043 int tmpfd;
2044 SMB_STRUCT_STAT sbuf;
2045 char *s;
2046 NTSTATUS status;
2047 TALLOC_CTX *ctx = talloc_tos();
2048
2049 START_PROFILE(SMBctemp);
2050
2051 if (req->wct < 3) {
2052 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2053 END_PROFILE(SMBctemp);
2054 return;
2055 }
2056
2057 fattr = SVAL(req->vwv+0, 0);
2058 oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2059
2060 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2061 STR_TERMINATE, &status);
2062 if (!NT_STATUS_IS_OK(status)) {
2063 reply_nterror(req, status);
2064 END_PROFILE(SMBctemp);
2065 return;
2066 }
2067 if (*fname) {
2068 fname = talloc_asprintf(ctx,
2069 "%s/TMXXXXXX",
2070 fname);
2071 } else {
2072 fname = talloc_strdup(ctx, "TMXXXXXX");
2073 }
2074
2075 if (!fname) {
2076 reply_nterror(req, NT_STATUS_NO_MEMORY);
2077 END_PROFILE(SMBctemp);
2078 return;
2079 }
2080
2081 status = resolve_dfspath(ctx, conn,
2082 req->flags2 & FLAGS2_DFS_PATHNAMES,
2083 fname,
2084 &fname);
2085 if (!NT_STATUS_IS_OK(status)) {
2086 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2087 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2088 ERRSRV, ERRbadpath);
2089 END_PROFILE(SMBctemp);
2090 return;
2091 }
2092 reply_nterror(req, status);
2093 END_PROFILE(SMBctemp);
2094 return;
2095 }
2096
2097 status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2098 if (!NT_STATUS_IS_OK(status)) {
2099 reply_nterror(req, status);
2100 END_PROFILE(SMBctemp);
2101 return;
2102 }
2103
2104 status = check_name(conn, fname);
2105 if (!NT_STATUS_IS_OK(status)) {
2106 reply_nterror(req, status);
2107 END_PROFILE(SMBctemp);
2108 return;
2109 }
2110
2111 tmpfd = smb_mkstemp(fname);
2112 if (tmpfd == -1) {
2113 reply_unixerror(req, ERRDOS, ERRnoaccess);
2114 END_PROFILE(SMBctemp);
2115 return;
2116 }
2117
2118 SMB_VFS_STAT(conn,fname,&sbuf);
2119
2120 /* We should fail if file does not exist. */
2121 status = SMB_VFS_CREATE_FILE(
2122 conn, /* conn */
2123 req, /* req */
2124 0, /* root_dir_fid */
2125 fname, /* fname */
2126 0, /* create_file_flags */
2127 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2128 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
2129 FILE_OPEN, /* create_disposition*/
2130 0, /* create_options */
2131 fattr, /* file_attributes */
2132 oplock_request, /* oplock_request */
2133 0, /* allocation_size */
2134 NULL, /* sd */
2135 NULL, /* ea_list */
2136 &fsp, /* result */
2137 NULL, /* pinfo */
2138 &sbuf); /* psbuf */
2139
2140 /* close fd from smb_mkstemp() */
2141 close(tmpfd);
2142
2143 if (!NT_STATUS_IS_OK(status)) {
2144 if (open_was_deferred(req->mid)) {
2145 /* We have re-scheduled this call. */
2146 END_PROFILE(SMBctemp);
2147 return;
2148 }
2149 reply_openerror(req, status);
2150 END_PROFILE(SMBctemp);
2151 return;
2152 }
2153
2154 reply_outbuf(req, 1, 0);
2155 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2156
2157 /* the returned filename is relative to the directory */
2158 s = strrchr_m(fsp->fsp_name, '/');
2159 if (!s) {
2160 s = fsp->fsp_name;
2161 } else {
2162 s++;
2163 }
2164
2165 #if 0
2166 /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2167 thing in the byte section. JRA */
2168 SSVALS(p, 0, -1); /* what is this? not in spec */
2169 #endif
2170 if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2171 == -1) {
2172 reply_nterror(req, NT_STATUS_NO_MEMORY);
2173 END_PROFILE(SMBctemp);
2174 return;
2175 }
2176
2177 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2178 SCVAL(req->outbuf, smb_flg,
2179 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2180 }
2181
2182 if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2183 SCVAL(req->outbuf, smb_flg,
2184 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2185 }
2186
2187 DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2188 DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2189 fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2190
2191 END_PROFILE(SMBctemp);
2192 return;
2193 }
2194
2195 /*******************************************************************
2196 Check if a user is allowed to rename a file.
2197 ********************************************************************/
2198
2199 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2200 uint16 dirtype, SMB_STRUCT_STAT *pst)
2201 {
2202 uint32 fmode;
2203
2204 if (!CAN_WRITE(conn)) {
2205 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2206 }
2207
2208 fmode = dos_mode(conn, fsp->fsp_name, pst);
2209 if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2210 return NT_STATUS_NO_SUCH_FILE;
2211 }
2212
2213 if (S_ISDIR(pst->st_mode)) {
2214 return NT_STATUS_OK;
2215 }
2216
2217 if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2218 return NT_STATUS_OK;
2219 }
2220
2221 return NT_STATUS_ACCESS_DENIED;
2222 }
2223
2224 /*******************************************************************
2225 * unlink a file with all relevant access checks
2226 *******************************************************************/
2227
2228 static NTSTATUS do_unlink(connection_struct *conn,
2229 struct smb_request *req,
2230 const char *fname,
2231 uint32 dirtype)
2232 {
2233 SMB_STRUCT_STAT sbuf;
2234 uint32 fattr;
2235 files_struct *fsp;
2236 uint32 dirtype_orig = dirtype;
2237 NTSTATUS status;
2238
2239 DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2240
2241 if (!CAN_WRITE(conn)) {
2242 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2243 }
2244
2245 if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2246 return map_nt_error_from_unix(errno);
2247 }
2248
2249 fattr = dos_mode(conn,fname,&sbuf);
2250
2251 if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2252 dirtype = aDIR|aARCH|aRONLY;
2253 }
2254
2255 dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2256 if (!dirtype) {
2257 return NT_STATUS_NO_SUCH_FILE;
2258 }
2259
2260 if (!dir_check_ftype(conn, fattr, dirtype)) {
2261 if (fattr & aDIR) {
2262 return NT_STATUS_FILE_IS_A_DIRECTORY;
2263 }
2264 return NT_STATUS_NO_SUCH_FILE;
2265 }
2266
2267 if (dirtype_orig & 0x8000) {
2268 /* These will never be set for POSIX. */
2269 return NT_STATUS_NO_SUCH_FILE;
2270 }
2271
2272 #if 0
2273 if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2274 return NT_STATUS_FILE_IS_A_DIRECTORY;
2275 }
2276
2277 if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2278 return NT_STATUS_NO_SUCH_FILE;
2279 }
2280
2281 if (dirtype & 0xFF00) {
2282 /* These will never be set for POSIX. */
2283 return NT_STATUS_NO_SUCH_FILE;
2284 }
2285
2286 dirtype &= 0xFF;
2287 if (!dirtype) {
2288 return NT_STATUS_NO_SUCH_FILE;
2289 }
2290
2291 /* Can't delete a directory. */
2292 if (fattr & aDIR) {
2293 return NT_STATUS_FILE_IS_A_DIRECTORY;
2294 }
2295 #endif
2296
2297 #if 0 /* JRATEST */
2298 else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2299 return NT_STATUS_OBJECT_NAME_INVALID;
2300 #endif /* JRATEST */
2301
2302 /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2303
2304 On a Windows share, a file with read-only dosmode can be opened with
2305 DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2306 fails with NT_STATUS_CANNOT_DELETE error.
2307
2308 This semantic causes a problem that a user can not
2309 rename a file with read-only dosmode on a Samba share
2310 from a Windows command prompt (i.e. cmd.exe, but can rename
2311 from Windows Explorer).
2312 */
2313
2314 if (!lp_delete_readonly(SNUM(conn))) {
2315 if (fattr & aRONLY) {
2316 return NT_STATUS_CANNOT_DELETE;
2317 }
2318 }
2319
2320 /* On open checks the open itself will check the share mode, so
2321 don't do it here as we'll get it wrong. */
2322
2323 status = SMB_VFS_CREATE_FILE
2324 (conn, /* conn */
2325 req, /* req */
2326 0, /* root_dir_fid */
2327 fname, /* fname */
2328 0, /* create_file_flags */
2329 DELETE_ACCESS, /* access_mask */
2330 FILE_SHARE_NONE, /* share_access */
2331 FILE_OPEN, /* create_disposition*/
2332 FILE_NON_DIRECTORY_FILE, /* create_options */
2333 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2334 0, /* oplock_request */
2335 0, /* allocation_size */
2336 NULL, /* sd */
2337 NULL, /* ea_list */
2338 &fsp, /* result */
2339 NULL, /* pinfo */
2340 &sbuf); /* psbuf */
2341
2342 if (!NT_STATUS_IS_OK(status)) {
2343 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2344 nt_errstr(status)));
2345 return status;
2346 }
2347
2348 /* The set is across all open files on this dev/inode pair. */
2349 if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2350 close_file(req, fsp, NORMAL_CLOSE);
2351 return NT_STATUS_ACCESS_DENIED;
2352 }
2353
2354 return close_file(req, fsp, NORMAL_CLOSE);
2355 }
2356
2357 /****************************************************************************
2358 The guts of the unlink command, split out so it may be called by the NT SMB
2359 code.
2360 ****************************************************************************/
2361
2362 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2363 uint32 dirtype, const char *name_in, bool has_wild)
2364 {
2365 const char *directory = NULL;
2366 char *mask = NULL;
2367 char *name = NULL;
2368 char *p = NULL;
2369 int count=0;
2370 NTSTATUS status = NT_STATUS_OK;
2371 SMB_STRUCT_STAT sbuf;
2372 TALLOC_CTX *ctx = talloc_tos();
2373
2374 status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2375 if (!NT_STATUS_IS_OK(status)) {
2376 return status;
2377 }
2378
2379 p = strrchr_m(name,'/');
2380 if (!p) {
2381 directory = talloc_strdup(ctx, ".");
2382 if (!directory) {
2383 return NT_STATUS_NO_MEMORY;
2384 }
2385 mask = name;
2386 } else {
2387 *p = 0;
2388 directory = name;
2389 mask = p+1;
2390 }
2391
2392 /*
2393 * We should only check the mangled cache
2394 * here if unix_convert failed. This means
2395 * that the path in 'mask' doesn't exist
2396 * on the file system and so we need to look
2397 * for a possible mangle. This patch from
2398 * Tine Smukavec <valentin.smukavec@hermes.si>.
2399 */
2400
2401 if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2402 char *new_mask = NULL;
2403 mangle_lookup_name_from_8_3(ctx,
2404 mask,
2405 &new_mask,
2406 conn->params );
2407 if (new_mask) {
2408 mask = new_mask;
2409 }
2410 }
2411
2412 if (!has_wild) {
2413 directory = talloc_asprintf(ctx,
2414 "%s/%s",
2415 directory,
2416 mask);
2417 if (!directory) {
2418 return NT_STATUS_NO_MEMORY;
2419 }
2420 if (dirtype == 0) {
2421 dirtype = FILE_ATTRIBUTE_NORMAL;
2422 }
2423
2424 status = check_name(conn, directory);
2425 if (!NT_STATUS_IS_OK(status)) {
2426 return status;
2427 }
2428
2429 status = do_unlink(conn, req, directory, dirtype);
2430 if (!NT_STATUS_IS_OK(status)) {
2431 return status;
2432 }
2433
2434 count++;
2435 } else {
2436 struct smb_Dir *dir_hnd = NULL;
2437 long offset = 0;
2438 const char *dname;
2439
2440 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2441 return NT_STATUS_OBJECT_NAME_INVALID;
2442 }
2443
2444 if (strequal(mask,"????????.???")) {
2445 mask[0] = '*';
2446 mask[1] = '\0';
2447 }
2448
2449 status = check_name(conn, directory);
2450 if (!NT_STATUS_IS_OK(status)) {
2451 return status;
2452 }
2453
2454 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2455 dirtype);
2456 if (dir_hnd == NULL) {
2457 return map_nt_error_from_unix(errno);
2458 }
2459
2460 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2461 the pattern matches against the long name, otherwise the short name
2462 We don't implement this yet XXXX
2463 */
2464
2465 status = NT_STATUS_NO_SUCH_FILE;
2466
2467 while ((dname = ReadDirName(dir_hnd, &offset))) {
2468 SMB_STRUCT_STAT st;
2469 char *fname = NULL;
2470
2471 if (!is_visible_file(conn, directory, dname, &st, True)) {
2472 continue;
2473 }
2474
2475 /* Quick check for "." and ".." */
2476 if (ISDOT(dname) || ISDOTDOT(dname)) {
2477 continue;
2478 }
2479
2480 if(!mask_match(dname, mask, conn->case_sensitive)) {
2481 continue;
2482 }
2483
2484 fname = talloc_asprintf(ctx, "%s/%s",
2485 directory,
2486 dname);
2487 if (!fname) {
2488 return NT_STATUS_NO_MEMORY;
2489 }
2490
2491 status = check_name(conn, fname);
2492 if (!NT_STATUS_IS_OK(status)) {
2493 TALLOC_FREE(dir_hnd);
2494 return status;
2495 }
2496
2497 status = do_unlink(conn, req, fname, dirtype);
2498 if (!NT_STATUS_IS_OK(status)) {
2499 TALLOC_FREE(fname);
2500 continue;
2501 }
2502
2503 count++;
2504 DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2505 fname));
2506
2507 TALLOC_FREE(fname);
2508 }
2509 TALLOC_FREE(dir_hnd);
2510 }
2511
2512 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2513 status = map_nt_error_from_unix(errno);
2514 }
2515
2516 return status;
2517 }
2518
2519 /****************************************************************************
2520 Reply to a unlink
2521 ****************************************************************************/
2522
2523 void reply_unlink(struct smb_request *req)
2524 {
2525 connection_struct *conn = req->conn;
2526 char *name = NULL;
2527 uint32 dirtype;
2528 NTSTATUS status;
2529 bool path_contains_wcard = False;
2530 TALLOC_CTX *ctx = talloc_tos();
2531
2532 START_PROFILE(SMBunlink);
2533
2534 if (req->wct < 1) {
2535 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2536 END_PROFILE(SMBunlink);
2537 return;
2538 }
2539
2540 dirtype = SVAL(req->vwv+0, 0);
2541
2542 srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2543 STR_TERMINATE, &status,
2544 &path_contains_wcard);
2545 if (!NT_STATUS_IS_OK(status)) {
2546 reply_nterror(req, status);
2547 END_PROFILE(SMBunlink);
2548 return;
2549 }
2550
2551 status = resolve_dfspath_wcard(ctx, conn,
2552 req->flags2 & FLAGS2_DFS_PATHNAMES,
2553 name,
2554 &name,
2555 &path_contains_wcard);
2556 if (!NT_STATUS_IS_OK(status)) {
2557 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2558 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2559 ERRSRV, ERRbadpath);
2560 END_PROFILE(SMBunlink);
2561 return;
2562 }
2563 reply_nterror(req, status);
2564 END_PROFILE(SMBunlink);
2565 return;
2566 }
2567
2568 DEBUG(3,("reply_unlink : %s\n",name));
2569
2570 status = unlink_internals(conn, req, dirtype, name,
2571 path_contains_wcard);
2572 if (!NT_STATUS_IS_OK(status)) {
2573 if (open_was_deferred(req->mid)) {
2574 /* We have re-scheduled this call. */
2575 END_PROFILE(SMBunlink);
2576 return;
2577 }
2578 reply_nterror(req, status);
2579 END_PROFILE(SMBunlink);
2580 return;
2581 }
2582
2583 reply_outbuf(req, 0, 0);
2584 END_PROFILE(SMBunlink);
2585
2586 return;
2587 }
2588
2589 /****************************************************************************
2590 Fail for readbraw.
2591 ****************************************************************************/
2592
2593 static void fail_readraw(void)
2594 {
2595 const char *errstr = talloc_asprintf(talloc_tos(),
2596 "FAIL ! reply_readbraw: socket write fail (%s)",
2597 strerror(errno));
2598 if (!errstr) {
2599 errstr = "";
2600 }
2601 exit_server_cleanly(errstr);
2602 }
2603
2604 /****************************************************************************
2605 Fake (read/write) sendfile. Returns -1 on read or write fail.
2606 ****************************************************************************/
2607
2608 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2609 size_t nread)
2610 {
2611 size_t bufsize;
2612 size_t tosend = nread;
2613 char *buf;
2614
2615 if (nread == 0) {
2616 return 0;
2617 }
2618
2619 bufsize = MIN(nread, 65536);
2620
2621 if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2622 return -1;
2623 }
2624
2625 while (tosend > 0) {
2626 ssize_t ret;
2627 size_t cur_read;
2628
2629 if (tosend > bufsize) {
2630 cur_read = bufsize;
2631 } else {
2632 cur_read = tosend;
2633 }
2634 ret = read_file(fsp,buf,startpos,cur_read);
2635 if (ret == -1) {
2636 SAFE_FREE(buf);
2637 return -1;
2638 }
2639
2640 /* If we had a short read, fill with zeros. */
2641 if (ret < cur_read) {
2642 memset(buf, '\0', cur_read - ret);
2643 }
2644
2645 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2646 SAFE_FREE(buf);
2647 return -1;
2648 }
2649 tosend -= cur_read;
2650 startpos += cur_read;
2651 }
2652
2653 SAFE_FREE(buf);
2654 return (ssize_t)nread;
2655 }
2656
2657 /****************************************************************************
2658 Deal with the case of sendfile reading less bytes from the file than
2659 requested. Fill with zeros (all we can do).
2660 ****************************************************************************/
2661
2662 static void sendfile_short_send(files_struct *fsp,
2663 ssize_t nread,
2664 size_t headersize,
2665 size_t smb_maxcnt)
2666 {
2667 if (nread < headersize) {
2668 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2669 "header for file %s (%s). Terminating\n",
2670 fsp->fsp_name, strerror(errno) ));
2671 exit_server_cleanly("sendfile_short_send failed");
2672 }
2673
2674 nread -= headersize;
2675
2676 if (nread < smb_maxcnt) {
2677 char *buf = SMB_CALLOC_ARRAY(char, 1024);
2678 if (!buf) {
2679 exit_server_cleanly("sendfile_short_send: "
2680 "malloc failed");
2681 }
2682
2683 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2684 "with zeros !\n", fsp->fsp_name));
2685
2686 while (nread < smb_maxcnt) {
2687 /*
2688 * We asked for the real file size and told sendfile
2689 * to not go beyond the end of the file. But it can
2690 * happen that in between our fstat call and the
2691 * sendfile call the file was truncated. This is very
2692 * bad because we have already announced the larger
2693 * number of bytes to the client.
2694 *
2695 * The best we can do now is to send 0-bytes, just as
2696 * a read from a hole in a sparse file would do.
2697 *
2698 * This should happen rarely enough that I don't care
2699 * about efficiency here :-)
2700 */
2701 size_t to_write;
2702
2703 to_write = MIN(sizeof(buf), smb_maxcnt - nread);
2704 if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2705 exit_server_cleanly("sendfile_short_send: "
2706 "write_data failed");
2707 }
2708 nread += to_write;
2709 }
2710 SAFE_FREE(buf);
2711 }
2712 }
2713
2714 /****************************************************************************
2715 Return a readbraw error (4 bytes of zero).
2716 ****************************************************************************/
2717
2718 static void reply_readbraw_error(void)
2719 {
2720 char header[4];
2721 SIVAL(header,0,0);
2722 if (write_data(smbd_server_fd(),header,4) != 4) {
2723 fail_readraw();
2724 }
2725 }
2726
2727 /****************************************************************************
2728 Use sendfile in readbraw.
2729 ****************************************************************************/
2730
2731 static void send_file_readbraw(connection_struct *conn,
2732 struct smb_request *req,
2733 files_struct *fsp,
2734 SMB_OFF_T startpos,
2735 size_t nread,
2736 ssize_t mincount)
2737 {
2738 char *outbuf = NULL;
2739 ssize_t ret=0;
2740
2741 #if defined(WITH_SENDFILE)
2742 /*
2743 * We can only use sendfile on a non-chained packet
2744 * but we can use on a non-oplocked file. tridge proved this
2745 * on a train in Germany :-). JRA.
2746 * reply_readbraw has already checked the length.
2747 */
2748
2749 if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2750 (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2751 ssize_t sendfile_read = -1;
2752 char header[4];
2753 DATA_BLOB header_blob;
2754
2755 _smb_setlen(header,nread);
2756 header_blob = data_blob_const(header, 4);
2757
2758 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2759 &header_blob, startpos, nread)) == -1) {
2760 /* Returning ENOSYS means no data at all was sent.
2761 * Do this as a normal read. */
2762 if (errno == ENOSYS) {
2763 goto normal_readbraw;
2764 }
2765
2766 /*
2767 * Special hack for broken Linux with no working sendfile. If we
2768 * return EINTR we sent the header but not the rest of the data.
2769 * Fake this up by doing read/write calls.
2770 */
2771 if (errno == EINTR) {
2772 /* Ensure we don't do this again. */
2773 set_use_sendfile(SNUM(conn), False);
2774 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2775
2776 if (fake_sendfile(fsp, startpos, nread) == -1) {
2777 DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2778 fsp->fsp_name, strerror(errno) ));
2779 exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2780 }
2781 return;
2782 }
2783
2784 DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2785 fsp->fsp_name, strerror(errno) ));
2786 exit_server_cleanly("send_file_readbraw sendfile failed");
2787 }
2788
2789 /* Deal with possible short send. */
2790 if (sendfile_read != 4+nread) {
2791 sendfile_short_send(fsp, sendfile_read, 4, nread);
2792 }
2793 return;
2794 }
2795 #endif
2796
2797 normal_readbraw:
2798
2799 outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2800 if (!outbuf) {
2801 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2802 (unsigned)(nread+4)));
2803 reply_readbraw_error();
2804 return;
2805 }
2806
2807 if (nread > 0) {
2808 ret = read_file(fsp,outbuf+4,startpos,nread);
2809 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2810 if (ret < mincount)
2811 ret = 0;
2812 #else
2813 if (ret < nread)
2814 ret = 0;
2815 #endif
2816 }
2817
2818 _smb_setlen(outbuf,ret);
2819 if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2820 fail_readraw();
2821
2822 TALLOC_FREE(outbuf);
2823 }
2824
2825 /****************************************************************************
2826 Reply to a readbraw (core+ protocol).
2827 ****************************************************************************/
2828
2829 void reply_readbraw(struct smb_request *req)
2830 {
2831 connection_struct *conn = req->conn;
2832 ssize_t maxcount,mincount;
2833 size_t nread = 0;
2834 SMB_OFF_T startpos;
2835 files_struct *fsp;
2836 SMB_STRUCT_STAT st;
2837 SMB_OFF_T size = 0;
2838
2839 START_PROFILE(SMBreadbraw);
2840
2841 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2842 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2843 "raw reads/writes are disallowed.");
2844 }
2845
2846 if (req->wct < 8) {
2847 reply_readbraw_error();
2848 END_PROFILE(SMBreadbraw);
2849 return;
2850 }
2851
2852 /*
2853 * Special check if an oplock break has been issued
2854 * and the readraw request croses on the wire, we must
2855 * return a zero length response here.
2856 */
2857
2858 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
2859
2860 /*
2861 * We have to do a check_fsp by hand here, as
2862 * we must always return 4 zero bytes on error,
2863 * not a NTSTATUS.
2864 */
2865
2866 if (!fsp || !conn || conn != fsp->conn ||
2867 req->vuid != fsp->vuid ||
2868 fsp->is_directory || fsp->fh->fd == -1) {
2869 /*
2870 * fsp could be NULL here so use the value from the packet. JRA.
2871 */
2872 DEBUG(3,("reply_readbraw: fnum %d not valid "
2873 "- cache prime?\n",
2874 (int)SVAL(req->vwv+0, 0)));
2875 reply_readbraw_error();
2876 END_PROFILE(SMBreadbraw);
2877 return;
2878 }
2879
2880 /* Do a "by hand" version of CHECK_READ. */
2881 if (!(fsp->can_read ||
2882 ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2883 (fsp->access_mask & FILE_EXECUTE)))) {
2884 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2885 (int)SVAL(req->vwv+0, 0)));
2886 reply_readbraw_error();
2887 END_PROFILE(SMBreadbraw);
2888 return;
2889 }
2890
2891 flush_write_cache(fsp, READRAW_FLUSH);
2892
2893 startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
2894 if(req->wct == 10) {
2895 /*
2896 * This is a large offset (64 bit) read.
2897 */
2898 #ifdef LARGE_SMB_OFF_T
2899
2900 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
2901
2902 #else /* !LARGE_SMB_OFF_T */
2903
2904 /*
2905 * Ensure we haven't been sent a >32 bit offset.
2906 */
2907
2908 if(IVAL(req->vwv+8, 0) != 0) {
2909 DEBUG(0,("reply_readbraw: large offset "
2910 "(%x << 32) used and we don't support "
2911 "64 bit offsets.\n",
2912 (unsigned int)IVAL(req->vwv+8, 0) ));
2913 reply_readbraw_error();
2914 END_PROFILE(SMBreadbraw);
2915 return;
2916 }
2917
2918 #endif /* LARGE_SMB_OFF_T */
2919
2920 if(startpos < 0) {
2921 DEBUG(0,("reply_readbraw: negative 64 bit "
2922 "readraw offset (%.0f) !\n",
2923 (double)startpos ));
2924 reply_readbraw_error();
2925 END_PROFILE(SMBreadbraw);
2926 return;
2927 }
2928 }
2929
2930 maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
2931 mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
2932
2933 /* ensure we don't overrun the packet size */
2934 maxcount = MIN(65535,maxcount);
2935
2936 if (is_locked(fsp,(uint32)req->smbpid,
2937 (uint64_t)maxcount,
2938 (uint64_t)startpos,
2939 READ_LOCK)) {
2940 reply_readbraw_error();
2941 END_PROFILE(SMBreadbraw);
2942 return;
2943 }
2944
2945 if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2946 size = st.st_size;
2947 }
2948
2949 if (startpos >= size) {
2950 nread = 0;
2951 } else {
2952 nread = MIN(maxcount,(size - startpos));
2953 }
2954
2955 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2956 if (nread < mincount)
2957 nread = 0;
2958 #endif
2959
2960 DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2961 "min=%lu nread=%lu\n",
2962 fsp->fnum, (double)startpos,
2963 (unsigned long)maxcount,
2964 (unsigned long)mincount,
2965 (unsigned long)nread ) );
2966
2967 send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
2968
2969 DEBUG(5,("reply_readbraw finished\n"));
2970 END_PROFILE(SMBreadbraw);
2971 }
2972
2973 #undef DBGC_CLASS
2974 #define DBGC_CLASS DBGC_LOCKING
2975
2976 /****************************************************************************
2977 Reply to a lockread (core+ protocol).
2978 ****************************************************************************/
2979
2980 void reply_lockread(struct smb_request *req)
2981 {
2982 connection_struct *conn = req->conn;
2983 ssize_t nread = -1;
2984 char *data;
2985 SMB_OFF_T startpos;
2986 size_t numtoread;
2987 NTSTATUS status;
2988 files_struct *fsp;
2989 struct byte_range_lock *br_lck = NULL;
2990 char *p = NULL;
2991
2992 START_PROFILE(SMBlockread);
2993
2994 if (req->wct < 5) {
2995 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2996 END_PROFILE(SMBlockread);
2997 return;
2998 }
2999
3000 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3001
3002 if (!check_fsp(conn, req, fsp)) {
3003 END_PROFILE(SMBlockread);
3004 return;
3005 }
3006
3007 if (!CHECK_READ(fsp,req)) {
3008 reply_doserror(req, ERRDOS, ERRbadaccess);
3009 END_PROFILE(SMBlockread);
3010 return;
3011 }
3012
3013 release_level_2_oplocks_on_change(fsp);
3014
3015 numtoread = SVAL(req->vwv+1, 0);
3016 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3017
3018 numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3019
3020 reply_outbuf(req, 5, numtoread + 3);
3021
3022 data = smb_buf(req->outbuf) + 3;
3023
3024 /*
3025 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3026 * protocol request that predates the read/write lock concept.
3027 * Thus instead of asking for a read lock here we need to ask
3028 * for a write lock. JRA.
3029 * Note that the requested lock size is unaffected by max_recv.
3030 */
3031
3032 br_lck = do_lock(smbd_messaging_context(),
3033 fsp,
3034 req->smbpid,
3035 (uint64_t)numtoread,
3036 (uint64_t)startpos,
3037 WRITE_LOCK,
3038 WINDOWS_LOCK,
3039 False, /* Non-blocking lock. */
3040 &status,
3041 NULL);
3042 TALLOC_FREE(br_lck);
3043
3044 if (NT_STATUS_V(status)) {
3045 reply_nterror(req, status);
3046 END_PROFILE(SMBlockread);
3047 return;
3048 }
3049
3050 /*
3051 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3052 */
3053
3054 if (numtoread > max_recv) {
3055 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3056 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3057 (unsigned int)numtoread, (unsigned int)max_recv ));
3058 numtoread = MIN(numtoread,max_recv);
3059 }
3060 nread = read_file(fsp,data,startpos,numtoread);
3061
3062 if (nread < 0) {
3063 reply_unixerror(req, ERRDOS, ERRnoaccess);
3064 END_PROFILE(SMBlockread);
3065 return;
3066 }
3067
3068 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3069
3070 SSVAL(req->outbuf,smb_vwv0,nread);
3071 SSVAL(req->outbuf,smb_vwv5,nread+3);
3072 p = smb_buf(req->outbuf);
3073 SCVAL(p,0,0); /* pad byte. */
3074 SSVAL(p,1,nread);
3075
3076 DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3077 fsp->fnum, (int)numtoread, (int)nread));
3078
3079 END_PROFILE(SMBlockread);
3080 return;
3081 }
3082
3083 #undef DBGC_CLASS
3084 #define DBGC_CLASS DBGC_ALL
3085
3086 /****************************************************************************
3087 Reply to a read.
3088 ****************************************************************************/
3089
3090 void reply_read(struct smb_request *req)
3091 {
3092 connection_struct *conn = req->conn;
3093 size_t numtoread;
3094 ssize_t nread = 0;
3095 char *data;
3096 SMB_OFF_T startpos;
3097 int outsize = 0;
3098 files_struct *fsp;
3099
3100 START_PROFILE(SMBread);
3101
3102 if (req->wct < 3) {
3103 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3104 END_PROFILE(SMBread);
3105 return;
3106 }
3107
3108 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3109
3110 if (!check_fsp(conn, req, fsp)) {
3111 END_PROFILE(SMBread);
3112 return;
3113 }
3114
3115 if (!CHECK_READ(fsp,req)) {
3116 reply_doserror(req, ERRDOS, ERRbadaccess);
3117 END_PROFILE(SMBread);
3118 return;
3119 }
3120
3121 numtoread = SVAL(req->vwv+1, 0);
3122 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3123
3124 numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3125
3126 /*
3127 * The requested read size cannot be greater than max_recv. JRA.
3128 */
3129 if (numtoread > max_recv) {
3130 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3131 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3132 (unsigned int)numtoread, (unsigned int)max_recv ));
3133 numtoread = MIN(numtoread,max_recv);
3134 }
3135
3136 reply_outbuf(req, 5, numtoread+3);
3137
3138 data = smb_buf(req->outbuf) + 3;
3139
3140 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtoread,
3141 (uint64_t)startpos, READ_LOCK)) {
3142 reply_doserror(req, ERRDOS,ERRlock);
3143 END_PROFILE(SMBread);
3144 return;
3145 }
3146
3147 if (numtoread > 0)
3148 nread = read_file(fsp,data,startpos,numtoread);
3149
3150 if (nread < 0) {
3151 reply_unixerror(req, ERRDOS,ERRnoaccess);
3152 END_PROFILE(SMBread);
3153 return;
3154 }
3155
3156 srv_set_message((char *)req->outbuf, 5, nread+3, False);
3157
3158 SSVAL(req->outbuf,smb_vwv0,nread);
3159 SSVAL(req->outbuf,smb_vwv5,nread+3);
3160 SCVAL(smb_buf(req->outbuf),0,1);
3161 SSVAL(smb_buf(req->outbuf),1,nread);
3162
3163 DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3164 fsp->fnum, (int)numtoread, (int)nread ) );
3165
3166 END_PROFILE(SMBread);
3167 return;
3168 }
3169
3170 /****************************************************************************
3171 Setup readX header.
3172 ****************************************************************************/
3173
3174 static int setup_readX_header(struct smb_request *req, char *outbuf,
3175 size_t smb_maxcnt)
3176 {
3177 int outsize;
3178 char *data;
3179
3180 outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3181 data = smb_buf(outbuf);
3182
3183 memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3184
3185 SCVAL(outbuf,smb_vwv0,0xFF);
3186 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3187 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3188 SSVAL(outbuf,smb_vwv6,
3189 req_wct_ofs(req)
3190 + 1 /* the wct field */
3191 + 12 * sizeof(uint16_t) /* vwv */
3192 + 2); /* the buflen field */
3193 SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3194 SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3195 /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3196 _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3197 return outsize;
3198 }
3199
3200 /****************************************************************************
3201 Reply to a read and X - possibly using sendfile.
3202 ****************************************************************************/
3203
3204 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3205 files_struct *fsp, SMB_OFF_T startpos,
3206 size_t smb_maxcnt)
3207 {
3208 SMB_STRUCT_STAT sbuf;
3209 ssize_t nread = -1;
3210
3211 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3212 reply_unixerror(req, ERRDOS, ERRnoaccess);
3213 return;
3214 }
3215
3216 if (startpos > sbuf.st_size) {
3217 smb_maxcnt = 0;
3218 } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3219 smb_maxcnt = (sbuf.st_size - startpos);
3220 }
3221
3222 if (smb_maxcnt == 0) {
3223 goto normal_read;
3224 }
3225
3226 #if defined(WITH_SENDFILE)
3227 /*
3228 * We can only use sendfile on a non-chained packet
3229 * but we can use on a non-oplocked file. tridge proved this
3230 * on a train in Germany :-). JRA.
3231 */
3232
3233 if (!req_is_in_chain(req) &&
3234 !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3235 lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3236 uint8 headerbuf[smb_size + 12 * 2];
3237 DATA_BLOB header;
3238
3239 /*
3240 * Set up the packet header before send. We
3241 * assume here the sendfile will work (get the
3242 * correct amount of data).
3243 */
3244
3245 header = data_blob_const(headerbuf, sizeof(headerbuf));
3246
3247 construct_reply_common_req(req, (char *)headerbuf);
3248 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3249
3250 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3251 /* Returning ENOSYS means no data at all was sent.
3252 Do this as a normal read. */
3253 if (errno == ENOSYS) {
3254 goto normal_read;
3255 }
3256
3257 /*
3258 * Special hack for broken Linux with no working sendfile. If we
3259 * return EINTR we sent the header but not the rest of the data.
3260 * Fake this up by doing read/write calls.
3261 */
3262
3263 if (errno == EINTR) {
3264 /* Ensure we don't do this again. */
3265 set_use_sendfile(SNUM(conn), False);
3266 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3267 nread = fake_sendfile(fsp, startpos,
3268 smb_maxcnt);
3269 if (nread == -1) {
3270 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3271 fsp->fsp_name, strerror(errno) ));
3272 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3273 }
3274 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3275 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3276 /* No outbuf here means successful sendfile. */
3277 TALLOC_FREE(req->outbuf);
3278 return;
3279 }
3280
3281 DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3282 fsp->fsp_name, strerror(errno) ));
3283 exit_server_cleanly("send_file_readX sendfile failed");
3284 }
3285
3286 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3287 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3288
3289 /* Deal with possible short send. */
3290 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3291 sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3292 }
3293
3294 /* No outbuf here means successful sendfile. */
3295 TALLOC_FREE(req->outbuf);
3296 return;
3297 }
3298 #endif
3299
3300 normal_read:
3301
3302 if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3303 uint8 headerbuf[smb_size + 2*12];
3304
3305 construct_reply_common_req(req, (char *)headerbuf);
3306 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3307
3308 /* Send out the header. */
3309 if (write_data(smbd_server_fd(), (char *)headerbuf,
3310 sizeof(headerbuf)) != sizeof(headerbuf)) {
3311 DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3312 fsp->fsp_name, strerror(errno) ));
3313 exit_server_cleanly("send_file_readX sendfile failed");
3314 }
3315 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3316 if (nread == -1) {
3317 DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3318 fsp->fsp_name, strerror(errno) ));
3319 exit_server_cleanly("send_file_readX: fake_sendfile failed");
3320 }
3321 TALLOC_FREE(req->outbuf);
3322 return;
3323 }
3324
3325 reply_outbuf(req, 12, smb_maxcnt);
3326
3327 nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3328 if (nread < 0) {
3329 reply_unixerror(req, ERRDOS, ERRnoaccess);
3330 return;
3331 }
3332
3333 setup_readX_header(req, (char *)req->outbuf, nread);
3334
3335 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3336 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3337
3338 chain_reply(req);
3339 }
3340
3341 /****************************************************************************
3342 Reply to a read and X.
3343 ****************************************************************************/
3344
3345 void reply_read_and_X(struct smb_request *req)
3346 {
3347 connection_struct *conn = req->conn;
3348 files_struct *fsp;
3349 SMB_OFF_T startpos;
3350 size_t smb_maxcnt;
3351 bool big_readX = False;
3352 #if 0
3353 size_t smb_mincnt = SVAL(req->vwv+6, 0);
3354 #endif
3355
3356 START_PROFILE(SMBreadX);
3357
3358 if ((req->wct != 10) && (req->wct != 12)) {
3359 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3360 return;
3361 }
3362
3363 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3364 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3365 smb_maxcnt = SVAL(req->vwv+5, 0);
3366
3367 /* If it's an IPC, pass off the pipe handler. */
3368 if (IS_IPC(conn)) {
3369 reply_pipe_read_and_X(req);
3370 END_PROFILE(SMBreadX);
3371 return;
3372 }
3373
3374 if (!check_fsp(conn, req, fsp)) {
3375 END_PROFILE(SMBreadX);
3376 return;
3377 }
3378
3379 if (!CHECK_READ(fsp,req)) {
3380 reply_doserror(req, ERRDOS,ERRbadaccess);
3381 END_PROFILE(SMBreadX);
3382 return;
3383 }
3384
3385 if (global_client_caps & CAP_LARGE_READX) {
3386 size_t upper_size = SVAL(req->vwv+7, 0);
3387 smb_maxcnt |= (upper_size<<16);
3388 if (upper_size > 1) {
3389 /* Can't do this on a chained packet. */
3390 if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3391 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3392 END_PROFILE(SMBreadX);
3393 return;
3394 }
3395 /* We currently don't do this on signed or sealed data. */
3396 if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3397 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3398 END_PROFILE(SMBreadX);
3399 return;
3400 }
3401 /* Is there room in the reply for this data ? */
3402 if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3403 reply_nterror(req,
3404 NT_STATUS_INVALID_PARAMETER);
3405 END_PROFILE(SMBreadX);
3406 return;
3407 }
3408 big_readX = True;
3409 }
3410 }
3411
3412 if (req->wct == 12) {
3413 #ifdef LARGE_SMB_OFF_T
3414 /*
3415 * This is a large offset (64 bit) read.
3416 */
3417 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3418
3419 #else /* !LARGE_SMB_OFF_T */
3420
3421 /*
3422 * Ensure we haven't been sent a >32 bit offset.
3423 */
3424
3425 if(IVAL(req->vwv+10, 0) != 0) {
3426 DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3427 "used and we don't support 64 bit offsets.\n",
3428 (unsigned int)IVAL(req->vwv+10, 0) ));
3429 END_PROFILE(SMBreadX);
3430 reply_doserror(req, ERRDOS, ERRbadaccess);
3431 return;
3432 }
3433
3434 #endif /* LARGE_SMB_OFF_T */
3435
3436 }
3437
3438 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)smb_maxcnt,
3439 (uint64_t)startpos, READ_LOCK)) {
3440 END_PROFILE(SMBreadX);
3441 reply_doserror(req, ERRDOS, ERRlock);
3442 return;
3443 }
3444
3445 if (!big_readX &&
3446 schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3447 END_PROFILE(SMBreadX);
3448 return;
3449 }
3450
3451 send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3452
3453 END_PROFILE(SMBreadX);
3454 return;
3455 }
3456
3457 /****************************************************************************
3458 Error replies to writebraw must have smb_wct == 1. Fix this up.
3459 ****************************************************************************/
3460
3461 void error_to_writebrawerr(struct smb_request *req)
3462 {
3463 uint8 *old_outbuf = req->outbuf;
3464
3465 reply_outbuf(req, 1, 0);
3466
3467 memcpy(req->outbuf, old_outbuf, smb_size);
3468 TALLOC_FREE(old_outbuf);
3469 }
3470
3471 /****************************************************************************
3472 Reply to a writebraw (core+ or LANMAN1.0 protocol).
3473 ****************************************************************************/
3474
3475 void reply_writebraw(struct smb_request *req)
3476 {
3477 connection_struct *conn = req->conn;
3478 char *buf = NULL;
3479 ssize_t nwritten=0;
3480 ssize_t total_written=0;
3481 size_t numtowrite=0;
3482 size_t tcount;
3483 SMB_OFF_T startpos;
3484 char *data=NULL;
3485 bool write_through;
3486 files_struct *fsp;
3487 NTSTATUS status;
3488
3489 START_PROFILE(SMBwritebraw);
3490
3491 /*
3492 * If we ever reply with an error, it must have the SMB command
3493 * type of SMBwritec, not SMBwriteBraw, as this tells the client
3494 * we're finished.
3495 */
3496 SCVAL(req->inbuf,smb_com,SMBwritec);
3497
3498 if (srv_is_signing_active()) {
3499 END_PROFILE(SMBwritebraw);
3500 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3501 "raw reads/writes are disallowed.");
3502 }
3503
3504 if (req->wct < 12) {
3505 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3506 error_to_writebrawerr(req);
3507 END_PROFILE(SMBwritebraw);
3508 return;
3509 }
3510
3511 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3512 if (!check_fsp(conn, req, fsp)) {
3513 error_to_writebrawerr(req);
3514 END_PROFILE(SMBwritebraw);
3515 return;
3516 }
3517
3518 if (!CHECK_WRITE(fsp)) {
3519 reply_doserror(req, ERRDOS, ERRbadaccess);
3520 error_to_writebrawerr(req);
3521 END_PROFILE(SMBwritebraw);
3522 return;
3523 }
3524
3525 tcount = IVAL(req->vwv+1, 0);
3526 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3527 write_through = BITSETW(req->vwv+7,0);
3528
3529 /* We have to deal with slightly different formats depending
3530 on whether we are using the core+ or lanman1.0 protocol */
3531
3532 if(Protocol <= PROTOCOL_COREPLUS) {
3533 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3534 data = smb_buf(req->inbuf);
3535 } else {
3536 numtowrite = SVAL(req->vwv+10, 0);
3537 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3538 }
3539
3540 /* Ensure we don't write bytes past the end of this packet. */
3541 if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3542 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3543 error_to_writebrawerr(req);
3544 END_PROFILE(SMBwritebraw);
3545 return;
3546 }
3547
3548 if (is_locked(fsp,(uint32)req->smbpid,(uint64_t)tcount,
3549 (uint64_t)startpos, WRITE_LOCK)) {
3550 reply_doserror(req, ERRDOS, ERRlock);
3551 error_to_writebrawerr(req);
3552 END_PROFILE(SMBwritebraw);
3553 return;
3554 }
3555
3556 if (numtowrite>0) {
3557 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3558 }
3559
3560 DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3561 "wrote=%d sync=%d\n",
3562 fsp->fnum, (double)startpos, (int)numtowrite,
3563 (int)nwritten, (int)write_through));
3564
3565 if (nwritten < (ssize_t)numtowrite) {
3566 reply_unixerror(req, ERRHRD, ERRdiskfull);
3567 error_to_writebrawerr(req);
3568 END_PROFILE(SMBwritebraw);
3569 return;
3570 }
3571
3572 total_written = nwritten;
3573
3574 /* Allocate a buffer of 64k + length. */
3575 buf = TALLOC_ARRAY(NULL, char, 65540);
3576 if (!buf) {
3577 reply_doserror(req, ERRDOS, ERRnomem);
3578 error_to_writebrawerr(req);
3579 END_PROFILE(SMBwritebraw);
3580 return;
3581 }
3582
3583 /* Return a SMBwritebraw message to the redirector to tell
3584 * it to send more bytes */
3585
3586 memcpy(buf, req->inbuf, smb_size);
3587 srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3588 SCVAL(buf,smb_com,SMBwritebraw);
3589 SSVALS(buf,smb_vwv0,0xFFFF);
3590 show_msg(buf);
3591 if (!srv_send_smb(smbd_server_fd(),
3592 buf,
3593 IS_CONN_ENCRYPTED(conn))) {
3594 exit_server_cleanly("reply_writebraw: srv_send_smb "
3595 "failed.");
3596 }
3597
3598 /* Now read the raw data into the buffer and write it */
3599 status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3600 &numtowrite);
3601 if (!NT_STATUS_IS_OK(status)) {
3602 exit_server_cleanly("secondary writebraw failed");
3603 }
3604
3605 /* Set up outbuf to return the correct size */
3606 reply_outbuf(req, 1, 0);
3607
3608 if (numtowrite != 0) {
3609
3610 if (numtowrite > 0xFFFF) {
3611 DEBUG(0,("reply_writebraw: Oversize secondary write "
3612 "raw requested (%u). Terminating\n",
3613 (unsigned int)numtowrite ));
3614 exit_server_cleanly("secondary writebraw failed");
3615 }
3616
3617 if (tcount > nwritten+numtowrite) {
3618 DEBUG(3,("reply_writebraw: Client overestimated the "
3619 "write %d %d %d\n",
3620 (int)tcount,(int)nwritten,(int)numtowrite));
3621 }
3622
3623 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3624
3625 if (!NT_STATUS_IS_OK(status)) {
3626 DEBUG(0,("reply_writebraw: Oversize secondary write "
3627 "raw read failed (%s). Terminating\n",
3628 nt_errstr(status)));
3629 exit_server_cleanly("secondary writebraw failed");
3630 }
3631
3632 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3633 if (nwritten == -1) {
3634 TALLOC_FREE(buf);
3635 reply_unixerror(req, ERRHRD, ERRdiskfull);
3636 error_to_writebrawerr(req);
3637 END_PROFILE(SMBwritebraw);
3638 return;
3639 }
3640
3641 if (nwritten < (ssize_t)numtowrite) {
3642 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3643 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3644 }
3645
3646 if (nwritten > 0) {
3647 total_written += nwritten;
3648 }
3649 }
3650
3651 TALLOC_FREE(buf);
3652 SSVAL(req->outbuf,smb_vwv0,total_written);
3653
3654 status = sync_file(conn, fsp, write_through);
3655 if (!NT_STATUS_IS_OK(status)) {
3656 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3657 fsp->fsp_name, nt_errstr(status) ));
3658 reply_nterror(req, status);
3659 error_to_writebrawerr(req);
3660 END_PROFILE(SMBwritebraw);
3661 return;
3662 }
3663
3664 DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3665 "wrote=%d\n",
3666 fsp->fnum, (double)startpos, (int)numtowrite,
3667 (int)total_written));
3668
3669 /* We won't return a status if write through is not selected - this
3670 * follows what WfWg does */
3671 END_PROFILE(SMBwritebraw);
3672
3673 if (!write_through && total_written==tcount) {
3674
3675 #if RABBIT_PELLET_FIX
3676 /*
3677 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3678 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3679 * JRA.
3680 */
3681 if (!send_keepalive(smbd_server_fd())) {
3682 exit_server_cleanly("reply_writebraw: send of "
3683 "keepalive failed");
3684 }
3685 #endif
3686 TALLOC_FREE(req->outbuf);
3687 }
3688 return;
3689 }
3690
3691 #undef DBGC_CLASS
3692 #define DBGC_CLASS DBGC_LOCKING
3693
3694 /****************************************************************************
3695 Reply to a writeunlock (core+).
3696 ****************************************************************************/
3697
3698 void reply_writeunlock(struct smb_request *req)
3699 {
3700 connection_struct *conn = req->conn;
3701 ssize_t nwritten = -1;
3702 size_t numtowrite;
3703 SMB_OFF_T startpos;
3704 const char *data;
3705 NTSTATUS status = NT_STATUS_OK;
3706 files_struct *fsp;
3707
3708 START_PROFILE(SMBwriteunlock);
3709
3710 if (req->wct < 5) {
3711 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3712 END_PROFILE(SMBwriteunlock);
3713 return;
3714 }
3715
3716 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3717
3718 if (!check_fsp(conn, req, fsp)) {
3719 END_PROFILE(SMBwriteunlock);
3720 return;
3721 }
3722
3723 if (!CHECK_WRITE(fsp)) {
3724 reply_doserror(req, ERRDOS,ERRbadaccess);
3725 END_PROFILE(SMBwriteunlock);
3726 return;
3727 }
3728
3729 numtowrite = SVAL(req->vwv+1, 0);
3730 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3731 data = (const char *)req->buf + 3;
3732
3733 if (numtowrite
3734 && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
3735 (uint64_t)startpos, WRITE_LOCK)) {
3736 reply_doserror(req, ERRDOS, ERRlock);
3737 END_PROFILE(SMBwriteunlock);
3738 return;
3739 }
3740
3741 /* The special X/Open SMB protocol handling of
3742 zero length writes is *NOT* done for
3743 this call */
3744 if(numtowrite == 0) {
3745 nwritten = 0;
3746 } else {
3747 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3748 }
3749
3750 status = sync_file(conn, fsp, False /* write through */);
3751 if (!NT_STATUS_IS_OK(status)) {
3752 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3753 fsp->fsp_name, nt_errstr(status) ));
3754 reply_nterror(req, status);
3755 END_PROFILE(SMBwriteunlock);
3756 return;
3757 }
3758
3759 if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3760 reply_unixerror(req, ERRHRD, ERRdiskfull);
3761 END_PROFILE(SMBwriteunlock);
3762 return;
3763 }
3764
3765 if (numtowrite) {
3766 status = do_unlock(smbd_messaging_context(),
3767 fsp,
3768 req->smbpid,
3769 (uint64_t)numtowrite,
3770 (uint64_t)startpos,
3771 WINDOWS_LOCK);
3772
3773 if (NT_STATUS_V(status)) {
3774 reply_nterror(req, status);
3775 END_PROFILE(SMBwriteunlock);
3776 return;
3777 }
3778 }
3779
3780 reply_outbuf(req, 1, 0);
3781
3782 SSVAL(req->outbuf,smb_vwv0,nwritten);
3783
3784 DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3785 fsp->fnum, (int)numtowrite, (int)nwritten));
3786
3787 END_PROFILE(SMBwriteunlock);
3788 return;
3789 }
3790
3791 #undef DBGC_CLASS
3792 #define DBGC_CLASS DBGC_ALL
3793
3794 /****************************************************************************
3795 Reply to a write.
3796 ****************************************************************************/
3797
3798 void reply_write(struct smb_request *req)
3799 {
3800 connection_struct *conn = req->conn;
3801 size_t numtowrite;
3802 ssize_t nwritten = -1;
3803 SMB_OFF_T startpos;
3804 const char *data;
3805 files_struct *fsp;
3806 NTSTATUS status;
3807
3808 START_PROFILE(SMBwrite);
3809
3810 if (req->wct < 5) {
3811 END_PROFILE(SMBwrite);
3812 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3813 return;
3814 }
3815
3816 /* If it's an IPC, pass off the pipe handler. */
3817 if (IS_IPC(conn)) {
3818 reply_pipe_write(req);
3819 END_PROFILE(SMBwrite);
3820 return;
3821 }
3822
3823 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3824
3825 if (!check_fsp(conn, req, fsp)) {
3826 END_PROFILE(SMBwrite);
3827 return;
3828 }
3829
3830 if (!CHECK_WRITE(fsp)) {
3831 reply_doserror(req, ERRDOS, ERRbadaccess);
3832 END_PROFILE(SMBwrite);
3833 return;
3834 }
3835
3836 numtowrite = SVAL(req->vwv+1, 0);
3837 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3838 data = (const char *)req->buf + 3;
3839
3840 if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
3841 (uint64_t)startpos, WRITE_LOCK)) {
3842 reply_doserror(req, ERRDOS, ERRlock);
3843 END_PROFILE(SMBwrite);
3844 return;
3845 }
3846
3847 /*
3848 * X/Open SMB protocol says that if smb_vwv1 is
3849 * zero then the file size should be extended or
3850 * truncated to the size given in smb_vwv[2-3].
3851 */
3852
3853 if(numtowrite == 0) {
3854 /*
3855 * This is actually an allocate call, and set EOF. JRA.
3856 */
3857 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3858 if (nwritten < 0) {
3859 reply_nterror(req, NT_STATUS_DISK_FULL);
3860 END_PROFILE(SMBwrite);
3861 return;
3862 }
3863 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3864 if (nwritten < 0) {
3865 reply_nterror(req, NT_STATUS_DISK_FULL);
3866 END_PROFILE(SMBwrite);
3867 return;
3868 }
3869 trigger_write_time_update_immediate(fsp);
3870 } else {
3871 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3872 }
3873
3874 status = sync_file(conn, fsp, False);
3875 if (!NT_STATUS_IS_OK(status)) {
3876 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3877 fsp->fsp_name, nt_errstr(status) ));
3878 reply_nterror(req, status);
3879 END_PROFILE(SMBwrite);
3880 return;
3881 }
3882
3883 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3884 reply_unixerror(req, ERRHRD, ERRdiskfull);
3885 END_PROFILE(SMBwrite);
3886 return;
3887 }
3888
3889 reply_outbuf(req, 1, 0);
3890
3891 SSVAL(req->outbuf,smb_vwv0,nwritten);
3892
3893 if (nwritten < (ssize_t)numtowrite) {
3894 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3895 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3896 }
3897
3898 DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3899
3900 END_PROFILE(SMBwrite);
3901 return;
3902 }
3903
3904 /****************************************************************************
3905 Ensure a buffer is a valid writeX for recvfile purposes.
3906 ****************************************************************************/
3907
3908 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3909 (2*14) + /* word count (including bcc) */ \
3910 1 /* pad byte */)
3911
3912 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3913 {
3914 size_t numtowrite;
3915 connection_struct *conn = NULL;
3916 unsigned int doff = 0;
3917 size_t len = smb_len_large(inbuf);
3918
3919 if (is_encrypted_packet(inbuf)) {
3920 /* Can't do this on encrypted
3921 * connections. */
3922 return false;
3923 }
3924
3925 if (CVAL(inbuf,smb_com) != SMBwriteX) {
3926 return false;
3927 }
3928
3929 if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3930 CVAL(inbuf,smb_wct) != 14) {
3931 DEBUG(10,("is_valid_writeX_buffer: chained or "
3932 "invalid word length.\n"));
3933 return false;
3934 }
3935
3936 conn = conn_find(SVAL(inbuf, smb_tid));
3937 if (conn == NULL) {
3938 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3939 return false;
3940 }
3941 if (IS_IPC(conn)) {
3942 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3943 return false;
3944 }
3945 if (IS_PRINT(conn)) {
3946 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
3947 return false;
3948 }
3949 doff = SVAL(inbuf,smb_vwv11);
3950
3951 numtowrite = SVAL(inbuf,smb_vwv10);
3952
3953 if (len > doff && len - doff > 0xFFFF) {
3954 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3955 }
3956
3957 if (numtowrite == 0) {
3958 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3959 return false;
3960 }
3961
3962 /* Ensure the sizes match up. */
3963 if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3964 /* no pad byte...old smbclient :-( */
3965 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3966 (unsigned int)doff,
3967 (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3968 return false;
3969 }
3970
3971 if (len - doff != numtowrite) {
3972 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3973 "len = %u, doff = %u, numtowrite = %u\n",
3974 (unsigned int)len,
3975 (unsigned int)doff,
3976 (unsigned int)numtowrite ));
3977 return false;
3978 }
3979
3980 DEBUG(10,("is_valid_writeX_buffer: true "
3981 "len = %u, doff = %u, numtowrite = %u\n",
3982 (unsigned int)len,
3983 (unsigned int)doff,
3984 (unsigned int)numtowrite ));
3985
3986 return true;
3987 }
3988
3989 /****************************************************************************
3990 Reply to a write and X.
3991 ****************************************************************************/
3992
3993 void reply_write_and_X(struct smb_request *req)
3994 {
3995 connection_struct *conn = req->conn;
3996 files_struct *fsp;
3997 SMB_OFF_T startpos;
3998 size_t numtowrite;
3999 bool write_through;
4000 ssize_t nwritten;
4001 unsigned int smb_doff;
4002 unsigned int smblen;
4003 char *data;
4004 NTSTATUS status;
4005
4006 START_PROFILE(SMBwriteX);
4007
4008 if ((req->wct != 12) && (req->wct != 14)) {
4009 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4010 END_PROFILE(SMBwriteX);
4011 return;
4012 }
4013
4014 numtowrite = SVAL(req->vwv+10, 0);
4015 smb_doff = SVAL(req->vwv+11, 0);
4016 smblen = smb_len(req->inbuf);
4017
4018 if (req->unread_bytes > 0xFFFF ||
4019 (smblen > smb_doff &&
4020 smblen - smb_doff > 0xFFFF)) {
4021 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4022 }
4023
4024 if (req->unread_bytes) {
4025 /* Can't do a recvfile write on IPC$ */
4026 if (IS_IPC(conn)) {
4027 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4028 END_PROFILE(SMBwriteX);
4029 return;
4030 }
4031 if (numtowrite != req->unread_bytes) {
4032 reply_doserror(req, ERRDOS, ERRbadmem);
4033 END_PROFILE(SMBwriteX);
4034 return;
4035 }
4036 } else {
4037 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4038 smb_doff + numtowrite > smblen) {
4039 reply_doserror(req, ERRDOS, ERRbadmem);
4040 END_PROFILE(SMBwriteX);
4041 return;
4042 }
4043 }
4044
4045 /* If it's an IPC, pass off the pipe handler. */
4046 if (IS_IPC(conn)) {
4047 if (req->unread_bytes) {
4048 reply_doserror(req, ERRDOS, ERRbadmem);
4049 END_PROFILE(SMBwriteX);
4050 return;
4051 }
4052 reply_pipe_write_and_X(req);
4053 END_PROFILE(SMBwriteX);
4054 return;
4055 }
4056
4057 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4058 startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4059 write_through = BITSETW(req->vwv+7,0);
4060
4061 if (!check_fsp(conn, req, fsp)) {
4062 END_PROFILE(SMBwriteX);
4063 return;
4064 }
4065
4066 if (!CHECK_WRITE(fsp)) {
4067 reply_doserror(req, ERRDOS, ERRbadaccess);
4068 END_PROFILE(SMBwriteX);
4069 return;
4070 }
4071
4072 data = smb_base(req->inbuf) + smb_doff;
4073
4074 if(req->wct == 14) {
4075 #ifdef LARGE_SMB_OFF_T
4076 /*
4077 * This is a large offset (64 bit) write.
4078 */
4079 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4080
4081 #else /* !LARGE_SMB_OFF_T */
4082
4083 /*
4084 * Ensure we haven't been sent a >32 bit offset.
4085 */
4086
4087 if(IVAL(req->vwv+12, 0) != 0) {
4088 DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4089 "used and we don't support 64 bit offsets.\n",
4090 (unsigned int)IVAL(req->vwv+12, 0) ));
4091 reply_doserror(req, ERRDOS, ERRbadaccess);
4092 END_PROFILE(SMBwriteX);
4093 return;
4094 }
4095
4096 #endif /* LARGE_SMB_OFF_T */
4097 }
4098
4099 if (is_locked(fsp,(uint32)req->smbpid,
4100 (uint64_t)numtowrite,
4101 (uint64_t)startpos, WRITE_LOCK)) {
4102 reply_doserror(req, ERRDOS, ERRlock);
4103 END_PROFILE(SMBwriteX);
4104 return;
4105 }
4106
4107 /* X/Open SMB protocol says that, unlike SMBwrite
4108 if the length is zero then NO truncation is
4109 done, just a write of zero. To truncate a file,
4110 use SMBwrite. */
4111
4112 if(numtowrite == 0) {
4113 nwritten = 0;
4114 } else {
4115
4116 if ((req->unread_bytes == 0) &&
4117 schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4118 numtowrite)) {
4119 END_PROFILE(SMBwriteX);
4120 return;
4121 }
4122
4123 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4124 }
4125
4126 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4127 reply_unixerror(req, ERRHRD, ERRdiskfull);
4128 END_PROFILE(SMBwriteX);
4129 return;
4130 }
4131
4132 reply_outbuf(req, 6, 0);
4133 SSVAL(req->outbuf,smb_vwv2,nwritten);
4134 SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4135
4136 if (nwritten < (ssize_t)numtowrite) {
4137 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4138 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4139 }
4140
4141 DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4142 fsp->fnum, (int)numtowrite, (int)nwritten));
4143
4144 status = sync_file(conn, fsp, write_through);
4145 if (!NT_STATUS_IS_OK(status)) {
4146 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4147 fsp->fsp_name, nt_errstr(status) ));
4148 reply_nterror(req, status);
4149 END_PROFILE(SMBwriteX);
4150 return;
4151 }
4152
4153 END_PROFILE(SMBwriteX);
4154 chain_reply(req);
4155 return;
4156 }
4157
4158 /****************************************************************************
4159 Reply to a lseek.
4160 ****************************************************************************/
4161
4162 void reply_lseek(struct smb_request *req)
4163 {
4164 connection_struct *conn = req->conn;
4165 SMB_OFF_T startpos;
4166 SMB_OFF_T res= -1;
4167 int mode,umode;
4168 files_struct *fsp;
4169
4170 START_PROFILE(SMBlseek);
4171
4172 if (req->wct < 4) {
4173 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4174 END_PROFILE(SMBlseek);
4175 return;
4176 }
4177
4178 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4179
4180 if (!check_fsp(conn, req, fsp)) {
4181 return;
4182 }
4183
4184 flush_write_cache(fsp, SEEK_FLUSH);
4185
4186 mode = SVAL(req->vwv+1, 0) & 3;
4187 /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4188 startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4189
4190 switch (mode) {
4191 case 0:
4192 umode = SEEK_SET;
4193 res = startpos;
4194 break;
4195 case 1:
4196 umode = SEEK_CUR;
4197 res = fsp->fh->pos + startpos;
4198 break;
4199 case 2:
4200 umode = SEEK_END;
4201 break;
4202 default:
4203 umode = SEEK_SET;
4204 res = startpos;
4205 break;
4206 }
4207
4208 if (umode == SEEK_END) {
4209 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4210 if(errno == EINVAL) {
4211 SMB_OFF_T current_pos = startpos;
4212 SMB_STRUCT_STAT sbuf;
4213
4214 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4215 reply_unixerror(req, ERRDOS,
4216 ERRnoaccess);
4217 END_PROFILE(SMBlseek);
4218 return;
4219 }
4220
4221 current_pos += sbuf.st_size;
4222 if(current_pos < 0)
4223 res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4224 }
4225 }
4226
4227 if(res == -1) {
4228 reply_unixerror(req, ERRDOS, ERRnoaccess);
4229 END_PROFILE(SMBlseek);
4230 return;
4231 }
4232 }
4233
4234 fsp->fh->pos = res;
4235
4236 reply_outbuf(req, 2, 0);
4237 SIVAL(req->outbuf,smb_vwv0,res);
4238
4239 DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4240 fsp->fnum, (double)startpos, (double)res, mode));
4241
4242 END_PROFILE(SMBlseek);
4243 return;
4244 }
4245
4246 /****************************************************************************
4247 Reply to a flush.
4248 ****************************************************************************/
4249
4250 void reply_flush(struct smb_request *req)
4251 {
4252 connection_struct *conn = req->conn;
4253 uint16 fnum;
4254 files_struct *fsp;
4255
4256 START_PROFILE(SMBflush);
4257
4258 if (req->wct < 1) {
4259 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4260 return;
4261 }
4262
4263 fnum = SVAL(req->vwv+0, 0);
4264 fsp = file_fsp(req, fnum);
4265
4266 if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4267 return;
4268 }
4269
4270 if (!fsp) {
4271 file_sync_all(conn);
4272 } else {
4273 NTSTATUS status = sync_file(conn, fsp, True);
4274 if (!NT_STATUS_IS_OK(status)) {
4275 DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4276 fsp->fsp_name, nt_errstr(status) ));
4277 reply_nterror(req, status);
4278 END_PROFILE(SMBflush);
4279 return;
4280 }
4281 }
4282
4283 reply_outbuf(req, 0, 0);
4284
4285 DEBUG(3,("flush\n"));
4286 END_PROFILE(SMBflush);
4287 return;
4288 }
4289
4290 /****************************************************************************
4291 Reply to a exit.
4292 conn POINTER CAN BE NULL HERE !
4293 ****************************************************************************/
4294
4295 void reply_exit(struct smb_request *req)
4296 {
4297 START_PROFILE(SMBexit);
4298
4299 file_close_pid(req->smbpid, req->vuid);
4300
4301 reply_outbuf(req, 0, 0);
4302
4303 DEBUG(3,("exit\n"));
4304
4305 END_PROFILE(SMBexit);
4306 return;
4307 }
4308
4309 /****************************************************************************
4310 Reply to a close - has to deal with closing a directory opened by NT SMB's.
4311 ****************************************************************************/
4312
4313 void reply_close(struct smb_request *req)
4314 {
4315 connection_struct *conn = req->conn;
4316 NTSTATUS status = NT_STATUS_OK;
4317 files_struct *fsp = NULL;
4318 START_PROFILE(SMBclose);
4319
4320 if (req->wct < 3) {
4321 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4322 END_PROFILE(SMBclose);
4323 return;
4324 }
4325
4326 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4327
4328 /*
4329 * We can only use check_fsp if we know it's not a directory.
4330 */
4331
4332 if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4333 reply_doserror(req, ERRDOS, ERRbadfid);
4334 END_PROFILE(SMBclose);
4335 return;
4336 }
4337
4338 if(fsp->is_directory) {
4339 /*
4340 * Special case - close NT SMB directory handle.
4341 */
4342 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4343 status = close_file(req, fsp, NORMAL_CLOSE);
4344 } else {
4345 time_t t;
4346 /*
4347 * Close ordinary file.
4348 */
4349
4350 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4351 fsp->fh->fd, fsp->fnum,
4352 conn->num_files_open));
4353
4354 /*
4355 * Take care of any time sent in the close.
4356 */
4357
4358 t = srv_make_unix_date3(req->vwv+1);
4359 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4360
4361 /*
4362 * close_file() returns the unix errno if an error
4363 * was detected on close - normally this is due to
4364 * a disk full error. If not then it was probably an I/O error.
4365 */
4366
4367 status = close_file(req, fsp, NORMAL_CLOSE);
4368 }
4369
4370 if (!NT_STATUS_IS_OK(status)) {
4371 reply_nterror(req, status);
4372 END_PROFILE(SMBclose);
4373 return;
4374 }
4375
4376 reply_outbuf(req, 0, 0);
4377 END_PROFILE(SMBclose);
4378 return;
4379 }
4380
4381 /****************************************************************************
4382 Reply to a writeclose (Core+ protocol).
4383 ****************************************************************************/
4384
4385 void reply_writeclose(struct smb_request *req)
4386 {
4387 connection_struct *conn = req->conn;
4388 size_t numtowrite;
4389 ssize_t nwritten = -1;
4390 NTSTATUS close_status = NT_STATUS_OK;
4391 SMB_OFF_T startpos;
4392 const char *data;
4393 struct timespec mtime;
4394 files_struct *fsp;
4395
4396 START_PROFILE(SMBwriteclose);
4397
4398 if (req->wct < 6) {
4399 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4400 END_PROFILE(SMBwriteclose);
4401 return;
4402 }
4403
4404 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4405
4406 if (!check_fsp(conn, req, fsp)) {
4407 END_PROFILE(SMBwriteclose);
4408 return;
4409 }
4410 if (!CHECK_WRITE(fsp)) {
4411 reply_doserror(req, ERRDOS,ERRbadaccess);
4412 END_PROFILE(SMBwriteclose);
4413 return;
4414 }
4415
4416 numtowrite = SVAL(req->vwv+1, 0);
4417 startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4418 mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4419 data = (const char *)req->buf + 1;
4420
4421 if (numtowrite
4422 && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
4423 (uint64_t)startpos, WRITE_LOCK)) {
4424 reply_doserror(req, ERRDOS,ERRlock);
4425 END_PROFILE(SMBwriteclose);
4426 return;
4427 }
4428
4429 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4430
4431 set_close_write_time(fsp, mtime);
4432
4433 /*
4434 * More insanity. W2K only closes the file if writelen > 0.
4435 * JRA.
4436 */
4437
4438 if (numtowrite) {
4439 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4440 fsp->fsp_name ));
4441 close_status = close_file(req, fsp, NORMAL_CLOSE);
4442 }
4443
4444 DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4445 fsp->fnum, (int)numtowrite, (int)nwritten,
4446 conn->num_files_open));
4447
4448 if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4449 reply_doserror(req, ERRHRD, ERRdiskfull);
4450 END_PROFILE(SMBwriteclose);
4451 return;
4452 }
4453
4454 if(!NT_STATUS_IS_OK(close_status)) {
4455 reply_nterror(req, close_status);
4456 END_PROFILE(SMBwriteclose);
4457 return;
4458 }
4459
4460 reply_outbuf(req, 1, 0);
4461
4462 SSVAL(req->outbuf,smb_vwv0,nwritten);
4463 END_PROFILE(SMBwriteclose);
4464 return;
4465 }
4466
4467 #undef DBGC_CLASS
4468 #define DBGC_CLASS DBGC_LOCKING
4469
4470 /****************************************************************************
4471 Reply to a lock.
4472 ****************************************************************************/
4473
4474 void reply_lock(struct smb_request *req)
4475 {
4476 connection_struct *conn = req->conn;
4477 uint64_t count,offset;
4478 NTSTATUS status;
4479 files_struct *fsp;
4480 struct byte_range_lock *br_lck = NULL;
4481
4482 START_PROFILE(SMBlock);
4483
4484 if (req->wct < 5) {
4485 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4486 END_PROFILE(SMBlock);
4487 return;
4488 }
4489
4490 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4491
4492 if (!check_fsp(conn, req, fsp)) {
4493 END_PROFILE(SMBlock);
4494 return;
4495 }
4496
4497 release_level_2_oplocks_on_change(fsp);
4498
4499 count = (uint64_t)IVAL(req->vwv+1, 0);
4500 offset = (uint64_t)IVAL(req->vwv+3, 0);
4501
4502 DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4503 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4504
4505 br_lck = do_lock(smbd_messaging_context(),
4506 fsp,
4507 req->smbpid,
4508 count,
4509 offset,
4510 WRITE_LOCK,
4511 WINDOWS_LOCK,
4512 False, /* Non-blocking lock. */
4513 &status,
4514 NULL);
4515
4516 TALLOC_FREE(br_lck);
4517
4518 if (NT_STATUS_V(status)) {
4519 reply_nterror(req, status);
4520 END_PROFILE(SMBlock);
4521 return;
4522 }
4523
4524 reply_outbuf(req, 0, 0);
4525
4526 END_PROFILE(SMBlock);
4527 return;
4528 }
4529
4530 /****************************************************************************
4531 Reply to a unlock.
4532 ****************************************************************************/
4533
4534 void reply_unlock(struct smb_request *req)
4535 {
4536 connection_struct *conn = req->conn;
4537 uint64_t count,offset;
4538 NTSTATUS status;
4539 files_struct *fsp;
4540
4541 START_PROFILE(SMBunlock);
4542
4543 if (req->wct < 5) {
4544 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4545 END_PROFILE(SMBunlock);
4546 return;
4547 }
4548
4549 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4550
4551 if (!check_fsp(conn, req, fsp)) {
4552 END_PROFILE(SMBunlock);
4553 return;
4554 }
4555
4556 count = (uint64_t)IVAL(req->vwv+1, 0);
4557 offset = (uint64_t)IVAL(req->vwv+3, 0);
4558
4559 status = do_unlock(smbd_messaging_context(),
4560 fsp,
4561 req->smbpid,
4562 count,
4563 offset,
4564 WINDOWS_LOCK);
4565
4566 if (NT_STATUS_V(status)) {
4567 reply_nterror(req, status);
4568 END_PROFILE(SMBunlock);
4569 return;
4570 }
4571
4572 DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4573 fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4574
4575 reply_outbuf(req, 0, 0);
4576
4577 END_PROFILE(SMBunlock);
4578 return;
4579 }
4580
4581 #undef DBGC_CLASS
4582 #define DBGC_CLASS DBGC_ALL
4583
4584 /****************************************************************************
4585 Reply to a tdis.
4586 conn POINTER CAN BE NULL HERE !
4587 ****************************************************************************/
4588
4589 void reply_tdis(struct smb_request *req)
4590 {
4591 connection_struct *conn = req->conn;
4592 START_PROFILE(SMBtdis);
4593
4594 if (!conn) {
4595 DEBUG(4,("Invalid connection in tdis\n"));
4596 reply_doserror(req, ERRSRV, ERRinvnid);
4597 END_PROFILE(SMBtdis);
4598 return;
4599 }
4600
4601 conn->used = False;
4602
4603 close_cnum(conn,req->vuid);
4604 req->conn = NULL;
4605
4606 reply_outbuf(req, 0, 0);
4607 END_PROFILE(SMBtdis);
4608 return;
4609 }
4610
4611 /****************************************************************************
4612 Reply to a echo.
4613 conn POINTER CAN BE NULL HERE !
4614 ****************************************************************************/
4615
4616 void reply_echo(struct smb_request *req)
4617 {
4618 connection_struct *conn = req->conn;
4619 int smb_reverb;
4620 int seq_num;
4621
4622 START_PROFILE(SMBecho);
4623
4624 if (req->wct < 1) {
4625 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4626 END_PROFILE(SMBecho);
4627 return;
4628 }
4629
4630 smb_reverb = SVAL(req->vwv+0, 0);
4631
4632 reply_outbuf(req, 1, req->buflen);
4633
4634 /* copy any incoming data back out */
4635 if (req->buflen > 0) {
4636 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4637 }
4638
4639 if (smb_reverb > 100) {
4640 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4641 smb_reverb = 100;
4642 }
4643
4644 for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4645 SSVAL(req->outbuf,smb_vwv0,seq_num);
4646
4647 show_msg((char *)req->outbuf);
4648 if (!srv_send_smb(smbd_server_fd(),
4649 (char *)req->outbuf,
4650 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4651 exit_server_cleanly("reply_echo: srv_send_smb failed.");
4652 }
4653
4654 DEBUG(3,("echo %d times\n", smb_reverb));
4655
4656 TALLOC_FREE(req->outbuf);
4657
4658 END_PROFILE(SMBecho);
4659 return;
4660 }
4661
4662 /****************************************************************************
4663 Reply to a printopen.
4664 ****************************************************************************/
4665
4666 void reply_printopen(struct smb_request *req)
4667 {
4668 connection_struct *conn = req->conn;
4669 files_struct *fsp;
4670 SMB_STRUCT_STAT sbuf;
4671 NTSTATUS status;
4672
4673 START_PROFILE(SMBsplopen);
4674
4675 if (req->wct < 2) {
4676 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4677 END_PROFILE(SMBsplopen);
4678 return;
4679 }
4680
4681 if (!CAN_PRINT(conn)) {
4682 reply_doserror(req, ERRDOS, ERRnoaccess);
4683 END_PROFILE(SMBsplopen);
4684 return;
4685 }
4686
4687 status = file_new(req, conn, &fsp);
4688 if(!NT_STATUS_IS_OK(status)) {
4689 reply_nterror(req, status);
4690 END_PROFILE(SMBsplopen);
4691 return;
4692 }
4693
4694 /* Open for exclusive use, write only. */
4695 status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4696
4697 if (!NT_STATUS_IS_OK(status)) {
4698 reply_nterror(req, status);
4699 END_PROFILE(SMBsplopen);
4700 return;
4701 }
4702
4703 reply_outbuf(req, 1, 0);
4704 SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4705
4706 DEBUG(3,("openprint fd=%d fnum=%d\n",
4707 fsp->fh->fd, fsp->fnum));
4708
4709 END_PROFILE(SMBsplopen);
4710 return;
4711 }
4712
4713 /****************************************************************************
4714 Reply to a printclose.
4715 ****************************************************************************/
4716
4717 void reply_printclose(struct smb_request *req)
4718 {
4719 connection_struct *conn = req->conn;
4720 files_struct *fsp;
4721 NTSTATUS status;
4722
4723 START_PROFILE(SMBsplclose);
4724
4725 if (req->wct < 1) {
4726 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4727 END_PROFILE(SMBsplclose);
4728 return;
4729 }
4730
4731 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4732
4733 if (!check_fsp(conn, req, fsp)) {
4734 END_PROFILE(SMBsplclose);
4735 return;
4736 }
4737
4738 if (!CAN_PRINT(conn)) {
4739 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4740 END_PROFILE(SMBsplclose);
4741 return;
4742 }
4743
4744 DEBUG(3,("printclose fd=%d fnum=%d\n",
4745 fsp->fh->fd,fsp->fnum));
4746
4747 status = close_file(req, fsp, NORMAL_CLOSE);
4748
4749 if(!NT_STATUS_IS_OK(status)) {
4750 reply_nterror(req, status);
4751 END_PROFILE(SMBsplclose);
4752 return;
4753 }
4754
4755 reply_outbuf(req, 0, 0);
4756
4757 END_PROFILE(SMBsplclose);
4758 return;
4759 }
4760
4761 /****************************************************************************
4762 Reply to a printqueue.
4763 ****************************************************************************/
4764
4765 void reply_printqueue(struct smb_request *req)
4766 {
4767 connection_struct *conn = req->conn;
4768 int max_count;
4769 int start_index;
4770
4771 START_PROFILE(SMBsplretq);
4772
4773 if (req->wct < 2) {
4774 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4775 END_PROFILE(SMBsplretq);
4776 return;
4777 }
4778
4779 max_count = SVAL(req->vwv+0, 0);
4780 start_index = SVAL(req->vwv+1, 0);
4781
4782 /* we used to allow the client to get the cnum wrong, but that
4783 is really quite gross and only worked when there was only
4784 one printer - I think we should now only accept it if they
4785 get it right (tridge) */
4786 if (!CAN_PRINT(conn)) {
4787 reply_doserror(req, ERRDOS, ERRnoaccess);
4788 END_PROFILE(SMBsplretq);
4789 return;
4790 }
4791
4792 reply_outbuf(req, 2, 3);
4793 SSVAL(req->outbuf,smb_vwv0,0);
4794 SSVAL(req->outbuf,smb_vwv1,0);
4795 SCVAL(smb_buf(req->outbuf),0,1);
4796 SSVAL(smb_buf(req->outbuf),1,0);
4797
4798 DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4799 start_index, max_count));
4800
4801 {
4802 print_queue_struct *queue = NULL;
4803 print_status_struct status;
4804 int count = print_queue_status(SNUM(conn), &queue, &status);
4805 int num_to_get = ABS(max_count);
4806 int first = (max_count>0?start_index:start_index+max_count+1);
4807 int i;
4808
4809 if (first >= count)
4810 num_to_get = 0;
4811 else
4812 num_to_get = MIN(num_to_get,count-first);
4813
4814
4815 for (i=first;i<first+num_to_get;i++) {
4816 char blob[28];
4817 char *p = blob;
4818
4819 srv_put_dos_date2(p,0,queue[i].time);
4820 SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4821 SSVAL(p,5, queue[i].job);
4822 SIVAL(p,7,queue[i].size);
4823 SCVAL(p,11,0);
4824 srvstr_push(blob, req->flags2, p+12,
4825 queue[i].fs_user, 16, STR_ASCII);
4826
4827 if (message_push_blob(
4828 &req->outbuf,
4829 data_blob_const(
4830 blob, sizeof(blob))) == -1) {
4831 reply_nterror(req, NT_STATUS_NO_MEMORY);
4832 END_PROFILE(SMBsplretq);
4833 return;
4834 }
4835 }
4836
4837 if (count > 0) {
4838 SSVAL(req->outbuf,smb_vwv0,count);
4839 SSVAL(req->outbuf,smb_vwv1,
4840 (max_count>0?first+count:first-1));
4841 SCVAL(smb_buf(req->outbuf),0,1);
4842 SSVAL(smb_buf(req->outbuf),1,28*count);
4843 }
4844
4845 SAFE_FREE(queue);
4846
4847 DEBUG(3,("%d entries returned in queue\n",count));
4848 }
4849
4850 END_PROFILE(SMBsplretq);
4851 return;
4852 }
4853
4854 /****************************************************************************
4855 Reply to a printwrite.
4856 ****************************************************************************/
4857
4858 void reply_printwrite(struct smb_request *req)
4859 {
4860 connection_struct *conn = req->conn;
4861 int numtowrite;
4862 const char *data;
4863 files_struct *fsp;
4864
4865 START_PROFILE(SMBsplwr);
4866
4867 if (req->wct < 1) {
4868 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4869 END_PROFILE(SMBsplwr);
4870 return;
4871 }
4872
4873 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4874
4875 if (!check_fsp(conn, req, fsp)) {
4876 END_PROFILE(SMBsplwr);
4877 return;
4878 }
4879
4880 if (!CAN_PRINT(conn)) {
4881 reply_doserror(req, ERRDOS, ERRnoaccess);
4882 END_PROFILE(SMBsplwr);
4883 return;
4884 }
4885
4886 if (!CHECK_WRITE(fsp)) {
4887 reply_doserror(req, ERRDOS, ERRbadaccess);
4888 END_PROFILE(SMBsplwr);
4889 return;
4890 }
4891
4892 numtowrite = SVAL(req->buf, 1);
4893
4894 if (req->buflen < numtowrite + 3) {
4895 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4896 END_PROFILE(SMBsplwr);
4897 return;
4898 }
4899
4900 data = (const char *)req->buf + 3;
4901
4902 if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4903 reply_unixerror(req, ERRHRD, ERRdiskfull);
4904 END_PROFILE(SMBsplwr);
4905 return;
4906 }
4907
4908 DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4909
4910 END_PROFILE(SMBsplwr);
4911 return;
4912 }
4913
4914 /****************************************************************************
4915 Reply to a mkdir.
4916 ****************************************************************************/
4917
4918 void reply_mkdir(struct smb_request *req)
4919 {
4920 connection_struct *conn = req->conn;
4921 char *directory = NULL;
4922 NTSTATUS status;
4923 SMB_STRUCT_STAT sbuf;
4924 TALLOC_CTX *ctx = talloc_tos();
4925
4926 START_PROFILE(SMBmkdir);
4927
4928 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
4929 STR_TERMINATE, &status);
4930 if (!NT_STATUS_IS_OK(status)) {
4931 reply_nterror(req, status);
4932 END_PROFILE(SMBmkdir);
4933 return;
4934 }
4935
4936 status = resolve_dfspath(ctx, conn,
4937 req->flags2 & FLAGS2_DFS_PATHNAMES,
4938 directory,
4939 &directory);
4940 if (!NT_STATUS_IS_OK(status)) {
4941 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4942 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4943 ERRSRV, ERRbadpath);
4944 END_PROFILE(SMBmkdir);
4945 return;
4946 }
4947 reply_nterror(req, status);
4948 END_PROFILE(SMBmkdir);
4949 return;
4950 }
4951
4952 status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4953 if (!NT_STATUS_IS_OK(status)) {
4954 reply_nterror(req, status);
4955 END_PROFILE(SMBmkdir);
4956 return;
4957 }
4958
4959 status = check_name(conn, directory);
4960 if (!NT_STATUS_IS_OK(status)) {
4961 reply_nterror(req, status);
4962 END_PROFILE(SMBmkdir);
4963 return;
4964 }
4965
4966 status = create_directory(conn, req, directory);
4967
4968 DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4969
4970 if (!NT_STATUS_IS_OK(status)) {
4971
4972 if (!use_nt_status()
4973 && NT_STATUS_EQUAL(status,
4974 NT_STATUS_OBJECT_NAME_COLLISION)) {
4975 /*
4976 * Yes, in the DOS error code case we get a
4977 * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4978 * samba4 torture test.
4979 */
4980 status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4981 }
4982
4983 reply_nterror(req, status);
4984 END_PROFILE(SMBmkdir);
4985 return;
4986 }
4987
4988 reply_outbuf(req, 0, 0);
4989
4990 DEBUG( 3, ( "mkdir %s\n", directory ) );
4991
4992 END_PROFILE(SMBmkdir);
4993 return;
4994 }
4995
4996 /****************************************************************************
4997 Static function used by reply_rmdir to delete an entire directory
4998 tree recursively. Return True on ok, False on fail.
4999 ****************************************************************************/
5000
5001 static bool recursive_rmdir(TALLOC_CTX *ctx,
5002 connection_struct *conn,
5003 char *directory)
5004 {
5005 const char *dname = NULL;
5006 bool ret = True;
5007 long offset = 0;
5008 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5009 NULL, 0);
5010
5011 if(dir_hnd == NULL)
5012 return False;
5013
5014 while((dname = ReadDirName(dir_hnd, &offset))) {
5015 char *fullname = NULL;
5016 SMB_STRUCT_STAT st;
5017
5018 if (ISDOT(dname) || ISDOTDOT(dname)) {
5019 continue;
5020 }
5021
5022 if (!is_visible_file(conn, directory, dname, &st, False)) {
5023 continue;
5024 }
5025
5026 /* Construct the full name. */
5027 fullname = talloc_asprintf(ctx,
5028 "%s/%s",
5029 directory,
5030 dname);
5031 if (!fullname) {
5032 errno = ENOMEM;
5033 ret = False;
5034 break;
5035 }
5036
5037 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5038 ret = False;
5039 break;
5040 }
5041
5042 if(st.st_mode & S_IFDIR) {
5043 if(!recursive_rmdir(ctx, conn, fullname)) {
5044 ret = False;
5045 break;
5046 }
5047 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5048 ret = False;
5049 break;
5050 }
5051 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5052 ret = False;
5053 break;
5054 }
5055 TALLOC_FREE(fullname);
5056 }
5057 TALLOC_FREE(dir_hnd);
5058 return ret;
5059 }
5060
5061 /****************************************************************************
5062 The internals of the rmdir code - called elsewhere.
5063 ****************************************************************************/
5064
5065 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5066 connection_struct *conn,
5067 const char *directory)
5068 {
5069 int ret;
5070 SMB_STRUCT_STAT st;
5071
5072 /* Might be a symlink. */
5073 if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5074 return map_nt_error_from_unix(errno);
5075 }
5076
5077 if (S_ISLNK(st.st_mode)) {
5078 /* Is what it points to a directory ? */
5079 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5080 return map_nt_error_from_unix(errno);
5081 }
5082 if (!(S_ISDIR(st.st_mode))) {
5083 return NT_STATUS_NOT_A_DIRECTORY;
5084 }
5085 ret = SMB_VFS_UNLINK(conn,directory);
5086 } else {
5087 ret = SMB_VFS_RMDIR(conn,directory);
5088 }
5089 if (ret == 0) {
5090 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5091 FILE_NOTIFY_CHANGE_DIR_NAME,
5092 directory);
5093 return NT_STATUS_OK;
5094 }
5095
5096 if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5097 /*
5098 * Check to see if the only thing in this directory are
5099 * vetoed files/directories. If so then delete them and
5100 * retry. If we fail to delete any of them (and we *don't*
5101 * do a recursive delete) then fail the rmdir.
5102 */
5103 const char *dname;
5104 long dirpos = 0;
5105 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5106 directory, NULL, 0);
5107
5108 if(dir_hnd == NULL) {
5109 errno = ENOTEMPTY;
5110 goto err;
5111 }
5112
5113 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5114 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5115 continue;
5116 if (!is_visible_file(conn, directory, dname, &st, False))
5117 continue;
5118 if(!IS_VETO_PATH(conn, dname)) {
5119 TALLOC_FREE(dir_hnd);
5120 errno = ENOTEMPTY;
5121 goto err;
5122 }
5123 }
5124
5125 /* We only have veto files/directories.
5126 * Are we allowed to delete them ? */
5127
5128 if(!lp_recursive_veto_delete(SNUM(conn))) {
5129 TALLOC_FREE(dir_hnd);
5130 errno = ENOTEMPTY;
5131 goto err;
5132 }
5133
5134 /* Do a recursive delete. */
5135 RewindDir(dir_hnd,&dirpos);
5136 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5137 char *fullname = NULL;
5138
5139 if (ISDOT(dname) || ISDOTDOT(dname)) {
5140 continue;
5141 }
5142 if (!is_visible_file(conn, directory, dname, &st, False)) {
5143 continue;
5144 }
5145
5146 fullname = talloc_asprintf(ctx,
5147 "%s/%s",
5148 directory,
5149 dname);
5150
5151 if(!fullname) {
5152 errno = ENOMEM;
5153 break;
5154 }
5155
5156 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5157 break;
5158 }
5159 if(st.st_mode & S_IFDIR) {
5160 if(!recursive_rmdir(ctx, conn, fullname)) {
5161 break;
5162 }
5163 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5164 break;
5165 }
5166 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5167 break;
5168 }
5169 TALLOC_FREE(fullname);
5170 }
5171 TALLOC_FREE(dir_hnd);
5172 /* Retry the rmdir */
5173 ret = SMB_VFS_RMDIR(conn,directory);
5174 }
5175
5176 err:
5177
5178 if (ret != 0) {
5179 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5180 "%s\n", directory,strerror(errno)));
5181 return map_nt_error_from_unix(errno);
5182 }
5183
5184 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5185 FILE_NOTIFY_CHANGE_DIR_NAME,
5186 directory);
5187
5188 return NT_STATUS_OK;
5189 }
5190
5191 /****************************************************************************
5192 Reply to a rmdir.
5193 ****************************************************************************/
5194
5195 void reply_rmdir(struct smb_request *req)
5196 {
5197 connection_struct *conn = req->conn;
5198 char *directory = NULL;
5199 SMB_STRUCT_STAT sbuf;
5200 NTSTATUS status;
5201 TALLOC_CTX *ctx = talloc_tos();
5202
5203 START_PROFILE(SMBrmdir);
5204
5205 srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5206 STR_TERMINATE, &status);
5207 if (!NT_STATUS_IS_OK(status)) {
5208 reply_nterror(req, status);
5209 END_PROFILE(SMBrmdir);
5210 return;
5211 }
5212
5213 status = resolve_dfspath(ctx, conn,
5214 req->flags2 & FLAGS2_DFS_PATHNAMES,
5215 directory,
5216 &directory);
5217 if (!NT_STATUS_IS_OK(status)) {
5218 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5219 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5220 ERRSRV, ERRbadpath);
5221 END_PROFILE(SMBrmdir);
5222 return;
5223 }
5224 reply_nterror(req, status);
5225 END_PROFILE(SMBrmdir);
5226 return;
5227 }
5228
5229 status = unix_convert(ctx, conn, directory, False, &directory,
5230 NULL, &sbuf);
5231 if (!NT_STATUS_IS_OK(status)) {
5232 reply_nterror(req, status);
5233 END_PROFILE(SMBrmdir);
5234 return;
5235 }
5236
5237 status = check_name(conn, directory);
5238 if (!NT_STATUS_IS_OK(status)) {
5239 reply_nterror(req, status);
5240 END_PROFILE(SMBrmdir);
5241 return;
5242 }
5243
5244 dptr_closepath(directory, req->smbpid);
5245 status = rmdir_internals(ctx, conn, directory);
5246 if (!NT_STATUS_IS_OK(status)) {
5247 reply_nterror(req, status);
5248 END_PROFILE(SMBrmdir);
5249 return;
5250 }
5251
5252 reply_outbuf(req, 0, 0);
5253
5254 DEBUG( 3, ( "rmdir %s\n", directory ) );
5255
5256 END_PROFILE(SMBrmdir);
5257 return;
5258 }
5259
5260 /*******************************************************************
5261 Resolve wildcards in a filename rename.
5262 ********************************************************************/
5263
5264 static bool resolve_wildcards(TALLOC_CTX *ctx,
5265 const char *name1,
5266 const char *name2,
5267 char **pp_newname)
5268 {
5269 char *name2_copy = NULL;
5270 char *root1 = NULL;
5271 char *root2 = NULL;
5272 char *ext1 = NULL;
5273 char *ext2 = NULL;
5274 char *p,*p2, *pname1, *pname2;
5275
5276 name2_copy = talloc_strdup(ctx, name2);
5277 if (!name2_copy) {
5278 return False;
5279 }
5280
5281 pname1 = strrchr_m(name1,'/');
5282 pname2 = strrchr_m(name2_copy,'/');
5283
5284 if (!pname1 || !pname2) {
5285 return False;
5286 }
5287
5288 /* Truncate the copy of name2 at the last '/' */
5289 *pname2 = '\0';
5290
5291 /* Now go past the '/' */
5292 pname1++;
5293 pname2++;
5294
5295 root1 = talloc_strdup(ctx, pname1);
5296 root2 = talloc_strdup(ctx, pname2);
5297
5298 if (!root1 || !root2) {
5299 return False;
5300 }
5301
5302 p = strrchr_m(root1,'.');
5303 if (p) {
5304 *p = 0;
5305 ext1 = talloc_strdup(ctx, p+1);
5306 } else {
5307 ext1 = talloc_strdup(ctx, "");
5308 }
5309 p = strrchr_m(root2,'.');
5310 if (p) {
5311 *p = 0;
5312 ext2 = talloc_strdup(ctx, p+1);
5313 } else {
5314 ext2 = talloc_strdup(ctx, "");
5315 }
5316
5317 if (!ext1 || !ext2) {
5318 return False;
5319 }
5320
5321 p = root1;
5322 p2 = root2;
5323 while (*p2) {
5324 if (*p2 == '?') {
5325 /* Hmmm. Should this be mb-aware ? */
5326 *p2 = *p;
5327 p2++;
5328 } else if (*p2 == '*') {
5329 *p2 = '\0';
5330 root2 = talloc_asprintf(ctx, "%s%s",
5331 root2,
5332 p);
5333 if (!root2) {
5334 return False;
5335 }
5336 break;
5337 } else {
5338 p2++;
5339 }
5340 if (*p) {
5341 p++;
5342 }
5343 }
5344
5345 p = ext1;
5346 p2 = ext2;
5347 while (*p2) {
5348 if (*p2 == '?') {
5349 /* Hmmm. Should this be mb-aware ? */
5350 *p2 = *p;
5351 p2++;
5352 } else if (*p2 == '*') {
5353 *p2 = '\0';
5354 ext2 = talloc_asprintf(ctx, "%s%s",
5355 ext2,
5356 p);
5357 if (!ext2) {
5358 return False;
5359 }
5360 break;
5361 } else {
5362 p2++;
5363 }
5364 if (*p) {
5365 p++;
5366 }
5367 }
5368
5369 if (*ext2) {
5370 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5371 name2_copy,
5372 root2,
5373 ext2);
5374 } else {
5375 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5376 name2_copy,
5377 root2);
5378 }
5379
5380 if (!*pp_newname) {
5381 return False;
5382 }
5383
5384 return True;
5385 }
5386
5387 /****************************************************************************
5388 Ensure open files have their names updated. Updated to notify other smbd's
5389 asynchronously.
5390 ****************************************************************************/
5391
5392 static void rename_open_files(connection_struct *conn,
5393 struct share_mode_lock *lck,
5394 const char *newname)
5395 {
5396 files_struct *fsp;
5397 bool did_rename = False;
5398
5399 for(fsp = file_find_di_first(lck->id); fsp;
5400 fsp = file_find_di_next(fsp)) {
5401 /* fsp_name is a relative path under the fsp. To change this for other
5402 sharepaths we need to manipulate relative paths. */
5403 /* TODO - create the absolute path and manipulate the newname
5404 relative to the sharepath. */
5405 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5406 continue;
5407 }
5408 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5409 fsp->fnum, file_id_string_tos(&fsp->file_id),
5410 fsp->fsp_name, newname ));
5411 string_set(&fsp->fsp_name, newname);
5412 did_rename = True;
5413 }
5414
5415 if (!did_rename) {
5416 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5417 file_id_string_tos(&lck->id), newname ));
5418 }
5419
5420 /* Send messages to all smbd's (not ourself) that the name has changed. */
5421 rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5422 newname);
5423 }
5424
5425 /****************************************************************************
5426 We need to check if the source path is a parent directory of the destination
5427 (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5428 refuse the rename with a sharing violation. Under UNIX the above call can
5429 *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5430 probably need to check that the client is a Windows one before disallowing
5431 this as a UNIX client (one with UNIX extensions) can know the source is a
5432 symlink and make this decision intelligently. Found by an excellent bug
5433 report from <AndyLiebman@aol.com>.
5434 ****************************************************************************/
5435
5436 static bool rename_path_prefix_equal(const char *src, const char *dest)
5437 {
5438 const char *psrc = src;
5439 const char *pdst = dest;
5440 size_t slen;
5441
5442 if (psrc[0] == '.' && psrc[1] == '/') {
5443 psrc += 2;
5444 }
5445 if (pdst[0] == '.' && pdst[1] == '/') {
5446 pdst += 2;
5447 }
5448 if ((slen = strlen(psrc)) > strlen(pdst)) {
5449 return False;
5450 }
5451 return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5452 }
5453
5454 /*
5455 * Do the notify calls from a rename
5456 */
5457
5458 static void notify_rename(connection_struct *conn, bool is_dir,
5459 const char *oldpath, const char *newpath)
5460 {
5461 char *olddir, *newdir;
5462 const char *oldname, *newname;
5463 uint32 mask;
5464
5465 mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5466 : FILE_NOTIFY_CHANGE_FILE_NAME;
5467
5468 if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
5469 || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
5470 TALLOC_FREE(olddir);
5471 return;
5472 }
5473
5474 if (strcmp(olddir, newdir) == 0) {
5475 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5476 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5477 }
5478 else {
5479 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5480 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5481 }
5482 TALLOC_FREE(olddir);
5483 TALLOC_FREE(newdir);
5484
5485 /* this is a strange one. w2k3 gives an additional event for
5486 CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5487 files, but not directories */
5488 if (!is_dir) {
5489 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5490 FILE_NOTIFY_CHANGE_ATTRIBUTES
5491 |FILE_NOTIFY_CHANGE_CREATION,
5492 newpath);
5493 }
5494 }
5495
5496 /****************************************************************************
5497 Rename an open file - given an fsp.
5498 ****************************************************************************/
5499
5500 NTSTATUS rename_internals_fsp(connection_struct *conn,
5501 files_struct *fsp,
5502 char *newname,
5503 const char *newname_last_component,
5504 uint32 attrs,
5505 bool replace_if_exists)
5506 {
5507 TALLOC_CTX *ctx = talloc_tos();
5508 SMB_STRUCT_STAT sbuf, sbuf1;
5509 NTSTATUS status = NT_STATUS_OK;
5510 struct share_mode_lock *lck = NULL;
5511 bool dst_exists, old_is_stream, new_is_stream;
5512
5513 ZERO_STRUCT(sbuf);
5514
5515 status = check_name(conn, newname);
5516 if (!NT_STATUS_IS_OK(status)) {
5517 return status;
5518 }
5519
5520 /* Ensure newname contains a '/' */
5521 if(strrchr_m(newname,'/') == 0) {
5522 newname = talloc_asprintf(ctx,
5523 "./%s",
5524 newname);
5525 if (!newname) {
5526 return NT_STATUS_NO_MEMORY;
5527 }
5528 }
5529
5530 /*
5531 * Check for special case with case preserving and not
5532 * case sensitive. If the old last component differs from the original
5533 * last component only by case, then we should allow
5534 * the rename (user is trying to change the case of the
5535 * filename).
5536 */
5537
5538 if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5539 strequal(newname, fsp->fsp_name)) {
5540 char *p;
5541 char *newname_modified_last_component = NULL;
5542
5543 /*
5544 * Get the last component of the modified name.
5545 * Note that we guarantee that newname contains a '/'
5546 * character above.
5547 */
5548 p = strrchr_m(newname,'/');
5549 newname_modified_last_component = talloc_strdup(ctx,
5550 p+1);
5551 if (!newname_modified_last_component) {
5552 return NT_STATUS_NO_MEMORY;
5553 }
5554
5555 if(strcsequal(newname_modified_last_component,
5556 newname_last_component) == False) {
5557 /*
5558 * Replace the modified last component with
5559 * the original.
5560 */
5561 *p = '\0'; /* Truncate at the '/' */
5562 newname = talloc_asprintf(ctx,
5563 "%s/%s",
5564 newname,
5565 newname_last_component);
5566 }
5567 }
5568
5569 /*
5570 * If the src and dest names are identical - including case,
5571 * don't do the rename, just return success.
5572 */
5573
5574 if (strcsequal(fsp->fsp_name, newname)) {
5575 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5576 newname));
5577 return NT_STATUS_OK;
5578 }
5579
5580 old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5581 new_is_stream = is_ntfs_stream_name(newname);
5582
5583 /* Return the correct error code if both names aren't streams. */
5584 if (!old_is_stream && new_is_stream) {
5585 return NT_STATUS_OBJECT_NAME_INVALID;
5586 }
5587
5588 if (old_is_stream && !new_is_stream) {
5589 return NT_STATUS_INVALID_PARAMETER;
5590 }
5591
5592 /*
5593 * Have vfs_object_exist also fill sbuf1
5594 */
5595 dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5596
5597 if(!replace_if_exists && dst_exists) {
5598 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5599 fsp->fsp_name,newname));
5600 return NT_STATUS_OBJECT_NAME_COLLISION;
5601 }
5602
5603 if (dst_exists) {
5604 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5605 files_struct *dst_fsp = file_find_di_first(fileid);
5606 /* The file can be open when renaming a stream */
5607 if (dst_fsp && !new_is_stream) {
5608 DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5609 return NT_STATUS_ACCESS_DENIED;
5610 }
5611 }
5612
5613 /* Ensure we have a valid stat struct for the source. */
5614 if (fsp->fh->fd != -1) {
5615 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5616 return map_nt_error_from_unix(errno);
5617 }
5618 } else {
5619 int ret = -1;
5620 if (fsp->posix_open) {
5621 ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5622 } else {
5623 ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5624 }
5625 if (ret == -1) {
5626 return map_nt_error_from_unix(errno);
5627 }
5628 }
5629
5630 status = can_rename(conn, fsp, attrs, &sbuf);
5631
5632 if (!NT_STATUS_IS_OK(status)) {
5633 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5634 nt_errstr(status), fsp->fsp_name,newname));
5635 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5636 status = NT_STATUS_ACCESS_DENIED;
5637 return status;
5638 }
5639
5640 if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5641 return NT_STATUS_ACCESS_DENIED;
5642 }
5643
5644 lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5645 NULL);
5646
5647 /*
5648 * We have the file open ourselves, so not being able to get the
5649 * corresponding share mode lock is a fatal error.
5650 */
5651
5652 SMB_ASSERT(lck != NULL);
5653
5654 if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5655 uint32 create_options = fsp->fh->private_options;
5656
5657 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5658 fsp->fsp_name,newname));
5659
5660 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5661
5662 rename_open_files(conn, lck, newname);
5663
5664 /*
5665 * A rename acts as a new file create w.r.t. allowing an initial delete
5666 * on close, probably because in Windows there is a new handle to the
5667 * new file. If initial delete on close was requested but not
5668 * originally set, we need to set it here. This is probably not 100% correct,
5669 * but will work for the CIFSFS client which in non-posix mode
5670 * depends on these semantics. JRA.
5671 */
5672
5673 if (create_options & FILE_DELETE_ON_CLOSE) {
5674 status = can_set_delete_on_close(fsp, True, 0);
5675
5676 if (NT_STATUS_IS_OK(status)) {
5677 /* Note that here we set the *inital* delete on close flag,
5678 * not the regular one. The magic gets handled in close. */
5679 fsp->initial_delete_on_close = True;
5680 }
5681 }
5682 TALLOC_FREE(lck);
5683 return NT_STATUS_OK;
5684 }
5685
5686 TALLOC_FREE(lck);
5687
5688 if (errno == ENOTDIR || errno == EISDIR) {
5689 status = NT_STATUS_OBJECT_NAME_COLLISION;
5690 } else {
5691 status = map_nt_error_from_unix(errno);
5692 }
5693
5694 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5695 nt_errstr(status), fsp->fsp_name,newname));
5696
5697 return status;
5698 }
5699
5700 /****************************************************************************
5701 The guts of the rename command, split out so it may be called by the NT SMB
5702 code.
5703 ****************************************************************************/
5704
5705 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5706 connection_struct *conn,
5707 struct smb_request *req,
5708 const char *name_in,
5709 const char *newname_in,
5710 uint32 attrs,
5711 bool replace_if_exists,
5712 bool src_has_wild,
5713 bool dest_has_wild,
5714 uint32_t access_mask)
5715 {
5716 char *directory = NULL;
5717 char *mask = NULL;
5718 char *last_component_src = NULL;
5719 char *last_component_dest = NULL;
5720 char *name = NULL;
5721 char *newname = NULL;
5722 char *p;
5723 int count=0;
5724 NTSTATUS status = NT_STATUS_OK;
5725 SMB_STRUCT_STAT sbuf1, sbuf2;
5726 struct smb_Dir *dir_hnd = NULL;
5727 const char *dname;
5728 long offset = 0;
5729 int create_options = 0;
5730 bool posix_pathnames = lp_posix_pathnames();
5731
5732 ZERO_STRUCT(sbuf1);
5733 ZERO_STRUCT(sbuf2);
5734
5735 status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5736 &last_component_src, &sbuf1);
5737 if (!NT_STATUS_IS_OK(status)) {
5738 return status;
5739 }
5740
5741 status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5742 &last_component_dest, &sbuf2);
5743 if (!NT_STATUS_IS_OK(status)) {
5744 return status;
5745 }
5746
5747 /*
5748 * Split the old name into directory and last component
5749 * strings. Note that unix_convert may have stripped off a
5750 * leading ./ from both name and newname if the rename is
5751 * at the root of the share. We need to make sure either both
5752 * name and newname contain a / character or neither of them do
5753 * as this is checked in resolve_wildcards().
5754 */
5755
5756 p = strrchr_m(name,'/');
5757 if (!p) {
5758 directory = talloc_strdup(ctx, ".");
5759 if (!directory) {
5760 return NT_STATUS_NO_MEMORY;
5761 }
5762 mask = name;
5763 } else {
5764 *p = 0;
5765 directory = talloc_strdup(ctx, name);
5766 if (!directory) {
5767 return NT_STATUS_NO_MEMORY;
5768 }
5769 mask = p+1;
5770 *p = '/'; /* Replace needed for exceptional test below. */
5771 }
5772
5773 /*
5774 * We should only check the mangled cache
5775 * here if unix_convert failed. This means
5776 * that the path in 'mask' doesn't exist
5777 * on the file system and so we need to look
5778 * for a possible mangle. This patch from
5779 * Tine Smukavec <valentin.smukavec@hermes.si>.
5780 */
5781
5782 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5783 char *new_mask = NULL;
5784 mangle_lookup_name_from_8_3(ctx,
5785 mask,
5786 &new_mask,
5787 conn->params );
5788 if (new_mask) {
5789 mask = new_mask;
5790 }
5791 }
5792
5793 if (!src_has_wild) {
5794 files_struct *fsp;
5795
5796 /*
5797 * No wildcards - just process the one file.
5798 */
5799 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5800
5801 /* Add a terminating '/' to the directory name. */
5802 directory = talloc_asprintf_append(directory,
5803 "/%s",
5804 mask);
5805 if (!directory) {
5806 return NT_STATUS_NO_MEMORY;
5807 }
5808
5809 /* Ensure newname contains a '/' also */
5810 if(strrchr_m(newname,'/') == 0) {
5811 newname = talloc_asprintf(ctx,
5812 "./%s",
5813 newname);
5814 if (!newname) {
5815 return NT_STATUS_NO_MEMORY;
5816 }
5817 }
5818
5819 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5820 "case_preserve = %d, short case preserve = %d, "
5821 "directory = %s, newname = %s, "
5822 "last_component_dest = %s, is_8_3 = %d\n",
5823 conn->case_sensitive, conn->case_preserve,
5824 conn->short_case_preserve, directory,
5825 newname, last_component_dest, is_short_name));
5826
5827 /* The dest name still may have wildcards. */
5828 if (dest_has_wild) {
5829 char *mod_newname = NULL;
5830 if (!resolve_wildcards(ctx,
5831 directory,newname,&mod_newname)) {
5832 DEBUG(6, ("rename_internals: resolve_wildcards "
5833 "%s %s failed\n",
5834 directory,
5835 newname));
5836 return NT_STATUS_NO_MEMORY;
5837 }
5838 newname = mod_newname;
5839 }
5840
5841 ZERO_STRUCT(sbuf1);
5842 if (posix_pathnames) {
5843 SMB_VFS_LSTAT(conn, directory, &sbuf1);
5844 } else {
5845 SMB_VFS_STAT(conn, directory, &sbuf1);
5846 }
5847
5848 if (S_ISDIR(sbuf1.st_mode)) {
5849 create_options |= FILE_DIRECTORY_FILE;
5850 }
5851
5852 status = SMB_VFS_CREATE_FILE(
5853 conn, /* conn */
5854 req, /* req */
5855 0, /* root_dir_fid */
5856 directory, /* fname */
5857 0, /* create_file_flags */
5858 access_mask, /* access_mask */
5859 (FILE_SHARE_READ | /* share_access */
5860 FILE_SHARE_WRITE),
5861 FILE_OPEN, /* create_disposition*/
5862 create_options, /* create_options */
5863 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
5864 0, /* oplock_request */
5865 0, /* allocation_size */
5866 NULL, /* sd */
5867 NULL, /* ea_list */
5868 &fsp, /* result */
5869 NULL, /* pinfo */
5870 &sbuf1); /* psbuf */
5871
5872 if (!NT_STATUS_IS_OK(status)) {
5873 DEBUG(3, ("Could not open rename source %s: %s\n",
5874 directory, nt_errstr(status)));
5875 return status;
5876 }
5877
5878 status = rename_internals_fsp(conn, fsp, newname,
5879 last_component_dest,
5880 attrs, replace_if_exists);
5881
5882 close_file(req, fsp, NORMAL_CLOSE);
5883
5884 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5885 nt_errstr(status), directory,newname));
5886
5887 return status;
5888 }
5889
5890 /*
5891 * Wildcards - process each file that matches.
5892 */
5893 if (strequal(mask,"????????.???")) {
5894 mask[0] = '*';
5895 mask[1] = '\0';
5896 }
5897
5898 status = check_name(conn, directory);
5899 if (!NT_STATUS_IS_OK(status)) {
5900 return status;
5901 }
5902
5903 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5904 if (dir_hnd == NULL) {
5905 return map_nt_error_from_unix(errno);
5906 }
5907
5908 status = NT_STATUS_NO_SUCH_FILE;
5909 /*
5910 * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5911 * - gentest fix. JRA
5912 */
5913
5914 while ((dname = ReadDirName(dir_hnd, &offset))) {
5915 files_struct *fsp = NULL;
5916 char *fname = NULL;
5917 char *destname = NULL;
5918 bool sysdir_entry = False;
5919
5920 /* Quick check for "." and ".." */
5921 if (ISDOT(dname) || ISDOTDOT(dname)) {
5922 if (attrs & aDIR) {
5923 sysdir_entry = True;
5924 } else {
5925 continue;
5926 }
5927 }
5928
5929 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5930 continue;
5931 }
5932
5933 if(!mask_match(dname, mask, conn->case_sensitive)) {
5934 continue;
5935 }
5936
5937 if (sysdir_entry) {
5938 status = NT_STATUS_OBJECT_NAME_INVALID;
5939 break;
5940 }
5941
5942 fname = talloc_asprintf(ctx,
5943 "%s/%s",
5944 directory,
5945 dname);
5946 if (!fname) {
5947 return NT_STATUS_NO_MEMORY;
5948 }
5949
5950 if (!resolve_wildcards(ctx,
5951 fname,newname,&destname)) {
5952 DEBUG(6, ("resolve_wildcards %s %s failed\n",
5953 fname, destname));
5954 TALLOC_FREE(fname);
5955 continue;
5956 }
5957 if (!destname) {
5958 return NT_STATUS_NO_MEMORY;
5959 }
5960
5961 ZERO_STRUCT(sbuf1);
5962 if (posix_pathnames) {
5963 SMB_VFS_LSTAT(conn, fname, &sbuf1);
5964 } else {
5965 SMB_VFS_STAT(conn, fname, &sbuf1);
5966 }
5967
5968 create_options = 0;
5969
5970 if (S_ISDIR(sbuf1.st_mode)) {
5971 create_options |= FILE_DIRECTORY_FILE;
5972 }
5973
5974 status = SMB_VFS_CREATE_FILE(
5975 conn, /* conn */
5976 req, /* req */
5977 0, /* root_dir_fid */
5978 fname, /* fname */
5979 0, /* create_file_flags */
5980 access_mask, /* access_mask */
5981 (FILE_SHARE_READ | /* share_access */
5982 FILE_SHARE_WRITE),
5983 FILE_OPEN, /* create_disposition*/
5984 create_options, /* create_options */
5985 posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
5986 0, /* oplock_request */
5987 0, /* allocation_size */
5988 NULL, /* sd */
5989 NULL, /* ea_list */
5990 &fsp, /* result */
5991 NULL, /* pinfo */
5992 &sbuf1); /* psbuf */
5993
5994 if (!NT_STATUS_IS_OK(status)) {
5995 DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
5996 "returned %s rename %s -> %s\n",
5997 nt_errstr(status), directory, newname));
5998 break;
5999 }
6000
6001 status = rename_internals_fsp(conn, fsp, destname, dname,
6002 attrs, replace_if_exists);
6003
6004 close_file(req, fsp, NORMAL_CLOSE);
6005
6006 if (!NT_STATUS_IS_OK(status)) {
6007 DEBUG(3, ("rename_internals_fsp returned %s for "
6008 "rename %s -> %s\n", nt_errstr(status),
6009 directory, newname));
6010 break;
6011 }
6012
6013 count++;
6014
6015 DEBUG(3,("rename_internals: doing rename on %s -> "
6016 "%s\n",fname,destname));
6017
6018 TALLOC_FREE(fname);
6019 TALLOC_FREE(destname);
6020 }
6021 TALLOC_FREE(dir_hnd);
6022
6023 if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6024 status = map_nt_error_from_unix(errno);
6025 }
6026
6027 return status;
6028 }
6029
6030 /****************************************************************************
6031 Reply to a mv.
6032 ****************************************************************************/
6033
6034 void reply_mv(struct smb_request *req)
6035 {
6036 connection_struct *conn = req->conn;
6037 char *name = NULL;
6038 char *newname = NULL;
6039 const char *p;
6040 uint32 attrs;
6041 NTSTATUS status;
6042 bool src_has_wcard = False;
6043 bool dest_has_wcard = False;
6044 TALLOC_CTX *ctx = talloc_tos();
6045
6046 START_PROFILE(SMBmv);
6047
6048 if (req->wct < 1) {
6049 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6050 END_PROFILE(SMBmv);
6051 return;
6052 }
6053
6054 attrs = SVAL(req->vwv+0, 0);
6055
6056 p = (const char *)req->buf + 1;
6057 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6058 &status, &src_has_wcard);
6059 if (!NT_STATUS_IS_OK(status)) {
6060 reply_nterror(req, status);
6061 END_PROFILE(SMBmv);
6062 return;
6063 }
6064 p++;
6065 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6066 &status, &dest_has_wcard);
6067 if (!NT_STATUS_IS_OK(status)) {
6068 reply_nterror(req, status);
6069 END_PROFILE(SMBmv);
6070 return;
6071 }
6072
6073 status = resolve_dfspath_wcard(ctx, conn,
6074 req->flags2 & FLAGS2_DFS_PATHNAMES,
6075 name,
6076 &name,
6077 &src_has_wcard);
6078 if (!NT_STATUS_IS_OK(status)) {
6079 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6080 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6081 ERRSRV, ERRbadpath);
6082 END_PROFILE(SMBmv);
6083 return;
6084 }
6085 reply_nterror(req, status);
6086 END_PROFILE(SMBmv);
6087 return;
6088 }
6089
6090 status = resolve_dfspath_wcard(ctx, conn,
6091 req->flags2 & FLAGS2_DFS_PATHNAMES,
6092 newname,
6093 &newname,
6094 &dest_has_wcard);
6095 if (!NT_STATUS_IS_OK(status)) {
6096 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6097 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6098 ERRSRV, ERRbadpath);
6099 END_PROFILE(SMBmv);
6100 return;
6101 }
6102 reply_nterror(req, status);
6103 END_PROFILE(SMBmv);
6104 return;
6105 }
6106
6107 DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6108
6109 status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6110 src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6111 if (!NT_STATUS_IS_OK(status)) {
6112 if (open_was_deferred(req->mid)) {
6113 /* We have re-scheduled this call. */
6114 END_PROFILE(SMBmv);
6115 return;
6116 }
6117 reply_nterror(req, status);
6118 END_PROFILE(SMBmv);
6119 return;
6120 }
6121
6122 reply_outbuf(req, 0, 0);
6123
6124 END_PROFILE(SMBmv);
6125 return;
6126 }
6127
6128 /*******************************************************************
6129 Copy a file as part of a reply_copy.
6130 ******************************************************************/
6131
6132 /*
6133 * TODO: check error codes on all callers
6134 */
6135
6136 NTSTATUS copy_file(TALLOC_CTX *ctx,
6137 connection_struct *conn,
6138 const char *src,
6139 const char *dest1,
6140 int ofun,
6141 int count,
6142 bool target_is_directory)
6143 {
6144 SMB_STRUCT_STAT src_sbuf, sbuf2;
6145 SMB_OFF_T ret=-1;
6146 files_struct *fsp1,*fsp2;
6147 char *dest = NULL;
6148 uint32 dosattrs;
6149 uint32 new_create_disposition;
6150 NTSTATUS status;
6151
6152 dest = talloc_strdup(ctx, dest1);
6153 if (!dest) {
6154 return NT_STATUS_NO_MEMORY;
6155 }
6156 if (target_is_directory) {
6157 const char *p = strrchr_m(src,'/');
6158 if (p) {
6159 p++;
6160 } else {
6161 p = src;
6162 }
6163 dest = talloc_asprintf_append(dest,
6164 "/%s",
6165 p);
6166 if (!dest) {
6167 return NT_STATUS_NO_MEMORY;
6168 }
6169 }
6170
6171 if (!vfs_file_exist(conn,src,&src_sbuf)) {
6172 TALLOC_FREE(dest);
6173 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6174 }
6175
6176 if (!target_is_directory && count) {
6177 new_create_disposition = FILE_OPEN;
6178 } else {
6179 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6180 NULL, NULL, &new_create_disposition, NULL)) {
6181 TALLOC_FREE(dest);
6182 return NT_STATUS_INVALID_PARAMETER;
6183 }
6184 }
6185
6186 status = SMB_VFS_CREATE_FILE(
6187 conn, /* conn */
6188 NULL, /* req */
6189 0, /* root_dir_fid */
6190 src, /* fname */
6191 0, /* create_file_flags */
6192 FILE_GENERIC_READ, /* access_mask */
6193 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6194 FILE_OPEN, /* create_disposition*/
6195 0, /* create_options */
6196 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6197 INTERNAL_OPEN_ONLY, /* oplock_request */
6198 0, /* allocation_size */
6199 NULL, /* sd */
6200 NULL, /* ea_list */
6201 &fsp1, /* result */
6202 NULL, /* pinfo */
6203 &src_sbuf); /* psbuf */
6204
6205 if (!NT_STATUS_IS_OK(status)) {
6206 TALLOC_FREE(dest);
6207 return status;
6208 }
6209
6210 dosattrs = dos_mode(conn, src, &src_sbuf);
6211 if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6212 ZERO_STRUCTP(&sbuf2);
6213 }
6214
6215 status = SMB_VFS_CREATE_FILE(
6216 conn, /* conn */
6217 NULL, /* req */
6218 0, /* root_dir_fid */
6219 dest, /* fname */
6220 0, /* create_file_flags */
6221 FILE_GENERIC_WRITE, /* access_mask */
6222 FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
6223 new_create_disposition, /* create_disposition*/
6224 0, /* create_options */
6225 dosattrs, /* file_attributes */
6226 INTERNAL_OPEN_ONLY, /* oplock_request */
6227 0, /* allocation_size */
6228 NULL, /* sd */
6229 NULL, /* ea_list */
6230 &fsp2, /* result */
6231 NULL, /* pinfo */
6232 &sbuf2); /* psbuf */
6233
6234 TALLOC_FREE(dest);
6235
6236 if (!NT_STATUS_IS_OK(status)) {
6237 close_file(NULL, fsp1, ERROR_CLOSE);
6238 return status;
6239 }
6240
6241 if ((ofun&3) == 1) {
6242 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6243 DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6244 /*
6245 * Stop the copy from occurring.
6246 */
6247 ret = -1;
6248 src_sbuf.st_size = 0;
6249 }
6250 }
6251
6252 if (src_sbuf.st_size) {
6253 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6254 }
6255
6256 close_file(NULL, fsp1, NORMAL_CLOSE);
6257
6258 /* Ensure the modtime is set correctly on the destination file. */
6259 set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6260
6261 /*
6262 * As we are opening fsp1 read-only we only expect
6263 * an error on close on fsp2 if we are out of space.
6264 * Thus we don't look at the error return from the
6265 * close of fsp1.
6266 */
6267 status = close_file(NULL, fsp2, NORMAL_CLOSE);
6268
6269 if (!NT_STATUS_IS_OK(status)) {
6270 return status;
6271 }
6272
6273 if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6274 return NT_STATUS_DISK_FULL;
6275 }
6276
6277 return NT_STATUS_OK;
6278 }
6279
6280 /****************************************************************************
6281 Reply to a file copy.
6282 ****************************************************************************/
6283
6284 void reply_copy(struct smb_request *req)
6285 {
6286 connection_struct *conn = req->conn;
6287 char *name = NULL;
6288 char *newname = NULL;
6289 char *directory = NULL;
6290 const char *mask = NULL;
6291 const char mask_star[] = "*";
6292 const char *p;
6293 int count=0;
6294 int error = ERRnoaccess;
6295 int err = 0;
6296 int tid2;
6297 int ofun;
6298 int flags;
6299 bool target_is_directory=False;
6300 bool source_has_wild = False;
6301 bool dest_has_wild = False;
6302 SMB_STRUCT_STAT sbuf1, sbuf2;
6303 NTSTATUS status;
6304 TALLOC_CTX *ctx = talloc_tos();
6305
6306 START_PROFILE(SMBcopy);
6307
6308 if (req->wct < 3) {
6309 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6310 END_PROFILE(SMBcopy);
6311 return;
6312 }
6313
6314 tid2 = SVAL(req->vwv+0, 0);
6315 ofun = SVAL(req->vwv+1, 0);
6316 flags = SVAL(req->vwv+2, 0);
6317
6318 p = (const char *)req->buf;
6319 p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6320 &status, &source_has_wild);
6321 if (!NT_STATUS_IS_OK(status)) {
6322 reply_nterror(req, status);
6323 END_PROFILE(SMBcopy);
6324 return;
6325 }
6326 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6327 &status, &dest_has_wild);
6328 if (!NT_STATUS_IS_OK(status)) {
6329 reply_nterror(req, status);
6330 END_PROFILE(SMBcopy);
6331 return;
6332 }
6333
6334 DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6335
6336 if (tid2 != conn->cnum) {
6337 /* can't currently handle inter share copies XXXX */
6338 DEBUG(3,("Rejecting inter-share copy\n"));
6339 reply_doserror(req, ERRSRV, ERRinvdevice);
6340 END_PROFILE(SMBcopy);
6341 return;
6342 }
6343
6344 status = resolve_dfspath_wcard(ctx, conn,
6345 req->flags2 & FLAGS2_DFS_PATHNAMES,
6346 name,
6347 &name,
6348 &source_has_wild);
6349 if (!NT_STATUS_IS_OK(status)) {
6350 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6351 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6352 ERRSRV, ERRbadpath);
6353 END_PROFILE(SMBcopy);
6354 return;
6355 }
6356 reply_nterror(req, status);
6357 END_PROFILE(SMBcopy);
6358 return;
6359 }
6360
6361 status = resolve_dfspath_wcard(ctx, conn,
6362 req->flags2 & FLAGS2_DFS_PATHNAMES,
6363 newname,
6364 &newname,
6365 &dest_has_wild);
6366 if (!NT_STATUS_IS_OK(status)) {
6367 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6368 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6369 ERRSRV, ERRbadpath);
6370 END_PROFILE(SMBcopy);
6371 return;
6372 }
6373 reply_nterror(req, status);
6374 END_PROFILE(SMBcopy);
6375 return;
6376 }
6377
6378 status = unix_convert(ctx, conn, name, source_has_wild,
6379 &name, NULL, &sbuf1);
6380 if (!NT_STATUS_IS_OK(status)) {
6381 reply_nterror(req, status);
6382 END_PROFILE(SMBcopy);
6383 return;
6384 }
6385
6386 status = unix_convert(ctx, conn, newname, dest_has_wild,
6387 &newname, NULL, &sbuf2);
6388 if (!NT_STATUS_IS_OK(status)) {
6389 reply_nterror(req, status);
6390 END_PROFILE(SMBcopy);
6391 return;
6392 }
6393
6394 target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6395
6396 if ((flags&1) && target_is_directory) {
6397 reply_doserror(req, ERRDOS, ERRbadfile);
6398 END_PROFILE(SMBcopy);
6399 return;
6400 }
6401
6402 if ((flags&2) && !target_is_directory) {
6403 reply_doserror(req, ERRDOS, ERRbadpath);
6404 END_PROFILE(SMBcopy);
6405 return;
6406 }
6407
6408 if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6409 /* wants a tree copy! XXXX */
6410 DEBUG(3,("Rejecting tree copy\n"));
6411 reply_doserror(req, ERRSRV, ERRerror);
6412 END_PROFILE(SMBcopy);
6413 return;
6414 }
6415
6416 p = strrchr_m(name,'/');
6417 if (p != NULL) {
6418 directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
6419 mask = p+1;
6420 } else {
6421 directory = talloc_strdup(ctx, "./");
6422 mask = name;
6423 }
6424
6425 if (!directory) {
6426 reply_nterror(req, NT_STATUS_NO_MEMORY);
6427 END_PROFILE(SMBcopy);
6428 return;
6429 }
6430
6431 /*
6432 * We should only check the mangled cache
6433 * here if unix_convert failed. This means
6434 * that the path in 'mask' doesn't exist
6435 * on the file system and so we need to look
6436 * for a possible mangle. This patch from
6437 * Tine Smukavec <valentin.smukavec@hermes.si>.
6438 */
6439
6440 if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6441 char *new_mask = NULL;
6442 mangle_lookup_name_from_8_3(ctx,
6443 mask,
6444 &new_mask,
6445 conn->params );
6446 if (new_mask) {
6447 mask = new_mask;
6448 }
6449 }
6450
6451 if (!source_has_wild) {
6452 directory = talloc_asprintf_append(directory,
6453 "/%s",
6454 mask);
6455 if (dest_has_wild) {
6456 char *mod_newname = NULL;
6457 if (!resolve_wildcards(ctx,
6458 directory,newname,&mod_newname)) {
6459 reply_nterror(req, NT_STATUS_NO_MEMORY);
6460 END_PROFILE(SMBcopy);
6461 return;
6462 }
6463 newname = mod_newname;
6464 }
6465
6466 status = check_name(conn, directory);
6467 if (!NT_STATUS_IS_OK(status)) {
6468 reply_nterror(req, status);
6469 END_PROFILE(SMBcopy);
6470 return;
6471 }
6472
6473 status = check_name(conn, newname);
6474 if (!NT_STATUS_IS_OK(status)) {
6475 reply_nterror(req, status);
6476 END_PROFILE(SMBcopy);
6477 return;
6478 }
6479
6480 status = copy_file(ctx,conn,directory,newname,ofun,
6481 count,target_is_directory);
6482
6483 if(!NT_STATUS_IS_OK(status)) {
6484 reply_nterror(req, status);
6485 END_PROFILE(SMBcopy);
6486 return;
6487 } else {
6488 count++;
6489 }
6490 } else {
6491 struct smb_Dir *dir_hnd = NULL;
6492 const char *dname = NULL;
6493 long offset = 0;
6494
6495 if (strequal(mask,"????????.???")) {
6496 mask = mask_star;
6497 }
6498
6499 status = check_name(conn, directory);
6500 if (!NT_STATUS_IS_OK(status)) {
6501 reply_nterror(req, status);
6502 END_PROFILE(SMBcopy);
6503 return;
6504 }
6505
6506 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6507 if (dir_hnd == NULL) {
6508 status = map_nt_error_from_unix(errno);
6509 reply_nterror(req, status);
6510 END_PROFILE(SMBcopy);
6511 return;
6512 }
6513
6514 error = ERRbadfile;
6515
6516 while ((dname = ReadDirName(dir_hnd, &offset))) {
6517 char *destname = NULL;
6518 char *fname = NULL;
6519
6520 if (ISDOT(dname) || ISDOTDOT(dname)) {
6521 continue;
6522 }
6523
6524 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6525 continue;
6526 }
6527
6528 if(!mask_match(dname, mask, conn->case_sensitive)) {
6529 continue;
6530 }
6531
6532 error = ERRnoaccess;
6533 fname = talloc_asprintf(ctx,
6534 "%s/%s",
6535 directory,
6536 dname);
6537 if (!fname) {
6538 TALLOC_FREE(dir_hnd);
6539 reply_nterror(req, NT_STATUS_NO_MEMORY);
6540 END_PROFILE(SMBcopy);
6541 return;
6542 }
6543
6544 if (!resolve_wildcards(ctx,
6545 fname,newname,&destname)) {
6546 continue;
6547 }
6548 if (!destname) {
6549 TALLOC_FREE(dir_hnd);
6550 reply_nterror(req, NT_STATUS_NO_MEMORY);
6551 END_PROFILE(SMBcopy);
6552 return;
6553 }
6554
6555 status = check_name(conn, fname);
6556 if (!NT_STATUS_IS_OK(status)) {
6557 TALLOC_FREE(dir_hnd);
6558 reply_nterror(req, status);
6559 END_PROFILE(SMBcopy);
6560 return;
6561 }
6562
6563 status = check_name(conn, destname);
6564 if (!NT_STATUS_IS_OK(status)) {
6565 TALLOC_FREE(dir_hnd);
6566 reply_nterror(req, status);
6567 END_PROFILE(SMBcopy);
6568 return;
6569 }
6570
6571 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6572
6573 status = copy_file(ctx,conn,fname,destname,ofun,
6574 count,target_is_directory);
6575 if (NT_STATUS_IS_OK(status)) {
6576 count++;
6577 }
6578 TALLOC_FREE(fname);
6579 TALLOC_FREE(destname);
6580 }
6581 TALLOC_FREE(dir_hnd);
6582 }
6583
6584 if (count == 0) {
6585 if(err) {
6586 /* Error on close... */
6587 errno = err;
6588 reply_unixerror(req, ERRHRD, ERRgeneral);
6589 END_PROFILE(SMBcopy);
6590 return;
6591 }
6592
6593 reply_doserror(req, ERRDOS, error);
6594 END_PROFILE(SMBcopy);
6595 return;
6596 }
6597
6598 reply_outbuf(req, 1, 0);
6599 SSVAL(req->outbuf,smb_vwv0,count);
6600
6601 END_PROFILE(SMBcopy);
6602 return;
6603 }
6604
6605 #undef DBGC_CLASS
6606 #define DBGC_CLASS DBGC_LOCKING
6607
6608 /****************************************************************************
6609 Get a lock pid, dealing with large count requests.
6610 ****************************************************************************/
6611
6612 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6613 bool large_file_format)
6614 {
6615 if(!large_file_format)
6616 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6617 else
6618 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6619 }
6620
6621 /****************************************************************************
6622 Get a lock count, dealing with large count requests.
6623 ****************************************************************************/
6624
6625 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6626 bool large_file_format)
6627 {
6628 uint64_t count = 0;
6629
6630 if(!large_file_format) {
6631 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6632 } else {
6633
6634 #if defined(HAVE_LONGLONG)
6635 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6636 ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6637 #else /* HAVE_LONGLONG */
6638
6639 /*
6640 * NT4.x seems to be broken in that it sends large file (64 bit)
6641 * lockingX calls even if the CAP_LARGE_FILES was *not*
6642 * negotiated. For boxes without large unsigned ints truncate the
6643 * lock count by dropping the top 32 bits.
6644 */
6645
6646 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6647 DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6648 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6649 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6650 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6651 }
6652
6653 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6654 #endif /* HAVE_LONGLONG */
6655 }
6656
6657 return count;
6658 }
6659
6660 #if !defined(HAVE_LONGLONG)
6661 /****************************************************************************
6662 Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6663 ****************************************************************************/
6664
6665 static uint32 map_lock_offset(uint32 high, uint32 low)
6666 {
6667 unsigned int i;
6668 uint32 mask = 0;
6669 uint32 highcopy = high;
6670
6671 /*
6672 * Try and find out how many significant bits there are in high.
6673 */
6674
6675 for(i = 0; highcopy; i++)
6676 highcopy >>= 1;
6677
6678 /*
6679 * We use 31 bits not 32 here as POSIX
6680 * lock offsets may not be negative.
6681 */
6682
6683 mask = (~0) << (31 - i);
6684
6685 if(low & mask)
6686 return 0; /* Fail. */
6687
6688 high <<= (31 - i);
6689
6690 return (high|low);
6691 }
6692 #endif /* !defined(HAVE_LONGLONG) */
6693
6694 /****************************************************************************
6695 Get a lock offset, dealing with large offset requests.
6696 ****************************************************************************/
6697
6698 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
6699 bool large_file_format, bool *err)
6700 {
6701 uint64_t offset = 0;
6702
6703 *err = False;
6704
6705 if(!large_file_format) {
6706 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6707 } else {
6708
6709 #if defined(HAVE_LONGLONG)
6710 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6711 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6712 #else /* HAVE_LONGLONG */
6713
6714 /*
6715 * NT4.x seems to be broken in that it sends large file (64 bit)
6716 * lockingX calls even if the CAP_LARGE_FILES was *not*
6717 * negotiated. For boxes without large unsigned ints mangle the
6718 * lock offset by mapping the top 32 bits onto the lower 32.
6719 */
6720
6721 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6722 uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6723 uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6724 uint32 new_low = 0;
6725
6726 if((new_low = map_lock_offset(high, low)) == 0) {
6727 *err = True;
6728 return (uint64_t)-1;
6729 }
6730
6731 DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6732 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6733 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6734 SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6735 }
6736
6737 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6738 #endif /* HAVE_LONGLONG */
6739 }
6740
6741 return offset;
6742 }
6743
6744 /****************************************************************************
6745 Reply to a lockingX request.
6746 ****************************************************************************/
6747
6748 void reply_lockingX(struct smb_request *req)
6749 {
6750 connection_struct *conn = req->conn;
6751 files_struct *fsp;
6752 unsigned char locktype;
6753 unsigned char oplocklevel;
6754 uint16 num_ulocks;
6755 uint16 num_locks;
6756 uint64_t count = 0, offset = 0;
6757 uint32 lock_pid;
6758 int32 lock_timeout;
6759 int i;
6760 const uint8_t *data;
6761 bool large_file_format;
6762 bool err;
6763 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6764
6765 START_PROFILE(SMBlockingX);
6766
6767 if (req->wct < 8) {
6768 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6769 END_PROFILE(SMBlockingX);
6770 return;
6771 }
6772
6773 fsp = file_fsp(req, SVAL(req->vwv+2, 0));
6774 locktype = CVAL(req->vwv+3, 0);
6775 oplocklevel = CVAL(req->vwv+3, 1);
6776 num_ulocks = SVAL(req->vwv+6, 0);
6777 num_locks = SVAL(req->vwv+7, 0);
6778 lock_timeout = IVAL(req->vwv+4, 0);
6779 large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6780
6781 if (!check_fsp(conn, req, fsp)) {
6782 END_PROFILE(SMBlockingX);
6783 return;
6784 }
6785
6786 data = req->buf;
6787
6788 if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6789 /* we don't support these - and CANCEL_LOCK makes w2k
6790 and XP reboot so I don't really want to be
6791 compatible! (tridge) */
6792 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6793 END_PROFILE(SMBlockingX);
6794 return;
6795 }
6796
6797 /* Check if this is an oplock break on a file
6798 we have granted an oplock on.
6799 */
6800 if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6801 /* Client can insist on breaking to none. */
6802 bool break_to_none = (oplocklevel == 0);
6803 bool result;
6804
6805 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6806 "for fnum = %d\n", (unsigned int)oplocklevel,
6807 fsp->fnum ));
6808
6809 /*
6810 * Make sure we have granted an exclusive or batch oplock on
6811 * this file.
6812 */
6813
6814 if (fsp->oplock_type == 0) {
6815
6816 /* The Samba4 nbench simulator doesn't understand
6817 the difference between break to level2 and break
6818 to none from level2 - it sends oplock break
6819 replies in both cases. Don't keep logging an error
6820 message here - just ignore it. JRA. */
6821
6822 DEBUG(5,("reply_lockingX: Error : oplock break from "
6823 "client for fnum = %d (oplock=%d) and no "
6824 "oplock granted on this file (%s).\n",
6825 fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6826
6827 /* if this is a pure oplock break request then don't
6828 * send a reply */
6829 if (num_locks == 0 && num_ulocks == 0) {
6830 END_PROFILE(SMBlockingX);
6831 return;
6832 } else {
6833 END_PROFILE(SMBlockingX);
6834 reply_doserror(req, ERRDOS, ERRlock);
6835 return;
6836 }
6837 }
6838
6839 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6840 (break_to_none)) {
6841 result = remove_oplock(fsp);
6842 } else {
6843 result = downgrade_oplock(fsp);
6844 }
6845
6846 if (!result) {
6847 DEBUG(0, ("reply_lockingX: error in removing "
6848 "oplock on file %s\n", fsp->fsp_name));
6849 /* Hmmm. Is this panic justified? */
6850 smb_panic("internal tdb error");
6851 }
6852
6853 reply_to_oplock_break_requests(fsp);
6854
6855 /* if this is a pure oplock break request then don't send a
6856 * reply */
6857 if (num_locks == 0 && num_ulocks == 0) {
6858 /* Sanity check - ensure a pure oplock break is not a
6859 chained request. */
6860 if(CVAL(req->vwv+0, 0) != 0xff)
6861 DEBUG(0,("reply_lockingX: Error : pure oplock "
6862 "break is a chained %d request !\n",
6863 (unsigned int)CVAL(req->vwv+0, 0)));
6864 END_PROFILE(SMBlockingX);
6865 return;
6866 }
6867 }
6868
6869 /*
6870 * We do this check *after* we have checked this is not a oplock break
6871 * response message. JRA.
6872 */
6873
6874 release_level_2_oplocks_on_change(fsp);
6875
6876 if (req->buflen <
6877 (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6878 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6879 END_PROFILE(SMBlockingX);
6880 return;
6881 }
6882
6883 /* Data now points at the beginning of the list
6884 of smb_unlkrng structs */
6885 for(i = 0; i < (int)num_ulocks; i++) {
6886 lock_pid = get_lock_pid( data, i, large_file_format);
6887 count = get_lock_count( data, i, large_file_format);
6888 offset = get_lock_offset( data, i, large_file_format, &err);
6889
6890 /*
6891 * There is no error code marked "stupid client bug".... :-).
6892 */
6893 if(err) {
6894 END_PROFILE(SMBlockingX);
6895 reply_doserror(req, ERRDOS, ERRnoaccess);
6896 return;
6897 }
6898
6899 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6900 "pid %u, file %s\n", (double)offset, (double)count,
6901 (unsigned int)lock_pid, fsp->fsp_name ));
6902
6903 status = do_unlock(smbd_messaging_context(),
6904 fsp,
6905 lock_pid,
6906 count,
6907 offset,
6908 WINDOWS_LOCK);
6909
6910 if (NT_STATUS_V(status)) {
6911 END_PROFILE(SMBlockingX);
6912 reply_nterror(req, status);
6913 return;
6914 }
6915 }
6916
6917 /* Setup the timeout in seconds. */
6918
6919 if (!lp_blocking_locks(SNUM(conn))) {
6920 lock_timeout = 0;
6921 }
6922
6923 /* Now do any requested locks */
6924 data += ((large_file_format ? 20 : 10)*num_ulocks);
6925
6926 /* Data now points at the beginning of the list
6927 of smb_lkrng structs */
6928
6929 for(i = 0; i < (int)num_locks; i++) {
6930 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6931 READ_LOCK:WRITE_LOCK);
6932 lock_pid = get_lock_pid( data, i, large_file_format);
6933 count = get_lock_count( data, i, large_file_format);
6934 offset = get_lock_offset( data, i, large_file_format, &err);
6935
6936 /*
6937 * There is no error code marked "stupid client bug".... :-).
6938 */
6939 if(err) {
6940 END_PROFILE(SMBlockingX);
6941 reply_doserror(req, ERRDOS, ERRnoaccess);
6942 return;
6943 }
6944
6945 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6946 "%u, file %s timeout = %d\n", (double)offset,
6947 (double)count, (unsigned int)lock_pid,
6948 fsp->fsp_name, (int)lock_timeout ));
6949
6950 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6951 if (lp_blocking_locks(SNUM(conn))) {
6952
6953 /* Schedule a message to ourselves to
6954 remove the blocking lock record and
6955 return the right error. */
6956
6957 if (!blocking_lock_cancel(fsp,
6958 lock_pid,
6959 offset,
6960 count,
6961 WINDOWS_LOCK,
6962 locktype,
6963 NT_STATUS_FILE_LOCK_CONFLICT)) {
6964 END_PROFILE(SMBlockingX);
6965 reply_nterror(
6966 req,
6967 NT_STATUS_DOS(
6968 ERRDOS,
6969 ERRcancelviolation));
6970 return;
6971 }
6972 }
6973 /* Remove a matching pending lock. */
6974 status = do_lock_cancel(fsp,
6975 lock_pid,
6976 count,
6977 offset,
6978 WINDOWS_LOCK);
6979 } else {
6980 bool blocking_lock = lock_timeout ? True : False;
6981 bool defer_lock = False;
6982 struct byte_range_lock *br_lck;
6983 uint32 block_smbpid;
6984
6985 br_lck = do_lock(smbd_messaging_context(),
6986 fsp,
6987 lock_pid,
6988 count,
6989 offset,
6990 lock_type,
6991 WINDOWS_LOCK,
6992 blocking_lock,
6993 &status,
6994 &block_smbpid);
6995
6996 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6997 /* Windows internal resolution for blocking locks seems
6998 to be about 200ms... Don't wait for less than that. JRA. */
6999 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
7000 lock_timeout = lp_lock_spin_time();
7001 }
7002 defer_lock = True;
7003 }
7004
7005 /* This heuristic seems to match W2K3 very well. If a
7006 lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7007 it pretends we asked for a timeout of between 150 - 300 milliseconds as
7008 far as I can tell. Replacement for do_lock_spin(). JRA. */
7009
7010 if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7011 NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7012 defer_lock = True;
7013 lock_timeout = lp_lock_spin_time();
7014 }
7015
7016 if (br_lck && defer_lock) {
7017 /*
7018 * A blocking lock was requested. Package up
7019 * this smb into a queued request and push it
7020 * onto the blocking lock queue.
7021 */
7022 if(push_blocking_lock_request(br_lck,
7023 req,
7024 fsp,
7025 lock_timeout,
7026 i,
7027 lock_pid,
7028 lock_type,
7029 WINDOWS_LOCK,
7030 offset,
7031 count,
7032 block_smbpid)) {
7033 TALLOC_FREE(br_lck);
7034 END_PROFILE(SMBlockingX);
7035 return;
7036 }
7037 }
7038
7039 TALLOC_FREE(br_lck);
7040 }
7041
7042 if (NT_STATUS_V(status)) {
7043 END_PROFILE(SMBlockingX);
7044 reply_nterror(req, status);
7045 return;
7046 }
7047 }
7048
7049 /* If any of the above locks failed, then we must unlock
7050 all of the previous locks (X/Open spec). */
7051
7052 if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7053 (i != num_locks) &&
7054 (num_locks != 0)) {
7055 /*
7056 * Ensure we don't do a remove on the lock that just failed,
7057 * as under POSIX rules, if we have a lock already there, we
7058 * will delete it (and we shouldn't) .....
7059 */
7060 for(i--; i >= 0; i--) {
7061 lock_pid = get_lock_pid( data, i, large_file_format);
7062 count = get_lock_count( data, i, large_file_format);
7063 offset = get_lock_offset( data, i, large_file_format,
7064 &err);
7065
7066 /*
7067 * There is no error code marked "stupid client
7068 * bug".... :-).
7069 */
7070 if(err) {
7071 END_PROFILE(SMBlockingX);
7072 reply_doserror(req, ERRDOS, ERRnoaccess);
7073 return;
7074 }
7075
7076 do_unlock(smbd_messaging_context(),
7077 fsp,
7078 lock_pid,
7079 count,
7080 offset,
7081 WINDOWS_LOCK);
7082 }
7083 END_PROFILE(SMBlockingX);
7084 reply_nterror(req, status);
7085 return;
7086 }
7087
7088 reply_outbuf(req, 2, 0);
7089
7090 DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7091 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7092
7093 END_PROFILE(SMBlockingX);
7094 chain_reply(req);
7095 }
7096
7097 #undef DBGC_CLASS
7098 #define DBGC_CLASS DBGC_ALL
7099
7100 /****************************************************************************
7101 Reply to a SMBreadbmpx (read block multiplex) request.
7102 Always reply with an error, if someone has a platform really needs this,
7103 please contact vl@samba.org
7104 ****************************************************************************/
7105
7106 void reply_readbmpx(struct smb_request *req)
7107 {
7108 START_PROFILE(SMBreadBmpx);
7109 reply_doserror(req, ERRSRV, ERRuseSTD);
7110 END_PROFILE(SMBreadBmpx);
7111 return;
7112 }
7113
7114 /****************************************************************************
7115 Reply to a SMBreadbs (read block multiplex secondary) request.
7116 Always reply with an error, if someone has a platform really needs this,
7117 please contact vl@samba.org
7118 ****************************************************************************/
7119
7120 void reply_readbs(struct smb_request *req)
7121 {
7122 START_PROFILE(SMBreadBs);
7123 reply_doserror(req, ERRSRV, ERRuseSTD);
7124 END_PROFILE(SMBreadBs);
7125 return;
7126 }
7127
7128 /****************************************************************************
7129 Reply to a SMBsetattrE.
7130 ****************************************************************************/
7131
7132 void reply_setattrE(struct smb_request *req)
7133 {
7134 connection_struct *conn = req->conn;
7135 struct smb_file_time ft;
7136 files_struct *fsp;
7137 SMB_STRUCT_STAT sbuf;
7138 NTSTATUS status;
7139
7140 START_PROFILE(SMBsetattrE);
7141 ZERO_STRUCT(ft);
7142
7143 if (req->wct < 7) {
7144 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7145 END_PROFILE(SMBsetattrE);
7146 return;
7147 }
7148
7149 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7150
7151 if(!fsp || (fsp->conn != conn)) {
7152 reply_doserror(req, ERRDOS, ERRbadfid);
7153 END_PROFILE(SMBsetattrE);
7154 return;
7155 }
7156
7157
7158 /*
7159 * Convert the DOS times into unix times.
7160 */
7161
7162 ft.atime = convert_time_t_to_timespec(
7163 srv_make_unix_date2(req->vwv+3));
7164 ft.mtime = convert_time_t_to_timespec(
7165 srv_make_unix_date2(req->vwv+5));
7166 ft.create_time = convert_time_t_to_timespec(
7167 srv_make_unix_date2(req->vwv+1));
7168
7169 reply_outbuf(req, 0, 0);
7170
7171 /*
7172 * Patch from Ray Frush <frush@engr.colostate.edu>
7173 * Sometimes times are sent as zero - ignore them.
7174 */
7175
7176 /* Ensure we have a valid stat struct for the source. */
7177 if (fsp->fh->fd != -1) {
7178 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7179 status = map_nt_error_from_unix(errno);
7180 reply_nterror(req, status);
7181 END_PROFILE(SMBsetattrE);
7182 return;
7183 }
7184 } else {
7185 int ret = -1;
7186
7187 if (fsp->posix_open) {
7188 ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7189 } else {
7190 ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7191 }
7192 if (ret == -1) {
7193 status = map_nt_error_from_unix(errno);
7194 reply_nterror(req, status);
7195 END_PROFILE(SMBsetattrE);
7196 return;
7197 }
7198 }
7199
7200 status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7201 &sbuf, &ft, true);
7202 if (!NT_STATUS_IS_OK(status)) {
7203 reply_doserror(req, ERRDOS, ERRnoaccess);
7204 END_PROFILE(SMBsetattrE);
7205 return;
7206 }
7207
7208 DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7209 " createtime=%u\n",
7210 fsp->fnum,
7211 (unsigned int)ft.atime.tv_sec,
7212 (unsigned int)ft.mtime.tv_sec,
7213 (unsigned int)ft.create_time.tv_sec
7214 ));
7215
7216 END_PROFILE(SMBsetattrE);
7217 return;
7218 }
7219
7220
7221 /* Back from the dead for OS/2..... JRA. */
7222
7223 /****************************************************************************
7224 Reply to a SMBwritebmpx (write block multiplex primary) request.
7225 Always reply with an error, if someone has a platform really needs this,
7226 please contact vl@samba.org
7227 ****************************************************************************/
7228
7229 void reply_writebmpx(struct smb_request *req)
7230 {
7231 START_PROFILE(SMBwriteBmpx);
7232 reply_doserror(req, ERRSRV, ERRuseSTD);
7233 END_PROFILE(SMBwriteBmpx);
7234 return;
7235 }
7236
7237 /****************************************************************************
7238 Reply to a SMBwritebs (write block multiplex secondary) request.
7239 Always reply with an error, if someone has a platform really needs this,
7240 please contact vl@samba.org
7241 ****************************************************************************/
7242
7243 void reply_writebs(struct smb_request *req)
7244 {
7245 START_PROFILE(SMBwriteBs);
7246 reply_doserror(req, ERRSRV, ERRuseSTD);
7247 END_PROFILE(SMBwriteBs);
7248 return;
7249 }
7250
7251 /****************************************************************************
7252 Reply to a SMBgetattrE.
7253 ****************************************************************************/
7254
7255 void reply_getattrE(struct smb_request *req)
7256 {
7257 connection_struct *conn = req->conn;
7258 SMB_STRUCT_STAT sbuf;
7259 int mode;
7260 files_struct *fsp;
7261 struct timespec create_ts;
7262
7263 START_PROFILE(SMBgetattrE);
7264
7265 if (req->wct < 1) {
7266 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7267 END_PROFILE(SMBgetattrE);
7268 return;
7269 }
7270
7271 fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7272
7273 if(!fsp || (fsp->conn != conn)) {
7274 reply_doserror(req, ERRDOS, ERRbadfid);
7275 END_PROFILE(SMBgetattrE);
7276 return;
7277 }
7278
7279 /* Do an fstat on this file */
7280 if(fsp_stat(fsp, &sbuf)) {
7281 reply_unixerror(req, ERRDOS, ERRnoaccess);
7282 END_PROFILE(SMBgetattrE);
7283 return;
7284 }
7285
7286 mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7287
7288 /*
7289 * Convert the times into dos times. Set create
7290 * date to be last modify date as UNIX doesn't save
7291 * this.
7292 */
7293
7294 reply_outbuf(req, 11, 0);
7295
7296 create_ts = get_create_timespec(&sbuf,
7297 lp_fake_dir_create_times(SNUM(conn)));
7298 srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7299 srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7300 /* Should we check pending modtime here ? JRA */
7301 srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7302
7303 if (mode & aDIR) {
7304 SIVAL(req->outbuf, smb_vwv6, 0);
7305 SIVAL(req->outbuf, smb_vwv8, 0);
7306 } else {
7307 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7308 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7309 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7310 }
7311 SSVAL(req->outbuf,smb_vwv10, mode);
7312
7313 DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7314
7315 END_PROFILE(SMBgetattrE);
7316 return;
7317 }